berbew | a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702.exe
Size 923KB
Sample241107-c8yrmswlhk
SHA256 a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702
MD5 ff587b3085e6c211d92315d7589c40cd
SHA1 37297ca1157fd86fc48ecf49f1ffdd7fdb1f66b3
SHA512 382e5ab313228d01a0b060278a5cc024da3f94e7befcfaa7a206f653d43abfcc9b61145d6aa029c38f607e7c54db0f04a2c4834551580b2db968f48ffbfd7cb9
SSDEEP 12288:fZByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:favr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mablfnne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkgeainn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekajec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooclapd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kheekkjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Objkmkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Padnaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqbcbkab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimldogg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edplhjhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Foclgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbldphde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbebbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqoloc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lhenai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mhjhmhhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ommceclc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hicpgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boldhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dglkoeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbagbebm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oqmhqapg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nimmifgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ooibkpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgjoif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhjhmhhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqmhqapg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjdpelnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enkmfolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Egohdegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipbaol32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1308	Nglhld32.exe
3904	Nmipdk32.exe
4584	Oplfkeob.exe
4192	Ogcnmc32.exe
2944	Opclldhj.exe
2564	Ohlqcagj.exe
4368	Ppgegd32.exe
2840	Pfandnla.exe
3000	Pmlfqh32.exe
4904	Ppjbmc32.exe
428	Pjpfjl32.exe
4292	Pmnbfhal.exe
3644	Pdhkcb32.exe
3472	Pffgom32.exe
2616	Pmpolgoi.exe
372	Pdjgha32.exe
1028	Pjdpelnc.exe
2360	Pmblagmf.exe
1072	Pdmdnadc.exe
2436	Qfkqjmdg.exe
468	Qobhkjdi.exe
1148	Qpcecb32.exe
464	Qfmmplad.exe
928	Qmgelf32.exe
3848	Qpeahb32.exe
2372	Ahmjjoig.exe
1000	Aogbfi32.exe
2796	Aaenbd32.exe
2516	Adcjop32.exe
3392	Aknbkjfh.exe
1180	Aagkhd32.exe
4360	Adfgdpmi.exe
1556	Agdcpkll.exe
2952	Amnlme32.exe
1836	Apmhiq32.exe
2980	Aggpfkjj.exe
3648	Amqhbe32.exe
4928	Adkqoohc.exe
3788	Akdilipp.exe
4268	Amcehdod.exe
1632	Bhhiemoj.exe
2224	Bkgeainn.exe
4168	Baannc32.exe
324	Bdojjo32.exe
2336	Bkibgh32.exe
1252	Bacjdbch.exe
1416	Bdagpnbk.exe
2280	Bklomh32.exe
2208	Bphgeo32.exe
4380	Bhpofl32.exe
2936	Bnlhncgi.exe
1840	Bpkdjofm.exe
2992	Bgelgi32.exe
2060	Boldhf32.exe
2184	Cpmapodj.exe
2256	Cggimh32.exe
1156	Cnaaib32.exe
3276	Cdkifmjq.exe
184	Ckebcg32.exe
876	Caojpaij.exe
5136	Cdmfllhn.exe
5172	Ckgohf32.exe
5208	Caageq32.exe
5248	Chkobkod.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bacjdbch.exe	Bkibgh32.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Enpfan32.exe	Ekajec32.exe
File created	C:\Windows\SysWOW64\Hpaoan32.dll	Fajbjh32.exe
File opened for modification	C:\Windows\SysWOW64\Gpdennml.exe	Gijmad32.exe
File created	C:\Windows\SysWOW64\Npmknd32.dll	Jekjcaef.exe
File created	C:\Windows\SysWOW64\Kadpdp32.exe	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Plmell32.dll	Giljfddl.exe
File created	C:\Windows\SysWOW64\Ocgjojai.dll	Njljch32.exe
File opened for modification	C:\Windows\SysWOW64\Ppgegd32.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Bkgeainn.exe	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Lacaea32.dll	Damfao32.exe
File created	C:\Windows\SysWOW64\Gedhfp32.dll	Gegkpf32.exe
File created	C:\Windows\SysWOW64\Eajbghaq.dll	Hbgkei32.exe
File created	C:\Windows\SysWOW64\Hanpdgfl.dll	Kolabf32.exe
File opened for modification	C:\Windows\SysWOW64\Omdieb32.exe	Ofjqihnn.exe
File created	C:\Windows\SysWOW64\Pimfpc32.exe	Omfekbdh.exe
File created	C:\Windows\SysWOW64\Ppgegd32.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Pffgom32.exe
File created	C:\Windows\SysWOW64\Lcccepbd.dll	Adcjop32.exe
File created	C:\Windows\SysWOW64\Aagkhd32.exe	Aknbkjfh.exe
File opened for modification	C:\Windows\SysWOW64\Cdmfllhn.exe	Caojpaij.exe
File created	C:\Windows\SysWOW64\Lhenai32.exe	Lomjicei.exe
File created	C:\Windows\SysWOW64\Anafep32.dll	Mablfnne.exe
File opened for modification	C:\Windows\SysWOW64\Nqoloc32.exe	Nhhdnf32.exe
File created	C:\Windows\SysWOW64\Fpenlneh.dll	Nqoloc32.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Ofgdcipq.exe
File opened for modification	C:\Windows\SysWOW64\Bpkdjofm.exe	Bnlhncgi.exe
File opened for modification	C:\Windows\SysWOW64\Caojpaij.exe	Ckebcg32.exe
File opened for modification	C:\Windows\SysWOW64\Dgjoif32.exe	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Gpaihooo.exe	Geldkfpi.exe
File created	C:\Windows\SysWOW64\Iacngdgj.exe	Ipbaol32.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Caageq32.exe
File created	C:\Windows\SysWOW64\Hbenoi32.exe	Hlkfbocp.exe
File created	C:\Windows\SysWOW64\Jkmmde32.dll	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Nqoloc32.exe	Nhhdnf32.exe
File opened for modification	C:\Windows\SysWOW64\Ofjqihnn.exe	Ockdmmoj.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Pmnbfhal.exe
File created	C:\Windows\SysWOW64\Lielhgaa.dll	Amqhbe32.exe
File opened for modification	C:\Windows\SysWOW64\Gbkkik32.exe	Gkaclqkk.exe
File created	C:\Windows\SysWOW64\Jgbfjmkq.dll	Mjpjgj32.exe
File created	C:\Windows\SysWOW64\Pjpfjl32.exe	Ppjbmc32.exe
File created	C:\Windows\SysWOW64\Pneall32.dll	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Hlmchoan.exe	Hecjke32.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Enfckp32.exe	Dglkoeio.exe
File created	C:\Windows\SysWOW64\Gimngjie.dll	Edgbii32.exe
File created	C:\Windows\SysWOW64\Fallih32.dll	Heegad32.exe
File opened for modification	C:\Windows\SysWOW64\Jahqiaeb.exe	Jpgdai32.exe
File opened for modification	C:\Windows\SysWOW64\Lomjicei.exe	Llnnmhfe.exe
File created	C:\Windows\SysWOW64\Ncbegn32.dll	Ljdkll32.exe
File created	C:\Windows\SysWOW64\Nofefp32.exe	Nimmifgo.exe
File opened for modification	C:\Windows\SysWOW64\Aknbkjfh.exe	Adcjop32.exe
File created	C:\Windows\SysWOW64\Egaejeej.exe	Edbiniff.exe
File created	C:\Windows\SysWOW64\Gcmjja32.dll	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Aqjpajgi.dll	Cdmfllhn.exe
File created	C:\Windows\SysWOW64\Bfcjjj32.dll	Dqnjgl32.exe
File created	C:\Windows\SysWOW64\Eiekog32.exe	Eqncnj32.exe
File created	C:\Windows\SysWOW64\Ffdihjbp.dll	Ipbaol32.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Ppjbmc32.exe
File opened for modification	C:\Windows\SysWOW64\Pffgom32.exe	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Pmblagmf.exe	Pjdpelnc.exe
File opened for modification	C:\Windows\SysWOW64\Adkqoohc.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Dkcndeen.exe	Dhdbhifj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8044	7860	WerFault.exe	321

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldbpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jahqiaeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpclce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkcndeen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbnhoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlofcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmblagmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlkfbocp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbccge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klggli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgklkoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhhdnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foapaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeioiam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgjhpcmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fganqbgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iacngdgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmaciefp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njgqhicg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hejqldci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpeiie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhgjaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dolmodpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pimfpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gegkpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbnajqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edgbii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgoakc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcmodajm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpapnfhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjpjgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekajec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohlqcagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hicpgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimldogg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gijmad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkgeainn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqnjgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Damfao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpdennml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbihjifh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihmfco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jekjcaef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pciqnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egohdegl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcclncbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Edgbii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debbff32.dll"	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Llnnmhfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngckdnpn.dll"	Gbkkik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjehdpem.dll"	Hicpgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeeaodnk.dll"	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jbccge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ooibkpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpbdco32.dll"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddlnnc32.dll"	Hbnaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jeocna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nfihbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpenlneh.dll"	Nqoloc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nimmifgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aadafn32.dll"	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibclo32.dll"	Fijdjfdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahfmjddg.dll"	Kofdhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkhnbpne.dll"	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fgjhpcmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anfmbd32.dll"	Dkcndeen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hejeak32.dll"	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfcklp32.dll"	Fofilp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpapnfhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pegopgia.dll"	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfhmgagf.dll"	Enhpao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dognaofl.dll"	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hicpgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mpapnfhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ommceclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Helbbkkj.dll"	Fgjhpcmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hlkfbocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnjfof32.dll"	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbagbebm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jbagbebm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kifojnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfgomdnj.dll"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lielhgaa.dll"	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjecbd32.dll"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmmdfp32.dll"	Dndgfpbo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1308	2176	a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702.exe	83
PID 2176 wrote to memory of 1308	2176	a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702.exe	83
PID 2176 wrote to memory of 1308	2176	a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702.exe	83
PID 1308 wrote to memory of 3904	1308	Nglhld32.exe	84
PID 1308 wrote to memory of 3904	1308	Nglhld32.exe	84
PID 1308 wrote to memory of 3904	1308	Nglhld32.exe	84
PID 3904 wrote to memory of 4584	3904	Nmipdk32.exe	85
PID 3904 wrote to memory of 4584	3904	Nmipdk32.exe	85
PID 3904 wrote to memory of 4584	3904	Nmipdk32.exe	85
PID 4584 wrote to memory of 4192	4584	Oplfkeob.exe	86
PID 4584 wrote to memory of 4192	4584	Oplfkeob.exe	86
PID 4584 wrote to memory of 4192	4584	Oplfkeob.exe	86
PID 4192 wrote to memory of 2944	4192	Ogcnmc32.exe	88
PID 4192 wrote to memory of 2944	4192	Ogcnmc32.exe	88
PID 4192 wrote to memory of 2944	4192	Ogcnmc32.exe	88
PID 2944 wrote to memory of 2564	2944	Opclldhj.exe	89
PID 2944 wrote to memory of 2564	2944	Opclldhj.exe	89
PID 2944 wrote to memory of 2564	2944	Opclldhj.exe	89
PID 2564 wrote to memory of 4368	2564	Ohlqcagj.exe	91
PID 2564 wrote to memory of 4368	2564	Ohlqcagj.exe	91
PID 2564 wrote to memory of 4368	2564	Ohlqcagj.exe	91
PID 4368 wrote to memory of 2840	4368	Ppgegd32.exe	92
PID 4368 wrote to memory of 2840	4368	Ppgegd32.exe	92
PID 4368 wrote to memory of 2840	4368	Ppgegd32.exe	92
PID 2840 wrote to memory of 3000	2840	Pfandnla.exe	93
PID 2840 wrote to memory of 3000	2840	Pfandnla.exe	93
PID 2840 wrote to memory of 3000	2840	Pfandnla.exe	93
PID 3000 wrote to memory of 4904	3000	Pmlfqh32.exe	94
PID 3000 wrote to memory of 4904	3000	Pmlfqh32.exe	94
PID 3000 wrote to memory of 4904	3000	Pmlfqh32.exe	94
PID 4904 wrote to memory of 428	4904	Ppjbmc32.exe	95
PID 4904 wrote to memory of 428	4904	Ppjbmc32.exe	95
PID 4904 wrote to memory of 428	4904	Ppjbmc32.exe	95
PID 428 wrote to memory of 4292	428	Pjpfjl32.exe	96
PID 428 wrote to memory of 4292	428	Pjpfjl32.exe	96
PID 428 wrote to memory of 4292	428	Pjpfjl32.exe	96
PID 4292 wrote to memory of 3644	4292	Pmnbfhal.exe	97
PID 4292 wrote to memory of 3644	4292	Pmnbfhal.exe	97
PID 4292 wrote to memory of 3644	4292	Pmnbfhal.exe	97
PID 3644 wrote to memory of 3472	3644	Pdhkcb32.exe	98
PID 3644 wrote to memory of 3472	3644	Pdhkcb32.exe	98
PID 3644 wrote to memory of 3472	3644	Pdhkcb32.exe	98
PID 3472 wrote to memory of 2616	3472	Pffgom32.exe	99
PID 3472 wrote to memory of 2616	3472	Pffgom32.exe	99
PID 3472 wrote to memory of 2616	3472	Pffgom32.exe	99
PID 2616 wrote to memory of 372	2616	Pmpolgoi.exe	100
PID 2616 wrote to memory of 372	2616	Pmpolgoi.exe	100
PID 2616 wrote to memory of 372	2616	Pmpolgoi.exe	100
PID 372 wrote to memory of 1028	372	Pdjgha32.exe	101
PID 372 wrote to memory of 1028	372	Pdjgha32.exe	101
PID 372 wrote to memory of 1028	372	Pdjgha32.exe	101
PID 1028 wrote to memory of 2360	1028	Pjdpelnc.exe	102
PID 1028 wrote to memory of 2360	1028	Pjdpelnc.exe	102
PID 1028 wrote to memory of 2360	1028	Pjdpelnc.exe	102
PID 2360 wrote to memory of 1072	2360	Pmblagmf.exe	103
PID 2360 wrote to memory of 1072	2360	Pmblagmf.exe	103
PID 2360 wrote to memory of 1072	2360	Pmblagmf.exe	103
PID 1072 wrote to memory of 2436	1072	Pdmdnadc.exe	104
PID 1072 wrote to memory of 2436	1072	Pdmdnadc.exe	104
PID 1072 wrote to memory of 2436	1072	Pdmdnadc.exe	104
PID 2436 wrote to memory of 468	2436	Qfkqjmdg.exe	105
PID 2436 wrote to memory of 468	2436	Qfkqjmdg.exe	105
PID 2436 wrote to memory of 468	2436	Qfkqjmdg.exe	105
PID 468 wrote to memory of 1148	468	Qobhkjdi.exe	106

C:\Users\Admin\AppData\Local\Temp\a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702.exe
"C:\Users\Admin\AppData\Local\Temp\a579c3dc8d7bb4d21b71a66b015ae032a6eff12c7da507ca65bef49d7e128702.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\Nglhld32.exe
  C:\Windows\system32\Nglhld32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\Nmipdk32.exe
    C:\Windows\system32\Nmipdk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\SysWOW64\Oplfkeob.exe
      C:\Windows\system32\Oplfkeob.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4192
      - C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        23⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        24⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        25⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        26⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        28⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2516
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        32⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        33⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        34⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        35⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        40⤵
        Executes dropped EXE
        
        PID:3788
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1632
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2224
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:324
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        47⤵
        Executes dropped EXE
        
        PID:1252
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        48⤵
        Executes dropped EXE
        
        PID:1416
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        51⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1840
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        56⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2256
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        58⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        59⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:184
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:876
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        65⤵
        Executes dropped EXE
        
        PID:5248
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        67⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        69⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        74⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        77⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        79⤵
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        82⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        85⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        86⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2756
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1736
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3908
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        90⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        91⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        92⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:368
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        97⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        99⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        100⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        102⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        103⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        107⤵
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        108⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        110⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        111⤵
        Drops file in System32 directory
        
        PID:3640
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        112⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        113⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        114⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        115⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3172
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        116⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        117⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        118⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        119⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        120⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        121⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        122⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        123⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        126⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        127⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        128⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        131⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        132⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        133⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        134⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        140⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        141⤵
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        142⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        143⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        148⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        149⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        150⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        152⤵
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        153⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2328
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        155⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        157⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        158⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        160⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        162⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        163⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        165⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        167⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        168⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        169⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        170⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        172⤵
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        173⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        174⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        175⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        176⤵
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        179⤵
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4992
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        181⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        182⤵
        Drops file in System32 directory
        
        PID:5076
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        183⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        185⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6580
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        187⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        189⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        191⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        193⤵
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        194⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        195⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        196⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        202⤵
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        203⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:820
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3252
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1292
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        210⤵
        Drops file in System32 directory
        
        PID:3424
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        211⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        213⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        215⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        218⤵
        Drops file in System32 directory
        
        PID:4184
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        220⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        221⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        222⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        223⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        225⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7344
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        228⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        229⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        231⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        232⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        233⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        235⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7860 -s 412
        236⤵
        Program crash
        
        PID:8044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7860 -ip 7860
1⤵
PID:7996

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:7060

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:6372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaenbd32.exe

Path C:\Windows\SysWOW64\Aaenbd32.exe
Size 923KB
SHA256 699d856b087a7baad1d26b0c2a88e3116b38d0a2fb919258d41cbdc14801835f
MD5 17d58f4da8482b60fe212a5149949dfd
SHA1 27342653b17695f287f1d59da86248c588531009
SHA512 1476101542eec261dd240f36ee481bcce8fbb8d370fa6a044b2f7fde65d445cab38e3d47de5e2d723361eac1fe5565cf43dd7f814dcc5056c88a4b56422c1b23
SSDEEP 12288:tMDHoa9ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:GHoRvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aagkhd32.exe

Path C:\Windows\SysWOW64\Aagkhd32.exe
Size 923KB
SHA256 3a15e3fa36d5c38f7013001e5945085cf600dd9bef0cd554eb06da01c46c0562
MD5 f2f5d49c979f3ee78526821a7a3a6e16
SHA1 1baa9ce646ec5163f914b030d9195f8eb0a58eb9
SHA512 5b481e8f80de6acc36acf32f02f129d03c75bfb76f7b763a2c94890bec352e60fb1cf3b8e83cb007d1b1a0819af8424b3fd3b790c367636e7a59fd0620a6aa3c
SSDEEP 12288:dFiYByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:KXvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adcjop32.exe

Path C:\Windows\SysWOW64\Adcjop32.exe
Size 923KB
SHA256 f6a4e69987a8c7f8c0cc4a2652b3e3b6b6a1bf426ed8cf9a0bf07c3aabd869ba
MD5 4b7585b36e2e7855f94995f401a84930
SHA1 3b92f832f7e139546ef044e5a296ba36a6d2be22
SHA512 3e0ed43e320d06730510e0e99249119e2e5e42cb240d07abbae1dc1efff64a75dcc5cf92682490a23673ede69f6a32f7203e6dca2a169296bd4d7920f17f64bd
SSDEEP 12288:L8ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:Xvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adfgdpmi.exe

Path C:\Windows\SysWOW64\Adfgdpmi.exe
Size 923KB
SHA256 f2c0c8e3f7ea8211706cad60e570cdade5e83f74548bb77303773abbc5e9abac
MD5 2ec9371ceffd3845eae69aaf5dad9973
SHA1 e7c32bccf4eff9d0ce20c458610917bc0dae3703
SHA512 904e92c485883e1f09e92f0294d258a733ab330da5e4aa83b80b9fcba3a2c0c3be8ddd44298256665a9ef69bc7a27084cee66eaa01fdc9057f19f076075c7183
SSDEEP 12288:ByxqS2Uz3ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:0Svr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ahmjjoig.exe

Path C:\Windows\SysWOW64\Ahmjjoig.exe
Size 923KB
SHA256 6b75561b908a6437491a688a45b6ca7dc333c11629ac0acedce81afb6e3619f2
MD5 6cd87f01d6a0323bd04c88183fd9a2ca
SHA1 496d2953056706dbf3e50ad77467b657ef510803
SHA512 e1bcc3e7725df448a8da11dd37e08ca1b07abe54baf9611358b0ea40e85dabc55a87d61dd8a1e2fab04ea6b9157910d146fcd6dc223d73f18b9c54e4b9ca045b
SSDEEP 12288:jWkByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:jWbvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aknbkjfh.exe

Path C:\Windows\SysWOW64\Aknbkjfh.exe
Size 923KB
SHA256 b961ca6584e1b8cb2561366df9f3c64170c774cb7eee42a063668b73f47a08e0
MD5 c9ca5960fbdf71c6692ae63350d3003f
SHA1 083110f79714e51db55d82bb2a2f735967088f8b
SHA512 b5d54af9668978c1964043de0bba72c3e25f5daa42f336763d1275c9d6d600e352aa49aa6794fd3f7440dbca26430869b29e451c68065da6e18db732a4acb6b7
SSDEEP 12288:NgWMxByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:OEvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aogbfi32.exe

Path C:\Windows\SysWOW64\Aogbfi32.exe
Size 923KB
SHA256 9a155c8c80d3da7ffa95367267bcab276acc2246d307d7bca07084a63b69fadd
MD5 8642faadd82c2c2cfdd0bdb678bb78c5
SHA1 b577127eb78e313aefd42a8adbddf2c8df94ebed
SHA512 dca4af22a125cf35111e66b54bdab072b690a06a4a405a3d9ca2c88945ce62c79d831d760294561eb22c33fb18bdaabef505b637444f76d858755fc93098a8ae
SSDEEP 12288:mAgv7ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:mPvcvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gdmpga32.dll

Path C:\Windows\SysWOW64\Gdmpga32.dll
Size 7KB
SHA256 48946aff360ab666fc14baf36e02815e6f4113bdc45e7d5048d55718ede25569
MD5 0296b00b380ef58600e29cee6613a267
SHA1 75816787f7827302432199f963c035c2be6c40a5
SHA512 5cd6d6ff1c172e578ed0fb441009ea2dcd0290d7c2e710013c082f7a0b477c5735a0015a103b14233a59c17bdae3481aac4fa221ad0ccbd0869a3bf2acce1ea3
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaPl0d3cX5aXW:wUaJf/aFbP0Ot2JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jahqiaeb.exe

Path C:\Windows\SysWOW64\Jahqiaeb.exe
Size 923KB
SHA256 7defef916b2f3f50b6e5e3c8233bbce76da633eb2a72fca244e2ed80e686774d
MD5 e9e22f2b5b62b3fbc9d1657fedacf49f
SHA1 cfe0a1064ce9b03ee04ca718131e5c603de8c106
SHA512 36c51a9ed6189ca9cb38362029a011aa186a527f0311687850703c4fff251959fc20e2dc57678694b56eb2780c697e4fb61c77082f4116de2c288f7578f06bea
SSDEEP 12288:zt8ffaNnByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:zu+wvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jimldogg.exe

Path C:\Windows\SysWOW64\Jimldogg.exe
Size 923KB
SHA256 2fdc457eade552dca9c0a2bf55d0536b8541893d82b4398d5a91f21326c7706f
MD5 6d032c1cc54a4210885cc6a9c706d5d7
SHA1 090bdcfcf2a67bda16c23e9de4eb22b273508255
SHA512 3913b73ebe866ad9bf7bbe4a822e22a8df6a59ac66687ff5e0ec647c87fce48c0e97f438cb7fb7f13b986f693d9d20564191b94091da79f9b754fce0045f8608
SSDEEP 12288:xhkkByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:evr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jocnlg32.exe

Path C:\Windows\SysWOW64\Jocnlg32.exe
Size 923KB
SHA256 cec15f81668cbb32b9296fb1ca0ac924d8cf311ead7848efde7c7d6bbee519ff
MD5 99bea4cac8663fa64f2c449f41e22d0d
SHA1 790561dc86cf2f468d7b8c0ca78b6ace88873b0e
SHA512 ea8d4b60687f25ca3bb56728529b54e671624d02eb155de6830cd8414ab55d08f318b9e3633356416de819628b9a3893e044b769c9c3e5c4918f2b1d32d9d244
SSDEEP 12288:5d9ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:5dGvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kabcopmg.exe

Path C:\Windows\SysWOW64\Kabcopmg.exe
Size 923KB
SHA256 8fe0e361211a006ef9ff2d20a012c86f60631afaac3d339b5b149cba72001b0f
MD5 30d771dc3dae2abbf1bf842adbb366f9
SHA1 971f32d182d05985a3a067b28df675e9a9028354
SHA512 c40fdf36005d2815dcf880693cb62a802b08014a2879561f578b2801ea822edacf76c92cde10b2b269cf76812dd7bb113b856ef490995264ff3aeab5bd03bee4
SSDEEP 12288:1zmByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:VFvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kifojnol.exe

Path C:\Windows\SysWOW64\Kifojnol.exe
Size 923KB
SHA256 ce472a2601b2e81918ffbf59287a8ebd2882ac41e7ea589d19d4428a254cb976
MD5 85383c949bc49b09a1f553c2ef0a03f3
SHA1 c831c6ed1e97dd453dde072cd72b73162197caa8
SHA512 04d7ec761cabccd2dcd43991821bf2a691d07fc3f0240e15c1fb4c778b41ccac96cd4550ff435faadef71a68039a1e29894512d40857d13218c96e215db26a42
SSDEEP 12288:KaR79gRX4TByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:J9cX40vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kplmliko.exe

Path C:\Windows\SysWOW64\Kplmliko.exe
Size 923KB
SHA256 51c5ea625dd6982b6ae8b687bbdad66d6f4fdc404f32a24a2051aa9e0a1984c8
MD5 fd46cbf9ceecd2f6be6ee7c3aa7c7c2c
SHA1 15c00d634c57926cda1ca4b098cbb17e477a8e61
SHA512 c2ddcea953acdd3846d5aaf5eaec3be89eb3e2a431f4008ed70f0a947da571abf528f4f80baefac36aef3c575344a20a08062712a38024de8881131596918177
SSDEEP 12288:Vh8VByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:/xvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Likhem32.exe

Path C:\Windows\SysWOW64\Likhem32.exe
Size 923KB
SHA256 dac41faa2f7e1d11f029f56215950bf0d0c6679aceadbfda41d8f1f5a458318b
MD5 e98125ec703a28cbc02684f7eb905dd5
SHA1 eb04737a13d95ea112877e8dbc62900eb2ad1a7f
SHA512 548e64d57ab6e3bfcf6976d28f7499b3462b3cce80db8977badcd96a7d3f3af4c201b6e3096364450e6cc044da6b290b81a281bf021ef6148edc09b12b6b8322
SSDEEP 12288:K1ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:Xvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lindkm32.exe

Path C:\Windows\SysWOW64\Lindkm32.exe
Size 923KB
SHA256 e16891bcf9ca2f74a1b9981c3416451bc64db248dd8eefe0bcf222e32f5325fc
MD5 d2ca875ff50c2fbf5e3e2c00a51549a0
SHA1 602aaae17ee52ae1a91028d73b90bb6bf88a085a
SHA512 157392a6ba3e3ddb150a6a5496e520b01ec048094eb436dd6ce3ecfdeac43037140e681cdae7ca907fa61dd9440eabab20015a0fd7c5a2f70980938d1fcf20dd
SSDEEP 12288:08EtriVByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:TEfvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lomjicei.exe

Path C:\Windows\SysWOW64\Lomjicei.exe
Size 923KB
SHA256 2a106cdd47d656b5da8d884e09fc4681648530245af7533edb2bd124bafd88b5
MD5 e34380dcb1a5c31531ebb5d8a46005ab
SHA1 9845ced60a0e5a567d80f65e29f6bb68b7224400
SHA512 f0a4179b6a205b4586224b24ba28bcd445784c5336fae583da7e9b768bfbfdbc8282c3d51aeda519bfb7eebe0bfde391cc3b09a22bf247b2d73f4cc237f7254a
SSDEEP 12288:8eOFByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:pvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lplfcf32.exe

Path C:\Windows\SysWOW64\Lplfcf32.exe
Size 923KB
SHA256 c22f10bee52d8e21a6c1add0b76703e91ad8f888426c88a5c538941fa2a044c6
MD5 4f81767def59a552fcf316243288a4bc
SHA1 6d819db86e9d55fd3877cb302c1b15e6c1fcf8cf
SHA512 ffd987e9b3fbac592f38f3f606f49c8b4cc56960072cf73263a67d1bf99145eab62118aa2204cb3f3d2221e4f3f235f9a19a17578e9bb3f0d32e78392240b4b9
SSDEEP 12288:xwxJ+ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:xyvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mlofcf32.exe

Path C:\Windows\SysWOW64\Mlofcf32.exe
Size 923KB
SHA256 beee316fac0c7e20a6c1c52c9a95500497e43d00f296217c6334eee91e51a6d7
MD5 f9d05196803498e24457e560fe69557b
SHA1 e027f447590c13201e659c92f787057e0528467c
SHA512 a3d4463e933bd361516a71eef57933f8e79482f301cfc5e58f05484ffcf92890423fb981931cdadea501ad7520b80b4506ce242fb3e4c8f5e590d725a61b5392
SSDEEP 12288:HbByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:cvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpclce32.exe

Path C:\Windows\SysWOW64\Mpclce32.exe
Size 923KB
SHA256 277d33ca18e947e53172832a20655367d8c986c3f80bcb56bbe968c3d88fb96c
MD5 778d02083b62d7c4258f3ed1877522ae
SHA1 59b0124fd9033d45e2d87fc6d6efed0682024b5b
SHA512 043397923bcb448d9bba660e058962cad31d9d471cf781ee814c1b7e09efa5c0d85ba488c654b32e811164fb4e285c57babb95a7449326bac3709607f3b64ca0
SSDEEP 12288:mRxyNkS5XByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:mRYNkS5Avr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpeiie32.exe

Path C:\Windows\SysWOW64\Mpeiie32.exe
Size 923KB
SHA256 b2c9545ef27beb81ec82c3c08485c6c55a54cca3e3f23dca54d89e38e7fadff8
MD5 135b8e9bddbc9911a68f3422b762e938
SHA1 5e103f626d27ae137635cccb6bd87aeb8ff3949c
SHA512 7585067123eec1312bca73ffcdc104aa3082a7772111e9dd83ad6ae86476cf81226158386d2a8e0ce8118ea08959bbbbc4ca5fde88b8031481b7d8663a53c2d6
SSDEEP 12288:Dh7GpUByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:wvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nglhld32.exe

Path C:\Windows\SysWOW64\Nglhld32.exe
Size 923KB
SHA256 abf3a63ab1cf1808adfc451033d4771f16b4e11e45e2a352336d07021359ad32
MD5 2aac0a6d644abe159e8108a50601a58c
SHA1 ddf58d4aa308bb5aca9f378a93b109a5a2f43552
SHA512 c5b933bed1070d62bf6856ed2705458113ba20fa32faa5b42601cd83232ced7f097268163ded0457d0ad40f7987e8a510fb7a70762a3ad694b0d5efc6fc0d73e
SSDEEP 12288:tZY/r9ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:tZgCvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nmipdk32.exe

Path C:\Windows\SysWOW64\Nmipdk32.exe
Size 923KB
SHA256 a496d639c031c8587b0d5ed4b6ff2922912e9c9aaa08c016e503810be36b89b4
MD5 51ecf54bb4530c205ca3160a42fcc520
SHA1 919f0a004bc0cf4c94fd7b597710caa9b24f4de5
SHA512 c05a771ae87053d19690826d5e9ce10d73e310de4aba8988a0434f8df4e7d1251d07e72139fe05af85dfb85100da1e09ce548f0ade2af30a9b338c54e3ffe9cd
SSDEEP 12288:tB9mpZByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:t/vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqoloc32.exe

Path C:\Windows\SysWOW64\Nqoloc32.exe
Size 923KB
SHA256 f1e5410335cf3e607347a654e6d752b53d030770e7c66ce327f9fe43c9c21101
MD5 cbce52daf1b490a80466ba3fe5581b65
SHA1 35994496dac6fb5f1671e37118aa593babac1c70
SHA512 b7d2ad564884f77e96b20aad53df7b1c9da24eaf9d403bc2d5eff61050ca470f216a6f5bbcf3d2fccbfd1643debd0c21fbac3bf4f1f6fd649c7a88ce388e1e48
SSDEEP 12288:SzVWBByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:uwivr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Obgohklm.exe

Path C:\Windows\SysWOW64\Obgohklm.exe
Size 923KB
SHA256 8d41825a8f60d83f7f0d1aecbd363b39281c5d32e7796774d6d298a667ef813d
MD5 4674c1be9b5ebb711d6162034185026b
SHA1 3219d07efe0f0246b659a36317f7c8cb53342ff4
SHA512 1b0969535eb1667c498e7b62f4f303218f8dcb07a2c1b3677b078338be752ef9598ce085c291951aa48c8dfe682845811088dafd2594859ebcd3dcc556a4450d
SSDEEP 12288:mdQ4GKZ2ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:bQ1vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Objkmkjj.exe

Path C:\Windows\SysWOW64\Objkmkjj.exe
Size 923KB
SHA256 43b9535b62718a78e00f7fe4e564a532eda287feb347e2fbd8d7e60661e60d4a
MD5 74eb545b30f65a2ebbc924fff5ff67c5
SHA1 062e3a6e3d20efbeb4c6e590bc05bf1dd7a76807
SHA512 8a9ce432ef5d3e8d460d402a33853b6d3b445b5ecf1af632b29fedb53e2cb9e0f88a60fea149381756c336be75326fc1b7cb0002979cab704901b3abbc6fa7ce
SSDEEP 12288:286ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:26vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ofgdcipq.exe

Path C:\Windows\SysWOW64\Ofgdcipq.exe
Size 923KB
SHA256 1668e4c16748a80e6e79d022ab369d9f8ecc2383d7fb7132c98a29d7783ba06f
MD5 990bd22c30efedc1c310a02acd500649
SHA1 427941abe1a1e181104854402640b77a950238b8
SHA512 9c8034b7c47442200a3dee2dfbf8b47fba0586d59cef0742f819d03f3909d9b6e1cb7433b0efb384b4f6e5ecdba76b219160bce0fd1c36bd3c57da56e510aae7
SSDEEP 12288:5rGO/ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:5rGVvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogcnmc32.exe

Path C:\Windows\SysWOW64\Ogcnmc32.exe
Size 923KB
SHA256 45f109ce7db36ec62cbf39033ed8913a813c041f295f19d4feae16be6f60b3b5
MD5 18d5f86bd0c14edda389338da37f12e1
SHA1 aae249a133101acbc1a234cd8391dbfff83da636
SHA512 7c6a8bce5af069837e50bbc6cb0ca93763635bc1fbbc6d1fb7e557f0c1e438517ef7e87a9d866c818766abb799adef92a1bb01b902606321bfaf435defe28f39
SSDEEP 12288:rnqByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:rnRvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ohlqcagj.exe

Path C:\Windows\SysWOW64\Ohlqcagj.exe
Size 923KB
SHA256 e0339073d24bb2392f9da8040975ab9422b454248e199b7a95713d66a1023226
MD5 81995c5a6b9f0f9ba59db7578a616f99
SHA1 3dcac4619cead9e01a7e6fce9dcb91b4e0daddc5
SHA512 4cd2f50b95917e4164c457e51c289d4897f7f68cca49140096703cc3bcd2bf8e8b87c58754b90461695ceaac96c28cf21724713fb1eda2969f369000c7c54b9e
SSDEEP 12288:eXiCFD1ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:eyCFavr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opclldhj.exe

Path C:\Windows\SysWOW64\Opclldhj.exe
Size 923KB
SHA256 cef63d8ea32ed4037fed21ead3d2b2ae2bf05ce262846f9ece49b91e2789b965
MD5 84789980022932219355d2c8f13ea2e6
SHA1 073add0842f989c33cd6daa2e9857d36ac0d3e5d
SHA512 c9ae38aa8f77879b39743feea0a83a4ad6b9706eafc7e4b216833969bccba7f1d08e8cf9580d3d4d0e6cfa73b51a7213af982d659bbb60f2f4ff50c8131065e2
SSDEEP 12288:NhE5iEByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:Nf7vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oplfkeob.exe

Path C:\Windows\SysWOW64\Oplfkeob.exe
Size 923KB
SHA256 2e28d7b2a2bf4c66c1466d7ef96c5397008be383a88075f6200c4ca5f58f49db
MD5 eac080f67e857378982a85a4057d041d
SHA1 6c69135c5f65404a20219ac7bf6ffabe5b7a7c8f
SHA512 a42383509de53ad56bf63ac0ce403efcc288b93d47e4a35db25088cd0160779a01372d9ac72de6d73eca49f2b82089de133cf7a3d429361d455a064f3f23ae68
SSDEEP 12288:QqByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:QRvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pcbkml32.exe

Path C:\Windows\SysWOW64\Pcbkml32.exe
Size 923KB
SHA256 fa9213dba4f3104797f2c20f4ab92089a97b7da6160268146e815e2d1f5fb22c
MD5 2d7ffef16ccbdde301b775a728f111d1
SHA1 4a6bbf297cf0b10bf295589c6bba7ba2bb1d596c
SHA512 89c33a63106964b3705bd747b006a034e5a936225a6e88d38c5a1694ca369bdca69c2b9d126622d05e70a7d7cb66c7d0861becee1457b2c36711f57ec9b3bd99
SSDEEP 12288:KOCByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:1pvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdhkcb32.exe

Path C:\Windows\SysWOW64\Pdhkcb32.exe
Size 923KB
SHA256 0a0c22015803e54747b994a7dd75007c0d2b4555ee998de195a0069829c6d775
MD5 8ec970961c690f3fe7f6f0f0b895aeb2
SHA1 82cb7756aeae1f049c4d26ea8c42a2dd8cdf03e0
SHA512 71da265f45ad5112b38ca2406f494823ee6e849af926ca59228985bc63f50ec3fd794f6a895f813b491679bc138d3aa5db56df870280f7cd23ae821fb1fb4af0
SSDEEP 12288:diNByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:s2vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdjgha32.exe

Path C:\Windows\SysWOW64\Pdjgha32.exe
Size 923KB
SHA256 df34ebeb7fee92128fe6a22f5081b384c27977af37f3a91f944a11b4350563f2
MD5 612f72e8a546329e18834a3dbd5106f3
SHA1 e1b0860ccdc1d7b9a177000ea54736cd868d316c
SHA512 1f0f1191564e96989f756f927ed8f24e2eaca223e2c428d0ea412668b6ddc2840e3f5c83a981e247204037c3132e3667ae4fd371c648c6f9aad278e17d1d198c
SSDEEP 12288:44XLBNNByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:44XLB4vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdmdnadc.exe

Path C:\Windows\SysWOW64\Pdmdnadc.exe
Size 923KB
SHA256 f5b20c46736280db0c1ef8489654938308d7cf31f53708722ffa7e6ca1d83086
MD5 248c3ea88c4bde0a4a02bb71099d32ac
SHA1 bfd527c5e42286d0f4764ed0d872d6a75383fcf6
SHA512 dd733d94d17013096ccb10938538b065adfb064f81112676092de19635a6f2733e11e637b819bc130e2b860633b1a0225d6c1a9a8c06e2327b90044d372fced3
SSDEEP 12288:n+ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:n9vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfandnla.exe

Path C:\Windows\SysWOW64\Pfandnla.exe
Size 923KB
SHA256 1e23adca60777591c8c13a0993de8e51daf77b369d31267ebf35e0f9777fd9ff
MD5 a69a630c682a7b5a9d34e650422f42dd
SHA1 be2be33fa416bde4400974dceb987c7556fff42a
SHA512 40ff5a9db66994bfd94cff094f6822315a1eed8ca9ecf9813ed890947e3609d3163ce43a5767cd22cbe3524500e741fd9f84629935aac2196a03561786196393
SSDEEP 12288:Pnzb72MenByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:Pnzb72Mewvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfccogfc.exe

Path C:\Windows\SysWOW64\Pfccogfc.exe
Size 923KB
SHA256 86bfd0815e4d5ba7e2ebc53de663e15fbe2fde134bc502328d815d7a5b07d899
MD5 59e2459bf60cfc71b038ff8f6fd0d46b
SHA1 27792b3d9bc6375321575c968116cdf30a70a28c
SHA512 bf7b76bb112906723bb2d25f6ebc7f9fb067b20fd1d9194bff1c6dfb3746829e8d348f049057b8ffac90f010bc60966cad108be40a5a1cae3045a48da2c4346d
SSDEEP 12288:cxp34H5eZByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:cxp3Evr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pffgom32.exe

Path C:\Windows\SysWOW64\Pffgom32.exe
Size 923KB
SHA256 d9d0e73b7ca71c3ce7006c7840b4d867ca17b527ef09e1b432e0456cb05b9e37
MD5 d491a982f49c00e0709b86a0517ff87f
SHA1 b12b103006a2b5229135a752f56f2eb9ad97d7a8
SHA512 3b7cb2f8cf9b0e6e85478bf8332efcabc161676671811fb786d9b18e4d0fba7ccd736f092983662d47f4aac0ab78f9a39b6dd4c87ffbbfc0aa602a20a091430b
SSDEEP 12288:oiubByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:oiu8vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pidlqb32.exe

Path C:\Windows\SysWOW64\Pidlqb32.exe
Size 923KB
SHA256 b232205f0273f0934b4a7951ba491866e182e1219b25518997ab3adcee6ecdbc
MD5 fdd4412010a19ee91a3c7132fbf860d8
SHA1 ae1961911740ae92b24a0341a2a22e4e21041f2e
SHA512 98ce614cc3d9cf7de864280434e111a0cfdf0a8d81013c8972fece59279e30a9a15207f94d428e182e7075495e1f6b7fbb8cad7c9d5559d5cd3adfac851d0d25
SSDEEP 12288:RpVeSByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:nVeZvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjdpelnc.exe

Path C:\Windows\SysWOW64\Pjdpelnc.exe
Size 923KB
SHA256 c77578a46ff2fad2ba093ce8659a6a0338491c38dadb5420834c6a89e1a0071c
MD5 957213d91b25a635e93038e55de303ca
SHA1 1d8971f6cd6a871ab430d4d6c705073f045debf3
SHA512 2a99d36121648cfe954bbf800f9a62b8df6efc6192f1d4d1da412f09cefac4a663b1166c00eb34142117122851fa7334dc45613e00dad9e024461b599d0dbf2c
SSDEEP 12288:QfLdTvByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:Ed8vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjpfjl32.exe

Path C:\Windows\SysWOW64\Pjpfjl32.exe
Size 923KB
SHA256 f3538f6cbc3d5e641c829d0f52728c0004d7fab0d48dbe42e5e0edb52d1e4c55
MD5 eddad0500669f5fbd6aaf96108e9a0a9
SHA1 697268340eec7f19d3e745905cb5044ce62f459f
SHA512 17cd7c5e10284139ccafb5d16d73ed2382d8af8dbc3bce44df390b9275a4d7c808a0abb4118942fc26708ba26ea09b50ca832daa83fe03cbc3d3dd699e585124
SSDEEP 12288:oPM0WcsByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:sPvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmblagmf.exe

Path C:\Windows\SysWOW64\Pmblagmf.exe
Size 923KB
SHA256 13b956b893f4c21ce52a68c604bf781b4bfede17b3921c6f3b188f952f56f35b
MD5 e775ea62b99a5b021ce238a7913d50b2
SHA1 02babe6a00f7e28dbd83f6dbe88fe35deb1d390a
SHA512 e03054eafa6a31af88d8d5eb95baaf7d8b6fb736113c12485ac57a40091ce0c8445083074047688a979613b1dd5fa07cfbf282b2a6af7c989942c1871d3afdd1
SSDEEP 12288:dl+aByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:dlKvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmlfqh32.exe

Path C:\Windows\SysWOW64\Pmlfqh32.exe
Size 923KB
SHA256 94a14447000dca82b5bd4ae4879a0e9dde06fe9e2e8b0c567f495bf6d95d29bc
MD5 57a924553a165cf4c271e4a0fc765046
SHA1 f03a87207e77b4dafb3d6c159e20f93487299816
SHA512 162d4ddbcbcec3c240877fe94065f59afed7de4c93a3ab8ecae240d08f93fbaf58988246ba013282e539dff2012fc438669f1d8e67536ba9456252088390a1fa
SSDEEP 12288:8lIybG3ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:SBvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmnbfhal.exe

Path C:\Windows\SysWOW64\Pmnbfhal.exe
Size 923KB
SHA256 9a9d9fb1411babbd5395b3ed9dbd4b58292956e0e43fe0a0977fcb2e3725e24d
MD5 b3e8ffa03b770f7aa3317233308c3bf2
SHA1 8afb5aa8dd85ae8c0f691de9f80001626cf10278
SHA512 fd80bf2116e362321b8b4627f3ba327c50a1a73f05805eeadbada805101c83384bf84cfa2ade40ff044e6381c55420947005e890ddce5995c38a5f35ef828d0b
SSDEEP 12288:5vPMkByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:5vPivr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmpolgoi.exe

Path C:\Windows\SysWOW64\Pmpolgoi.exe
Size 923KB
SHA256 eafa9ce979c3fa33ddc32bfc7d3979c36b625ae1bf756bbc3c8101361d846c87
MD5 32bc76a964e2b9ed4e52ccb952fb5cfa
SHA1 e24cac9717d235684ff20f865c6ae081d7261bd2
SHA512 27dcaa6b25444a58ee92a19125cc470a567265eba631e5d728d52e911d54e2ec36d741ff328e9a47a13fbc86174826bebd17810640b05deffe85d36b2ba00624
SSDEEP 12288:1I8ILlKxLByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:SxLTvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppgegd32.exe

Path C:\Windows\SysWOW64\Ppgegd32.exe
Size 923KB
SHA256 7c04e00df87981dd82bb210c9d9f64c817d7b05f94e34e06fc0724c0bd56e9c1
MD5 6e9c6ec919bb24c9d38c9bf8a23235a2
SHA1 76914b58923d4ab5ce49fee2bf92b7c9cb771aee
SHA512 1bc0c2f5ac94288e14e63d9b67669feb3ee929ad51f38ee5d5febd91e5da04c2e2f8f9ba48e569ec4782958a07ab4b509c4e5b25893ee1015f71941bb1e8c70e
SSDEEP 12288:aEG763JByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:4763qvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppjbmc32.exe

Path C:\Windows\SysWOW64\Ppjbmc32.exe
Size 923KB
SHA256 2c4c9f30add8e5e06408316ae7b636245182ffda94c9558253132819c1a3b157
MD5 ff5f40fecbcfe83c92b3f1287152b7ca
SHA1 3655ca9c4f8e8505ffaf42da5130caef2dae8adb
SHA512 40af007b92e9ed10ba1f2e15eb306879c989c4e4a3f94dbb155c859d8bc741c0a53996bae3d19a5dfb513f3618b599e733d7b32438a0ae749c7d029918389130
SSDEEP 12288:Bk9ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:zvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qfkqjmdg.exe

Path C:\Windows\SysWOW64\Qfkqjmdg.exe
Size 923KB
SHA256 aa20bf9de330600ef7dc0716214db865c87300ed56b80bf287672090bb2c8388
MD5 da4743a4cee6375e16d6ea91827b3a6f
SHA1 0c340a70102a44b9f477f82316d68d621e396dce
SHA512 74792107696bf397aacc744eb62a1d553c13de41a96b98032d08068278bd21bdca6cdb9a109fbd1bc0ecca1be1bfc518a23442c9ba74e7eb862ff5521396bc79
SSDEEP 12288:rYzrWWgGByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:raOlvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qfmmplad.exe

Path C:\Windows\SysWOW64\Qfmmplad.exe
Size 923KB
SHA256 addd82f4ef3b4ecd3060085902527030528f8bd77e02524344bd2ec2f0140d40
MD5 fb2a3fed67065b8533d3ebb317c1332f
SHA1 a2d52b746fdae92ed4361242d439759cad1b0957
SHA512 93b79c53bf845305e90a761082cd445965cdf82b7e6e9fb719f98c993d518ff398dcf8fe863d987cf7e477bc08b31790abfe4e917300e955e0a9908f7abdcce8
SSDEEP 12288:ciDZoDRgNVgByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:ci9uRg7/vr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qmgelf32.exe

Path C:\Windows\SysWOW64\Qmgelf32.exe
Size 923KB
SHA256 0d8efeeeba4782e0ec6f647ac65aad1e8b02c919a4e72e471ad605dc4a048917
MD5 758c3c44e854561eea23b07b6dd6fe38
SHA1 8e58d90a473f0de1632afa4e866bd1aae2e49b2e
SHA512 64ef9148b6ab7552bbcc55c7d9f7bb9fec33c3ff1d0044147422b63eb944b5d19256a240a757aac47443efb7f2369b54f2fe17a88f6c10da5ae02c5d4fbb225a
SSDEEP 12288:zvsgByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:zmvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qobhkjdi.exe

Path C:\Windows\SysWOW64\Qobhkjdi.exe
Size 923KB
SHA256 468eff849dc98207ae7eaa359c37ad7ea76c51090e1e9f1359a8a058896d3a8f
MD5 960b3b30f170cc0c0e44a57def9a0497
SHA1 862bbd039428b36f1925b5998da9ce015018bd86
SHA512 70ff82aaf093602086695cf34bf9d8be75e6a2ecb568bc6d0d3be71d50c4eefcf0e0c56c519c0ee1f1b4f761e1ea51bd8cc27035f093ee730293de2a156662c9
SSDEEP 12288:/pdIWByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:4Vvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qpcecb32.exe

Path C:\Windows\SysWOW64\Qpcecb32.exe
Size 923KB
SHA256 7723a081553b2f59628e915ec9c07592526f7a98a9502043e649dfad24bc6360
MD5 93d277583fb3b946e065d4e86824889a
SHA1 2a6c1ab109cec64fd3e28b34aacbead9517a3d41
SHA512 f910e8e9efdcf9221ea07f52d9980df89292028835cba8f11942b7fd9dca40a608cb1b8eb236135f2a92fddce32bac0fd2e65b0a0d31683fce986852b50c1b29
SSDEEP 12288:DzPaByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:DVvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qpeahb32.exe

Path C:\Windows\SysWOW64\Qpeahb32.exe
Size 923KB
SHA256 3fdb5c880dd78d7a7791f4598b93a4e38d81280e1d7eff7541c3897f44c10855
MD5 6148d268342b211469cee9d034e010de
SHA1 a28b9fa5b69ae8bb8407dcee7ae900e5c02b11ce
SHA512 489f7280593844502e2d123ed7f5b9477b0512af5f5bd27c9781cf6522b185a0cd64669349ce92698b579b354a456c4fd19cb9018ebd1531ee3d10af0c19f098
SSDEEP 12288:VWy8ByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5H8:VWyzvr4B9f01ZmQvrUENOVvrc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/184-423-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/324-333-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/372-132-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/428-92-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/464-188-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/468-173-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/876-428-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/928-197-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1000-221-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1028-140-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1072-156-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1148-180-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1156-411-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1180-252-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1252-345-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1308-7-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1308-555-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1416-351-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1556-267-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1632-315-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1736-597-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1836-279-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1840-381-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2060-393-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2176-0-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2176-548-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2184-399-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2208-363-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2224-321-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2256-404-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2280-357-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2336-339-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2360-149-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2372-213-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2436-165-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2516-236-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2564-47-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2564-590-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2616-125-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2756-591-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2796-229-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2840-69-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2936-375-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2944-583-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2944-39-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2952-273-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2980-285-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2992-387-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3000-609-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3000-75-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3276-417-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3392-245-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3472-116-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3644-109-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3648-291-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3788-303-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3848-205-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3904-16-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3904-563-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3908-603-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4168-327-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4192-31-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4192-576-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4268-309-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4292-100-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4360-260-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4368-60-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4380-368-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4584-28-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4904-84-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4928-297-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5136-434-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5172-441-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5208-451-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5248-453-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5288-458-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5348-465-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5380-471-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5424-477-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5464-483-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5504-489-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5544-495-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5584-501-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5624-507-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5664-513-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5704-519-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5744-525-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5784-531-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5824-537-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5864-543-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5904-550-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5948-557-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/5996-564-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6032-570-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6076-577-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/6116-584-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/7296-1534-0x0000000000400000-0x0000000000433000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads