berbew | 27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455N.exe
Size

276KB
MD5

3db136d31ddc20634bdbeef294a54c30
SHA1

aa00bf2fa6db97ec3cd5dc95db1de850131a8c34
SHA256

27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455
SHA512

f3506a3fd10c54deb604bf6642747810264e92a8bb6a8d7fcddd07b88f9d46f48a163348c507e81bd2f321e6d6599b3991799600971ebb148d48ee449c54859f
SSDEEP

3072:+KhyNCq8NQYyMhl63M9XeS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQVDrM8d7w:cNCqwnTXdZMGXF5ahdt3rM8d7TtLa

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caageq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adndoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chiigadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Glgcbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmkigh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjknfnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkjiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lfgipd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekqmhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jilfifme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npepkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpanan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckclhn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbjoeojc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgpfbjlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkjiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnmoijje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndeii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojdgnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndeii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkfadkgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deqcbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kegpifod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpcjgnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ennqfenp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efpomccg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfhgkmpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbphg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fflohaij.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
5008	Akccap32.exe
1980	Ahgcjddh.exe
544	Aoalgn32.exe
4024	Aaohcj32.exe
3576	Adndoe32.exe
1052	Alelqb32.exe
2868	Bochmn32.exe
2212	Bnfihkqm.exe
3584	Bemqih32.exe
1856	Bhkmec32.exe
2616	Bkjiao32.exe
3332	Bnhenj32.exe
1160	Badanigc.exe
2536	Bdbnjdfg.exe
3948	Blielbfi.exe
728	Bklfgo32.exe
4200	Bnkbcj32.exe
3148	Bebjdgmj.exe
376	Bddjpd32.exe
3156	Bllbaa32.exe
5100	Bojomm32.exe
264	Bnmoijje.exe
3828	Bahkih32.exe
3980	Bdgged32.exe
1000	Blnoga32.exe
1616	Bomkcm32.exe
4268	Bakgoh32.exe
2984	Bffcpg32.exe
3768	Bheplb32.exe
2336	Ckclhn32.exe
3224	Coohhlpe.exe
1712	Camddhoi.exe
3160	Cfipef32.exe
3100	Chglab32.exe
4908	Clchbqoo.exe
4384	Coadnlnb.exe
3124	Cfkmkf32.exe
2056	Chiigadc.exe
2996	Cocacl32.exe
1396	Cbbnpg32.exe
432	Chlflabp.exe
4824	Clgbmp32.exe
3088	Cnindhpg.exe
4204	Cfpffeaj.exe
1044	Chnbbqpn.exe
2560	Ckmonl32.exe
2512	Cnkkjh32.exe
4868	Cfbcke32.exe
836	Chqogq32.exe
4252	Dkokcl32.exe
1180	Dokgdkeh.exe
2564	Dbicpfdk.exe
4700	Ddgplado.exe
1292	Dmohno32.exe
4996	Domdjj32.exe
3624	Dbkqfe32.exe
4864	Ddjmba32.exe
748	Dheibpje.exe
412	Dkceokii.exe
4552	Dnbakghm.exe
4944	Dfiildio.exe
4264	Ddligq32.exe
4476	Dkfadkgf.exe
4520	Dndnpf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ibaeen32.exe	Hoeieolb.exe
File created	C:\Windows\SysWOW64\Hccdbf32.dll	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Bnoddcef.exe
File created	C:\Windows\SysWOW64\Bhkmec32.exe	Bemqih32.exe
File created	C:\Windows\SysWOW64\Iikikigb.dll	Cfpffeaj.exe
File created	C:\Windows\SysWOW64\Amlogfel.exe	Aphnnafb.exe
File opened for modification	C:\Windows\SysWOW64\Bkjiao32.exe	Bhkmec32.exe
File created	C:\Windows\SysWOW64\Ncpgam32.dll	Lqhdbm32.exe
File opened for modification	C:\Windows\SysWOW64\Bpdnjple.exe	Bkgeainn.exe
File created	C:\Windows\SysWOW64\Jefjbddd.dll	Jiiicf32.exe
File created	C:\Windows\SysWOW64\Kgdpni32.exe	Komhll32.exe
File created	C:\Windows\SysWOW64\Bphgeo32.exe	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Pipeabep.dll	Caageq32.exe
File created	C:\Windows\SysWOW64\Anoipp32.dll	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Nopfpgip.exe	Nnojho32.exe
File created	C:\Windows\SysWOW64\Nceefd32.exe	Nagiji32.exe
File created	C:\Windows\SysWOW64\Mnegbp32.exe	Mjjkaabc.exe
File created	C:\Windows\SysWOW64\Okehmlqi.dll	Mjaabq32.exe
File created	C:\Windows\SysWOW64\Lpghll32.dll	Oakbehfe.exe
File created	C:\Windows\SysWOW64\Jljbeali.exe	Jilfifme.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Komhll32.exe
File created	C:\Windows\SysWOW64\Pghaae32.dll	Chglab32.exe
File opened for modification	C:\Windows\SysWOW64\Oaifpi32.exe	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Ofmdio32.exe	Oaplqh32.exe
File opened for modification	C:\Windows\SysWOW64\Gihgfk32.exe	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Pmhkafda.dll	Imiehfao.exe
File created	C:\Windows\SysWOW64\Koodbl32.exe	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Jgqjbf32.dll	Mmkdcm32.exe
File created	C:\Windows\SysWOW64\Mfhbga32.exe	Monjjgkb.exe
File created	C:\Windows\SysWOW64\Jfegnkqm.dll	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Gepgfb32.dll	Fmhdkknd.exe
File created	C:\Windows\SysWOW64\Clchbqoo.exe	Chglab32.exe
File opened for modification	C:\Windows\SysWOW64\Dfiildio.exe	Dnbakghm.exe
File opened for modification	C:\Windows\SysWOW64\Imiehfao.exe	Iebngial.exe
File opened for modification	C:\Windows\SysWOW64\Ilqoobdd.exe	Iibccgep.exe
File opened for modification	C:\Windows\SysWOW64\Pfiddm32.exe	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Ahmjjoig.exe	Qodeajbg.exe
File opened for modification	C:\Windows\SysWOW64\Ahmjjoig.exe	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Dnkdmlfj.dll	Amlogfel.exe
File opened for modification	C:\Windows\SysWOW64\Dokgdkeh.exe	Dkokcl32.exe
File created	C:\Windows\SysWOW64\Hipmfjee.exe	Gbeejp32.exe
File created	C:\Windows\SysWOW64\Bhpopokm.dll	Fealin32.exe
File opened for modification	C:\Windows\SysWOW64\Kcpjnjii.exe	Kpanan32.exe
File created	C:\Windows\SysWOW64\Lqhdbm32.exe	Lnjgfb32.exe
File opened for modification	C:\Windows\SysWOW64\Camddhoi.exe	Coohhlpe.exe
File created	C:\Windows\SysWOW64\Dbicpfdk.exe	Dokgdkeh.exe
File opened for modification	C:\Windows\SysWOW64\Monjjgkb.exe	Mjaabq32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgplado.exe	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Gmafajfi.exe	Gejopl32.exe
File created	C:\Windows\SysWOW64\Ehkaqc32.dll	Iebngial.exe
File opened for modification	C:\Windows\SysWOW64\Koodbl32.exe	Knnhjcog.exe
File opened for modification	C:\Windows\SysWOW64\Akblfj32.exe	Aokkahlo.exe
File created	C:\Windows\SysWOW64\Lahoec32.dll	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Fdnnlj32.dll	Cnindhpg.exe
File created	C:\Windows\SysWOW64\Fngcmcfe.exe	Fligqhga.exe
File created	C:\Windows\SysWOW64\Eopjfnlo.dll	Pmiikh32.exe
File opened for modification	C:\Windows\SysWOW64\Bojomm32.exe	Bllbaa32.exe
File created	C:\Windows\SysWOW64\Gpelhd32.exe	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Mjfmcmai.dll	Cnkkjh32.exe
File created	C:\Windows\SysWOW64\Oakbehfe.exe	Onmfimga.exe
File created	C:\Windows\SysWOW64\Nnojho32.exe	Mfhbga32.exe
File created	C:\Windows\SysWOW64\Bgmioggn.dll	Fneggdhg.exe
File created	C:\Windows\SysWOW64\Dibkjmof.dll	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Dijbno32.exe	Dflfac32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	7744	WerFault.exe	420

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imiehfao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpiplm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enbjad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbfcigf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibaeen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgflcifg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjgfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmennnni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fngcmcfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jilfifme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koodbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofmdio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfiddm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbbnpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dndnpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eokqkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fligqhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgphpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebjdgmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmoijje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoheakj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddjpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffceip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkceokii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbbffdlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eejeiocj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmafajfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpnoncim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqmmmmph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoalgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmohno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modgdicm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdenmbkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eppjfgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gehbjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhgkmpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ioolkncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcpjnjii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiokinbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebgpad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqdcnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojdgnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camddhoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbohpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdjinjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkmec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Badanigc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmhdkknd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lobjni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljhnlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ennqfenp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flfkkhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjmba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpfgmnfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clgbmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Domdjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eodolnaf.dll"	Fflohaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cghane32.dll"	Chiigadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heeeiopa.dll"	Chlflabp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdimkqnb.dll"	Jpaekqhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhaljido.dll"	Jphkkpbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Adndoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mioaanec.dll"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hoeieolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojenek32.dll"	Opqofe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Difebl32.dll"	Moipoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjdipap.dll"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilgonc32.dll"	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcbd32.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ombcji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dohjem32.dll"	Kngkqbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppgif32.dll"	Kpanan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpcpel32.dll"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncpgam32.dll"	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Enigke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Johnamkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Doepmnag.dll"	Jniood32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdkac32.dll"	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbikhdcm.dll"	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idaiki32.dll"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iahici32.dll"	Bhkmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fihnomjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhegobpi.dll"	Ilqoobdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dempqa32.dll"	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjaabq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Epmmqheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gppcmeem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaafn32.dll"	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnindhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gepgfb32.dll"	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fiodpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akkeajoj.dll"	Mmmqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nncccnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poigcbng.dll"	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kghfphob.dll"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjmj32.dll"	Kgflcifg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5008	3116	27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455N.exe	83
PID 3116 wrote to memory of 5008	3116	27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455N.exe	83
PID 3116 wrote to memory of 5008	3116	27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455N.exe	83
PID 5008 wrote to memory of 1980	5008	Akccap32.exe	84
PID 5008 wrote to memory of 1980	5008	Akccap32.exe	84
PID 5008 wrote to memory of 1980	5008	Akccap32.exe	84
PID 1980 wrote to memory of 544	1980	Ahgcjddh.exe	85
PID 1980 wrote to memory of 544	1980	Ahgcjddh.exe	85
PID 1980 wrote to memory of 544	1980	Ahgcjddh.exe	85
PID 544 wrote to memory of 4024	544	Aoalgn32.exe	87
PID 544 wrote to memory of 4024	544	Aoalgn32.exe	87
PID 544 wrote to memory of 4024	544	Aoalgn32.exe	87
PID 4024 wrote to memory of 3576	4024	Aaohcj32.exe	88
PID 4024 wrote to memory of 3576	4024	Aaohcj32.exe	88
PID 4024 wrote to memory of 3576	4024	Aaohcj32.exe	88
PID 3576 wrote to memory of 1052	3576	Adndoe32.exe	89
PID 3576 wrote to memory of 1052	3576	Adndoe32.exe	89
PID 3576 wrote to memory of 1052	3576	Adndoe32.exe	89
PID 1052 wrote to memory of 2868	1052	Alelqb32.exe	90
PID 1052 wrote to memory of 2868	1052	Alelqb32.exe	90
PID 1052 wrote to memory of 2868	1052	Alelqb32.exe	90
PID 2868 wrote to memory of 2212	2868	Bochmn32.exe	91
PID 2868 wrote to memory of 2212	2868	Bochmn32.exe	91
PID 2868 wrote to memory of 2212	2868	Bochmn32.exe	91
PID 2212 wrote to memory of 3584	2212	Bnfihkqm.exe	92
PID 2212 wrote to memory of 3584	2212	Bnfihkqm.exe	92
PID 2212 wrote to memory of 3584	2212	Bnfihkqm.exe	92
PID 3584 wrote to memory of 1856	3584	Bemqih32.exe	93
PID 3584 wrote to memory of 1856	3584	Bemqih32.exe	93
PID 3584 wrote to memory of 1856	3584	Bemqih32.exe	93
PID 1856 wrote to memory of 2616	1856	Bhkmec32.exe	94
PID 1856 wrote to memory of 2616	1856	Bhkmec32.exe	94
PID 1856 wrote to memory of 2616	1856	Bhkmec32.exe	94
PID 2616 wrote to memory of 3332	2616	Bkjiao32.exe	95
PID 2616 wrote to memory of 3332	2616	Bkjiao32.exe	95
PID 2616 wrote to memory of 3332	2616	Bkjiao32.exe	95
PID 3332 wrote to memory of 1160	3332	Bnhenj32.exe	96
PID 3332 wrote to memory of 1160	3332	Bnhenj32.exe	96
PID 3332 wrote to memory of 1160	3332	Bnhenj32.exe	96
PID 1160 wrote to memory of 2536	1160	Badanigc.exe	97
PID 1160 wrote to memory of 2536	1160	Badanigc.exe	97
PID 1160 wrote to memory of 2536	1160	Badanigc.exe	97
PID 2536 wrote to memory of 3948	2536	Bdbnjdfg.exe	98
PID 2536 wrote to memory of 3948	2536	Bdbnjdfg.exe	98
PID 2536 wrote to memory of 3948	2536	Bdbnjdfg.exe	98
PID 3948 wrote to memory of 728	3948	Blielbfi.exe	99
PID 3948 wrote to memory of 728	3948	Blielbfi.exe	99
PID 3948 wrote to memory of 728	3948	Blielbfi.exe	99
PID 728 wrote to memory of 4200	728	Bklfgo32.exe	100
PID 728 wrote to memory of 4200	728	Bklfgo32.exe	100
PID 728 wrote to memory of 4200	728	Bklfgo32.exe	100
PID 4200 wrote to memory of 3148	4200	Bnkbcj32.exe	101
PID 4200 wrote to memory of 3148	4200	Bnkbcj32.exe	101
PID 4200 wrote to memory of 3148	4200	Bnkbcj32.exe	101
PID 3148 wrote to memory of 376	3148	Bebjdgmj.exe	102
PID 3148 wrote to memory of 376	3148	Bebjdgmj.exe	102
PID 3148 wrote to memory of 376	3148	Bebjdgmj.exe	102
PID 376 wrote to memory of 3156	376	Bddjpd32.exe	103
PID 376 wrote to memory of 3156	376	Bddjpd32.exe	103
PID 376 wrote to memory of 3156	376	Bddjpd32.exe	103
PID 3156 wrote to memory of 5100	3156	Bllbaa32.exe	104
PID 3156 wrote to memory of 5100	3156	Bllbaa32.exe	104
PID 3156 wrote to memory of 5100	3156	Bllbaa32.exe	104
PID 5100 wrote to memory of 264	5100	Bojomm32.exe	105

C:\Users\Admin\AppData\Local\Temp\27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455N.exe
"C:\Users\Admin\AppData\Local\Temp\27b1953e1f9f16777be54e55694db1a73a9a9b319211222844865cfdd52b4455N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\Akccap32.exe
  C:\Windows\system32\Akccap32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\Ahgcjddh.exe
    C:\Windows\system32\Ahgcjddh.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\Aoalgn32.exe
      C:\Windows\system32\Aoalgn32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4024
      - C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:264
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        24⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        25⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        26⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        27⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        28⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        29⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        30⤵
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3224
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        34⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3100
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        36⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        37⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:448
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        39⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        41⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1396
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:432
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3088
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        47⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        48⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        50⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        51⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1292
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        58⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        60⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:412
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        63⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        64⤵
        Executes dropped EXE
        
        PID:4264
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        66⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        67⤵
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        68⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        70⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:4524
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3716
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        73⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        74⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        75⤵
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        78⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        79⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        81⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        82⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        85⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        86⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        87⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        88⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        89⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        94⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        95⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        97⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        99⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:3732
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        102⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        103⤵
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        105⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3880
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        107⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        108⤵
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        110⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        112⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        114⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        117⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        119⤵
        Modifies registry class
        
        PID:720
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3012
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        121⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        122⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        123⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        124⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        125⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1692
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        127⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        129⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        132⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        136⤵
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4208
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        138⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        140⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        141⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3780
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        143⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        144⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        145⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        146⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        147⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        148⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        149⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        150⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        151⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        153⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        154⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        155⤵
        Drops file in System32 directory
        
        PID:768
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        156⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        158⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        159⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        161⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        163⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        164⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        165⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        167⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        168⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        169⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        171⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        172⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6544
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        174⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        175⤵
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        176⤵
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        177⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        178⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        180⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        182⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        185⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        186⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        187⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        188⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        192⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        193⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6660
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        196⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        197⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        198⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        199⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        200⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        202⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        203⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        204⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        205⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        206⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6760
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        208⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6992
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        210⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        211⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        212⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        213⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        215⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        217⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6800
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        219⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        220⤵
        Drops file in System32 directory
        
        PID:6520
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        221⤵
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        223⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        224⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        225⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        226⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7312
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        228⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        229⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        230⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        231⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7536
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        233⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7580
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        235⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        236⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        237⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        238⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        239⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        240⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        242⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        244⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        245⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        246⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        247⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        249⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        250⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        251⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        253⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        255⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        256⤵
        Drops file in System32 directory
        
        PID:7848
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        257⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        258⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        259⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8144
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        261⤵
        Modifies registry class
        
        PID:7200
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        262⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        264⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        265⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        266⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        267⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        269⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        270⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        271⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        272⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        273⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7124
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        276⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        277⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        278⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        279⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        280⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        281⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        282⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        284⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        287⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8756
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        289⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        290⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        291⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        292⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        293⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8976
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        294⤵
        Drops file in System32 directory
        
        PID:9020
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        295⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        296⤵
        Drops file in System32 directory
        
        PID:9116
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        297⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        298⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        299⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        301⤵
        Modifies registry class
        
        PID:8412
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        302⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        303⤵
        Drops file in System32 directory
        
        PID:8588
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:8680
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        305⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        306⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        308⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        309⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        312⤵
        Drops file in System32 directory
        
        PID:8376
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        313⤵
        System Location Discovery: System Language Discovery
        
        PID:8544
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        314⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8744
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        316⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        317⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9032
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        319⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:8160
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        322⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8704
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        324⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        325⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:9112
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        327⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        328⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        329⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        330⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:7744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7744 -s 420
        332⤵
        Program crash
        
        PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7744 -ip 7744
1⤵
PID:1928

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:7752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaohcj32.exe

Filesize
276KB

MD5
fe4419633ffb8e8817a8005cb57e49b0

SHA1
f23ab2d524293a27abc218fab48a3ba98d082092

SHA256
b7170055d961d748b1f23716e611347ab52901dd69e45be623a0a0d4b775876c

SHA512
2ba1e290c87652a530e809414c7c95a9cc357c14192204f0e72748b15a60565955aef27cc8c0632ad429c6d1e242e68416a7f216e6a326b6206243f041827b5a

Download Submit
C:\Windows\SysWOW64\Adndoe32.exe

Filesize
276KB

MD5
969b8baf82827ef1944112baaa61b234

SHA1
b889ee8fa5c41beb3399662310c0588a7d9aa3e5

SHA256
9a49b0f59a179886ce7c0811fb5bd9e03abfd2737d4e44b3e375ed98c1530c7a

SHA512
5ca860a8818cd591bc31b8329e69641585d21c0aef11de12fa36bdd6cc6ca1d3cc069c7b16de989e639ee96e4c3d3a588047da158a5f2611ae5c164ec1966a40

Download Submit
C:\Windows\SysWOW64\Ahgcjddh.exe

Filesize
276KB

MD5
58ef57215a42fd84de0e5bb9d502f56a

SHA1
f7e9efd1d3b9c489f4b55421872b7d7513249ce0

SHA256
a25184a8db3b738fd5194e760483889f5dc7f35ecb2737d26bdb65dfae2e6a58

SHA512
25ff14f0571fb1c776af67b3f36c45a43178034ff21e66e9a54c9fd1aca75d9e34c4466c1d1d85c7f8a4b8cffdcb54f0ee3e3421adf87b5ea691ee82e8038098

Download Submit
C:\Windows\SysWOW64\Ahmjjoig.exe

Filesize
276KB

MD5
8e1b07a10e87fd1c68599a27d4a4539f

SHA1
de8b1ac0b82d35adafa66e2fe7c62cd519bafc16

SHA256
2c0c8dd58de3d2804d0160a7eb456afbc903302af676ef80f2cc94cf9f9ca63a

SHA512
5d00424c5e04633103b25738fbfc9933f4bd6b8b1736fdd6838d5e37e20d5be3ca455a46423ac114e2c988c80cf2ae7a6add067c209182fcb5b460ab661befbb

Download Submit
C:\Windows\SysWOW64\Akccap32.exe

Filesize
276KB

MD5
f4a93687e2691f8180944fea2c634052

SHA1
89a37349760431ff7d143cf573d5cd9683ddc042

SHA256
e2e3e6e9210b23bb4543a646b82a23007e19a8f7031a102d04021f6e56348b35

SHA512
62e09dd53621161cb6c746e43185642e6a4b52b9f549ce7d3565976ab4eb8748f52ec4176f97a8f797675e24aa767759fd6bfe42de5d4544777c61038ef10592

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
276KB

MD5
7b33a501543f47f0b8061999b6c0ab93

SHA1
bd805793661afc2b7fad206b2494e3204fb63a1f

SHA256
8e6cbe9714e6f331e5d8da87f33ca8e15097d87675e697f33d28f8a720346c01

SHA512
3824f561d97864cfabab6fc09f36759c2d5fa426d37c0cb448412402e3dc86a410c775c065f1c5f111cfd92c552462b1bea2f9935f6d3698c80e6fe51d3e276b

Download Submit
C:\Windows\SysWOW64\Aoalgn32.exe

Filesize
276KB

MD5
37321424f373fec20e0a6070e4f0a1aa

SHA1
1e3b7f1e00bed6ea5315d07e067e0196606938d7

SHA256
23cdfacbad3129a84b171b2d863ab01f563a8329fd997608860cba74084fe0ea

SHA512
0d7189d6a11d2af56489fb000aad39b675758a2725b41aa39b6d8e30dfc15c1eb2afddfb4ca265b3d6e81e0b5adb7a487af2130915432fda931813875aa2f0ff

Download Submit
C:\Windows\SysWOW64\Badanigc.exe

Filesize
276KB

MD5
37f2f81203ef5ad456665f6b6b787266

SHA1
0da7c248ce22ab6481bd915bc9697623325a83bd

SHA256
455c8e6dc03c68c735abbf1d2934e93b19118aeaa7d1b3bdda631e12e1937787

SHA512
62168c3d36846c6a2cdda5f310198f4d8fe0c8619d7ff6d3725c8da7c14d8a18df05b3884b7e5e0149d1ed1618d2d0a0fb9b4def4721264423cd58537f2860f4

Download Submit
C:\Windows\SysWOW64\Bahkih32.exe

Filesize
276KB

MD5
4c6de414779432882c3f165d0c22fe91

SHA1
7adbf25b3d30ce9dfec375db7bfb5d5acd76ed2c

SHA256
f4f70fb967506e847d946aa3a1b6b5b968f9bcb8e4140d18e50d80ec91b89941

SHA512
7c90be902444645de7fe5d38c47a87b33fcdaed77e87f850db90fc418a1459b5d6fc0b491fbe942e7e26e2ccb685d7943c24979b72eaa9c9d9030c549bf21f94

Download Submit
C:\Windows\SysWOW64\Bakgoh32.exe

Filesize
276KB

MD5
f619f1644968373926d66d123ee3bfd6

SHA1
96653a01198ace83996273d9e7ac109490c88e53

SHA256
533d9ee767faf8eedd45a179f4191dbea03a3b16b22942dfb9af829dce2369fb

SHA512
b33cc14eb43094c52d59973b8f7ac0b1795fa5f3973fc2660820b61b29418a82c41306804e7161935c20914a4f83428348de18683612eb62efcf66a8f128f5a9

Download Submit
C:\Windows\SysWOW64\Bdbnjdfg.exe

Filesize
276KB

MD5
5212bf23a4f6aa1d2e9632d2d474167d

SHA1
9af52fb01fdd2476cf787fb61788e401a993de76

SHA256
02ead513aa4f857ecc79a0e52ceb06e8d58ae882c7d83c87161ca78d45004177

SHA512
86047bb5ac76f6c753072b6a3f38f01c9702e57ce90249b66e0e1b85f78b61f11299a100ef0d832b2c20601efe3c9b47b2054abf7933b08144e5a55ec106758d

Download Submit
C:\Windows\SysWOW64\Bddjpd32.exe

Filesize
276KB

MD5
a23b1bc9a955b5dbb32637b2b840fcbb

SHA1
50b41ef5a79116bd3ecfa390682b71a35b7c779d

SHA256
9ed20c0f5236659330722aa0a559253929072876adf6cd0ca5416f48211fc96a

SHA512
243aa2ce8e2b38ce061ce3239dda05dd02924ecab5702bf25c58050cbf386ebfcdef8271d4e175bbbc91d6ec72ecbed2a148d7c99f9c0d497e061ed18c86e776

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
276KB

MD5
d3182ce39a06d9b5ae96752c8ded5b77

SHA1
ec2e9b11e848189c52a78ab62420553828ae8921

SHA256
e6caf06ffeb39f3ad46928db083c61b9a59942828559be4cd940fadbf5cce3d1

SHA512
74f4dd2b1179c67cbdae6ef81cf487b002a6de6616b77922790fde7d7b57fc254998d070cf005fafe02a798e58a8bc4852977316f74e919ca5890fb7a427fead

Download Submit
C:\Windows\SysWOW64\Bebjdgmj.exe

Filesize
276KB

MD5
ab20c2be404156b7728f6df404ca3b2d

SHA1
72619aa2db57882b21c72d3b3940314132c7eaeb

SHA256
f134486b6b71cbd9cbbfd072c32a5a5083be81d5563ddd51b4ed83971d14ad3a

SHA512
c4d70bd150eded62796790c20c079cc4d178bccd58e99085a05bc888b4da8e17779d960995a50d6c16b4809886f24500e48d0645df40cff9a0db2746b3a642e3

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
276KB

MD5
3db177bb70c5a94e20b705775fb799fd

SHA1
59a9f840301bf2304c9d345a49db9458e9b04d15

SHA256
ee598c88e9f4129436efc9b6182fa3fb9eb2e8f6c623e0cc69fc75b087ffb2dc

SHA512
4746c69584349798b12b9b38c966de2f9b11f790fdfdb3b99de4030839894d0852f5003e243611d75c82d9961aeb852b63ade0bc7a80cdf9dd549c345ce60038

Download Submit
C:\Windows\SysWOW64\Bffcpg32.exe

Filesize
276KB

MD5
ce84a945ebb736d31f956ba2fbf674f5

SHA1
44cccd8b6127caaa1ad7994e6b34b7025d7f2e38

SHA256
016c687750892b1045b5a7436ee7b1d55c6eb7667dd5705fd427a6dbc04d709f

SHA512
044c4ec9bf1f3a6fd5e8386a39cde11ec976fbeb7988e8e9222e265da98e1feb108f4daa4ed5ea342fae1d476327587bcde08c4c8e4b77f27972edf876e43508

Download Submit
C:\Windows\SysWOW64\Bheplb32.exe

Filesize
276KB

MD5
628e65f8c94022b8dd48d622f5c7ec8f

SHA1
b710960e9c3506fa27a49c18a5a5bcfd1dad7db8

SHA256
0f18d98b43723a9ab8d41ed2871c801a4107cf52b8fe291c28ec5fba37d4c711

SHA512
f1203f3861b223421eda739590861d429a475d23ddf2b90272e207a7ef763c8c0885a71e69e5e56b3ed44e34cf5016237b158180fde448cf59147d5795294682

Download Submit
C:\Windows\SysWOW64\Bhkmec32.exe

Filesize
276KB

MD5
ee2bf3d23cba1421d615fedaf01f4f44

SHA1
cc362c13057188545965110daa7f99f54b77a955

SHA256
1b7eb5f466104f3cd29748c5c5e15e5213de11d7d3257555e3a4e81b0f557c30

SHA512
97d8e982e0008fb37529a15f9b9d746a28b4fb05737300db94c2926299d9c414504133223283a3dd958650e8eb6f7eeba0e1db5a8af5b136a741d98069df8007

Download Submit
C:\Windows\SysWOW64\Bkjiao32.exe

Filesize
276KB

MD5
73ad2fb3de9e610ac61e779421587946

SHA1
6aa08c89ae722bcbdf7a7eaa31af24d51a58115e

SHA256
35be177a2c240832dc99a3297a17bf1b68614be7ff44d97a4fa7c5c9b0adb963

SHA512
dd6c3bb135bf1c58ba144228ca2da8b6b0c5534c31706359dcca17d8ad0ac04eb2948c3890884388235c5924425f8f582612c3d43fcc4830bba6877cdcdb0db2

Download Submit
C:\Windows\SysWOW64\Bklfgo32.exe

Filesize
276KB

MD5
75891492da544a4eecd005b9189c20e6

SHA1
bcbc72402efc17e191988fa31d2ec829d27aa134

SHA256
ed33a82cf58046aada5f72791a6b62395a733a2327ca342a2ab219e957e08b27

SHA512
f6fd0b138b751464464cf3d58ff044e0a13d8f48192d5d5b2ed6075230099fe11808fe28d31c595d8b5923440c9cc88b03558446f872d9381f803a84ad0ae559

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
276KB

MD5
252f42ba025152b976c9a5c7d67b4c89

SHA1
90d44814c2d0ab596b5c15dc75a7638afd2b2bf7

SHA256
f6230543ea2fbeaeecc53a8845e7e3d507b2ebd9c1f3a2efa821a622cc2d3794

SHA512
351153390098bfd033dd1b3d58701447ae53a88336d2a099a965e8bc6558fedda288c7b4f8da0229fa527d54510c24b9f26d7a4af3fca9578cde58a13168b629

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
276KB

MD5
05f5e76a5891a09ab6a21d7e82962752

SHA1
f4f779ba56e984a9454b4331f7d49a4ef0c5b8e2

SHA256
085d483cffbffe8b91103b6b95b673c30237dfc6a503eddc63e5520d9a121514

SHA512
607ded376edba16fc37d72521691f0748d8abcc4f99faf7fe01ee26bf9ede5687d52c4043a12d9ff83e885a564f788cc34b267ab2eac608d886461b1b89825fc

Download Submit
C:\Windows\SysWOW64\Blnoga32.exe

Filesize
276KB

MD5
ac4a57353af6f5ac38f96527067fd4de

SHA1
17e5f67860aea14cd92ea94f6e10d13d86ca91f3

SHA256
0eee7b6f787c2e643a5f75685b14d883d2a244caae217b6d463745d587ff9bb2

SHA512
3302403d260b9533e49afa01060ddebc2fa675dcec051a46c7cc9bef5306d9138daa782aeb087f6c404ebd8a4834543700a869cf0c5acc98ce4ce72bc2bf64a6

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
276KB

MD5
f5c1b3ab3296afe2d8deb418046179c5

SHA1
893a05cf7ac18f47c0b8019640a41e74fa9bbe5b

SHA256
fffb7743ab9f38b3960849052d2d3fb23747707d1d15c32b793b1c6fd53f68f2

SHA512
c0ab5868bbe34eb328bcfcabde006dfa8a453930df58a8f9d365b422c23ed1241c139f88a251ea90bdd4354cd988cbfae8b15dd1eefa801154bc0e7e73d4c756

Download Submit
C:\Windows\SysWOW64\Bnfihkqm.exe

Filesize
276KB

MD5
cd50767fd35f9f4d0b092fd284d9527b

SHA1
b5cee029e2a51c163915f375b1f48c028b963e53

SHA256
15b0b51a5eb301ca91b7313633da30cacda5070d908968d72ee038250e1beb16

SHA512
89c246c778994b7234e39e3ee6a369f048c35353e15dcf7c71fd65cdd63b9c1ed6167db716ca3554521b2f2ed8896dcd6d4bd1bf7b9bfe39e43b3947d1661ffe

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
276KB

MD5
ab633eaacace9b76b682774f8b512662

SHA1
8894bcc73fb91f938a35991cbe0b6be4dd0b1011

SHA256
11641f0f85813a9dad43c6d08f4c4b74872bac5b5c2efe73b393124ffe339057

SHA512
96695e9df45903f60bee7f8c38109eb2b81534ba374672191f9231011b70205cbd7373aeb15f13ac957f5d2e473c0b5298ba0e42dd26f4b26baa5f57c06138ac

Download Submit
C:\Windows\SysWOW64\Bnkbcj32.exe

Filesize
276KB

MD5
0af82f7820902cc21916d3c2045d4e3a

SHA1
6c7e46d2cdd843279068056d0567226b13588fca

SHA256
793bd75a87a2322e382774175b64bc50417cca598ecbea298a2e1346e2596887

SHA512
bb4ae1968e3f262169ecf3f465e6df2639fe5021cae5424e4910ab37806b159827df6922441c8c72a1df5c34d05307488c76f0178a738fd4647501d30c435a46

Download Submit
C:\Windows\SysWOW64\Bnmoijje.exe

Filesize
276KB

MD5
9f544711a3287281df704b549cf5a665

SHA1
f9707a55fe66a47ed47218503615f1008905dc12

SHA256
a0d424166e6d3264277fc0e4ff1cedd632739fdb64eff74573f9fc7b648316fc

SHA512
ed4540e795e8649aba636173352da21df0b4eaff878e6d80b83d8b32f2956059dc3c5b4ef7cd74ba434dc1f9c595e565c82c3ebcc8605deca62dd14e0819ef98

Download Submit
C:\Windows\SysWOW64\Bochmn32.exe

Filesize
276KB

MD5
7f6f2ade0f8674dec27a90ec2f5f4404

SHA1
c89016eed0c0071f19578e16c00cf7096b89a2dc

SHA256
96c24235da208c64778017540dae22407d69b5656505790b4a07cd80b885c52b

SHA512
d44a9ab1971bc908bdea63f77fbdced6b361a324cc8975ca40b4295ff839df562436cf1ce1d88f962946cb71003a1cde7fc781419e5e13a63bb411b0ac50ab27

Download Submit
C:\Windows\SysWOW64\Bojomm32.exe

Filesize
276KB

MD5
058d6b53f5da4b60cddd35fcb3ab241b

SHA1
9f7b02542de2c6d6f8260a208b605dddd6f571fb

SHA256
a55c44e052a2e81c3a1897a8a7fb30d861dfd6f4aa00b8bc5d975687b9b0ff9f

SHA512
e342d40290beb3a24826ecbada9db58557ba0cebe267409bf28fbb1b70c07896912791fd2df1179298f8db4ce0c35c82a23555329ffcbff7a419c2c5cbf5970a

Download Submit
C:\Windows\SysWOW64\Bomkcm32.exe

Filesize
276KB

MD5
4a587bc98e95ebbb6542564c4e976aa2

SHA1
ef5f4ab54db4682490594dd0e6e6495b0f962294

SHA256
761db6dd688dad67d41010a04f9012340793d9b529b62024ff4cabd972352ab1

SHA512
59bad93dcddcb5da2a571712b2af1ca50e5d713f9bd8cc9b9c2236cf0c9b355edc21adbaec0b44ad4dbf6aed55fa2f07d93493ffc720fdbb8fcf7054ae122225

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
276KB

MD5
42f6bcbd4783ecd22af9a9b7b6ad1212

SHA1
cf07d72235806004e4f108ca1f9b7e3407a86af2

SHA256
95de487e56215c772fb33e4c16d480c6d3a6ee2a9c3dc6f49820656942cee3b9

SHA512
aca034691a87301065a9ee77a4c25753d44824e85f0bdfe8930555769da4af37a0e266919bd6195fb2368cbda3a31a8ba8507aefa0d736a00180034d5f44be1c

Download Submit
C:\Windows\SysWOW64\Camddhoi.exe

Filesize
276KB

MD5
622e12bc2dcd90c5a5bcedaa60c85a15

SHA1
36b437f0413ddc8f9498e86d3de89700588656fd

SHA256
b4e4504f07b8d804c46fce8ce8262e39553dd28a602f94e84f8757d9731a0f31

SHA512
1ce8905cdec3b9acd264fa997cd41a379795627689bb0a4fbd65b36e1875ac91a679c40e623566b10e43f142908f6c1060abe614f434023dbc340c4148005f26

Download Submit
C:\Windows\SysWOW64\Caojpaij.exe

Filesize
276KB

MD5
0fb9290a033db9d4bcd486e51bbec3a0

SHA1
ac4d0fc17c48dcf61bae23657ada40d8b96edad7

SHA256
31ce0030841d9b03a664267934f88822d64a606171817be1e8234e0e464c589b

SHA512
4a2c6135834ba44a00cb6aabcb2e4248d6ffe02f0d4b819371c4c4210436a14123492b7fcbaaa6b94875cc3eaf85e4a060f784385f9fb93b19a49065bf3b95bf

Download Submit
C:\Windows\SysWOW64\Cggimh32.exe

Filesize
276KB

MD5
72fcbedada48f4ad10301197f9bba568

SHA1
aa970a50ea108f3b6811c90b8a3280eb153a26c1

SHA256
2c06d827f51687392232f1645589bfa3386d77342a0d175cce6aea9e5ebe61b4

SHA512
74725b03ed18d8036b306940d16a41418ab8eb2741fd08ed46d4c846bec0dd14cd36be30eafdcb5f3783cc50d68fb4e13b2ec4d0f311450db1d5735fcc9a17ef

Download Submit
C:\Windows\SysWOW64\Ckclhn32.exe

Filesize
276KB

MD5
2a37a55bbcd0644c590437483626866d

SHA1
3cf615b8e83c36ca33a8665f6ebe3d95e39b4932

SHA256
9d5e8098674396ab8d951657328c1a1af63aca4953b3ecbc212d1b79dbd1e88c

SHA512
98779d6f88e07f4feeb6d8dcd24c20a1f3b8f59b1d8e6caeb6666db25f3a54c85806beb86b8161f9be4a7dd325ad6fdd5648d44594e9e4101fd26f573a5f36ff

Download Submit
C:\Windows\SysWOW64\Coohhlpe.exe

Filesize
276KB

MD5
5214648b478eff056c4c0620fdbcc69c

SHA1
cbcb92098988c12894025b62f5f70149c9dc141b

SHA256
63bae1e5e2bd9ce92a1b43f155cc526b3a8cb165862ff08fe0060484b0393ef8

SHA512
7a4f559086a8b8a044b3c11d443dfc591f2ed3f0930c124a2193f7fd0896ff7fcef93d9487fc5c528184e0f8c820a59d881da4ecf036ce7f0a56a67816c9f69b

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
276KB

MD5
30d85f433aa54a3993fbcd8b934ac73b

SHA1
f080db929d8734da71435882e43f398a63405380

SHA256
8d6e446cc68be252c63d036db8b43b42d43d350cbc5d1f08c269f028d404949e

SHA512
1ba978d147751976222f50063e0384b67479d4dc83d817f5b14cb696f9606ce245aceb63c1cb818bb57e02e86f02f8e13bf32f7ac5e831a0c465d1c614f89247

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
276KB

MD5
e5bab7e5cdd311fb26333f2f5ec69e35

SHA1
1803fac367765422b526a5eb3ade05fd21f2177c

SHA256
a694717950933aa045092286b26843aa4f216c68a53924480c017a587bc5b374

SHA512
a03906e7d64d243881f98b5ef272dcda626f09e24ed3fda6a42a48c2512f2a7d66a9645f4caade7592e04bba96d770519c9a95edba08ba4b78b021bb45bf7dde

Download Submit
C:\Windows\SysWOW64\Gikdkj32.exe

Filesize
276KB

MD5
6c62e47f8fe2fb769e8a384de1fb4bc8

SHA1
d3d1eb9faca571b1a68d9861e3e592141d2c0712

SHA256
f942699af152ad14facef2fdc82f21799ed7741564cc1a34fee3964a3523b3d4

SHA512
f113f36655fe82805084268eda01d2edf1bd30ad9fef77942ae54a34cd8427265ea393a3bd7662e943a662f0b7b809355e25c236fbcd43c744282d7cd334024f

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
276KB

MD5
d50ca598435d4bbbdd3cda68012b0d5c

SHA1
a6554c06c2e7f0bf934a483e7102a9b6366e172a

SHA256
3066b5760ef94320f88ab7d3b1f0ec82c98f4c59ca1ddd718a97df50ae880105

SHA512
3e9c33bd652bc78db1df6483e5367645f4cf18f02459fa42def0525c434375583db9edf2f5296c17124b3e375472d290b12c1ccf57ac03cf4a77467b226f59c8

Download Submit
C:\Windows\SysWOW64\Hiipmhmk.exe

Filesize
276KB

MD5
6bfb2d9128f29c62fd23b26a896f2f91

SHA1
00c7d80aac97e348136e28fbba1d96300db902b2

SHA256
b53856f88052d5822373b342db4337c2740c5bbbaa0113d3edf83530ba8d91e8

SHA512
5cc0e6620fbd878a93d713a587c7f2ee56c9d1bf708c2bf91cb6b27a2186f7fbbc08a89b0681debac47ac4f8df401eb20450f87f7b1a2dda0a3a137b8366861c

Download Submit
C:\Windows\SysWOW64\Hqdkac32.dll

Filesize
7KB

MD5
c7d7d5efb24469a4755d9ab619fdbfc2

SHA1
2f3bb5c0dc3b267e8fc4b21c43627c641f068e69

SHA256
983cb69656e8f4d33ada6c34aea72cc732b50c33bcdb934aff06884758becae0

SHA512
012e5c5b603b3a7371da48b736fb249b417ed551c7fb8b0be384de7cff0503240c37f292a786fe8db547fad73c005f19f603ed5233255b39d73f2295b8d184f5

Download Submit
C:\Windows\SysWOW64\Jedccfqg.exe

Filesize
276KB

MD5
2fbc0d243f5a74d83679cc3c72ee0e82

SHA1
b9bc06bd57fefac949588ef0ce54b7239d3ccf4e

SHA256
d2018508ec1a8916db117cba7063104c5cee8b66d3e011f6fc11507c16a2666d

SHA512
f0a7a5cd9932c50df5057170fbd2b57772f36e173194eba0db7d9d8858cb09fa3be5922dd15f7c29f6de990a985da792743e516640fcdf69cfdbb6ff477c03d9

Download Submit
C:\Windows\SysWOW64\Jmbhoeid.exe

Filesize
276KB

MD5
8464c5a140311bd1f1116521bd452aee

SHA1
3fa740c2ab515e0e520e6b044f85f7b51aba9d85

SHA256
718da1a7c2ebec0250e3d2c3d4d62134b6fab34a7b5bee79385202f77e02c857

SHA512
a270fa7ef2a6b75d557f126249ed2239bf86e5c9d259391c2de601cef690205a1804ab6a09b1048fd638d1c0dc84cf1aa5aaee07796536e8c62698e5c9748de0

Download Submit
C:\Windows\SysWOW64\Lpfgmnfp.exe

Filesize
276KB

MD5
c1d6db6178e9f6893e1a72c2d74dcdc6

SHA1
5758b7c25282d4581ec20ad0964efed0a245e914

SHA256
d024a496bb08836f084b9baa269d9b6bf90309735bc039d975ad4b5ae6b12626

SHA512
4101ba07dc6c996d73aa9215669ea4e9a0d7bb8238d36c2dc343abb304d65bb82f1a30fa25dd4663c0eafff6c99e779572360615aa951e9dbbe1be2d5721e648

Download Submit
C:\Windows\SysWOW64\Mcbpjg32.exe

Filesize
276KB

MD5
881a5ade0d9b6e075aae47aece2e046e

SHA1
dd8488d19d7c09f9262a8ec7e62801ef42ddfe46

SHA256
4603df1c0ed2b732fa7eb8e8235e08b947e3de7e9582716d361acbd14f2229c2

SHA512
cc10a69047aa1710c8879e893d9b4a9ef18119544b6357fd9b66d06ade89a7d275db26a429d6b93187280e935f2f5de6983eb578503e97935abe29878fe33c07

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
276KB

MD5
cc3b55b2e29e08dd9a8726c94b966008

SHA1
977402fd92adf9d4c3210467ea60258fa1cb6784

SHA256
21b3116c23c0d446b19bc5a5ec741af45eb6e9608b9b59e0b2185d006ccaf374

SHA512
3095649c86e9271196886143c4398da582949c0606b6fcd65fb1b7c49f825c74a987e4f157f15c78e37546f0e2ff2d34b8041d03829c222d0843352534eb7c0d

Download Submit
C:\Windows\SysWOW64\Pnplfj32.exe

Filesize
276KB

MD5
e7708f991bad98e2785de9dcb74e13fa

SHA1
ce5ffd0f6e1cde20fb7a54af13cf66d575bc040f

SHA256
7a4fd06e393d1dffb03af68c09506a50bf1b6cc01747ca822a7c9ee2f5bd3097

SHA512
6b118782c5d059f14d5390fbc8ed853570807dcc8cd50f5359aebd0ab64d8dc0486609cdece183e41597f65f912d04dd18ec042f8e97a056c364c85c96aada8c

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
276KB

MD5
69a545c0ef092d80cca64464193b3bfe

SHA1
eae8f09011a5e651f32f905181900cfc8a6cfa96

SHA256
3ae3e74634137c05eb13502b3f23c2cbf3e2c9046e22b1bcc9816c757e74cc9a

SHA512
460f3cd3ef5c11d4dc8b308e811034061792142b2eeb3c309c27f9b1d55d1f816cf225d56903a3e2ea86f165cdc784737b1a10b3186c687b2114dd40236fb1ff

Download Submit
C:\Windows\SysWOW64\Qjfmkk32.exe

Filesize
276KB

MD5
6b4237346e5d51cc967d8683630e105e

SHA1
32a477415f4a5c8e79d5e6908258722bfb1df8c9

SHA256
428e0beff17024dd2315aeb0427acaeacac128c3f03ef6bddf53e85ad7513442

SHA512
480a1db7acb5ec783ebf766bce7f2d8b3952bcb8d8eae75a649cfea00a912e6dc281ac628bfcefc138216b929b59fdf535670a1aca95b9ed5dddee94870457dc

Download Submit
memory/264-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/376-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/412-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/448-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/544-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/552-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/728-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/748-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/836-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1044-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1052-52-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1160-109-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1180-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1396-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1616-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1856-84-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1980-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1980-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2056-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2212-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2512-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2536-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2560-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2564-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-92-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-60-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2984-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3100-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3116-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3116-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3124-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3148-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3156-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3224-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3332-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3576-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3584-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3624-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3716-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3768-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3828-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3948-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4024-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4072-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4200-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4204-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4264-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4268-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4520-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4524-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4700-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4824-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4864-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4868-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4944-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5008-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5008-550-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5044-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-173-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5140-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5180-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5220-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5260-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5300-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5340-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5380-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5428-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5468-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5512-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5552-577-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5592-583-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5632-589-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5672-595-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5712-601-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5752-607-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5792-613-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5832-619-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8852-2249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8864-2214-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9008-2213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads