berbew | 5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2024, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe
Size

67KB
MD5

deea133b5f16328d2013f3de3088a6f2
SHA1

4cf3685553687881eac66e725d81cbebcde3952a
SHA256

5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6
SHA512

69d3d558b9c4521fbba9c5449d9785e6fdf430365d1cff47b13f45f073662a6b8ce297bb7ba76a6194daaf23dd6c0b603d6f26a93eeac60fc6f7040344401421
SSDEEP

768:5D/J1DXKvwrafdyA4aIVUz4bfyzrCsR6RdUqRN0TyZWNufX/1H5rxBEVErME/fe8:9JgvwcQV7yRAhHBsJifTduD4oTxw

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neafjdkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qikgco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omegjomb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmkdcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnpofnhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mblcnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmhlgmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebkbbmqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehpadhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knflpoqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neqopnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adikdfna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akglloai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndgfpbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aomifecf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebdcld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkmomfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aagdnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdedak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koajmepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abjmkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjaqpbkh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmlneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidhlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdjbiheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Loofnccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phhhhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kndojobi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aomifecf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omjpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miomdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nefped32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccdnjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glldgljg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acmobchj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnpabe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fofilp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Majjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjahlgpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqlfhjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mebcop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daediilg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idghpmnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akoqpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbofcghl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3544	Lbnngbbn.exe
4804	Llipehgk.exe
208	Mhppji32.exe
5112	Miomdk32.exe
4320	Mefmimif.exe
1372	Mpqkad32.exe
1588	Niklpj32.exe
3636	Nipekiep.exe
3028	Ohgoaehe.exe
5040	Oiihahme.exe
4028	Ocffempp.exe
1492	Phhhhc32.exe
1228	Phlacbfm.exe
3688	Qqhcpo32.exe
1108	Aggegh32.exe
3268	Acpbbi32.exe
2124	Biadeoce.exe
2968	Bjaqpbkh.exe
1960	Cpbbch32.exe
432	Cgndoeag.exe
1936	Cffmfadl.exe
4568	Dmbbhkjf.exe
5056	Dabhdinj.exe
688	Daediilg.exe
1140	Ehcfaboo.exe
3588	Ehfcfb32.exe
1728	Edmclccp.exe
1676	Efmmmn32.exe
2704	Fineoi32.exe
2756	Fmlneg32.exe
612	Fdhcgaic.exe
3932	Gdoihpbk.exe
3464	Gnjjfegi.exe
5104	Hjchaf32.exe
2468	Hdkidohn.exe
1500	Hkgnfhnh.exe
1580	Idbodn32.exe
5088	Idghpmnp.exe
3812	Inainbcn.exe
336	Jdnoplhh.exe
2892	Jqdoem32.exe
4716	Jdedak32.exe
2768	Jbiejoaj.exe
3952	Jnpfop32.exe
2188	Kndojobi.exe
4672	Knflpoqf.exe
5072	Lbgalmej.exe
4364	Lnpofnhk.exe
3976	Lbngllob.exe
4340	Lacdmh32.exe
4516	Mniallpq.exe
3988	Majjng32.exe
4892	Mblcnj32.exe
1800	Nemmoe32.exe
4248	Neafjdkn.exe
1556	Neccpd32.exe
4812	Nefped32.exe
2572	Oidhlb32.exe
4708	Oekiqccc.exe
2888	Okjnnj32.exe
3620	Ohnohn32.exe
4304	Pojcjh32.exe
216	Pkadoiip.exe
664	Poomegpf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gokbgpeg.exe	Fnkfmm32.exe
File created	C:\Windows\SysWOW64\Qdhlclpe.dll	Jllhpkfk.exe
File created	C:\Windows\SysWOW64\Oflmnh32.exe	Obnehj32.exe
File opened for modification	C:\Windows\SysWOW64\Poajkgnc.exe	Poomegpf.exe
File created	C:\Windows\SysWOW64\Dndnpf32.exe	Dmadco32.exe
File opened for modification	C:\Windows\SysWOW64\Cdmfllhn.exe	Cammjakm.exe
File opened for modification	C:\Windows\SysWOW64\Fnbcgn32.exe	Ebkbbmqj.exe
File created	C:\Windows\SysWOW64\Ehfcfb32.exe	Ehcfaboo.exe
File opened for modification	C:\Windows\SysWOW64\Inainbcn.exe	Idghpmnp.exe
File opened for modification	C:\Windows\SysWOW64\Mniallpq.exe	Lacdmh32.exe
File created	C:\Windows\SysWOW64\Hhlpmmgb.dll	Klfaapbl.exe
File opened for modification	C:\Windows\SysWOW64\Lomqcjie.exe	Lcgpni32.exe
File created	C:\Windows\SysWOW64\Gabfbmnl.dll	Mmkdcm32.exe
File created	C:\Windows\SysWOW64\Ehpadhll.exe	Edbiniff.exe
File created	C:\Windows\SysWOW64\Jbiejoaj.exe	Jdedak32.exe
File created	C:\Windows\SysWOW64\Dmeoam32.dll	Kglmio32.exe
File created	C:\Windows\SysWOW64\Qaalblgi.exe	Pmcclm32.exe
File created	C:\Windows\SysWOW64\Lomqcjie.exe	Lcgpni32.exe
File created	C:\Windows\SysWOW64\Dbkjdh32.dll	Qikgco32.exe
File created	C:\Windows\SysWOW64\Jddnfd32.exe	Jdaaaeqg.exe
File created	C:\Windows\SysWOW64\Nldfjqkf.dll	Lacdmh32.exe
File opened for modification	C:\Windows\SysWOW64\Okjnnj32.exe	Oekiqccc.exe
File created	C:\Windows\SysWOW64\Hehhjm32.dll	Pffgom32.exe
File created	C:\Windows\SysWOW64\Anbgamkp.dll	Bmladm32.exe
File created	C:\Windows\SysWOW64\Bhoqeibl.exe	Bkkple32.exe
File created	C:\Windows\SysWOW64\Jdedak32.exe	Jqdoem32.exe
File opened for modification	C:\Windows\SysWOW64\Oacoqnci.exe	Omegjomb.exe
File created	C:\Windows\SysWOW64\Mhoahh32.exe	Mfnhfm32.exe
File created	C:\Windows\SysWOW64\Glqfgdpo.dll	Mfnhfm32.exe
File created	C:\Windows\SysWOW64\Amjmfo32.dll	Jnpfop32.exe
File created	C:\Windows\SysWOW64\Mjaabq32.exe	Mnjqmpgg.exe
File created	C:\Windows\SysWOW64\Gaagdbfm.dll	Ojfcdnjc.exe
File opened for modification	C:\Windows\SysWOW64\Kemooo32.exe	Koajmepf.exe
File created	C:\Windows\SysWOW64\Pfigmnlg.dll	Nckkfp32.exe
File created	C:\Windows\SysWOW64\Lbnngbbn.exe	5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe
File opened for modification	C:\Windows\SysWOW64\Nemmoe32.exe	Mblcnj32.exe
File created	C:\Windows\SysWOW64\Pgapfg32.dll	Cmhigf32.exe
File created	C:\Windows\SysWOW64\Qfglbe32.dll	Lqkgbcff.exe
File opened for modification	C:\Windows\SysWOW64\Ehcfaboo.exe	Daediilg.exe
File opened for modification	C:\Windows\SysWOW64\Cmhigf32.exe	Cbphdn32.exe
File opened for modification	C:\Windows\SysWOW64\Bnmoijje.exe	Bklfgo32.exe
File created	C:\Windows\SysWOW64\Cepjip32.dll	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Helbbkkj.dll	Fnbcgn32.exe
File opened for modification	C:\Windows\SysWOW64\Bckkca32.exe	Bcinna32.exe
File opened for modification	C:\Windows\SysWOW64\Fcniglmb.exe	Eleepoob.exe
File created	C:\Windows\SysWOW64\Opjghl32.dll	Amnlme32.exe
File created	C:\Windows\SysWOW64\Qiiflaoo.exe	Qamago32.exe
File created	C:\Windows\SysWOW64\Bapgdm32.exe	Ajdbac32.exe
File opened for modification	C:\Windows\SysWOW64\Fbcfhibj.exe	Fcniglmb.exe
File opened for modification	C:\Windows\SysWOW64\Ofhknodl.exe	Offnhpfo.exe
File created	C:\Windows\SysWOW64\Koajmepf.exe	Kamjda32.exe
File opened for modification	C:\Windows\SysWOW64\Kamjda32.exe	Klndfj32.exe
File opened for modification	C:\Windows\SysWOW64\Mmkdcm32.exe	Mmhgmmbf.exe
File opened for modification	C:\Windows\SysWOW64\Apodoq32.exe	Amnlme32.exe
File opened for modification	C:\Windows\SysWOW64\Nhmofj32.exe	Nmenca32.exe
File created	C:\Windows\SysWOW64\Plkcijka.dll	Pkadoiip.exe
File created	C:\Windows\SysWOW64\Lhnhajba.exe	Kemooo32.exe
File created	C:\Windows\SysWOW64\Pekihfdc.dll	Jhnojl32.exe
File created	C:\Windows\SysWOW64\Pilehehn.dll	Llipehgk.exe
File created	C:\Windows\SysWOW64\Mblcnj32.exe	Majjng32.exe
File created	C:\Windows\SysWOW64\Pkhnpc32.dll	Neccpd32.exe
File created	C:\Windows\SysWOW64\Nagpeo32.exe	Neqopnhb.exe
File created	C:\Windows\SysWOW64\Bkkple32.exe	Acmobchj.exe
File opened for modification	C:\Windows\SysWOW64\Hlnjbedi.exe	Gojiiafp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7376	7252	WerFault.exe	390

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbbch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oekiqccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjillkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fihnomjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflmnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Poomegpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfheof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnpabe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nagpeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiccje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiihahme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oidhlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phlacbfm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmhigf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebhglj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hehkajig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hemdlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibaeen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebkbbmqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakdbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbcfhibj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpmdfonj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nipekiep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Majjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pojcjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Diccgfpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lopmii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abjmkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmkdcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemooo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllagh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdolgfbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adikdfna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idghpmnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knflpoqf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjkfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cljobphg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifcgion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jljbeali.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmhgmmbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggnadib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmgelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apeknk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacdmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acmobchj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacoqnci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omjpeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqdoem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gojiiafp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ioolkncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpolbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iondqhpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhnhajba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhppji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjaqpbkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmnmgnoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoalgn32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amjillkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gemkelcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dolmodpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dabhdinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhkilook.dll"	Doccpcja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgapfg32.dll"	Cmhigf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epopbo32.dll"	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aijqqd32.dll"	Hmmfmhll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjlopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqdoem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oekiqccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpecpo32.dll"	Kamjda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkiebg32.dll"	Fdhcgaic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idghpmnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmkmjjaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baepolni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mblcnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kglmio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiiicf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhoahh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omjpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkhapk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npgmpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphihiif.dll"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iimcma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kemooo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpqkad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckdpoji.dll"	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiebgmkm.dll"	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpmomo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qiiflaoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Migidc32.dll"	Gdoihpbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bomkcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oidalg32.dll"	Dmadco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnbcgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhanngbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaiemli.dll"	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apeknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldklgegb.dll"	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efmmmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjknojbk.dll"	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occgpjdk.dll"	Hdjbiheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikgbdnie.dll"	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnlecmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifomef32.dll"	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpplna32.dll"	Bjaqpbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfbhmo32.dll"	Akglloai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fihnomjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daqfhf32.dll"	Ckdkhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acpbbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlepppi.dll"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehpadhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifffn32.dll"	Hhfpbpdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbgalmej.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3544	2896	5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe	83
PID 2896 wrote to memory of 3544	2896	5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe	83
PID 2896 wrote to memory of 3544	2896	5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe	83
PID 3544 wrote to memory of 4804	3544	Lbnngbbn.exe	84
PID 3544 wrote to memory of 4804	3544	Lbnngbbn.exe	84
PID 3544 wrote to memory of 4804	3544	Lbnngbbn.exe	84
PID 4804 wrote to memory of 208	4804	Llipehgk.exe	85
PID 4804 wrote to memory of 208	4804	Llipehgk.exe	85
PID 4804 wrote to memory of 208	4804	Llipehgk.exe	85
PID 208 wrote to memory of 5112	208	Mhppji32.exe	86
PID 208 wrote to memory of 5112	208	Mhppji32.exe	86
PID 208 wrote to memory of 5112	208	Mhppji32.exe	86
PID 5112 wrote to memory of 4320	5112	Miomdk32.exe	87
PID 5112 wrote to memory of 4320	5112	Miomdk32.exe	87
PID 5112 wrote to memory of 4320	5112	Miomdk32.exe	87
PID 4320 wrote to memory of 1372	4320	Mefmimif.exe	88
PID 4320 wrote to memory of 1372	4320	Mefmimif.exe	88
PID 4320 wrote to memory of 1372	4320	Mefmimif.exe	88
PID 1372 wrote to memory of 1588	1372	Mpqkad32.exe	89
PID 1372 wrote to memory of 1588	1372	Mpqkad32.exe	89
PID 1372 wrote to memory of 1588	1372	Mpqkad32.exe	89
PID 1588 wrote to memory of 3636	1588	Niklpj32.exe	90
PID 1588 wrote to memory of 3636	1588	Niklpj32.exe	90
PID 1588 wrote to memory of 3636	1588	Niklpj32.exe	90
PID 3636 wrote to memory of 3028	3636	Nipekiep.exe	91
PID 3636 wrote to memory of 3028	3636	Nipekiep.exe	91
PID 3636 wrote to memory of 3028	3636	Nipekiep.exe	91
PID 3028 wrote to memory of 5040	3028	Ohgoaehe.exe	92
PID 3028 wrote to memory of 5040	3028	Ohgoaehe.exe	92
PID 3028 wrote to memory of 5040	3028	Ohgoaehe.exe	92
PID 5040 wrote to memory of 4028	5040	Oiihahme.exe	93
PID 5040 wrote to memory of 4028	5040	Oiihahme.exe	93
PID 5040 wrote to memory of 4028	5040	Oiihahme.exe	93
PID 4028 wrote to memory of 1492	4028	Ocffempp.exe	94
PID 4028 wrote to memory of 1492	4028	Ocffempp.exe	94
PID 4028 wrote to memory of 1492	4028	Ocffempp.exe	94
PID 1492 wrote to memory of 1228	1492	Phhhhc32.exe	95
PID 1492 wrote to memory of 1228	1492	Phhhhc32.exe	95
PID 1492 wrote to memory of 1228	1492	Phhhhc32.exe	95
PID 1228 wrote to memory of 3688	1228	Phlacbfm.exe	96
PID 1228 wrote to memory of 3688	1228	Phlacbfm.exe	96
PID 1228 wrote to memory of 3688	1228	Phlacbfm.exe	96
PID 3688 wrote to memory of 1108	3688	Qqhcpo32.exe	97
PID 3688 wrote to memory of 1108	3688	Qqhcpo32.exe	97
PID 3688 wrote to memory of 1108	3688	Qqhcpo32.exe	97
PID 1108 wrote to memory of 3268	1108	Aggegh32.exe	98
PID 1108 wrote to memory of 3268	1108	Aggegh32.exe	98
PID 1108 wrote to memory of 3268	1108	Aggegh32.exe	98
PID 3268 wrote to memory of 2124	3268	Acpbbi32.exe	99
PID 3268 wrote to memory of 2124	3268	Acpbbi32.exe	99
PID 3268 wrote to memory of 2124	3268	Acpbbi32.exe	99
PID 2124 wrote to memory of 2968	2124	Biadeoce.exe	100
PID 2124 wrote to memory of 2968	2124	Biadeoce.exe	100
PID 2124 wrote to memory of 2968	2124	Biadeoce.exe	100
PID 2968 wrote to memory of 1960	2968	Bjaqpbkh.exe	101
PID 2968 wrote to memory of 1960	2968	Bjaqpbkh.exe	101
PID 2968 wrote to memory of 1960	2968	Bjaqpbkh.exe	101
PID 1960 wrote to memory of 432	1960	Cpbbch32.exe	102
PID 1960 wrote to memory of 432	1960	Cpbbch32.exe	102
PID 1960 wrote to memory of 432	1960	Cpbbch32.exe	102
PID 432 wrote to memory of 1936	432	Cgndoeag.exe	103
PID 432 wrote to memory of 1936	432	Cgndoeag.exe	103
PID 432 wrote to memory of 1936	432	Cgndoeag.exe	103
PID 1936 wrote to memory of 4568	1936	Cffmfadl.exe	104

C:\Users\Admin\AppData\Local\Temp\5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe
"C:\Users\Admin\AppData\Local\Temp\5d513f173e4a204ae33a19a8205ae6f629008c7fd489619d564bb43d93a5d3d6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\Lbnngbbn.exe
  C:\Windows\system32\Lbnngbbn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\Llipehgk.exe
    C:\Windows\system32\Llipehgk.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\Mhppji32.exe
      C:\Windows\system32\Mhppji32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
      - C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        23⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:688
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        27⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        28⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        30⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:612
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        34⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        35⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        36⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        37⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        38⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3812
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        41⤵
        Executes dropped EXE
        
        PID:336
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        44⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        50⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        52⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        55⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1556
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        61⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:216
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:664
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        66⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1612
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4868
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1332
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        71⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        73⤵
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        74⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        75⤵
        Drops file in System32 directory
        
        PID:1012
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        76⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        77⤵
        Drops file in System32 directory
        
        PID:892
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4184
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3452
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        81⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        82⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        83⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        85⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        86⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        87⤵
        Drops file in System32 directory
        
        PID:2032
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:3800
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        89⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        90⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4520
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        93⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3980
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        95⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        98⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4064
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        100⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        101⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        102⤵
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        103⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        104⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        106⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        107⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        108⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        110⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4260
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        112⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        113⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        114⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        115⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        123⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        124⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        125⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        129⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        130⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        131⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        132⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        135⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        139⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        141⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        142⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        143⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        144⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        145⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        147⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        149⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        151⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        152⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        153⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        154⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        155⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        156⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        157⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        158⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        159⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        160⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        161⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        162⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        163⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        168⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        169⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        171⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        172⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        174⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        175⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        177⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        179⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        181⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        183⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        185⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        186⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        189⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        190⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6240
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        194⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        196⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        197⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        199⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        200⤵
        Drops file in System32 directory
        
        PID:1132
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        201⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        204⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        205⤵
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        206⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        207⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        209⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        211⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        212⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        213⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        214⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        215⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        216⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        220⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        222⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        223⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        224⤵
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        225⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        226⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1964
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        228⤵
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        229⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        230⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1376
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        234⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        235⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        236⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3644
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4320
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        240⤵
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        241⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        242⤵
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        243⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        244⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        245⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        246⤵
        Modifies registry class
        
        PID:840
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        247⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        248⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        249⤵
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        250⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        252⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        253⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        254⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        255⤵
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        256⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        257⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        259⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:428
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        262⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1976
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        264⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        265⤵
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        266⤵
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        267⤵
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        268⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        269⤵
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4100
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        271⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        272⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        274⤵
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        276⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        277⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        278⤵
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        280⤵
        Drops file in System32 directory
        
        PID:3924
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        281⤵
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        282⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2572
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        283⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2008
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1844
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        286⤵
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        287⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        288⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        289⤵
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        290⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        291⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        292⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        293⤵
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        294⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        296⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        297⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 404
        298⤵
        Program crash
        
        PID:7376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7252 -ip 7252
1⤵
PID:7320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadghn32.exe

Filesize
67KB

MD5
d83b19ef1ac8e587de37030c40db9549

SHA1
b345ae2db6d00ed0abf264f301ad0792677bfaa9

SHA256
4bc133a0f2d9500e32cab9c8c8fe3969bc322d96db7864f63c7fba3cf75017de

SHA512
094e77c816bd65489e6833a3994ef2aa42c820388dcf9972a2f6ffff4840daca8245512a3db33c2cdf42460e47f256aaa188ce30f6316ca770face3a7b9df57c

Download Submit
C:\Windows\SysWOW64\Acpbbi32.exe

Filesize
67KB

MD5
ff1ca09dbb6ea085bdceda85c514eb2c

SHA1
63230f790f4028d080f1debaa9875d3dfdf626d0

SHA256
ea3dca464e55333c6c77454af46161be6080058dc510f27dc858ca35b0cdd54d

SHA512
0009f5c6d15118fb27f9307634bf2182376f4d5216f4ceb99c50f4494ef4105fe0763cbb7c5c43c00c03531e37bb07c30fb5585d732e20d6adf0f6dc3ebeeb55

Download Submit
C:\Windows\SysWOW64\Aggegh32.exe

Filesize
67KB

MD5
bbe61a3752c99d4ab2a05bee7de751eb

SHA1
7518cab408ca5c5d93fd7246d98c05e06d5a76b5

SHA256
90a04e07b68e12ae41cdf595c857f026ed3fc186d7ac253db56044e83f57ee1e

SHA512
365c2910f91b97eeb845db326108eb6983a2d841833bde179b8054b3a76b396e679cb332d7a2a9112e440244a7416dee63ab4d8509a4dba06b3eeb8ca6c806a7

Download Submit
C:\Windows\SysWOW64\Ajdbac32.exe

Filesize
67KB

MD5
657b3e4db830e0ad9c95f65c908b651c

SHA1
fc83962f5e01c171e32e29333ecbc638782101b4

SHA256
28b8dd936f4af4d5b0cd30c4889fd1027d8c2fdf2d3984fe7661bd08310c5fb9

SHA512
512f85904bc689e71ff8dc7dee15c77f90d17a953ae504ea81cc114a1d5fb3d32c63a7b9d5fcd652201991e42ad896e283bc94e20acc27cbb7e18bccddd1d2fa

Download Submit
C:\Windows\SysWOW64\Akglloai.exe

Filesize
67KB

MD5
5977811d85471878daa6b706535ed6e6

SHA1
3dd82458d275fdb429365d29b6b841a58bb5e663

SHA256
9dc4d8611b47fb580e4b50480257a35fe2b4133c20a3c0a8ca1f721a5765d15f

SHA512
22ec9110ac97cd213a3dce3b2a47b0d4f2924ea3bb3cf81e9ecec65fd5e96d10c0cc8ef64eae1ffd983d722f6f58db9606774892b0022efc4f7713e93517a875

Download Submit
C:\Windows\SysWOW64\Baepolni.exe

Filesize
67KB

MD5
c218a8073f356e073f9d70d2bdf4eebc

SHA1
bf8fb788486e1aa899295765d03bef3953dfc74f

SHA256
ef97aed4acb95b225d5175059505021f75a86630ec6e5c7cce01ff4f8e766eb6

SHA512
e4d501d2ed53ef28f2ace66a14a5d9fe4a075b4adca3999ec677d3dbbf755c1882551debecdf813795c3ead5a1b8dca7ba3aa3827f15a178ad4ebee215d0e43d

Download Submit
C:\Windows\SysWOW64\Bhoqeibl.exe

Filesize
67KB

MD5
3a1487940d2139a74b50d18a7e7b232f

SHA1
e1e96a9eb5795c4620e2d0ebca0e4b1d9aac1836

SHA256
4590ec231a6bbadbc599e81f7230923b98d73005fbbdd4b0737915127af0c54a

SHA512
74748062420720e2f9258395c86b4eb691a0b5d81f4669649225fff4f6ac162ce4c8be6ab0d1e8f884050df76865db9fa4b468638a5549e63ee2327ffba25736

Download Submit
C:\Windows\SysWOW64\Biadeoce.exe

Filesize
67KB

MD5
6706e39bf33b3719fecee8c51441acf0

SHA1
2d1bb0cfb285862bb60149f896bca9c507a8a5ea

SHA256
fcbcb76b5b8218b657a70d9628226ca80272494874a04f23bf06fdeedcca4427

SHA512
83cc1b0e3621c8178d1aabc61e07d8529ea4892bae784140df180f4b11b9be5247c94cfff5f7db7c359a8b26ccea4176f75aacc7eb6639bd808705250c1fd2a7

Download Submit
C:\Windows\SysWOW64\Bjaqpbkh.exe

Filesize
67KB

MD5
4ae9c0746d549d9ff7949b3e9d97d23e

SHA1
2c00aa62df93962a03e1e902d0ade9553846efde

SHA256
4a27651601cfcb1b6d7fdf52ff0bc1031b0da2e7f4e11c2e097680d06a430c9b

SHA512
e7589bbf19173868d305df2966a8e2093c626e7a51d464e717efd0456df93f867060be58e143132ff350832e345a140355addb47e89c1568d51e874edbd51e43

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
67KB

MD5
6f91bdf89b0409c8f0a2e02d1ff8b11c

SHA1
83b883fa1935302e1b5e0779372dd33fb4ecfbfd

SHA256
98f4882d51d97a97f3865df4a3f4c14dd1e60decd682c3ff972763b4531b6e23

SHA512
22ff443d6744d43ba0244443e2725b1273113e2b3110664fb35978532401f7e36ddc841b0df5f37142a85e4928a11757fd96df491e84934afcfb437a8fbadd3f

Download Submit
C:\Windows\SysWOW64\Cdlqqcnl.exe

Filesize
67KB

MD5
ee35940f1920ddec21e3eabd99e2097f

SHA1
23e7efcc8f4bb237be8ded0128e9207ff8309262

SHA256
6fd4a9ecb18559420e76c81b36afb6eccbfea559060c4a532fda85b0ceedab5e

SHA512
2eb77026a8ea471499d60220f4e9971b15c7ff03704c58058ade0c08877a1fb3c7f58549050595b731aa8e6aae5cc64a2ae911fe5a75f36cd739a950fef9fa0b

Download Submit
C:\Windows\SysWOW64\Cffmfadl.exe

Filesize
67KB

MD5
d7f7d1f269b96f7abbcea0bacd4c08a0

SHA1
9acfcb55f322b968c832829707e93df974c6284f

SHA256
1042084f14caae1722e7b652ad3d2efd54e91af7aad8b9a50e7f74ee69cb1446

SHA512
32062937147a54a3cfd329166c175e1b7d85191972d3e9b41d97b81decff7f6b4612553645cd255a0bc6edec0b91f5aaf32ada11fd5b4c627f456deb4e92e039

Download Submit
C:\Windows\SysWOW64\Cgndoeag.exe

Filesize
67KB

MD5
d6bcd3d4132f0c6a389dbe0541c3fe1b

SHA1
095442b7846b4926e2a85e2992a2e649c76e3267

SHA256
48fbd4c6208ca576a6a5e59846f7d74fa3574bd42a7da663c95f733db0cc0254

SHA512
70412bbec9de10b8ab8ce6e0d6c3fef319f87cefef85757a87e176fbc204171e749b09b367fc7ef6c3468c6859a1e12112e6aa888659d5556227df4a33d1b25c

Download Submit
C:\Windows\SysWOW64\Cpbbch32.exe

Filesize
67KB

MD5
78d4715d37136b74f3fb55815846a512

SHA1
8c95796018a3f4ef465ddac22c824ed08a78119f

SHA256
c87a014178a0a756c5bba0aca446de999bc0d7bb92c1bf5674935293ce85d2a4

SHA512
92315c6d08a1943c58cfb563de8f9e2748701a12172b435c964fe8ea801e38f89e8c61d28415aa20e8ac96b963d9108d1959c0b7d67a5cb8353c17a13876f6ba

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
67KB

MD5
e0c343154b24bcd4ec4e3783ca2920e3

SHA1
03e8bd43d0e539c23bbab59511a74f4bf2de9126

SHA256
8eff05015421644236008ee6d901d41064782b101f132348645b332d6cfdb9ad

SHA512
4c132eee3ecf04aba18a664b779fefd3fb9001fbe820582d15d2df8e3b24ef4441b437ed2df2f40dd9cc35dd887ad26a2081fc36b5d1143f8f4d66a4233a615a

Download Submit
C:\Windows\SysWOW64\Daediilg.exe

Filesize
67KB

MD5
3d8e6dc746c834dc3641ec5edeee9ad2

SHA1
b19a8be3a978ec9e0fb518dbaef665d25e5e9e7b

SHA256
63b2f39abd7f46c34b4974e9076ed2cf8a53f641eedd35cd4c4f820bb2cc256b

SHA512
ce942073b21b7170c35476511a7bb14f3fdacf44986460fe88bad658f50d92445c002b53b0a3c5c984a33af55a3a9dc50fb4e872a74c91e86ef61490c30b1108

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
67KB

MD5
83f1c6fab2ae6efff00938413394fe9c

SHA1
a7f8bba49c357f62b887e87b3c9589cae26a5407

SHA256
49514f5c0d55ac1e07b307ce9af7c02918ce5962b10c0cccda69b0f96e5bfa14

SHA512
a875ca775bb122045ae9c0b7e3c11b64bb7ec609cd1a989da04bd452a2b8c6016c38f95f8dce1222baaf2ceb179f0ebcd26da3bc8ba61117bfaf049dfd4b5ba2

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
67KB

MD5
4be5d8b773f636181b9b64038342c06d

SHA1
0e24da81f18ecc8d381274805a16178b9fdf03fa

SHA256
526b8b31ffc47e1ea9852316350678d7969c60ce8ecfa1e1063f20a3564bbf53

SHA512
34707a018b100bd13dca9e8348908f387ccbc36b0f17ff8e0fba02f4c380ec21356b00c56893bbf7493f5c45f42f81808ffc8514d98a2c766b908d4a0e1aef1c

Download Submit
C:\Windows\SysWOW64\Diqnjl32.exe

Filesize
67KB

MD5
c6312709a94ec2a5393f2d24c8cb7586

SHA1
7b9f2fea8daaf44482a7a1b6dd9e9a658447b33d

SHA256
74e6e125e86ab5a412b4ce616edc0875c42f2dbe1818b78f86c13495d4e63fc3

SHA512
871186ba91afbcbd482f38e5e00173239547e26208b006160b74bd1cd719a4fb6df9c9f135f993aabb6c213d103610c94504924ddc063a52af607a5e85d790bb

Download Submit
C:\Windows\SysWOW64\Dmbbhkjf.exe

Filesize
67KB

MD5
9309dd6a55d2ddae3f7daf29181c2a85

SHA1
7c3c8762332720197c066d5dbc535f7dfbeb6650

SHA256
3b8650e524a553d2c653cacc96ee3c1fb721f5ef69b85cbaab3986c24d055ac7

SHA512
fa9384886c308e76df21c4f300bde61746b63f902e51a4bf5c3ef7ab107289d8454dd7675884b37c4415b4ba07efcf087989197015149d7127a4efdae48876a4

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
67KB

MD5
fa482c8205436df287ba6b89bef3d92b

SHA1
4064c2738221ec397010973d3c31910d7aee0d11

SHA256
ce43ea6a8c42c236af492eea8a9acf7ae809a659c548ca632e728d8b3c3116de

SHA512
101af111fea96223df5597416aadfb00f5f37a5866e14ac91b3cf28038ff9c5a873b387c83d118c81af2f553b1329a33b88cfbdc84afd2cc333c0d399a501c2a

Download Submit
C:\Windows\SysWOW64\Edmclccp.exe

Filesize
67KB

MD5
b01b0b736af746811f0acf3a9c26a2c7

SHA1
5597c25e736c13e90d6288e135312dfa084dce30

SHA256
d7f862d479055159f28a62b0bbee16f55b3865904bad3b8e6d015f6bce2bbd75

SHA512
c5a77f8f19b188ae9c353d7d836cb36c8d82da259c6e9f759bdd092e1d5d0c8a728e2b8d573003280587d942646ce47d126898d1cbd7a07f2e41fd73ff112935

Download Submit
C:\Windows\SysWOW64\Eehicoel.exe

Filesize
67KB

MD5
8b659b4cd68cccd011995fb69be0c5bf

SHA1
dc3b7b9863496c0d10628dcc360a3b36f688c456

SHA256
43b1ee3f5a9f08af775f5ec0e30da275902b2ad5f22522a7831e7cf13afcaa56

SHA512
f858379d1f7f651dcb40cca205f292ec0a3c4dd6f43eb4606d7dbea027d7631df204ddbaa4a83889d4ba668295ee4af81b9263537ba8202a312b0e2e1dd01dac

Download Submit
C:\Windows\SysWOW64\Efmmmn32.exe

Filesize
67KB

MD5
0c1c81c0f6f97968bf429c99e2064ec8

SHA1
4e074a4f47daa545dbdbf57d1f80c2809cba6732

SHA256
62aa48866c20aa9b117e451ffb9dab68022e8df0860df2f528e4c4f6583619e6

SHA512
e94e2c14367b9198279c30235dbd028fb6c9b20d64d751fa82f77e56fcca442e8ae9ee03bb5faf24de036466a33bdeb77af91b1a3ba56c0e37774c375d53e0de

Download Submit
C:\Windows\SysWOW64\Ehcfaboo.exe

Filesize
67KB

MD5
36003e499d71f63f7b4cbad2d9b57ae2

SHA1
3c12052cfbf106a7ec7dcb1141c8c454948f5b2c

SHA256
805f38cd43d12bebcdd2c9d9e1bbe52ef6edd77da1ed345c9b6db5ce63167e0e

SHA512
8b61b94e4cfc5637ca499c5e6107df142c77fc21304734d830779ecb1d46e00a00145a4f6dd36927244c491c491891b42a93937e934645003ea9aadefc8d904e

Download Submit
C:\Windows\SysWOW64\Ehfcfb32.exe

Filesize
67KB

MD5
fa50346e62fe03b3bc970cf3a3238a10

SHA1
83443317d2ef9b58ccc3d325d1b0dbef69fa877d

SHA256
14b3db47af3823ed5a0af89a0e7b4dc1ad628623bf0ceb67aa38728cb5c4e43a

SHA512
fdb9c1bea4a1fd9e09cefff939c3ee8b3693f008e6be2a5b8404121dc89f86c974447b57417e63596e6a6099081417106ab9642b937e92b7b318d3a7b4865bba

Download Submit
C:\Windows\SysWOW64\Elbhjp32.exe

Filesize
64KB

MD5
b6fe1dbadb78cf44f22f852fd2ba4e8d

SHA1
ae76adc97ff17a0bb22c01d266f29bcb9fc13486

SHA256
5a3c3cf9d65fcbdcf6eba8ff6294a877077b5d6c3f9d44b6fe53fe6c45fccb57

SHA512
73d9c1d4b03d03afa8d80f9d5451ff8879399e0acb032808b203ce411ecd65358de4d549cc9cf81316a67577e016a43dd44d80f4f7ea5c23a4db6808a968b412

Download Submit
C:\Windows\SysWOW64\Fdhcgaic.exe

Filesize
67KB

MD5
7bf1476a9a192b245cb76d63ea81abd9

SHA1
0750573a2539ffbebba37580a10957db8cfd79b0

SHA256
58b288065f04c2e28b70030d4e55a29a2817169fd427adc3651eb38b90b423a8

SHA512
589b2861ee3a195a56439aedc55f4896f7a5bedfc049da4f6516a61d4c1a41679d2db7b94f93b8e439e334fcb63b9c254d999bcfe6427b2c44593fa419d2a203

Download Submit
C:\Windows\SysWOW64\Fineoi32.exe

Filesize
67KB

MD5
e10b1e6f0d9a3d73d7577e362020009f

SHA1
c51bd78b6d4a73624b2aa9865bb9476a9531cc1d

SHA256
d9557e7662d75b03a034e2dd5019934d4533d19386a40e4ca5f9d9e22267de5f

SHA512
88e168255dada6a1924cff4dce219e1ac2b0b1559fda7c0ec83890c711ebb2b250b9a8d685190f0b5b12a431588a1949625abd2ab6cc045d7fa76cc5b5f70f5c

Download Submit
C:\Windows\SysWOW64\Fmlneg32.exe

Filesize
67KB

MD5
ab34c8263d26aca64ed5b36123a94f0c

SHA1
8fb06c02dfba49bd51b710f4cae2f292780762bd

SHA256
f98f39bb3f4a30cf6e332bfbd7c3f72fa2b0157777333a9ad0479582ba8814b4

SHA512
9e705367adb457540769a20a45d879f7d07864ccf6c288a4b5cd4bbcc7ec6796cc82ffc1a49dc9f23aff1717a0e384beec333afed63c8c9188bc01f55e7a0a81

Download Submit
C:\Windows\SysWOW64\Foapaa32.exe

Filesize
67KB

MD5
cd9827bfbc939f0287db17e9e21deb37

SHA1
a9c76e94c14f80274694e0b833409a8986be31c1

SHA256
762d99c574f731a07ec796b68e99f90f2233642442c9693567c99b472a35342f

SHA512
c292392c192b641077405e601396b1cd0ea959cba0d289ed76548ef56c231b430442a9820d9ea4eeff3e8cbc406800fe93801db888d2d8f24d02e99090ed26e8

Download Submit
C:\Windows\SysWOW64\Fofilp32.exe

Filesize
67KB

MD5
e5db137810d357e5b07ce6964f1c0673

SHA1
201ffc602a074ae11ee32cf7c4b78dda1cb2c2f3

SHA256
dd2ff44cf11e10bd7f100aa39409351fd85e74f9a1f836ca8894781b39f3f5ca

SHA512
ee361df1873b21c28e59c9d95b66fefd5695eef9018990ad895b10c3e6f51ee84062fbde8c012e4f95f50a5136b01c6b3572ddccedc08b4d32bb6bdc3c0c087a

Download Submit
C:\Windows\SysWOW64\Gdoihpbk.exe

Filesize
67KB

MD5
b1910dd25b47860006a61f1515428d36

SHA1
9143d36ac2ce074fdf98e3f33767ea9725dc5dcb

SHA256
4f770fda3599e17fade1440f06c74696c7d621572f5a678472a0ee3c7099df46

SHA512
93cc2cc4d11a45a0304b18fd621ac1aec64429bc2c184d41df2602396c666aecfca337931e86161b5f3614e5f6fe960b46608d8e589aedab80bf699a899996af

Download Submit
C:\Windows\SysWOW64\Gokbgpeg.exe

Filesize
67KB

MD5
d7b65d76030fac4acf5e0b0d25812e77

SHA1
df3dd0bd4a537e28b6e99289152f79f7f36c92dc

SHA256
a0e58e9f5dde4355eb751a0cf212552091426836f140c560ef5abcf452aa5e0c

SHA512
22d6d5b5863e36807ba0f9b9e95fc6ab39dbc60730b4b053a072a1a7ff632a062ef31690d6d9759c1b8a255461c45bacd46fe48907353b1d1f120c7d2c51378e

Download Submit
C:\Windows\SysWOW64\Hbgkei32.exe

Filesize
67KB

MD5
8380b4eea365ff4a2ffdbd8a29aa2510

SHA1
8e9b456e6ed76ec6331fb23d4e06dba1eff3c2b7

SHA256
f48ed5edd5ac5be8e503776a372d0786dcae073a3056af7cdc0620245bf54d08

SHA512
1eab0f2a750407fe6932aaa98b0dc629fd787c92cb526677be753ec973c3e5c34df6a565416c73b61717185fd1ee0c5793c09692741bbb19200c3b6231c8a98c

Download Submit
C:\Windows\SysWOW64\Hkgnfhnh.exe

Filesize
67KB

MD5
a960c08528f2b5ddf1409063a75c29a3

SHA1
3b1fff8ed181e5cbe50ca9d08303b22851f3b25b

SHA256
d972b90fd78148689e34b53233bf37ffb31d9f18b01645adc0ec9ee42e4d0095

SHA512
5a04f407d9dcb7b5279140051bc71855dcadc129a3286ff5e2d660bbda6f01c3104535b6426bdd26e0a3380e7f7821f5010d19a89ee787e7037cef57303895e3

Download Submit
C:\Windows\SysWOW64\Iimcma32.exe

Filesize
67KB

MD5
93f2a8073501eb57b856f2c3756a9d4c

SHA1
40528c2cf066169f1d6bfb72ee6ca5d1c1ec9b70

SHA256
dec9a1fb9cd7cb503004ced44f9ac98a86f265e86802b697dd38e580d5dd7da2

SHA512
832d011189f4b2b2c50f1ec0fbaa2851a7ab9cd8b3841d11aa4f233a364e25f6c8f7f2cbc63e1a4cdb1cc7b137a3a27884ded3409b0c86cd8eb6ac49c55e2fff

Download Submit
C:\Windows\SysWOW64\Inainbcn.exe

Filesize
67KB

MD5
4e188d135da0fee71003f67281dab64d

SHA1
01754afa25360b8068d17d0e2cc20324f6bb2772

SHA256
0f075d6ef81984fc99326390ed9f295012c443b0b2c35af193710b806d589b58

SHA512
823941c945a7e1878da543b0177633110da891836872a308bc7ab6cd861f24bdec2284f2bce0e99da96ed92373fcc00a2740ca1df5740dcbdde6eeafd5ea5dec

Download Submit
C:\Windows\SysWOW64\Ipoopgnf.exe

Filesize
67KB

MD5
26aea61b785a2f3139bbb0b70ffa5664

SHA1
85b06c4f53c05552bedd8f526a6e1306b853d00e

SHA256
90570a5d94f24c2f42a129cdc0b3b4102e86beb301a63011d283778ff33de7d2

SHA512
3f341006e6c0c4e6ede71de3cf7037bc2b71c2d5584fae4395d9a03291bff3b6b5b98fe49fcc9df3a81a6727f2a315c3868c5c2b6e800f12ac81215f603a8680

Download Submit
C:\Windows\SysWOW64\Jdedak32.exe

Filesize
67KB

MD5
cfc74f7fe36f43406a4fb733c588f313

SHA1
a5dae0a4f39fcb5c8d4b3990823e51dc2844dfac

SHA256
e6ad801cb4239ca34e53f8bae398b82b3a1f75c80b33dac5b21b7b989e88f424

SHA512
1ed6e7890127fd79763d8efc5edb9d6c5bc0f950ab112d4397aded9310f1f07edf7ad0fed8ae1908f2887476a9c5cae81a3c7c0549f67095692607f97af848d5

Download Submit
C:\Windows\SysWOW64\Jhkbdmbg.exe

Filesize
67KB

MD5
906a99ee38b6eaf458f024271bf5fe3f

SHA1
3523160f0a8f793a27bd21ba9fb1a9a1b5c34bf9

SHA256
d58a36b35a6b33d860cbfc91846387ca900a80f63ce39db16ce744cc56aa4f41

SHA512
3a59ecf26afc5fbded1dddaaa10a64ae56fc44be4e87e89810f5dfd1146a9abf66557790c60c1105c40e6496037e5e3b3eba6d5ea0259a0d894ed2d749457f2a

Download Submit
C:\Windows\SysWOW64\Kemooo32.exe

Filesize
67KB

MD5
de317523ef113f7190401a739a81e048

SHA1
3acb301688daf4785edeb9c72995068350cb1c35

SHA256
b2e796c0b0cb2c349bc3e5ffb55d5479ae821a4fe5415d8fb6242e20e5648dc1

SHA512
605070f239fbfc6302f546fef4617a6ea3eeec610095aea0cf34344b377b41201d6f004ab0425a3d8f9e27100993177de2ecefe7752dfe511212f658979a7e2d

Download Submit
C:\Windows\SysWOW64\Kjccdkki.exe

Filesize
67KB

MD5
e704d7633d4855e13faf18b45bcb380d

SHA1
aa3bf57d959f5f7df057f9696613f96f9c728309

SHA256
9bf3720ffedb86ea738d627170b9e408887e6f0eb4ea936c1797011f976be063

SHA512
0bc888e7f49e678c6f3b61052e17a2da87c02a48bf47a1f91abc8176945dadb7a9806c8d96d4e688d985af781f6698bd87c505b5f84a5cd652a9ec19a94ce55f

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
67KB

MD5
7c9054e43d5ba1c992019a352af9de3b

SHA1
8f62a36304070389a47a00c64dc83f87b237c7e1

SHA256
cbd6e075112707687df9bfb408132d81067fa7e90f5ca04b320e398cb8ba2f09

SHA512
a03edcae8904afd03a51737d3da8f0cd2c14bd2d2b866b6d01b207a46a2fe5f3fffe26c45e3482508a0adcf1a1ce52acc422abff5b965d3b7f00be2d2d780870

Download Submit
C:\Windows\SysWOW64\Lbnngbbn.exe

Filesize
67KB

MD5
b7c825ee16efa178b046d03920518e25

SHA1
7de3c8c8338fddfcdca513ba96ffcc2e3ed34533

SHA256
0233ab23d9fdf71dbc63464ecbaf55cbbd75517d13d04d7cad72bd7e2185bf7b

SHA512
c9e2a6f99c38d29a1dc1e3d354fdb391f1486e4d57a8a514a5490959bbf50f5a0a7fb2a19076cf5ddda0325ec3e3d4fcd52e6a39b5675ce0c245aa34058d800f

Download Submit
C:\Windows\SysWOW64\Ljnlecmp.exe

Filesize
67KB

MD5
ce77de7d814f7a99f4696a950b602d96

SHA1
58e36cd393308062fac4494beb23817ef3f6b7bb

SHA256
1183c5e97ad532731355499d86ebf562f16daff2a1b3c836ec723012894c6200

SHA512
76206cd46abd5cf87adce595fc19acbc50f324b813ae7046156bcbef520ab38fed876c2c0863f9ffd496fd18cd9b41466288125061cd437557fe1bf84c0355b6

Download Submit
C:\Windows\SysWOW64\Llipehgk.exe

Filesize
67KB

MD5
3037ef2233575ee59218252f6cd90aa7

SHA1
87d72c70c50066bf5d75ed4ec258c057dc32e584

SHA256
b2ce7714094ed71ac7b21d693f769d676d54128d0a17a9b907b35b0f6f37496c

SHA512
9f51337a0668946e163cfddd4ed5b3f87f95bb68e6fcb2cf7b63cf80c6c28826faca9e8227edc8fbf792499e90964d5ed87b1e943e536b4ad0d697ec31f7936c

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
67KB

MD5
329e38077b9f0c2104400ba1d36e2c9a

SHA1
b644277b2aedb693dbaeb860cc4b0f0b55640709

SHA256
20d8c5a238672e00d51b6e9006cdcfe37a9a41163b17c0781dbfdc2e0419927b

SHA512
aeb484bc129f04a057e1ccf304648be2f2ca2b4d71c7eed78e8ee72f5ae7eb79f6924d5a3df43703714d7cb20e210560d85bbdd1e5cd699652fc7d45169122c9

Download Submit
C:\Windows\SysWOW64\Lomqcjie.exe

Filesize
67KB

MD5
f793b95511c7156da2c0d018047ec465

SHA1
c6afe5e490894bdba25f461eb44a3d95b93ce4c9

SHA256
acfc364ecf91e38f71d730e8c78baaa59bf13204c44bf71bc7211a8be875d155

SHA512
3441850fea6593101447391c249b108c0b36c026e68fc4b1eed056d653c1c1690eba6939ce0d79106d40cff03698e5ab8ada53208b0a244315e19c47d904cfe0

Download Submit
C:\Windows\SysWOW64\Mefmimif.exe

Filesize
67KB

MD5
9d7d33493e63a28b259432f26ecadd26

SHA1
cd905396f43b8b58c17047d190343eb7b74c2ba6

SHA256
c0b865f3de3f58e63e069c97111094d47e12d016109503de1172a7d5a0c11cae

SHA512
2ea90f99c61f07495c6c88c8c1853fe7185b189305085c8d57e852da0f1d9a5bee8267c8838c17236173b859eb040a9949ded5f91b4e187fabcd5be592c00400

Download Submit
C:\Windows\SysWOW64\Mhppji32.exe

Filesize
67KB

MD5
849921d4cd1eeedf01589aa5187e20cf

SHA1
3a9803aa3673ca15cc0d48eca6c24b6e382aca52

SHA256
16b3fdabbb945ac5f9d971798c5b568719c1535933c38657504f4588afce135d

SHA512
f0ed04f80b0b955c4ec0d69df69aa8aa86a9cd9123df974003d910cd6b1980d033595dc174af4ce236ed3d574f8b950c9f5579c2d0337daee70720279c2579b3

Download Submit
C:\Windows\SysWOW64\Miomdk32.exe

Filesize
67KB

MD5
5ce2f78c79f354cb16415aa4e183fdca

SHA1
24db96003a8340d8ec3e7e40473c910f9c66ab23

SHA256
f26e8994acaac3b451e7bc2e82e1746038dcee3eb2bb7c8270c315f181f9d990

SHA512
7440c12b584ca5000d83fb8cf2144ed38dc275d108319cad7e6a456668b0054cb14e8290442ec565c3dd6041f461e1b0cc8099e83245cf5866de99e4684a790d

Download Submit
C:\Windows\SysWOW64\Mmhgmmbf.exe

Filesize
67KB

MD5
ecd48f0d883358603adf7856914d316e

SHA1
54006f0328ec48f2936f73f866b9453760dfb455

SHA256
bd12a99137e5e6f8b2fe16c2c8b3d4cfdfff288979dc0f88520bc86d934b2a75

SHA512
77b11084011a392d8d74d8fce76bea842ac224503a75dd19dda736262d09b6e398c7bcc9c81a087b974d51b893363bacb8d51b09acc1f278b6a66ea6f7ce193a

Download Submit
C:\Windows\SysWOW64\Mniallpq.exe

Filesize
67KB

MD5
31cb53c559c9be8ec7cfd2ef6957b44f

SHA1
a79f8217496f79438c6def5c6a8b2f9b677c813f

SHA256
b9ff932527f64ceb4d19dac79bd8c680a9c498aa3495b702e4fef68ca32f6d72

SHA512
73db56f76c086a69718220ac6f478b215157c8a351667199c56eec473cd755203eabba3e9bc51719ac955135b5a4dfd0b00352ea15ab5595ec8d77b1dd0481f0

Download Submit
C:\Windows\SysWOW64\Mpqkad32.exe

Filesize
67KB

MD5
4e01aef0df15db5f9ac26d7d60e40aaa

SHA1
8677d0152a20947d087fd24a4983c18baf305f20

SHA256
ba148e99900662407c3d8c9ae2ae8df31de5398182360b1e7220e34e67fb207e

SHA512
63038bc33a19b0323ae6b150c401240ffb55445b62ee2a12d52843312759c5b4a5a464ee098f5b1dca0eb9c2b9c483a15a67e17aa7ba988f0ed99c7e0181d2bd

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
64KB

MD5
c77ab5a932c2bf17c7c909bae31bf996

SHA1
d7401d439d51f42c1c91c6a774e9ebf13a10f52f

SHA256
85ca6daf94684507080848ef88f39bc1251ab39bf6b478bd0f52050842955942

SHA512
a265d90a959f21a72324619ed61ccc224c54e8192acea3e994bac285611dddf3ba948d22ba667fd14c5068be5af11e378c5614724eb2ab69d6335bb3260952bb

Download Submit
C:\Windows\SysWOW64\Niklpj32.exe

Filesize
67KB

MD5
3f4f9ce7218845b99a0be21a0bb34e3c

SHA1
778d9c18a60e4aede988c2f93dfc3322bee54e63

SHA256
2a93a30581d1097abc59bfe33debed1787a1eb00776ba3f26dd46dcba829f11e

SHA512
45d0506a8896809eeafd80522eb8deb089dece8d825b1350b1b0c3be9af0774b0b082f062142c3ae6fbc473fb582fd46e47e179f98c8c54ae652dbb8d989396e

Download Submit
C:\Windows\SysWOW64\Nipekiep.exe

Filesize
67KB

MD5
ac3cfabb2202cea953ce192269e697d8

SHA1
338eafebc89c02b940e38ca34fcb0273caf2e51e

SHA256
3f6f0b573beb110de69cb76d77f02aac264da147c2b69dcac41dfe983e339475

SHA512
4912e96d9fa1f8ca3f2330dadb326190fd6076e5b1c283f5180d08f150bbdae0396228fac0665158f82aa0003725508daf110fc9e39ac703417bf5cda4ba67de

Download Submit
C:\Windows\SysWOW64\Obgohklm.exe

Filesize
67KB

MD5
24faa177b090215580d216c67eeddf7c

SHA1
b1af2cc49951c70f184cfd7b8243b3a991816788

SHA256
22ac5c77914de861014a33b953cde0f372ae902a9509000591033b7efd9223f0

SHA512
0f3b872348f4899f1d0f9255f11d0b9b795e2e4aefbfc7f9456880d62ad4af4b17c2cd7486422089a92e05f7cfec19c827a8c50d7f354f570b80d22456fd4434

Download Submit
C:\Windows\SysWOW64\Ocffempp.exe

Filesize
67KB

MD5
6a3a83246b04540ab3ab1113268bc06d

SHA1
b4e41385d5a41c9ef2abb480f342af30031c1448

SHA256
39f246742ba9fa605a832c7699f84595130729df5ee8c336dc88d8d1eb0b2b5b

SHA512
e442a8c0ec9fadf9de3e5d7059e8367e7c339099f7e7dc318a607fc8bc3c56b8b90843a50855cf2775f40e9fd68ef3148c7a755a8a3c67ef946bfc8c45603315

Download Submit
C:\Windows\SysWOW64\Ohgoaehe.exe

Filesize
67KB

MD5
390eeed4b272f3741a9ff09058084a24

SHA1
470cd190b47e467dc05efeb4be83208d49c423cd

SHA256
b7d63684d79e7abab9126f5803d21922946b37f81bf2deb156c93a745c0cf6e5

SHA512
4dedb5de5cca4e7bf32e5fc6d20921666ce2095182a8d66db39b121a4eccf319f082fac5a9c8ded45f0b2ed4a6aafc17bdaab2a9cb719fa9479c3a325fd4ae0b

Download Submit
C:\Windows\SysWOW64\Oiihahme.exe

Filesize
67KB

MD5
0416f9a46cd34e796dd123329b69f116

SHA1
c6f57fbeb7ec5c5e1a05fd0e04c96e930ff85ca9

SHA256
70f586934f512be44eff1871aea9d62aa22e5de55d5f04ef954ee55354c8b77a

SHA512
8cc195b15c364a686e231ef06b2bc786b8c3dfe85e148fdc3da2417ce45f2f9ea9feb63ee21677f307f3ea110c1f0d90fa71a821a1bb527a513c8886830211f2

Download Submit
C:\Windows\SysWOW64\Ojcpdg32.exe

Filesize
67KB

MD5
0876bc3d8d7f78c361d0e78757f65dde

SHA1
02309aa3656741d9dce7c272176f2854cd9dbb61

SHA256
aa0e4c2c43c83ca57b295c12baf8e4956f8e8a62470591a7f608d4fc753c0c57

SHA512
572ffb3d4222ec48ac08c7fdb0315510f385f3147019c7bc8753340a90326765bcda97888df4a84df9714707e63871f94db504ec0cbed23f7bd44d8ae88a865e

Download Submit
C:\Windows\SysWOW64\Pabblb32.exe

Filesize
67KB

MD5
c698de47d7529eda56f6bf60b784aac3

SHA1
0f1ce59737ba1e11be240be972736566d23d2adf

SHA256
1befcc6890e26db6c35218138bb3cc8309bf94267bf4cc45f90dc4680b1cf470

SHA512
c07c5369c10a65891a66ad172b9a681b9507c132e1cab87d67dd6174379635a3c177e96522fd0edaae32a93057510e85a52cec97c142b1417bb6377f24006219

Download Submit
C:\Windows\SysWOW64\Pakdbp32.exe

Filesize
67KB

MD5
7398568c23f2e2b14163aeb1bfe25308

SHA1
b3e7f043ed1363e2d00911b052600ecf9a6b8a73

SHA256
4faf380cfa23d7cae2d6904d86d4274d00941b1eaaaca8c0d4a0140ed18e1dbc

SHA512
6b5b2b788d2e8679e3ab702d60cfeac8aaf43157d60d5b6c23847ddb4bdb4d5fe69cd289f99d8d172f38e08fec2824e71f5a790e0bbd6c2a1e65db22bf89680a

Download Submit
C:\Windows\SysWOW64\Phhhhc32.exe

Filesize
67KB

MD5
e769177762459a2f6fe71d875e58dffe

SHA1
b21c7c81abe73de1b91a8b95e69d86162a49e519

SHA256
472c0facc4fb1dd958119adaf9033e4e62959a7b6754e93746ce33c4920273d7

SHA512
893cd7fba39759bf1a2b925c01650ad139bf83daaaa86bba777cd4ee32c826bc69e7abf3681c0f147225c8aa73c09b3c858fec918abda85d9ba76d7988077b06

Download Submit
C:\Windows\SysWOW64\Phlacbfm.exe

Filesize
67KB

MD5
63532955a4aeb925f8ea071b9097a6a3

SHA1
b12054edb92b35697d42e7afd6cb305a7120e664

SHA256
f1dedacb0c664ad9059e5cfcb49078cba90404651c51c69e1c46460a1b4c657c

SHA512
39e02dcd09729bc8687b25dd3c3c6478f927337a91aa4e6e779ea88321d08a35085efdb2ed7b82891dfb0df09e9c7fe6a86c1ce6dac196c59885c4627010f147

Download Submit
C:\Windows\SysWOW64\Pmcclm32.exe

Filesize
64KB

MD5
d2c0c376cf6692702446decf4cbf5579

SHA1
978881e07d5314ba45046f722324a1ecfe8ab7cf

SHA256
f3f88a75537bc74b05bc9c67ef203dfa150ae7cf91852a8ab8171e0d8e815b72

SHA512
ada6a8a905c54eeda97a82bd9f320fcf0e49d23a9a6656cfb37fe0f7780d4c4562bc8f9bfb40f69d21c023cee2ca09214b910676623f0fe8381e550d7edb942d

Download Submit
C:\Windows\SysWOW64\Poliea32.exe

Filesize
67KB

MD5
f395c78beec968ba52024a08e7e57eb9

SHA1
52dd81725b7a3e139a81c707d00034f569cd8c18

SHA256
2f3090af3ba08ac50d8384819e63794f425b022290a1468a53ac9ade643c063e

SHA512
2f8b930c43c94e5e7970c25f4bee43980b0beb24993744550223ae8b4262fdfa83df0b4c4bbd1899c6f87cf792c59f93a826f34f4845651919f63c4087a866f0

Download Submit
C:\Windows\SysWOW64\Qiiflaoo.exe

Filesize
67KB

MD5
85ae69312f991edcefaf2402f498d575

SHA1
965e577d76c113c0458f5efb5aabdc84292a7508

SHA256
7f4dfd59baa1baf5769139ac9b38917e3d4a5f3f34a090c22639065519863050

SHA512
c67403d1b2d557848ecfd5de35ce4c7664cdbe08b3e7886094fef19c19aaae0a0ab0acd4c391a45dc2c0c2618b5e2db2ba925cc31efaef3d1d7feaaa82638a2e

Download Submit
C:\Windows\SysWOW64\Qqhcpo32.exe

Filesize
67KB

MD5
7548a58a3ce5d78aa4f2758189461591

SHA1
95c13494982f3304dc044eb232542027a99d557c

SHA256
65935a515a0391b56693086b09b8c6ff40449c495580c9ce405752102e8febe7

SHA512
f861049ba6c6fa302bc3a58b455c0f05235086354563eda3fc71cfa16ebec343e69d6d31318d7471bf99f496f37a843ea0188bdff36ed3aa2c88cd3fb04d4bc1

Download Submit
memory/208-106-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/208-24-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/336-404-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/336-335-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/432-170-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/432-260-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/612-270-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/612-341-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/688-206-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/688-292-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1108-125-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1108-214-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1140-215-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1140-299-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1228-107-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1228-196-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1372-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1372-48-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1492-99-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1492-187-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1500-307-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1500-376-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1580-383-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1580-314-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1588-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1588-143-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1676-243-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1676-320-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1728-313-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1728-234-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1936-179-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1936-269-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1960-251-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1960-161-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2124-233-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2124-144-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2188-370-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2468-369-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2468-300-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2704-327-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2704-252-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2756-334-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2756-261-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2768-356-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2892-411-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2892-342-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2896-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2896-79-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2968-152-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2968-242-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3028-160-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3028-71-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3268-224-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3268-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3464-286-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3464-355-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3544-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3544-88-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3588-306-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3588-225-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3636-151-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3636-63-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3688-205-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3688-116-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3812-328-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3812-397-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3932-348-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3932-278-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3952-363-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3976-398-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3988-419-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4028-178-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4028-89-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4320-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4320-124-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4340-405-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4364-391-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4516-412-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4568-188-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4568-277-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4672-377-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4716-418-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4716-349-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4804-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4804-98-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5040-80-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5040-169-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5056-285-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5056-197-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5072-384-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5088-321-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5088-390-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5104-293-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5104-362-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5112-115-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5112-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads