berbew | 7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe
Size

96KB
MD5

2b59fc38028f2b12bfb711ec770d6990
SHA1

647bfd4dfb9b0c2679cc5ab7b4dea3795310f95f
SHA256

7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815
SHA512

3603e5bcb5a89929714b14a4cddc8e71479ded32df2bc0de22d9b0d040e9ccad204efb4c2317313594bbe7b0863dacc3f9d41c11341ca76c04cb1821255887f5
SSDEEP

1536:1GZLdDKJk1EQzkD2EfkhGQtogDuVqS4WPduV9jojTIvjrH:0dDK/UkD2EfkozVMWPd69jc0vf

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfldgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phajna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hicpgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcoccc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fqppci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkmfolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gokbgpeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpioin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjidgkog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Filapfbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mledmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noppeaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofckhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdhkcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqgmmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lplfcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaenbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhaggp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iafkld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kabcopmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckboblp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplhhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhcali32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbpedjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohlqcagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kheekkjl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
1128	Oghghb32.exe
4940	Onapdl32.exe
1468	Omdppiif.exe
4564	Opclldhj.exe
2968	Ofmdio32.exe
2860	Oabhfg32.exe
2196	Ohlqcagj.exe
3464	Pnfiplog.exe
3220	Ppgegd32.exe
4232	Pfandnla.exe
5028	Pagbaglh.exe
4744	Phajna32.exe
1188	Pnkbkk32.exe
3048	Pplobcpp.exe
2256	Pdhkcb32.exe
4268	Palklf32.exe
1184	Pnplfj32.exe
5116	Ppahmb32.exe
2084	Qmeigg32.exe
1236	Qodeajbg.exe
4908	Qpeahb32.exe
3248	Akkffkhk.exe
212	Aaenbd32.exe
2744	Adcjop32.exe
3768	Aoioli32.exe
3192	Adfgdpmi.exe
2896	Akpoaj32.exe
3636	Aajhndkb.exe
3172	Ahdpjn32.exe
3456	Aonhghjl.exe
2692	Adkqoohc.exe
3064	Akdilipp.exe
3520	Aaoaic32.exe
4944	Bhhiemoj.exe
3144	Bobabg32.exe
4180	Baannc32.exe
440	Bhkfkmmg.exe
1688	Bkibgh32.exe
4688	Boenhgdd.exe
4320	Bpfkpp32.exe
4984	Bgpcliao.exe
1208	Baegibae.exe
740	Bphgeo32.exe
388	Bddcenpi.exe
4552	Bnlhncgi.exe
4852	Bpkdjofm.exe
3168	Bajqda32.exe
2476	Cdimqm32.exe
404	Cnaaib32.exe
2480	Cgifbhid.exe
4948	Cocjiehd.exe
1748	Cpdgqmnb.exe
1792	Cgnomg32.exe
1732	Coegoe32.exe
4360	Cdbpgl32.exe
3224	Cogddd32.exe
1524	Dpiplm32.exe
100	Dddllkbf.exe
3916	Dnmaea32.exe
1840	Ddgibkpc.exe
876	Dolmodpi.exe
1644	Dqnjgl32.exe
4912	Dkcndeen.exe
2352	Damfao32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lhcali32.exe	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Pfojdh32.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Kjiqkhgo.dll	Ihbponja.exe
File created	C:\Windows\SysWOW64\Biepfnpi.dll	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Mfpell32.exe	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Pblajhje.exe	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Dkjfaikb.dll	Ocgkan32.exe
File created	C:\Windows\SysWOW64\Pnkibcle.dll	Pfojdh32.exe
File created	C:\Windows\SysWOW64\Aajhndkb.exe	Akpoaj32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhiemoj.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Haaaaeim.exe	Hppeim32.exe
File created	C:\Windows\SysWOW64\Mneoha32.dll	Jhplpl32.exe
File created	C:\Windows\SysWOW64\Bepjbf32.dll	Nfihbk32.exe
File created	C:\Windows\SysWOW64\Nqcejcha.exe	Nimmifgo.exe
File opened for modification	C:\Windows\SysWOW64\Pcegclgp.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Cjkhnd32.dll	Ofckhj32.exe
File created	C:\Windows\SysWOW64\Adcjop32.exe	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Ofkhal32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Cagdge32.dll	Ehbnigjj.exe
File created	C:\Windows\SysWOW64\Abbqppqg.dll	Jahqiaeb.exe
File created	C:\Windows\SysWOW64\Njgqhicg.exe	Nfldgk32.exe
File created	C:\Windows\SysWOW64\Ildolk32.dll	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Ljbnfleo.exe	Lakfeodm.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Mfgomdnj.dll	Aaenbd32.exe
File opened for modification	C:\Windows\SysWOW64\Dqnjgl32.exe	Dolmodpi.exe
File created	C:\Windows\SysWOW64\Eqiibjlj.exe	Enkmfolf.exe
File created	C:\Windows\SysWOW64\Dahkpm32.dll	Jidinqpb.exe
File created	C:\Windows\SysWOW64\Flinad32.dll	Jlbejloe.exe
File opened for modification	C:\Windows\SysWOW64\Jpgdai32.exe	Jhplpl32.exe
File opened for modification	C:\Windows\SysWOW64\Pjlcjf32.exe	Pbekii32.exe
File created	C:\Windows\SysWOW64\Pfandnla.exe	Ppgegd32.exe
File created	C:\Windows\SysWOW64\Gcgplk32.dll	Adfgdpmi.exe
File opened for modification	C:\Windows\SysWOW64\Jahqiaeb.exe	Jbepme32.exe
File created	C:\Windows\SysWOW64\Fhphpicg.dll	Kpnjah32.exe
File created	C:\Windows\SysWOW64\Hnekbm32.dll	Lomjicei.exe
File opened for modification	C:\Windows\SysWOW64\Njgqhicg.exe	Nfldgk32.exe
File created	C:\Windows\SysWOW64\Ahdpjn32.exe	Aajhndkb.exe
File created	C:\Windows\SysWOW64\Bobabg32.exe	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Bgpcliao.exe	Bpfkpp32.exe
File created	C:\Windows\SysWOW64\Lhnhajba.exe	Lepleocn.exe
File opened for modification	C:\Windows\SysWOW64\Mapppn32.exe	Loacdc32.exe
File created	C:\Windows\SysWOW64\Eapjpi32.dll	Pplhhm32.exe
File opened for modification	C:\Windows\SysWOW64\Nfldgk32.exe	Ncmhko32.exe
File created	C:\Windows\SysWOW64\Nbebbk32.exe	Nofefp32.exe
File opened for modification	C:\Windows\SysWOW64\Aaoaic32.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Cnggkf32.dll	Eojiqb32.exe
File created	C:\Windows\SysWOW64\Gakbde32.dll	Hicpgc32.exe
File opened for modification	C:\Windows\SysWOW64\Kcmfnd32.exe	Kpnjah32.exe
File created	C:\Windows\SysWOW64\Nfenigce.dll	Mfpell32.exe
File opened for modification	C:\Windows\SysWOW64\Pfojdh32.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Pciqnk32.exe	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Pjmnkgfc.dll	Iafkld32.exe
File opened for modification	C:\Windows\SysWOW64\Jihbip32.exe	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Mqjbddpl.exe	Mhckcgpj.exe
File opened for modification	C:\Windows\SysWOW64\Pbjddh32.exe	Pplhhm32.exe
File opened for modification	C:\Windows\SysWOW64\Pififb32.exe	Pblajhje.exe
File created	C:\Windows\SysWOW64\Gaqhjggp.exe	Gpolbo32.exe
File opened for modification	C:\Windows\SysWOW64\Gpaihooo.exe	Gihpkd32.exe
File opened for modification	C:\Windows\SysWOW64\Ipdndloi.exe	Iijfhbhl.exe
File created	C:\Windows\SysWOW64\Idkobdie.dll	Kifojnol.exe
File created	C:\Windows\SysWOW64\Jicchk32.dll	Lhcali32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7176	8120	WerFault.exe	345

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqcejcha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdnln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjggal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncmhko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbbeml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kakmna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbebbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlblcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbepme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heegad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdehlip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fohfbpgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geanfelc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpioin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajhndkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ganldgib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kefiopki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koonge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mofmobmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplobcpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egohdegl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fajbjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgomnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqnjgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihpkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfpell32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpnjah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Damfao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieojgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jahqiaeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjmlaac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hemmac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkibgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fijdjfdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilkoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooibkpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmcpoedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgkan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqppci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcfidb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nciopppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fecadghc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oikjkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kheekkjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiikpnmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pblajhje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmeigg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eojiqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jidinqpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jppnpjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jihbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gokbgpeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gegkpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggfglb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjccmbf.dll"	Eoepebho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbepme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcdeeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Loacdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhhpb32.dll"	Ockdmmoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkpemq32.dll"	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfpagon.dll"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpdbcaok.dll"	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbcikkp.dll"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpenhh32.dll"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dbocfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hahokfag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jafdcbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiciojhd.dll"	Khgbqkhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npakijcp.dll"	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaaklfpn.dll"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enfqikef.dll"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcoccc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpfohk32.dll"	Nimmifgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnobcjlg.dll"	Ggfglb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iafkld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjfbb32.dll"	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojenek32.dll"	7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibohd32.dll"	Oghghb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fohfbpgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faoiogei.dll"	Mjidgkog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpaoan32.dll"	Fajbjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgcjfbed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hifmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhfdb32.dll"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bobabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfibla32.dll"	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgjhpcmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgccelpk.dll"	Mjnnbk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1128	452	7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe	81
PID 452 wrote to memory of 1128	452	7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe	81
PID 452 wrote to memory of 1128	452	7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe	81
PID 1128 wrote to memory of 4940	1128	Oghghb32.exe	82
PID 1128 wrote to memory of 4940	1128	Oghghb32.exe	82
PID 1128 wrote to memory of 4940	1128	Oghghb32.exe	82
PID 4940 wrote to memory of 1468	4940	Onapdl32.exe	83
PID 4940 wrote to memory of 1468	4940	Onapdl32.exe	83
PID 4940 wrote to memory of 1468	4940	Onapdl32.exe	83
PID 1468 wrote to memory of 4564	1468	Omdppiif.exe	84
PID 1468 wrote to memory of 4564	1468	Omdppiif.exe	84
PID 1468 wrote to memory of 4564	1468	Omdppiif.exe	84
PID 4564 wrote to memory of 2968	4564	Opclldhj.exe	85
PID 4564 wrote to memory of 2968	4564	Opclldhj.exe	85
PID 4564 wrote to memory of 2968	4564	Opclldhj.exe	85
PID 2968 wrote to memory of 2860	2968	Ofmdio32.exe	86
PID 2968 wrote to memory of 2860	2968	Ofmdio32.exe	86
PID 2968 wrote to memory of 2860	2968	Ofmdio32.exe	86
PID 2860 wrote to memory of 2196	2860	Oabhfg32.exe	87
PID 2860 wrote to memory of 2196	2860	Oabhfg32.exe	87
PID 2860 wrote to memory of 2196	2860	Oabhfg32.exe	87
PID 2196 wrote to memory of 3464	2196	Ohlqcagj.exe	88
PID 2196 wrote to memory of 3464	2196	Ohlqcagj.exe	88
PID 2196 wrote to memory of 3464	2196	Ohlqcagj.exe	88
PID 3464 wrote to memory of 3220	3464	Pnfiplog.exe	89
PID 3464 wrote to memory of 3220	3464	Pnfiplog.exe	89
PID 3464 wrote to memory of 3220	3464	Pnfiplog.exe	89
PID 3220 wrote to memory of 4232	3220	Ppgegd32.exe	90
PID 3220 wrote to memory of 4232	3220	Ppgegd32.exe	90
PID 3220 wrote to memory of 4232	3220	Ppgegd32.exe	90
PID 4232 wrote to memory of 5028	4232	Pfandnla.exe	91
PID 4232 wrote to memory of 5028	4232	Pfandnla.exe	91
PID 4232 wrote to memory of 5028	4232	Pfandnla.exe	91
PID 5028 wrote to memory of 4744	5028	Pagbaglh.exe	92
PID 5028 wrote to memory of 4744	5028	Pagbaglh.exe	92
PID 5028 wrote to memory of 4744	5028	Pagbaglh.exe	92
PID 4744 wrote to memory of 1188	4744	Phajna32.exe	93
PID 4744 wrote to memory of 1188	4744	Phajna32.exe	93
PID 4744 wrote to memory of 1188	4744	Phajna32.exe	93
PID 1188 wrote to memory of 3048	1188	Pnkbkk32.exe	94
PID 1188 wrote to memory of 3048	1188	Pnkbkk32.exe	94
PID 1188 wrote to memory of 3048	1188	Pnkbkk32.exe	94
PID 3048 wrote to memory of 2256	3048	Pplobcpp.exe	95
PID 3048 wrote to memory of 2256	3048	Pplobcpp.exe	95
PID 3048 wrote to memory of 2256	3048	Pplobcpp.exe	95
PID 2256 wrote to memory of 4268	2256	Pdhkcb32.exe	96
PID 2256 wrote to memory of 4268	2256	Pdhkcb32.exe	96
PID 2256 wrote to memory of 4268	2256	Pdhkcb32.exe	96
PID 4268 wrote to memory of 1184	4268	Palklf32.exe	97
PID 4268 wrote to memory of 1184	4268	Palklf32.exe	97
PID 4268 wrote to memory of 1184	4268	Palklf32.exe	97
PID 1184 wrote to memory of 5116	1184	Pnplfj32.exe	98
PID 1184 wrote to memory of 5116	1184	Pnplfj32.exe	98
PID 1184 wrote to memory of 5116	1184	Pnplfj32.exe	98
PID 5116 wrote to memory of 2084	5116	Ppahmb32.exe	99
PID 5116 wrote to memory of 2084	5116	Ppahmb32.exe	99
PID 5116 wrote to memory of 2084	5116	Ppahmb32.exe	99
PID 2084 wrote to memory of 1236	2084	Qmeigg32.exe	100
PID 2084 wrote to memory of 1236	2084	Qmeigg32.exe	100
PID 2084 wrote to memory of 1236	2084	Qmeigg32.exe	100
PID 1236 wrote to memory of 4908	1236	Qodeajbg.exe	101
PID 1236 wrote to memory of 4908	1236	Qodeajbg.exe	101
PID 1236 wrote to memory of 4908	1236	Qodeajbg.exe	101
PID 4908 wrote to memory of 3248	4908	Qpeahb32.exe	102

C:\Users\Admin\AppData\Local\Temp\7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe
"C:\Users\Admin\AppData\Local\Temp\7d4c3429ebf5d9d0214fd18fbe1cf6855c9cf59965cd04078c76221cc26e0815N.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\Oghghb32.exe
  C:\Windows\system32\Oghghb32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\Onapdl32.exe
    C:\Windows\system32\Onapdl32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\SysWOW64\Omdppiif.exe
      C:\Windows\system32\Omdppiif.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3192
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        30⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        32⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3064
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4944
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:440
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4688
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        44⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:388
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        46⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        47⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3168
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2476
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        54⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        55⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        58⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        59⤵
        Executes dropped EXE
        
        PID:100
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1840
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        64⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        66⤵
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        67⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        68⤵
        Modifies registry class
        
        PID:880
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        69⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        70⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        71⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        73⤵
        Modifies registry class
        
        PID:3436
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2592
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        75⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:960
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        77⤵
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:376
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        79⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        80⤵
        Drops file in System32 directory
        
        PID:4040
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        81⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        82⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        83⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        85⤵
        Modifies registry class
        
        PID:2656
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        87⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5020
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        92⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1168
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        93⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        95⤵
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4008
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        99⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1316
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        101⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        102⤵
        Drops file in System32 directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        103⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        105⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5076
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1872
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        108⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        109⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        111⤵
        
        PID:364
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        112⤵
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        113⤵
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        116⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        118⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        122⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        123⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        124⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        126⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        128⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        129⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        132⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        134⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        136⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        137⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        138⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        139⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        140⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        142⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        143⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        144⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        145⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        146⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        147⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        148⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        150⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        152⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        153⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        154⤵
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        155⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        156⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        157⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        158⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        159⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        160⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        161⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        162⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        163⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        164⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        168⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        169⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        171⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        172⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        173⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        177⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        178⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        179⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        180⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6204
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        182⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        184⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        188⤵
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        189⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        190⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6644
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        193⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        194⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        196⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        197⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        199⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        200⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        202⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        203⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        204⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        205⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        206⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        207⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        208⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        209⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        210⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        212⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6956
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        216⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        217⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        219⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        221⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        223⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        224⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:6924
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        226⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        228⤵
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        230⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        234⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        235⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        236⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        237⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        239⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        240⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        241⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        242⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        243⤵
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        244⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7236
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        246⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        247⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        248⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        250⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        252⤵
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        253⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        255⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        257⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        258⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        259⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        261⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        262⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7988
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        264⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8076
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        265⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8120 -s 420
        266⤵
        Program crash
        
        PID:7176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 8120 -ip 8120
1⤵
PID:8180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaenbd32.exe

Filesize
96KB

MD5
197f25601894918f86dd1f18fe77b87f

SHA1
d07cd538fede2b322f6c416086de40125a03aa5d

SHA256
26b4fece894e1ba30ff38e3a95e18a4ebcc8832d1eb660b1d233961a6da69b07

SHA512
9a677ad56e23ba098a560c7fa560445337dd45d0175facceb70cce292c32c039c5c2549b920bb7a0c74a1d71137e26c4c6044f606d768a73b036157be057a44d

Download Submit
C:\Windows\SysWOW64\Aajhndkb.exe

Filesize
96KB

MD5
a9d26d0fd1384461f1e59c778dcc05e0

SHA1
c95617c6ac537e9828e65169bb99e5a03851061c

SHA256
fddbd52e31ca77035c1793eb4b883a428628254301fb2d1aaedc5d3f8f29c45e

SHA512
1f2caaa8c402452cc59846918e040fba8e2573bebf1741aaeb0b502847f0d1fc9a48d594e8eeebee2b030b0a380c38e95eaed345ab66e782e9b4ef3e1b199f3b

Download Submit
C:\Windows\SysWOW64\Adcjop32.exe

Filesize
96KB

MD5
ce674fc7a78a7769c32dcdd75d66b488

SHA1
a65faaef9eb1d2a940f183eefe9aabc55a9f62c9

SHA256
d200f3e576d4e4b8748ae91e058d0466ce5f3c33b2a942b3ce89e6d32772688c

SHA512
70b1d2ff02bd1ac352a20d750b87a38ffcd4e91e922ea8f55ce27ba2d16abd82c0d8e1417df2f715a82d31cbd25675213125850ca73b1df3e18a54d901583781

Download Submit
C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
96KB

MD5
5ad67575ea2bc42adbefb5e762d8bc70

SHA1
39e53483b36e24024ff3a8ac4119aecbe85d9c3d

SHA256
8f57a7259a767cbf881cae750b4086bf4c3c1959265e930c04655768f6294e2a

SHA512
83096cbb3b9c3ed5c0d051d6facfef153276b4d16f63aa8ef77501382845d3199500bcf5dc94061ad9a0b11fb069208648feb670f33ec3e10d6dbc365a3776a5

Download Submit
C:\Windows\SysWOW64\Adkqoohc.exe

Filesize
96KB

MD5
53612d7d95bf2fe4a1a405362420f77c

SHA1
fd076823b91c0ab0dd2f04e56633500a5eccb51b

SHA256
1de27051a969aa62f01ce655a1153e7669c5abd21a08b653541954489a1c4fd5

SHA512
46c970c38c08a20ba0740e8c709d2a69ced4dcd71be0ce5a1ccaaa149d2360018e95855ed1f0f5b23885bf6f2d7176fcf1c37116cc46131024c7f11bdc815c13

Download Submit
C:\Windows\SysWOW64\Ahdpjn32.exe

Filesize
96KB

MD5
205be3237f7bd152a4fac07c8b38f4b9

SHA1
01db6c26b19caeb8300687505b9bb26d1598cce9

SHA256
05504d2f6242f9ac94f35b5c8e472bc56dca1c174797b7beb054534dfe85cf6c

SHA512
323d2ebb2c0b43cdfed8b9fe044787ae76dd073f39b054cf4a9374d238eea2809d4f075d2db9ee2dd700e025934861179b7a9ec5a957376669e0adc4f964cbff

Download Submit
C:\Windows\SysWOW64\Akdilipp.exe

Filesize
96KB

MD5
1a51a4048be2830229eb60b14fc877e5

SHA1
0dbbad8484f453fca67162ba71350222e90380ea

SHA256
1c30dd0b5e00ba64ca6ec92403324d89d46d50493bf5c504b42d7b7af9c33333

SHA512
15375002e0264892b82a9cdc9608c32ac394fd1e800862cfbf29bae446f60a3ea31ea03bc7d6fcf46b7c013566a4504ee32d4d9702b2b17c2de04b5d9a480fcf

Download Submit
C:\Windows\SysWOW64\Akkffkhk.exe

Filesize
96KB

MD5
15fce85a700c4b0eb9817be9cb3b6169

SHA1
c68a8479741d6a4b92a439722df9e6590f945fae

SHA256
3345fc2da65ca0608bb650be26706298402fa3707bdd0d5010f8938fe8c9f0de

SHA512
887d7083316bc399fdf346dc63192d6fee5158017e5bf5ffe68f294fb01b9288b625a30ada97ba2165fa6b77b4c873b3595ddd71964b85316420f0c4cef8aa42

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
96KB

MD5
2b33a9911a145108bd08fa816862c9b8

SHA1
9224035fa2c50838b7e170065c3ca50b4f4e47a9

SHA256
e7ccff5e8695350fc2953ab314d04fa68febc46b4608f3e738261a570e239ae4

SHA512
76b9865dfb55b96b274805abbf4ecd3a6d96525758f0e01ea2f46bb3f82af9397f46042184b092373151391b278267e578d8ea5b009aac4e19f1f1e03dbb6523

Download Submit
C:\Windows\SysWOW64\Aoioli32.exe

Filesize
96KB

MD5
4d113b098c99438837fcda03542cd735

SHA1
74f219dfa23429405a4ca073a72cec34ac795c6a

SHA256
72ce6a8649f56c69c496770297383946477833c0e2b5f86491c74bfd9676a2f2

SHA512
65e71a5b3c277e3f7079ef79a5b71a68e12b8ab9ced2e8aad1c663299150dc230ae207fa945aefd6a74ecc80d31c7517b981d986c082600581779f78584738d7

Download Submit
C:\Windows\SysWOW64\Aonhghjl.exe

Filesize
96KB

MD5
ed8d23e8ed4a3bfef1926668c8c7e9aa

SHA1
fc440697d33eca686eb06847663686a37e732cfb

SHA256
a7c40c2e92e9bb87e1b9e005b494e8e0cf7456a39a577649be0a91608a153f8d

SHA512
8983a8f5537694bbc6dd5e6d0512830dcec4629c6b4a8436a6c6105298130f3ac10b020d6ee553f11aa159c68344989ca809383c19252eb5c55e4b49e4d2ed09

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
96KB

MD5
542a7053415b5e87b4109e893da57b5e

SHA1
1fb0d126ebe7441ed5c50a463d2e6d386030da76

SHA256
094fabf1808bf50f3ea2b72fed95323972b37735238ad2c4acb17d65f58803f5

SHA512
98d95db62fca92a1d6262788ab42327e26b4e1bc5c3df40cd7a4ebb83b5fd805cb71c197634c1d8d9a9435da14637b1d545f7e95ef66276867392ce96ea23704

Download Submit
C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
96KB

MD5
cb2d2cd18e890637dba8ce019e561e3a

SHA1
4233235ec36d8aded7443c05d015d840e1519d6d

SHA256
6a25ee0d86635dfa03cb74d94fd51d3daaceb36954c665e0325feac5dabbf787

SHA512
ab693071677ad80228f36dca4f528085cc5a4ad66c969d18b70c3bb390dd785f8f6300f5e512cc64482bd3b92936f0824a1980cf05c461f8eb1d9f193312ee14

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
96KB

MD5
dc9e87bc88b51a30ba3ab0600749a782

SHA1
032ce1d4701a9ff5bf884f1b53a2f3c74c0e65fe

SHA256
40e84ec1010a0be292fd3de7225d4cf9fa2bc9c1877e1a521568bd70a0d45b75

SHA512
e78ca37088205af5b2b67a32cd43cf1a60c1f956a4a96b3d086bf7ed3b32cc10199abe9d8230bf9fbf60a2150ef8134ce3a90d64ba2e964484b96b88a8c6a4e5

Download Submit
C:\Windows\SysWOW64\Cgifbhid.exe

Filesize
96KB

MD5
60d1f4f140743e817c7ce95a5472e97f

SHA1
9c921c64b01ff3ad2b4b68691b9ba80b01429cc6

SHA256
227cc4cb78061fb409641f16ba1388a2423bf9340e69a913b5a0129665f675af

SHA512
cdc53705a76d24089c9973b8c8607d9087eafe317766de39fe61ce9c12860790c43bb0a89a46ab0739fd684595fa342b445ccd147cd41d435632b7d58bbbbbdd

Download Submit
C:\Windows\SysWOW64\Cgnomg32.exe

Filesize
96KB

MD5
e1cdce96f05dc1bc8c23fcecd512df43

SHA1
180f7ea8624a40f4e1997fd6d0a69f134001073c

SHA256
350e9d6ee3389ae6f74ccb5b1a26ae6002f49a4e852da99b33e9afbd07d52304

SHA512
4faddc5e964face8bb1a819449d85960c8dac8dcfb4ec91aba49c1b6b652f0e58593c5e33b5f7bf75a2cd6a5504707a604ba81660dc0a6f7d800705bdc978ceb

Download Submit
C:\Windows\SysWOW64\Ddgibkpc.exe

Filesize
96KB

MD5
271e3fc99fb9fa1d0a5214eab1d91682

SHA1
3b12ce919eb18f5512fa381531b0dbde5a6fda26

SHA256
738ee1bd4e38026da6eb9eb74a6c4ae451b0dbc6f1e58d3892a5424a9adb4fa8

SHA512
9de294bd6bd90ce6dea1eb17d49fb823b9f081d1bf85e0d5492b52722b6125fc8880ccb39ed3af8273d0401ca2d8c72da4a52716751d1fb9f5e74b2e76fc9952

Download Submit
C:\Windows\SysWOW64\Egaejeej.exe

Filesize
96KB

MD5
88ee849b88fb5b98313f18f8ae1416f3

SHA1
53fb834eb2b8a46edc9cb06e5be16f373360dada

SHA256
516e331866640cc87abbce00b3454af51961c9311319665e1e35ac4760a27366

SHA512
523bea311f326235b4913624fd10c551e48e8e90c38c481d509d1a194cf85c2813917e19c5c43bf64c8285b7047f1f35f8b32c2a6802b78a167692cbc9b92e40

Download Submit
C:\Windows\SysWOW64\Egohdegl.exe

Filesize
96KB

MD5
153e937275092b730f9be5351c9915e4

SHA1
1193c0d24de7d6ea3691ad1c4caa162c626840b1

SHA256
036fa28c84fcc72f67815a7a6a8cd30bb32ba332f20963413549108d23125f47

SHA512
c2b8716c23d1586dc2a8625ae30570ade2f7c120a50d60a8a791cf418ec13c6da0940b458edda30b172397d85197f34c42d258a82e58929a151bb34a37342245

Download Submit
C:\Windows\SysWOW64\Eomffaag.exe

Filesize
96KB

MD5
c9617512ab342a97a136fa345ea9fdb2

SHA1
f68934189e48c2f79e16048f3ddbea7398178af5

SHA256
af08ec3171fb279cac23c3d88cc249fc8fdfafc599ba1e3cb0778a91879cdf6b

SHA512
285a0881a45d12b2a91b00107a6aee063b00d097ff4173ad8d51f4bb4f43180b75ed4f55e72af1d2d91bec3cd9d95be44bd1625a44f036588e25ea5c3f81e6e4

Download Submit
C:\Windows\SysWOW64\Eqlfhjig.exe

Filesize
96KB

MD5
42be46f9a16523a88214640aa67e094f

SHA1
3dc0145620faca0ce7f28d361b651fc48ccc7452

SHA256
a247c6f248bd7184680e0cf9c1014cdeea3f0b774ec81c4f2396b2bb489ffb32

SHA512
8d77d1e8610fee7cbcdaa4011c2fb227e6da77aceba27bc4a0c66de2bda89f7311d5be31e605f287b82de40f84776c25d3d75a0bc96d62f15e7191108656b045

Download Submit
C:\Windows\SysWOW64\Fecadghc.exe

Filesize
96KB

MD5
8760b28108cd6e90cc325c1bb594f344

SHA1
99abdf8763315b6022c5317b45112326a33fcd95

SHA256
829b4065b0b4e4f1197da1c6a841363ed166d67940197f9e116277e8fcbce743

SHA512
00e9d89b96b134e3cdcb0900377d668f287e3caced3f9f42e73f0c2f6feb40d8be987ecce789262bd1a75ce3e3b943ed3f7573dae4f5160c552845ba8e629902

Download Submit
C:\Windows\SysWOW64\Fgcjfbed.exe

Filesize
96KB

MD5
ac70bc5753af2015291410d6eb9f0b21

SHA1
cf3f7591cf43e39c1e41f7e0bd92aa3d8e0eee68

SHA256
320d13190a8f6bf0a84648087fdccbb68b97f16cc3a7d6a0c97ec79de8c81ace

SHA512
91e116e1b579afc1097a7e162ec6510d7505df1dbef5dab491f95f038588e9cc93762f5f4d7f2e32b23cd6f4aa7ed09175daeb4f96565e640db7a0d1264a94d2

Download Submit
C:\Windows\SysWOW64\Fijdjfdb.exe

Filesize
96KB

MD5
443ed2cd4dea347fa125f45e0ca87b94

SHA1
00c665c0dfe5df171cc0e7388df6f62a8fb086f6

SHA256
1ad9c9a9460bd4ab6af3b6668e9f3bf7609bdd2fdcb202747f3fd3252d33e3a0

SHA512
d240c4f833fe3f0a97922a9fc01069ec7f3abfce40a348ddaedef65b62e9786cf7361e26e2fe5e7582506bc0e0f979d9b26f394e3e9cd28831d26d30a20e41ec

Download Submit
C:\Windows\SysWOW64\Filapfbo.exe

Filesize
96KB

MD5
7fbeaecef78eeb16397072dd41a61073

SHA1
a73d9fa01150e3c6a2e247dcdfdd293472a4d29b

SHA256
8c3a531da7780c4332f33c9c9d57dabe0570cfe5f65d5f540dbe95c66d7696d5

SHA512
ce72f7a9b624c2aa8e322bd2ec022ea3b4f426e637b182f9bd2bc26af48b560a65ffa04b72d7999ed326fce1bb438970a9fa6a942e8f93e291cac95fcfde6605

Download Submit
C:\Windows\SysWOW64\Fnbcgn32.exe

Filesize
96KB

MD5
155a9d1308324bcdcf8665296598b796

SHA1
d7a038f296490daa73d6cf3fe8b12c483ceee47d

SHA256
1b607b5cfa0e2accbecd86540ed584832d08700d7cd92bc9656a4fd1f0a26621

SHA512
4f70d4179a90acace91baa971678359d0c58da542853504d62923a8bab6b7fde32a558bf85c7cd634d3c0f4c4866584fbdd8d23787728b62264f9a286958ce3a

Download Submit
C:\Windows\SysWOW64\Gaagdbfm.dll

Filesize
7KB

MD5
363525588e61a1e1134c080205b932cc

SHA1
d5c0108610be116d71e6e22fc7005537c63d4acf

SHA256
62eb379bd3006252746eb9125ebad55d132977e7bc439b3512182bf5f41ac569

SHA512
7f9479602eadeb11e089b82bc4f47745b1b486cc8206e43cd5a5e307c0e937636b665a55269803c2856758cd0e990be45592796b5ab7228d4012335c1ae139d1

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
96KB

MD5
94e7b8ea48ed9edadfe33cf0f0c7275f

SHA1
ba0582d4b41fe3fd41fd7e87fee4387cfff79909

SHA256
f26cc2523abaa518a2830bcf4c3b6f9b097a4d9641533022bb56371c5770d9ae

SHA512
c67db1cf22443f96b1b2e5c7eb065956b4c64df350dd1098266f881434546a4282cf42ca73ea2e6d9ceb68dbe2d8a66d7252cb359126b88afff3c03311b4f019

Download Submit
C:\Windows\SysWOW64\Gaqhjggp.exe

Filesize
96KB

MD5
215cb82273df68a2dce0853fb84740fb

SHA1
227dd42c7700f94b9cb23b72c3f5af0c5ae99f69

SHA256
27a0321911158f0ced38093b8e3fd456bfba4a1c25d5cff5811e7e8f549537f0

SHA512
534705c3aa90187f095935565e6cbb3981cfa90d757fb553d7b697d7b8888a7865eecc7fbfd5c3469d7ec641d5a5c76b567f4696878b7a8eefd10e8c0f00dfac

Download Submit
C:\Windows\SysWOW64\Geanfelc.exe

Filesize
96KB

MD5
0afc540daaa9bc5ce12cb794eb2c3dbc

SHA1
48943fa7ba822484d6d99bf221ed782d793ba4fe

SHA256
a81543c525c20362e7ba96da2f5883c1cd6b427aea84f8f5ee98b8938327ac42

SHA512
f4e7c6be0d297b4022bdd547b184650c5177ac12bb138119988bf6a45b35ebbc4c23d84b7cfd5164e1b3657c57333b523020e6d3839e39705f3406ea79466d01

Download Submit
C:\Windows\SysWOW64\Geoapenf.exe

Filesize
96KB

MD5
01adee2aadeb9cca9bc01a88a7815687

SHA1
ffc4a8c96e94341a027de197b5b3332f7dc0baa9

SHA256
07115faecb6b9ef4002bcf2c0bfef36260726fa77a0ff1a2baf5b3ffb23e43dc

SHA512
0dfd2de432dbcefbece9706f0a3505567b5a74c39fee067199baf0c4ac332f8f8a979956cd425e87e16c1160ee12ef29857aad44514508bbd17894c59000b41d

Download Submit
C:\Windows\SysWOW64\Gpaihooo.exe

Filesize
96KB

MD5
0ebb84af6e5ff4dab4ed762fd503d395

SHA1
8d96cf1f7e51b0ff15f7ca29485c80aaf0e19b12

SHA256
fd43c6bfdb3555224949892bccde2d6cbc4ab96a30b056286000f81992ad3a11

SHA512
b31a77eb1f005f6634264cee9e73d5a77e2f92e615c23301528e0bef45ea058d2c55bd4a6da0ddbb3740836fdb990b4af4885a242bf8e3252be7a97fca11d074

Download Submit
C:\Windows\SysWOW64\Heegad32.exe

Filesize
96KB

MD5
acec416b6cf3ae544add1ebcca12469c

SHA1
01f77fd07ce29e4a51ceb04798449d8bb59b2015

SHA256
f6f7617ff0112dfc8e503785cd7e78cc0c6b9c7bfaa9ff57d1ea36ecd468bade

SHA512
bb3b862c85ad7d1186d68b73c41abcf636c3d599610dad82484b15ba8d7d93bb308acf6cd006bfc77fba9731d92c2e0b693c65d4e56eb0190e1510b8cff703cf

Download Submit
C:\Windows\SysWOW64\Hhaggp32.exe

Filesize
96KB

MD5
2e1c19608becc8aa0749bd4a3375e1e8

SHA1
7288c2d4113532c55cde23575f082d3c5480a6ef

SHA256
26063fc5aeb7a2668fb57c69c48fb4e5cc27f7f4de6b118186362c745fbf3f7d

SHA512
e524a2530f9db57b67ecdf182344d69f2c3fda9bdbb63aad618c17206d6c9bf276458264be1b28cd429345723791206673de5fb2910ad1008bc0699fdfb878e8

Download Submit
C:\Windows\SysWOW64\Hlblcn32.exe

Filesize
96KB

MD5
bec76e4434567d45ae1f8ee2827e2438

SHA1
02486f0a17b866159434f6684a044fb5c270f6cd

SHA256
5cc617f4970377cbf9b06c9234a04507088c2a029707952405a60ea13a5b0b30

SHA512
af0e7f582dd8d99293e41aaeda3f70afdb97ae652a3560abf9f11848c2b79947d66ad04ca6309c09e047a4839c408868ba22fc2ce64460af9b554c60f297be49

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
96KB

MD5
1a588efa1307779b46d42be6c6f5254e

SHA1
389f81933ab1d3ac5dbfe86c515cff44ef426d13

SHA256
1ea0af1d1516c7b9b247a28f13a1ca06859aa01bb8e3c4b1d32545c32227d6f9

SHA512
dc657bba3b6f58d5189c1b3872d4ca34f809affe5005273e9eab08be9f6e83e3a838a54b8d30aaa12eb24b12ca22fb619a3b670a37f4abad16ef02e70eeb1123

Download Submit
C:\Windows\SysWOW64\Iialhaad.exe

Filesize
96KB

MD5
2a673534830e090b6b1a1ee4f3ac588f

SHA1
dec7098c52a9ef9fab30ab5800fb30ec21671e82

SHA256
9b5dc5f0619259b54daf522c5659dcc70578b4dd9f5bf5034a7d047fc972ea31

SHA512
4cae0d556deddc1a1481ebfd4c3aa043ad4efd02faeca544e292020d69887ca015421aed39f04f05b2808570056c832836119dc4dce28190f207db75face3f7f

Download Submit
C:\Windows\SysWOW64\Jblmgf32.exe

Filesize
96KB

MD5
497bdbb444361806fc36982ceda518e7

SHA1
6cad4047f0a68da65743b76e141daec0bb546b29

SHA256
975c91d7b3254488d95ddbfdc211c0c41db1643e497ffe2b0d624df2a7dfec31

SHA512
dfb5bcd165c7b4f683e72984856d264e9b7585475d05ba888ce1d2367ee855e9d20d1f2180f09915fc27d9b858dcedb9a04063e43953da1b4f6c8225996b8b70

Download Submit
C:\Windows\SysWOW64\Jhifomdj.exe

Filesize
96KB

MD5
f530a9cee49581834a5c5820e866cba5

SHA1
df90b9de39574e4942e7d4b7f5b6e71efedee4b8

SHA256
cf0739c1e46b1ef830d116bacd72d63e0d6a687a933a3ac2aba426754a8a40c3

SHA512
c4f3eca80f01909ecc07f80059ceca7a958a5b43a01856de91c60426484d6db204ae1345e7192b8902d127121f7c61c254fd9c0f7b3870c186632190c7912251

Download Submit
C:\Windows\SysWOW64\Jhplpl32.exe

Filesize
96KB

MD5
87a227e319584e720257f2d2fbe162af

SHA1
75683c575f253235e2597b475a31c019d509f7a6

SHA256
a4c15ca2c28fef17df9ec3e04e70046addaa4de78ab6cf9284fd776e1fee40cb

SHA512
7a9ec1134aed1d418aa6c0bb7468ed21396ea3963ee3bed9f9286627b24f3f14f74fae17188057c627e90b73346ba5b66d5c327bda6038dfbdef2544d9803a60

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
96KB

MD5
0500f503c586e622be3f123bfa7d814b

SHA1
dc68ea399ee45cf1c1959c9fe1e240859a9c98a0

SHA256
82bd27d3ed5c726f9849aef813488fdde43444cb69f505cfb461975e4cc6803b

SHA512
c6582cd0f06f6dc040be25c2a19fac23039bbb3e7e6b7e753818f80604521590e652a1186a39289135e4b5ae13ef87b2c194043b4b8c3757af518d66ccb9e2ea

Download Submit
C:\Windows\SysWOW64\Jlikkkhn.exe

Filesize
96KB

MD5
4a988a2978f332a20851f9044df824c8

SHA1
b5b7a2e081bc8a6b54a161aa8fc89b40f5fd1474

SHA256
335d9e7babd0bb7129232f000025c1f871592d898eaa169e18495418b52eb958

SHA512
c98f903e3a2452fdbcdb213fc79e184c85fa2361f730e2e16ec515a61b4818759049c52f5779a654192534bf13cb2592b6f4f026d2afc7f5bc3a4c820cf02ba3

Download Submit
C:\Windows\SysWOW64\Kakmna32.exe

Filesize
96KB

MD5
80e0d7e5b9c3a29c22ca8dbdde5f19d4

SHA1
7d39869cb8f4836a95f5f6cd29331e2ef3276d11

SHA256
62781eb9926a8b303337e5b6d8abf1a38fec80adaa3ce986ac2ae0c6a7f1e93d

SHA512
dc48e7bb83cec3344b05434fec6b46e5cbf2885fd5b85850122af56bebb3f5847bce13756860d2e8fa8554f12c8fac6637819ffc78666d93546540f0ff249c27

Download Submit
C:\Windows\SysWOW64\Kcoccc32.exe

Filesize
96KB

MD5
465e0d0f422533ab7f2504ee5100f20e

SHA1
6e4791bf8eb07c646b24c622294643015e5efd85

SHA256
189bf07fc2aae4829fac66bf6e2beb81e542801fe92d3360abc91b2aac2c93e9

SHA512
dd55e0aec8b0f765717592ce566605ae47f9f3e2b35e368b12fcd40ce9a4ca0e6672086539a9e37ab2deb7fb6c67e57236871be0efaea693c44fa122eb3956da

Download Submit
C:\Windows\SysWOW64\Keifdpif.exe

Filesize
96KB

MD5
85b974997fc19c8ce77cb7be3f1d4e46

SHA1
7bb87d8c3c59592efb734e770721607d7cc2edfd

SHA256
6ddb1c9e3fce790ccda1b6437c6fa55b5d4622270f349881d3792c6df2fa9c4c

SHA512
68215b2d526573ab485a9322385c931d83cda9d923dc8b2cfa86f973c83f824f6c2512b9f02f3b6d1f78cc5e8a21db7d6ff97f347ade21363321a72183defff9

Download Submit
C:\Windows\SysWOW64\Kifojnol.exe

Filesize
96KB

MD5
8c14d2572f84db3a2ad4e4d15a2a5df9

SHA1
9deba55652c02b24649d6556f183b542dad8c7ff

SHA256
debecb2377aeb3d3946eba9eb973b4530fd6310e0ca5fb6b233e7b1b3f6758a4

SHA512
275197fd9c3457360f22f73b5cf0b8be3fe327a7cd0c83e0c322e925ab6799cfb02353d17bde7f4c15bf8aae098cfa8c538d7da8d88c580551cd6ba0ac12d8a6

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
96KB

MD5
5d7f9c3e79d718c73dc70ffe74d52678

SHA1
c1ff3f99293fd20fd3b58911138c3762f9b84804

SHA256
59aeddd3f417471dedf3c3151a6b97511740823eccd5241eac269d3027102181

SHA512
fb09ec539c2849b9488dbaa3cc6036e89af9e8bf42c412cb9b55844db4f997bc2fe786001a22f078b4d3573ffe156a17f282101a4eadad384c37bdd3f4986c14

Download Submit
C:\Windows\SysWOW64\Lcfidb32.exe

Filesize
96KB

MD5
43a1e03a461f2f73de99ff8ae33895e3

SHA1
1d7af83219755dccf780db003ab12b45576d7111

SHA256
0f1637f21a7f7376a0741824b6aadf2de31fdc35f5203f015f23891c75d7211b

SHA512
ba5d166ee98eeefd67507cf567a27926a7c4205e4d23a8c6de571f1bd8a077c59a6600a4971e67fa595c2d0a957726396bad1ec19063c06b3d7da93a3903d68c

Download Submit
C:\Windows\SysWOW64\Loacdc32.exe

Filesize
96KB

MD5
31cc3f0b388b4504b0685a3e4f5119ec

SHA1
043141537554050fc19a5b9b75c397b58ed10cf5

SHA256
44d5b4b0114ccb185c36da95b1a0ba183deeb4d84cc7f7f02e881df7a369c7f5

SHA512
a2b900bd62dbb8b384c42563ca3da2e8ca9f4914584b678e2f04d660f958675eae0b8c12e6f0e53d47b0756ee952a5fc05ba5c020c82201406d4cb816ccad1a0

Download Submit
C:\Windows\SysWOW64\Lohqnd32.exe

Filesize
96KB

MD5
8e3fb06113289935cfe956ba7253d1f9

SHA1
c93d89746136e9734c225cc308ef8647fcc5c5f7

SHA256
03b61cd80535ebf8665ee6fca1006c0b2ddd00ea85568d95c2182b37391b4d69

SHA512
0d2d63a0931165ebf03924d5f68453a245658abbfb384a79501c9c7b98db65e21e99c3218feaa49085126182a6f95a350c979486f9dac0e8e62cdb32d8dde6d1

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
96KB

MD5
42d627c96c2493849b248e41aa5c9a0a

SHA1
e9397779f97d9be735459251f24a4cc626fc780b

SHA256
546b9ca81d71e25dc5b676d80115d22d0f8b111d1ef9afd1afaa40ecb46d331b

SHA512
74e86263b07ec86198ed64e62762d642c0eb8bdacf9e5fcf714a6544d258acfea4a0e1b9981fe6cb9470e49b194d87c54ea74411ae23d86b9c2113f5ec2b40d4

Download Submit
C:\Windows\SysWOW64\Lplfcf32.exe

Filesize
96KB

MD5
81e3ca1d528df6cc4c86eff027480c09

SHA1
c099c7141ece2384469f23e67f0fcd240c944ba0

SHA256
5251bb8575ccfe84a056c6d7773c9a0ad024eb4956d268bf6e62d2cdbccce21d

SHA512
4ef33ecd65a9d69eea9858914b36cdb658c61a0bd61740ac01c218a9ea09bb159b3b32931805d8aef499f553b4cb8a403e46e199ffb4c515fcc6839ba2b7334a

Download Submit
C:\Windows\SysWOW64\Mfnhfm32.exe

Filesize
96KB

MD5
c166cbe4fd910b406f0662bccd100137

SHA1
a679effbc4bb2907ca5916cc521adf07b6618331

SHA256
dd05c87fb2c061e7856cc351d5c2aa14585d652a625b88dde929973b95517df8

SHA512
d57290c085d6172370a4ec76a2327751e59f290048714c4837996f41242fa62dc75aaaf899014227a3eca8a087504a7e527976c947c0e64b876f21a3ee75e113

Download Submit
C:\Windows\SysWOW64\Mjggal32.exe

Filesize
96KB

MD5
37bbf803aee793485110f28489bf0752

SHA1
9cde6c495622326400a6d63d283acaaa07a64ff1

SHA256
d8df41c723de8864304330643cd2770d3ade69dd9c1f871160417e6038dcd20d

SHA512
548cab4931eb7972857fbd45a2ef94abd8b92dfc5180382dd9721ccbc8932c1d57ddf2b0d409a29641849f3355d84d4a31ce0ffc9dfc22de6a7cbec33c00c910

Download Submit
C:\Windows\SysWOW64\Mjnnbk32.exe

Filesize
64KB

MD5
9e12617f0db02e99f60eacf7f382e6a8

SHA1
3370751b6d5d6a7f1e4c8c887cd287388ad05204

SHA256
a1fe29e1c192f6e3efc420df244196a236b4be6b3ee6ca7d76f8250747ae21f7

SHA512
e1a96d22ff9dbd1199e46e3a5ff2edce4bfd9a6fd9eb303e2ed880fa8ca7fb845214def5596766a867e74300850ecbfe65f837a9e2df67ad2723ac46381ed382

Download Submit
C:\Windows\SysWOW64\Mljmhflh.exe

Filesize
96KB

MD5
15e2c196c4886f0de33f0fd72b64380e

SHA1
5380bda7f1a4456cc4ff271c24733d62fd659317

SHA256
2a1e6bf9d8ac10227fd9d58ac9ff14d5aef906d12403866dbacd9736e6250279

SHA512
ac550c8dd81c29cb23f805efc5745fd83b4be9f8fe9be598f12c4aaf81cc99efad969fb946459cbd88ab563d70149810db1e4fcf4cee12cd1390065640e62b42

Download Submit
C:\Windows\SysWOW64\Ncmhko32.exe

Filesize
96KB

MD5
c841fc8a6a7b4a7ea23a0086c923f2fe

SHA1
68d31b04861046ee67a8f67172d9198875b205a2

SHA256
ae8ca5d377f08d1f18ed18a1d05534922f213e0dae7ffca2f40d58aa06049759

SHA512
a049929c0f9ddfc4023460858ef1747a64393b497ef319a7770931d815018b47e7aefe4b9a875f034937fc782449632b44117982caa71d6415354ffc77731ccc

Download Submit
C:\Windows\SysWOW64\Niojoeel.exe

Filesize
96KB

MD5
c9e3ff5f90dad625514b7fc6c8371f1d

SHA1
7ef70e9206440e345d53f1b1cbda2a6fd7b4470a

SHA256
969bb18f03dc51f1bbbbeaa3a1ab54d3d3403385c213bdb5366e72e218d925bf

SHA512
0e7a1602e7a61c4eb7692a707d56230bb849877d2b6b400368ed5d1a35eae80c0b813c74d9e8990b00d44016aea9050bf864de31c7edd293c493dfae24e2f891

Download Submit
C:\Windows\SysWOW64\Nmaciefp.exe

Filesize
96KB

MD5
f61498e558d9bfdf4b9d06753b492ebc

SHA1
1ea4311cb3648b18d98d4c5ce0559485b488f0b0

SHA256
3b931e5143b8f7357f2005f96dfc0b3f13e3b8deb6d1ed6fccec6add1fedf632

SHA512
cc0d8ddf6fb682387c9e948e660b553c85ac92c5f9cc7b3d7d518d41189ae10553ab46dc4882d5a2790a16ac067a92a2b06a9b9b34f3f8fdbb3fc3e076da9e8f

Download Submit
C:\Windows\SysWOW64\Nodiqp32.exe

Filesize
96KB

MD5
05195e593c4772587ed559633202a7a6

SHA1
422e596aeaa8ca19efb7baa983e39cd5ac5761a5

SHA256
9886d1fd1139f24a5d50a0b27f2cecb8c22bd762ffd4821c4677af67dc60dfda

SHA512
3b468c65e0c9c1c65aad4999726b2fd074f44a30ebcec0d30e00e785978fb4edafe1445e4eb2a35e11860ab804067c5850b32709a52567021fd3855cce4b43d2

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
96KB

MD5
202cb4eaa32fc3c6acf6981e17cc5ac9

SHA1
db0845cf919e0e15f5731930bec9e7b273a8d6dc

SHA256
459d3eb46c5a70ff8d781a6a796e538cadbdab9a4cea1eef6c3aa8fdd54e0f3f

SHA512
d3d5b889f38b8993bb9af02e29ec8b4359a70ddd7843457f0721126daf1d5a28d84ef6638c087dde3a8bb2ff9cb710f4883390b32dac20e825ee9add381e5366

Download Submit
C:\Windows\SysWOW64\Ockdmmoj.exe

Filesize
96KB

MD5
7fbc06880cb7efe7f035aff0bebfd7e0

SHA1
cbb22c8a8b0dbd89754ce4c5ae03184d657f9888

SHA256
57c0075553dbe45e501456b6f5a5154d7f0f88afe103470b905de987aba3e84f

SHA512
6e3e2b24817b0a0d16a9fa5b7f3bc1467f16f918d8d37879c76deac1d952997726e9e46b8368bee7d23e15bcac080b17ef94a1666816cce66d1bd60c347aaa40

Download Submit
C:\Windows\SysWOW64\Oflmnh32.exe

Filesize
96KB

MD5
6e1ebf51520cce52defcd55070bc057b

SHA1
13f1b293fc74cd7dfc18b36af866ed5f5d44fd10

SHA256
30cbfaad426173a3fe50e46b38f75f9b1739d90f4daf3385df6581c36e0295f5

SHA512
cd33b6bd8330437be16de3a620e84bed3387cbc120fd7dbad05f31349aad9bc350df407e69e07a5cad54fad7fdf8e77001e04c8f04899036412d7428fc1afe6b

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
96KB

MD5
2868ac355913b7116d3c93814f45b337

SHA1
a759407072783e49b725a2156aeed69b0069d5e0

SHA256
f553f0b21093306bcd8b3fbae66d39818484a76c720999fefdf146f66127d874

SHA512
f47fef700438ad4cad2af2d67adc749c4fc78852e61ab14c1ec8a57a05d9a04a296f658735f381797be5e26a10f5cbc31788f31e74a2d8a82eea7e1e110ed991

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
96KB

MD5
868bead9a124787af5ea3b6c28b352d7

SHA1
b1f38c73be263308c59fbf0e39db76399c0837ca

SHA256
069e78697c9c5597f511d5d65313fdd71984a151b7d38a0fd30a3dbdc012a25b

SHA512
84acd5a0e52c2e16a0c6a8c5a8e7b2c24cee5acbaf812b228bed50057d72a32fd0c6299dea1a6e31aa70e4adfe8adc131db571274327f113b589cd2992aeaa5d

Download Submit
C:\Windows\SysWOW64\Ohlqcagj.exe

Filesize
96KB

MD5
8512412848e8d6ab010333b60117dcc5

SHA1
0373d1727b1cf41ce065d440514aa93a86362c3f

SHA256
9cafe65453043666ed8c01d7f5be68d059f69e307672165175a11fc035f70151

SHA512
9a75ebd0fbccd7bb294ea4c2668a798aff7779d8fdf178d5694179c4c0d69058ea7b044a865b67c36ba41ca7682ca2277e14806b96db40664044dcabd7361502

Download Submit
C:\Windows\SysWOW64\Ojqcnhkl.exe

Filesize
96KB

MD5
2a6aa8cea0aece8479a8cf6fb0bc36d4

SHA1
493b92d1eeb80b35e5b75fa970a162cc76f53f15

SHA256
1f292e72decc7184fc4d1e193c2567c617abd661f76541e3bf21f2c83ab7b9c7

SHA512
b34ae9d9f3ac8725f23027886b4d959e476e9be4b29e66e3f2a31c44ad03f509f973ce4c71586a19c5e36f00bd6363f9adb07eaba1854013db59316302731c86

Download Submit
C:\Windows\SysWOW64\Omdppiif.exe

Filesize
96KB

MD5
ce4a75b31507d955c97ed144f40e8c8f

SHA1
b204b260e88a484f7b224663c685296b065c1305

SHA256
0b50c48c19b995dbe6f9f1de01dd955bda81d16ee1217be51d9a8c7a7eb65a22

SHA512
d000422917296b997126d295294b4761681ba18e146fa2118b20936898b81943c28165e1e501b01dbe96348f03e85c54f94d34e2f8f4aeec1f30dae479636e1e

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
96KB

MD5
0d00a38a49ddb4be86db449a4a995ee8

SHA1
6dae3666d5d3d27a7db70677bf3b030de98e2b3e

SHA256
6035994fcf24ad4958a1fa328a84c479d28fb813a799b4c28236cc954904b93c

SHA512
4d149e6313e5764b6a9a46ab7b691e065edb050c515e0ddec960c7379054e7643cb35c1147fe529d963bc085a25c85a35c29af96fe0091d7431642339b8ab746

Download Submit
C:\Windows\SysWOW64\Ookoaokf.exe

Filesize
96KB

MD5
cb1ace6259b2a9ef0f6981dde8b95552

SHA1
64e6185ef7b03b1dc4ef0de04a985277f2ba3c6d

SHA256
60ac24e294af52eaf2772cfecf165b8331cec058be67533d43a77c7f3a1eafbf

SHA512
e9eb01e0155dfc49d35a81952bc74eb1edbec1b0614a3c5583139b10676806c8c23207bd9694821e95ea9f59dcae48729ced141a88f6dd35cd394284b426697b

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
96KB

MD5
723a6955e0eb62a1217c04814d76752e

SHA1
485002087dec4928969b10dc5c19c9bfa711f258

SHA256
c3a4435d4e2cce4f8438256cc9f6ea6d41620ab3739b642cf5b060dca757b9d1

SHA512
4096d4e495f2012991f4c1f61f797ac52dfcaf591a5af296ea358f61b63466b59fe29df306444c7789608a7554ea672c2536e2a34fab78296ac6b28a0f96c199

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
96KB

MD5
8b0a593e931cef4c645e71ae803fe149

SHA1
17c136afd65978a216ac6f60d0770c67ea28ba44

SHA256
7f2e72f93f24927237e4c7af119715a25cbad994e5354d441aaeb30784a1ee50

SHA512
6949989aaaa2d83268056ebd25233af4792aaf45342e2581fbc44fc6dfe9bb83462aa88563ef21664bddce4aa450b44724888d06b9f515e9ca06642dac8dab35

Download Submit
C:\Windows\SysWOW64\Palklf32.exe

Filesize
96KB

MD5
6d822659cefdcbe52647a6c7aac71b85

SHA1
ebfe2d643337fed3a5d46f1b6add029c5a76f83a

SHA256
f9f9aa9f76142611575052c9e4d4bc7bfb4c2880d36ca32f8fb7637f557a7993

SHA512
df087d6be994e1944c805014d99729c35030be60d439fda5a300d48f7ef1cc64b35cf7d0bf9c4f227de01d9e44b3b622261b164ed67236edbc4209e1d4c5b329

Download Submit
C:\Windows\SysWOW64\Pbjddh32.exe

Filesize
96KB

MD5
57be16d533d6abdeaa08b30e314ed6af

SHA1
b2e27d0f829dfe49ff42210cb68fced28cf891d3

SHA256
9da7541d6415bcccd1b0d084e9274b9813f140018f01a59ed6940a11b7a59413

SHA512
631ab5628b387f5fa75527aa8ae6774464d0524f3f20d6c61626fce8ff83f4e8233dfb8bfe0cd484fe9f88dd06cb7f03dd100571a7cd384318a8c4cd284f214f

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
96KB

MD5
b43148c2a1fab9af09fb439e4bc7f0d5

SHA1
df3c500bcbcaa96eda89a9da45c5481bca6664d9

SHA256
f84fb783eca44c8545379e1a73dbde699998fdeedb6ce4e14c948ef3e49cad32

SHA512
d3071be803084bfa868c18904e5da6eb682945ee6b72a2c87469855aaba35e87a1d78df4d9620dbdce9c2894e92fb7deef6458bedf85f4aecb2315fc203bbaea

Download Submit
C:\Windows\SysWOW64\Pfandnla.exe

Filesize
96KB

MD5
2cf6c80f3982f8a1309760249e433675

SHA1
cc1fdfa0c12000e5a80ace8dd5bf6cd168b048e2

SHA256
8fc78926e3043826e9c8764d40b07cf7b2601b3b2fe00c2d61a4fd372d4dc09d

SHA512
659f44e6f01edfca0f64b2b9ba37554d4388632cc6f04241cfea1bf426b4a189e57f9f904898f03d67ce375094adeeda25c5a2e252b4a817d0f9a5a39ded174e

Download Submit
C:\Windows\SysWOW64\Pfojdh32.exe

Filesize
96KB

MD5
22938efff774a3139fc2bdf4c952ebe9

SHA1
b963f334c23b7e084f47b1d208f3aa18431731fb

SHA256
0a6003e822515c71b282ceaca6c6557d9b5a0b6ef708bbec5ecb1ff2e86a650c

SHA512
661d7564956470c0588c17044b092539e421398062c54799ead8e1fd9eaf5b03a3be8b6c8e3f6bc246cf2ea15b9d21534eb3584f98e4a44e8c345ad39514c42d

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
96KB

MD5
4c2ead55eaeffbfd8aca23bd9311751f

SHA1
693ad5b46b5958423c447d6268ac846b6a4b1e04

SHA256
59a0ff9e6e7775b097b8b12a01c11856c0c32bf86b924b68524c2b846592de0b

SHA512
84faff20f7c81589150923cf7cf64743d823172666a9ff67431ca94c8f53a8d688617fb5277f648a65b73647f9f643427a462333ceb58b1c06f5e4cb3571638d

Download Submit
C:\Windows\SysWOW64\Pififb32.exe

Filesize
96KB

MD5
61781df94130a250d9b007881579b522

SHA1
e75b5f459c3f4012ccdc4c5fbe98978304ef4892

SHA256
2cdfc6d3b6b1a2a5a9675d57e9d422c07ad615ac291b19e20e745246fd42640c

SHA512
ec73e90eb1106e73465f6ff425f1955202211f5ddf3c4d80f3e34cc6fac677831f2e7aa1cedc0c59f0e0a9a6ad87167ee1e5552e36e3dbf45ef5182f175c1c44

Download Submit
C:\Windows\SysWOW64\Pjlcjf32.exe

Filesize
96KB

MD5
30e75df6d13e548295913607a1b86cf8

SHA1
a6b4b4b42ca847ca253e0ebdb620bdc8c33b6a35

SHA256
2de77ff8dafe0323ae581326934b16fa5445fac231145e96999fdcdcad449b30

SHA512
ef9bb2a36b45b356de6d35b6a73fc87ffe2f60834516cbee694d6174f48ce868c3dd3dd434d8d78dc6ddb75ef0b080df14eb9a80a9c76fdb1bae542de0db3e9d

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
96KB

MD5
b3cc8f62362b54d8e7d2c40f8388d751

SHA1
11940571f1be87fb230b5c67fb089b0f405229e4

SHA256
52fa63e7b287b49708ef10e4d8f9e314f9bb09588843ac4ba341c0ad2bb815cc

SHA512
bbaccc81c5a1f022525571dcde9f25433f463b4fc958fe6050352d3b9fc0883782d9d5a2e5a3a77298f36ef37b5d860ffd610e4dd26acdb79305a567692fe290

Download Submit
C:\Windows\SysWOW64\Pnkbkk32.exe

Filesize
96KB

MD5
49510f1a3e94b5c1f12ec82296f60a69

SHA1
8a4f63441236be5ecba4977fb2d2390be5edd036

SHA256
731fd892b9a8f93547ce30f2bd15e3b15c8ecddfc2b01d5aa825285b05052a7f

SHA512
07eda4fbadc28d72460ac11f3b699949dc12eacb3f2ea4110731da17672def4404d9ecb5e9298c645f4f1bab3c1ef2d0eb4c2fbbb7af4792416c603884ede9cd

Download Submit
C:\Windows\SysWOW64\Pnplfj32.exe

Filesize
96KB

MD5
a25a6a7cc211c8a1a21d25f63f24a0fb

SHA1
cbe3c7f16b34f970629eb0e02db3050b28a79910

SHA256
487e6cdde0df7dbd67e2c18e0b6793c46a41867b68989fe48b59c3e1ccc871d9

SHA512
d1cd806b42e35dd5d3bc172eec0d7aa7c0aef52ce2eb21c6793fa89831c638791c9fba359b6889c83c0faf662b060d78b56cc361972e3deebdd36e1347289cbd

Download Submit
C:\Windows\SysWOW64\Ppahmb32.exe

Filesize
96KB

MD5
f6f27a8174cc0f3d84ec3f6f2589e6ba

SHA1
9705547a7ecdad6fbcbcd4528f8a6699054c0fac

SHA256
8cb962735963dfa6fad6c0afe855528f38af9eee0391a6e370145209c4988c11

SHA512
9b2f2988b5efa3064674394cbd1505fa75bf2a9ea2891c6695aa02124770750b2799dc144d39a4759e68938d0995a35269ea373e4a16dbdc3b4a79d884a04887

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
96KB

MD5
1ba80f6f12a682bf461511108e433fde

SHA1
d06c2136f4a2fd2b4c473548acd3181837a886d4

SHA256
6f14c70408d7049f5bfe1ad0565f40cb280731bce0bd0e64d13bd9cac796691a

SHA512
f655ddefb1edd08bacc39d860b153fe858b3600fce11b502db6f82d03947ce4c541233aa9ea3f97101baf9061b07daa8044bc574e19b86f006901ab8856e5856

Download Submit
C:\Windows\SysWOW64\Ppgomnai.exe

Filesize
96KB

MD5
00b974be99bd82933148138ebc901cf3

SHA1
5a61efb883ca04b19f5f158b2778bcb1113ce17a

SHA256
392b8505487f25ee602dc6fa3acb7b5aab9e82e67311ff88ad1fbe886e29ca59

SHA512
ff5051c17646c469a198ce499a3193326f0c29208d9e0c31dbb15d52fdbcb767ead77afc6ae0220a5fc7d87c3515a10ad8b352a35354c0ac0eed0dfbb494f165

Download Submit
C:\Windows\SysWOW64\Pplobcpp.exe

Filesize
96KB

MD5
665bc84caad324d62935821b5bb56e23

SHA1
69fb8c62741ce8eaf28750f859bdbe8431d0fd4f

SHA256
0f5c1ea810add19fb453e1675d8cde3431b8f731b2c1d481b832bfb5625a8bcf

SHA512
7debfe136b062cc90da47403ed5d17d7a8175efde636095d2c89721986fe7ec5bd13001525a32e6e3f7db57ae318040d2d66176f7d1d05e0ef293c6c8072d352

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
96KB

MD5
ea2e03aeef80cfc6df3df803b0255d22

SHA1
7526f5dce00adc43844ffe8160a66ff8da0ed31d

SHA256
e609100b68652877b8bc538b3e82934c259c34045e8267e7fea024f1df841320

SHA512
2747c4a32239a5cd301fb657be1766a2647a4f99021d8fa70fcb978f23b5174ed101b3a9bac8a7c8a85a92b33bb0fa9500447a40ade04160682ae4bbd560c72d

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
96KB

MD5
ccff7601b2141f16c9b9fc3aa8e3d8a6

SHA1
4f8f69fb871ff760f3197e60566de393be13c105

SHA256
754e3964ba3bb978238eea0f830ed2ecc3576beee42529f9ec28074abfaadc80

SHA512
1772d3596d0bd60becbaeb64c79d6a29c079130050497e5934deba166fe2cd84c74d416ed5481322908ce240e19f168299c9671957e86df4fc09788efe29b20f

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
96KB

MD5
b313217193aa98baff2937ad98316473

SHA1
5b88ae37b24b1354c9e74628d03153cfc934e548

SHA256
79c1bc506b5608d13e7eb78c674ca727ea3820dfca6edf317f92208c3d76b745

SHA512
30633726f314d3ba18cffe68d804aa4ecf142c28038cfe63a7d13afcb2d94c9729bb648251bf612f97ea1cff76a0101cc8bca036dc6f866432014613fa537a56

Download Submit
memory/100-412-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/212-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/376-526-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/388-328-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/404-358-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/440-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/452-544-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/452-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/740-326-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/804-587-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/876-430-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/880-466-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/960-514-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1012-520-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1128-551-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1128-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1184-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1188-103-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1208-321-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1236-159-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1460-580-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1468-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1468-565-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1524-406-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1644-436-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1688-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1732-388-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1748-376-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1768-559-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1792-385-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1840-424-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2084-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2096-454-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2196-593-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2196-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2256-120-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-508-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2352-448-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2476-352-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-364-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-460-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2592-502-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-490-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-573-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-247-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2744-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2860-48-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2860-586-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-215-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2968-579-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2968-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3048-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3064-255-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3144-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3168-346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3172-231-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3192-207-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3220-71-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3224-400-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3248-175-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3412-476-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3432-478-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3436-500-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3456-239-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3464-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3520-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3636-223-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3768-199-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3916-418-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4040-538-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4180-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4232-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4268-127-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4320-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4324-484-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4360-394-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4552-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4556-536-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4564-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4564-572-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4588-548-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4688-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4744-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4852-340-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4908-167-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4912-442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4936-566-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4940-558-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4940-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4944-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4948-370-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4984-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-594-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5028-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5096-552-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5116-143-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads