berbew | 38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c.exe
Size

76KB
MD5

cb214f17d08649524f4f9b3a47e3cd41
SHA1

65d71b079a4bd118f23acc8fddaa425178e7e44f
SHA256

38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c
SHA512

cdaac032515acc3ba5ae123a2b413eb87400e8bfe49d45c1e3395db498a89b224bddbcb61b85436aa9844beb8fe818dde97f5dae929ab3f6ffd50f9b4509e420
SSDEEP

1536:QHDO5cPRxutF6TluZ7KxTMLbZsPEqHioQV+/eCeyvCQ:Sa5UxYFol+7CubZqEqHrk+

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ippggbck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liddbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcimkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlaegk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1416	Gcagkdba.exe
460	Gdcdbl32.exe
4448	Gmjlcj32.exe
1796	Gohhpe32.exe
1060	Gbgdlq32.exe
5076	Ghaliknf.exe
3816	Gkoiefmj.exe
2036	Gcfqfc32.exe
3680	Gdhmnlcj.exe
4220	Gmoeoidl.exe
2892	Gcimkc32.exe
536	Gfgjgo32.exe
1948	Hiefcj32.exe
2712	Hopnqdan.exe
3036	Hbnjmp32.exe
4008	Hkfoeega.exe
3348	Hmfkoh32.exe
2312	Hcpclbfa.exe
1768	Himldi32.exe
4692	Hofdacke.exe
3944	Hbeqmoji.exe
928	Hioiji32.exe
640	Hkmefd32.exe
1592	Hcdmga32.exe
4568	Iiaephpc.exe
2960	Ikpaldog.exe
4416	Icgjmapi.exe
5056	Iicbehnq.exe
368	Icifbang.exe
3108	Iejcji32.exe
2800	Ippggbck.exe
2124	Ifjodl32.exe
4564	Imdgqfbd.exe
4284	Ipbdmaah.exe
4188	Ifllil32.exe
4828	Ieolehop.exe
4368	Ilidbbgl.exe
728	Icplcpgo.exe
380	Ibcmom32.exe
852	Jimekgff.exe
4520	Jlkagbej.exe
2140	Jbeidl32.exe
388	Jfaedkdp.exe
4596	Jmknaell.exe
4148	Jlnnmb32.exe
4336	Jfcbjk32.exe
2660	Jmmjgejj.exe
4172	Jplfcpin.exe
3808	Jbjcolha.exe
1920	Jmpgldhg.exe
4184	Jlbgha32.exe
4420	Kikame32.exe
4464	Klimip32.exe
4784	Kbceejpf.exe
1552	Kebbafoj.exe
1020	Kmijbcpl.exe
4620	Kdcbom32.exe
3124	Kfankifm.exe
544	Kmkfhc32.exe
2272	Kpjcdn32.exe
3132	Kbhoqj32.exe
116	Kefkme32.exe
224	Klqcioba.exe
1400	Kdgljmcd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hopnqdan.exe	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Iejcji32.exe	Icifbang.exe
File created	C:\Windows\SysWOW64\Lbabgh32.exe	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Opdghh32.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Fpeohm32.dll	Hbeqmoji.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Djoeni32.dll	Odkjng32.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qmkadgpo.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Ieolehop.exe	Ifllil32.exe
File opened for modification	C:\Windows\SysWOW64\Jlnnmb32.exe	Jmknaell.exe
File created	C:\Windows\SysWOW64\Ihidlk32.dll	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Iphcjp32.dll	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File opened for modification	C:\Windows\SysWOW64\Nggjdc32.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Blfiei32.dll	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Bcebhoii.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Pacghh32.dll	Imdgqfbd.exe
File opened for modification	C:\Windows\SysWOW64\Pdmpje32.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Pdkcde32.exe	Pnakhkol.exe
File created	C:\Windows\SysWOW64\Gokgpogl.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Ogkcpbam.exe	Odmgcgbi.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Icifbang.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Nkenegog.dll	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Olfobjbg.exe	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Onjegled.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Himldi32.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Blleba32.dll	Mpjlklok.exe
File opened for modification	C:\Windows\SysWOW64\Mmpijp32.exe	Mgfqmfde.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Nnlhfn32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Oqhacgdh.exe	Onjegled.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Hopnqdan.exe	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Medgncoe.exe	Mbfkbhpa.exe
File created	C:\Windows\SysWOW64\Fibbmq32.dll	Njqmepik.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Ojgbfocc.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Hkfoeega.exe	Hbnjmp32.exe
File opened for modification	C:\Windows\SysWOW64\Icplcpgo.exe	Ilidbbgl.exe
File opened for modification	C:\Windows\SysWOW64\Kfankifm.exe	Kdcbom32.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Ldjhpl32.exe
File opened for modification	C:\Windows\SysWOW64\Mpjlklok.exe	Medgncoe.exe
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Ogifjcdp.exe
File opened for modification	C:\Windows\SysWOW64\Ojjolnaq.exe	Ogkcpbam.exe
File created	C:\Windows\SysWOW64\Eheqhpfp.dll	Iiaephpc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7536	7440	WerFault.exe	323

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icgjmapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiaephpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnlhfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjolnaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmfkoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgljmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngmgne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbnjmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lboeaifi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpablkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imdgqfbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ligqhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiefcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcpclbfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbfkbhpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpijp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Himldi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iejcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfaedkdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njqmepik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hopnqdan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miifeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbgdlq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kebbafoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laqpgflj.dll"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibcmom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npibja32.dll"	Ilidbbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gdhmnlcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlkhie32.dll"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmcjho32.dll"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcfqfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpabk32.dll"	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnchkk32.dll"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeanii32.dll"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npjebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nngokoej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdpmpdbd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1416	2792	38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c.exe	82
PID 2792 wrote to memory of 1416	2792	38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c.exe	82
PID 2792 wrote to memory of 1416	2792	38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c.exe	82
PID 1416 wrote to memory of 460	1416	Gcagkdba.exe	83
PID 1416 wrote to memory of 460	1416	Gcagkdba.exe	83
PID 1416 wrote to memory of 460	1416	Gcagkdba.exe	83
PID 460 wrote to memory of 4448	460	Gdcdbl32.exe	84
PID 460 wrote to memory of 4448	460	Gdcdbl32.exe	84
PID 460 wrote to memory of 4448	460	Gdcdbl32.exe	84
PID 4448 wrote to memory of 1796	4448	Gmjlcj32.exe	85
PID 4448 wrote to memory of 1796	4448	Gmjlcj32.exe	85
PID 4448 wrote to memory of 1796	4448	Gmjlcj32.exe	85
PID 1796 wrote to memory of 1060	1796	Gohhpe32.exe	86
PID 1796 wrote to memory of 1060	1796	Gohhpe32.exe	86
PID 1796 wrote to memory of 1060	1796	Gohhpe32.exe	86
PID 1060 wrote to memory of 5076	1060	Gbgdlq32.exe	87
PID 1060 wrote to memory of 5076	1060	Gbgdlq32.exe	87
PID 1060 wrote to memory of 5076	1060	Gbgdlq32.exe	87
PID 5076 wrote to memory of 3816	5076	Ghaliknf.exe	88
PID 5076 wrote to memory of 3816	5076	Ghaliknf.exe	88
PID 5076 wrote to memory of 3816	5076	Ghaliknf.exe	88
PID 3816 wrote to memory of 2036	3816	Gkoiefmj.exe	89
PID 3816 wrote to memory of 2036	3816	Gkoiefmj.exe	89
PID 3816 wrote to memory of 2036	3816	Gkoiefmj.exe	89
PID 2036 wrote to memory of 3680	2036	Gcfqfc32.exe	90
PID 2036 wrote to memory of 3680	2036	Gcfqfc32.exe	90
PID 2036 wrote to memory of 3680	2036	Gcfqfc32.exe	90
PID 3680 wrote to memory of 4220	3680	Gdhmnlcj.exe	91
PID 3680 wrote to memory of 4220	3680	Gdhmnlcj.exe	91
PID 3680 wrote to memory of 4220	3680	Gdhmnlcj.exe	91
PID 4220 wrote to memory of 2892	4220	Gmoeoidl.exe	92
PID 4220 wrote to memory of 2892	4220	Gmoeoidl.exe	92
PID 4220 wrote to memory of 2892	4220	Gmoeoidl.exe	92
PID 2892 wrote to memory of 536	2892	Gcimkc32.exe	93
PID 2892 wrote to memory of 536	2892	Gcimkc32.exe	93
PID 2892 wrote to memory of 536	2892	Gcimkc32.exe	93
PID 536 wrote to memory of 1948	536	Gfgjgo32.exe	94
PID 536 wrote to memory of 1948	536	Gfgjgo32.exe	94
PID 536 wrote to memory of 1948	536	Gfgjgo32.exe	94
PID 1948 wrote to memory of 2712	1948	Hiefcj32.exe	95
PID 1948 wrote to memory of 2712	1948	Hiefcj32.exe	95
PID 1948 wrote to memory of 2712	1948	Hiefcj32.exe	95
PID 2712 wrote to memory of 3036	2712	Hopnqdan.exe	96
PID 2712 wrote to memory of 3036	2712	Hopnqdan.exe	96
PID 2712 wrote to memory of 3036	2712	Hopnqdan.exe	96
PID 3036 wrote to memory of 4008	3036	Hbnjmp32.exe	97
PID 3036 wrote to memory of 4008	3036	Hbnjmp32.exe	97
PID 3036 wrote to memory of 4008	3036	Hbnjmp32.exe	97
PID 4008 wrote to memory of 3348	4008	Hkfoeega.exe	98
PID 4008 wrote to memory of 3348	4008	Hkfoeega.exe	98
PID 4008 wrote to memory of 3348	4008	Hkfoeega.exe	98
PID 3348 wrote to memory of 2312	3348	Hmfkoh32.exe	99
PID 3348 wrote to memory of 2312	3348	Hmfkoh32.exe	99
PID 3348 wrote to memory of 2312	3348	Hmfkoh32.exe	99
PID 2312 wrote to memory of 1768	2312	Hcpclbfa.exe	100
PID 2312 wrote to memory of 1768	2312	Hcpclbfa.exe	100
PID 2312 wrote to memory of 1768	2312	Hcpclbfa.exe	100
PID 1768 wrote to memory of 4692	1768	Himldi32.exe	101
PID 1768 wrote to memory of 4692	1768	Himldi32.exe	101
PID 1768 wrote to memory of 4692	1768	Himldi32.exe	101
PID 4692 wrote to memory of 3944	4692	Hofdacke.exe	102
PID 4692 wrote to memory of 3944	4692	Hofdacke.exe	102
PID 4692 wrote to memory of 3944	4692	Hofdacke.exe	102
PID 3944 wrote to memory of 928	3944	Hbeqmoji.exe	103

C:\Users\Admin\AppData\Local\Temp\38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c.exe
"C:\Users\Admin\AppData\Local\Temp\38eb2921f9b8e571d8290428f9041755b65056fd3717c2f5138912a41c881c2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\Gcagkdba.exe
  C:\Windows\system32\Gcagkdba.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\Gdcdbl32.exe
    C:\Windows\system32\Gdcdbl32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Windows\SysWOW64\Gmjlcj32.exe
      C:\Windows\system32\Gmjlcj32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
      - C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:928
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        24⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        25⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2960
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2800
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        35⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4188
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        37⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:728
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        41⤵
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        43⤵
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:388
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        46⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        47⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2660
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3808
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        51⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        54⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        55⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1552
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        57⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4620
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        59⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        60⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2272
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        62⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        63⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        70⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        72⤵
        Modifies registry class
        
        PID:4736
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        74⤵
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        76⤵
        Modifies registry class
        
        PID:4348
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4632
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1788
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        79⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        80⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4240
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        83⤵
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        84⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        86⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        87⤵
        Drops file in System32 directory
        
        PID:4504
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        88⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        89⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        91⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5100
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:4380
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        94⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:4112
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2592
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        97⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        99⤵
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        100⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        101⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        102⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        104⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        105⤵
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        107⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        108⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        109⤵
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        110⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        112⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        113⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        114⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        116⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        119⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        120⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        122⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        123⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        124⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        126⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        128⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        130⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        132⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        135⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        137⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        139⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        140⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        141⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        143⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        145⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        146⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        147⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        150⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        153⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        157⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        158⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        161⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        162⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        165⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        167⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        172⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        173⤵
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        174⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        175⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        176⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        177⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        179⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        180⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6500
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        182⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        183⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        184⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        185⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        187⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6804
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        190⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        192⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        193⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        195⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7148
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        197⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        199⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        200⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        201⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        203⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        204⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        205⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        209⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        210⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        212⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        215⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        216⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        217⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        218⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        220⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        222⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        223⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        225⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        226⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        227⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        228⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        229⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        230⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        233⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        234⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        235⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        236⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        237⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        238⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        239⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        240⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        241⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        243⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 404
        244⤵
        Program crash
        
        PID:7536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7440 -ip 7440
1⤵
PID:7512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
76KB

MD5
d13b26894a82031c8c7210c13e046ae2

SHA1
8ee6d7d649c465b07d878309569576270062236a

SHA256
a32e3c363a4ca9d0e0a803926b19331d6872f12f4651adb80903602d969c209f

SHA512
915c74ecf2045fff27e718ed6ba725e61858f243f5238ee0657c7693fcffcfb02d7121d73a484d08d410d42bb4d3a5b77c917c8391e141655460a9617034f63d

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
76KB

MD5
b5c205ea4323049c8cde0e6e5bd4cf4e

SHA1
2f8253dbbdddd0cd75d7e3be3cee95fef26f84f4

SHA256
957d9eb5c5685f09d0ff971003677ec3c6262679720aa858575cc6a22442acfd

SHA512
1c009999f1c65a2992afead5e5a1541066c7db933ca69d381c31c998747c64cc3320c01a2801b0c7117b4934ea992f4f0f3677e0a5231c3a77720b0b22985a94

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
76KB

MD5
4313aab626dd7441baf4e90101437732

SHA1
06f5abe31a508f42fc8f9cc5165b65362eb283ba

SHA256
d0bcf3b739a42ea1d3bc98308a122de99003c351810661de20809d6e6302b5ea

SHA512
b6c4e8de9db642221d0b3f6e4dc4093b46d7abe9fea1f10797ea45639943c6ce6a3bc237ba33c80c939c48c56ee7e002178a7d12e7a2f52b1c1fe4abacee7836

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
76KB

MD5
a1e896c830eb3234e5e87f7ec20fe8e0

SHA1
ca31470000588cabbb8258c286f11b1d91e148d9

SHA256
7f4000ad9bbb16c53c1576737e75bfe49eb803398fc29a44dfa71c4f270f7747

SHA512
ff4abe0e8531c7d6aa028b90f4e5552fc601a5078f875d24969de2dd1b2c37f0898a82c9c9a7c2c8ea6f908f77341e7506d07ee26d27ed91b3f30afb1ac205ff

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
76KB

MD5
81a0ba8823af489c1e1b163bb2ae808a

SHA1
dfe1d675984fc70853a12fe13b5f7987669fcbd8

SHA256
731e473d931d4f0a8de7c24d474074cd8fb378bd37a635fd4ac3e31183cfb629

SHA512
0572774b31244d87b0f93b40c5aa7b68bd0e2e0e46c384fa924f6b4a478c64bab7fa274054376cd9348dac9c109bcaed5a6568fd051c6f7ae3e592612b0154cb

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
76KB

MD5
a5cf7f977af422cc85e2634edad6a1c5

SHA1
8475e7d1f1e1ed5b60e037b2b5c331f410bebc33

SHA256
2e96b91d56b49a4814ddad74c906e4f3c50bbddc8513e1262a849aeb30124797

SHA512
82e177af81360c4330d7f8849ef328cf36270ca87ec39f3c15e1529665f0c8140e01ca025889b031199202e58ec149ad7c19b80dac8a3f02dd918b8afae234e0

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
76KB

MD5
08343b65307ab3f61d2972992d9c7767

SHA1
1c668e2be850a1668082685801a98843889dd150

SHA256
5edc3333ce71db6ae17eae44b02c366772a597efbcb4a652b010746a8d725a35

SHA512
e81461625568c0a177b9bba93eff51bd2ab83d0e52c0df4775796a615043f8b54c19421fe39a2f7120f1e8a1b9b2e67bded0a613fa5eb5a5e4e823189571bb44

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
76KB

MD5
d2391bc39760ecaff7b8eeef3a6d1d6c

SHA1
8a939df9d2cbe97e58d35184d67be4af345e0e85

SHA256
978cb29a05f577e64209a11baacf68f77560712350c037fe241b3442575d2cea

SHA512
79114e23c3cd90a1cd0c2190174b69c9cfa53be314ed2ec9e9977cfa3951fe89c7114eaab649dfc68289c679fa94266e8b5fe5ab8d7bc44876702b8321f778c1

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
76KB

MD5
80209ca14515cfeaf68f4b28a3de8743

SHA1
8722638c70f0de6c42e47d24bdcc0d12bb864668

SHA256
eeb3fc18e41259469181244c77fdbcadef8d28c46fd3bd014cd6dcf54fe4babf

SHA512
0b9fe98f95beee7c29ddf283878d24302fe93ffef42f902cba60c3a4292d270411c4e14da1a7b0dffa02c3645d488ef70706188f77f818b58b2b924a5ea7945f

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
76KB

MD5
25e48961774a626e057a0fd45bb6ff48

SHA1
44a48cdde0083130cd1d85b9570d0d9a23178d7a

SHA256
8b222f144520644523cb02cf5ef89ebf0bd7e83c361d9681f23fe5e38d477cff

SHA512
bcb1a8bb6cff2f11816ccf37bf7eb8b7a834f7bb033958257b1beddcd86efecbc9e3a768fcd5050c49eec2026ebb2ab3db39c2a7ae9cb619900a2d6bbe3cd2c3

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
76KB

MD5
6461f53dc45f2e074eb35ad55de0ad64

SHA1
589829e94a8401c3aa8d2cf73e3f39e2f5d65ed1

SHA256
a32915b747648a3349b444d90f1f03df5751f5ad419106289e25197ee7ebf84e

SHA512
5751eed3e0c404a23205606ce348d0252010bec49ef84ad1d6975ae58d539ca62b5a16f71a3f41dccaf58d8f8bb3c8d2d578cbfdcfccd636c39cf0ed0a034bcb

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
76KB

MD5
c3eb71d7143da67d00f1476386b53146

SHA1
a02dfcd2678c6b01f9b5b395e0f29653b65c508b

SHA256
b63dc5afe8039e54c205363d9b998cd3ef23dfe596228b48ec2d16ea066f46be

SHA512
5f6616e61bd04992cb0688e3c46baeb8c96ade94767e918cb5d25b9aabe2be3d07a597274e9840fb22e55715d9b89573e64ffe279cd52f2768506193cab72c0c

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
76KB

MD5
f6f19c7667b4f9bb859020c0246212cb

SHA1
42b95f9c80f4255f13aa234704cff07ad6504f8b

SHA256
7be844047603c8f23b4b5376beee59ebc16baacadbd8948985995065d3ce8aec

SHA512
25f74c1913ced9d0c24064af1b5a9ae0739a930333c413a73101685cbf5087c97f41e22eb19688cff686bcb2cf3f795233e7e6173a0268aacc6bb5f1a7d2425e

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
76KB

MD5
c524b0276c868a36899a839d2ee2b398

SHA1
423ef663151347a226b7f888d53c0e55371b2fdc

SHA256
4d9db61a411fd55fba3eace3bb9c1c2769bd2470a3e83f8684ea9317dcd14cb2

SHA512
07b9709fbc93e02496918e7f4eebefd2227c0892e51703ec47ee15bdf72dff5bc92bf8a5653a615530a0e1f4d9c1e7c1181d1dfd8fda1584ee71eb15a734e212

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
76KB

MD5
d270afcc9b1e052f62a2e1b01115c8e3

SHA1
e7d1d8ca036dea785c41c3be0d98498960d06efd

SHA256
5028a8d877a9b044e5ca931e518d73d188a7064a79ade6705921e3aff3188d58

SHA512
32b6f47c5aa4dbc85b6307b85c31399ceeb42dfebb77ac3f3d63522a06ac78506244cb86be147d58250ef073877965b99be01f369c3ab79d47c62bab84f8f5c6

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
76KB

MD5
8fd00f21eb02cae15833f6b2789b8c54

SHA1
cdf368118bc178059a6c353adccc95ac01fd4079

SHA256
89075fda55ebcfa511ab9ab9f3dcb47209d2af727e25332c09865c5246de9b8e

SHA512
0964d3f6f08ad14e9dc45405d3d58df2edafed6198b74da445640fade684edf18099016893461d1932573cd8e462c98f5a2511a6885a37b3c8ed71f05d08131b

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
76KB

MD5
eea4838e26cfa254a89ca896504071ac

SHA1
371736edce23f1d216e3316f251ada47a5e869df

SHA256
71927a4096401b1a8ac452e214d325776b4893b797e974d785009d35d707b183

SHA512
965813f4140da145f0ffd722ed872e758eeb37025b4d0d677fb48e1d9296a6539952f3457c817b4c20d7f4c100fb0d6a720f1b72eebe31cbcd63c73c8c8fc0e2

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
76KB

MD5
096fcda67dc4b041945202b584c0d025

SHA1
291b00728e4fac2c0f9efaa9ba541bafe5843348

SHA256
23bc3c194ad230c5d323d3681a5f324bf4d04a14f65e36ab440abbcad37fc7ff

SHA512
330dad097d9a3d4c2a8d4d1fdf39c8c5c1af6382930fd6e5733d4513bab555055be9ec1144a18e2f0218ba4236972b736edbc03a913f6c32a9d3e4f9a07a53f9

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
76KB

MD5
2eda42193fd193b056dc85a3668d001f

SHA1
4d00a89446c964ad16457e7732ea56981520c8b2

SHA256
820daaaf7b71ca86d6b00727d21374f2abe757c3d2ce9f1b44c824cf0d8965b8

SHA512
bf7cdc425781126e0e28761ab945e81ef7c041db1693b21000e56178f7186d888381dfe2ae4dd28eee4681f07ade833b1b9d258efb858bb1e7261abcfcd5e1d3

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
76KB

MD5
9b559a6d501d65487575ca975624e6d9

SHA1
7867e371b52ff5a689fced31fc275b9905d5c525

SHA256
60b7236359657bb1dafff6a318df29e7f637a1197ef56583641b3095b6b095b8

SHA512
3106fa9be663510278e01f3c935ccd19437080ebf6a9f80f91c077dabaca58017013c587eb180437b658189fc770dc927eb053d053174ce6aa00d0c2865f1e73

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
76KB

MD5
f766e1b9e5beff763fa0e0d6cc46881c

SHA1
a249caccd814efebf065ebd2a7436ee7cb56ee68

SHA256
3f369909e89d79f3c2d458760d2352e9bb2e54194020cf0af99531764676de04

SHA512
64459241d5c7dd6b6895cd84cdcef6cee96b86e1050f90c9249026a99c47a5d9eb1a01920674f955aaff132215d69851b04d3d530dd4bc11114e8ce51b259943

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
76KB

MD5
0e3a986b56d5d37e13eb6aef483d0b0e

SHA1
332b0ebf2fa0162ef2a9f1e916dbe1bed401cd77

SHA256
40e6e1ddcdd7420c27fb0ed63f9daf765ce82943cf563415712b53a70f1ddcb2

SHA512
0d21b0ac5762d218f71462412ffd917400e47ee91c274758e91103618174efbc360cd7e78e4efeac6dc1626913291c6268208b7813b8b8a76600338fbd13f7ab

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
76KB

MD5
53bce722b656cc0a902be48d03e0631f

SHA1
96232f212bae179a8f64f489aeaba9bc6256e213

SHA256
ce62c01469ba44ff8df16d098b7b0f2ac4ee29e3a33fa52c6c88386b397c9668

SHA512
223be6bc71b1c4deb071274fd9611766e8b2f23398b836e6942cbd1b5b9cd7be2e1a60a440ed5d956a40c22fef4f3b7c1e02e97319e16226dda22cbc4c89bcc1

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
76KB

MD5
9ec8178745203cc6c1cb392c02a493d7

SHA1
e3f84585b426c7d1e6af87f7646e058d1b50273d

SHA256
251e24d56c7a9bdce1c9e18147001a5aa013ae7bf63d279c3559a6cd509ae442

SHA512
1c74f6dc8f6a382429fd1132c38eba7935daa25df8b1905fa2ae1102543fd2b2e0841013186e7f693519d712decee634770aaec0a35984e04a2bbe33a926dc12

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
76KB

MD5
932a65f98e94984ace13caf99bbe73ca

SHA1
45e97d3876017521f54dc77e710a49b57b3aa342

SHA256
67dba221ae3b97e0a139ecc67c5971f472b1245113a2f4a6ee7201ca2252feb7

SHA512
c656079ff0c6763d3c4b5d1698fbc943be1c0791a467a720d7504bf0cb9f851e8f907adc58589b195ba622304b85caf043bbb3a595e5dbb1565b1f3cd5ed3215

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
76KB

MD5
d4cc41ac5b7dda41634fb5f902de3663

SHA1
fe1d58c12f57d5e414fc7f3c664b9c629e88e914

SHA256
5bcd1ef3684f09de37960dd5bfdb9c8fb5cdc856856a858e171bc95c09a4ac16

SHA512
4d448d17e25498968a87dab3eeb8933ca6ec75fe1d3e2b068dd505d712374214d752d90c6b11e625efb8c9e1502573721ebce684c230a0677907fad82a6e85ab

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
76KB

MD5
28bfbc7830fa3a3b8144c37129ec5f02

SHA1
b8efa1e63cf4782a2b85fc800d8250b769a2a066

SHA256
bb2f814d32f4981cc5f6d00c13a5dcac8dafa8da9014755e17cca6143cbce8be

SHA512
a33e3250918a8abdc471f4edbbd2c3497d8a1946006807054b991a95ba0937e5569421c3918f19ab3f415d2b7ec91dbcd3bfd7f53236d911c62c1e1dd86d24f7

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
76KB

MD5
686504a3c21f09bbb9112f8533aa0cd5

SHA1
f26f807d51a5e46e1089f79c6001a1f6d6fec32e

SHA256
7e346efc6542d64e35067eef2fa563f34b2fc0dd166c464be57e43f7b4fded00

SHA512
74023a52ed6de5749d895734d93c875e945439378d7a108cf6107cba68778db2ffcf39336fb0a6f0dfc29cba944c5efd02581511fce7eeba52b1ecab5275d766

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
76KB

MD5
9c3307495f5ee00b2628c7cd68dedb6e

SHA1
f7e126163415d042f18ceb184477b4f6b795cba3

SHA256
21c360a1c313181360ca396c2714cfb15ee51325579e59162867fc1a2b88eeed

SHA512
8d3ff0df9c70971453876c706707964c29c909394ff2362041b560b28e58e009670dbf62c3bb164b6c5d94c6493d4b08bc90925fc50de24a04c08ba4715cbb74

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
76KB

MD5
228ac2fb8d4d000a1ef951d35d50deec

SHA1
4bfb8781c1e3b5d33259d76beacd5726ab9e21e8

SHA256
d078a3c64c10f1cf305ff206b581e542de44cfe647d67e4d14f0cd96172533f3

SHA512
dec6f53d8ebf2e9b4bea123d367bbc7888694729b5fa2784f6fc2283c0c8fa3ed0118de647199a0008b05267dcfde886c6ceb95b75abdfe96c2a739bcc6036a9

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
76KB

MD5
1e7935a17471a49a9ff817ee30075940

SHA1
b1a571df00d5049484539f68fa474c1258344387

SHA256
1c4091f6c8963a0a7eb837b62b5076085410ec4935d02c442bb62bf7a09785ef

SHA512
d00c23b68aa00ffd38fa429bfbe474733780030fdde0f0601cf8fd18c2ff86a482e2ccadd740df48011ae83d3406624cad2d39a8ee073f3f1752ea8de627059c

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
76KB

MD5
27e3ea2c3974e3e55a3927f7391a62e8

SHA1
f7307018dc98aa07fac6ed6bd361f4ce165d0e34

SHA256
da03caa696bf75addd22ed5c90995aa93a926ee6aa0ef51ebd1a384897fe5a36

SHA512
538dcf54e911b8656637078ea25d39e0340ff60e2af2dbd806f1a6c526d1d1b2f654123a6b90f641bf3180293f1c7de96b686bdf2846cc231840379cb5ee7129

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
76KB

MD5
dbc5157e97cdf1ad9dda92c16b0f2b46

SHA1
2873c55826c17b1865b81f7224c514ef80f46566

SHA256
7f238745cb3ea7def32c7016cca20cc332e38ca4166b2831a75cb647bff1eccd

SHA512
aa5e843cf12cdf54ab680ac8f1c45d9a4f7f16ad93f30ae6aa7c141d7eb95f31368d440ba02a9303f04740003bb385bca89568bad86ffaf7270497b68422f6df

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
76KB

MD5
553c1120270311c49a678712224289d3

SHA1
6908cb0377a3692d11d3e4a3609ea49bc9145f4a

SHA256
05b28eea013b2002e671349cde205c4120acf8ea712dd52f92834c3d3c2f2047

SHA512
8167539934eaba6b5b8420f76a4e997a49447d19233e4ea3943938e4ea2a5d7b8aa75b14fe40c97b8e7fb10d303e47593f92f6c73183df7e0091c86cf2b63ea7

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
76KB

MD5
594ce265af57d4f91c5163f28db8953e

SHA1
46a4ee937475c1c86136d63f7cdcde441e39361f

SHA256
68063fa749d8f5a6450a7c6e2e9528697d6ce8fe421b5665b42b44f70bebb92b

SHA512
87643a356d2aa32ec942103dd933f56fbb7edb009221deb04030c9e4eec3be029514fece753629d70a6406a3e77095f58e33034866350a9d9e638bcb277abcfa

Download Submit
C:\Windows\SysWOW64\Hbnjmp32.exe

Filesize
76KB

MD5
7fb276e411d7b81e804b6360eaad5c34

SHA1
6552a96664c77126488cf7fef6813735f3c50ed9

SHA256
e2e4188f31839adcd6ed800b4dd1fb332e547de73288c9808a0170381857572c

SHA512
53e4ab96397c971e5dfbc2d0b5fefd078521f84a49b271bebfeefb3f0b42863cd872ea99edce3db0aeae407ee203867fad3f127dc5ede42d3801e55e13f7a01e

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
76KB

MD5
f3c5738db5924e4073c334bad779a5fc

SHA1
d36fac29da282f64e9a4e8690f84e567f86089dd

SHA256
68d98f52822e5ca20fcc7e82c80a4de5dd5d54b9967cf91125ee586d35f9f5dd

SHA512
8df8d62612a19d62f8d8e3f9a0f856b08c9cbf3a050f5cfc52541906c1a9815eb5c29b0e28eeecb5400bd4404f8b704b85f8f2483810608b95cc3e118ad6bc12

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
76KB

MD5
05b4745d82e52ab1c40975a82b48e315

SHA1
6f3db6392d538ccb4a1a4639d5243140b960459f

SHA256
0f50e0183f9a0fb5ef7629a057101c977493f877575b287d4adb8bb7105ff802

SHA512
71e92ff54961ba5173c5516e7ec34d322781a5a94d6a3c935f0f431f933786183c77ca490c8e4bed6b0f57656e54a48a3ac125b9e901991ef41b9961aaa5ac64

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
76KB

MD5
438906842873cca4a26e956959ecf11c

SHA1
b43e6247ff86ee919745f4dfd4b68897dea9a3cd

SHA256
7c6277e48eb3b7226da11241eef7622e5115f88fb008a1668c0499ea02e9c8c8

SHA512
d293b0597301bee6986c8ded21a3343e669e6b786cd17554477b177c8e72dc14f33ad9b2bef53485a01fd52606e18b7ae69ce2aba26cd14721285e7ec29fd0be

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
76KB

MD5
e19dbaf38264cec113ab4e70f76aa049

SHA1
c90bc29b5189854927d1e2b8c96a2cc2873bb04f

SHA256
7d03f5dc0b038c430806a75688f0811eb32fdd443a00e81a5252935867fceed4

SHA512
4fff186aff7c83592c1e38862c548cc1e8b276dc098784667ae8ccffbda73bb0813b6ba2ae123994f48d8b85aac454250edf84309af5ae2507a8949f9f01f115

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
76KB

MD5
c51b5ca0fdca519df90f2bfb890e9b13

SHA1
e58e16d896dae85afdeb514875c75b1913268f0f

SHA256
78e63685caf6eb35491cfb9070c6bf54b19834a7d2fcea48d5953df8149a8e7e

SHA512
c474e64b0bb52b0d85431a0c54253bd2bc4f4146980d83277d043ef6916fe1750a1c9a54a8c6e8841d99c634768ee640e7fa012cbeb812cb4ba7554d49e16979

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
76KB

MD5
eca493e425f2b360a37a05fa5ec3b27f

SHA1
232ac2ab571cf108fd80ed8c093bb585b5098333

SHA256
1dd98d9788126e489c7c9429c0422769c35e983f1ade88fb4a0cf606a96cbac0

SHA512
c6a899b33a9946a12b21f6f4cb77713a364bce38daadf311dd8b445a1bfb06903558355e10ed575e18c9ab562e686ea62299c589dedcb7ae9437630b91facdff

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
76KB

MD5
9ebe70e6ae7bdfe239b47d9fb2857f5c

SHA1
9d2e0c90459be6193ae1b59f7332aeaf579cad2c

SHA256
1fc88160de88045d1e0c5ada51fee27a54458ce7377401666ffa8542ccdeea3f

SHA512
1e6875d10f932b551cf8e47897b587b5e1ebccafd6dea32e7108261ead5b1aee204bfc37e46bb200b125ae7941120dbb75622030b9ec78bffdc1c173f98aa509

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
76KB

MD5
7cd64e4d31fd2316e3f83167bd9f8b5e

SHA1
eb39a8823a4fa38ffd232991aa3b155061a24efc

SHA256
b3baceb46f842c1098bcf15fe7dd03f07f0dd7b845079ab30b20667746850921

SHA512
ae05a5776fe26962391eae719f5566537a26012b4afc34eff583e63d094ad56bdd54a340766f7ae31c9e9a28f693970682f4e0ce74026c51fec1639ad6654391

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
76KB

MD5
c2ca22e3ee26ffb73ba7e63854be73c8

SHA1
f226d98e17d4624b88107c0895d376b99508fb2e

SHA256
692d2580ee24adf17ab0f49f2bb3baa6d64acc6e4842a580c9693dca90a2f099

SHA512
9dbee3a3fa0013ef28d6a499b5b59ebfe003afd3b1e29d3f3ee573aa28f8c799b81ca3ffc5149fe86029d8df311c6b2f5db504cc3560e8a0805a8695fe04c54d

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
76KB

MD5
38d98b3dacc1c388dd5411838f328c8e

SHA1
b68f37f2831b1583212e14eb8a41d58a66f96997

SHA256
53dbce41f2987d7dddd0431ca0be6f5f7d42a5c632c8c4172ee66813af462321

SHA512
fa598aa54763453ed676313f31c6a1db8a3b9fad8fc186e0378540b25d1eb462266622269f51a98608e2fadb1bd05496dfabca603da027ebef4493e01d73dc5e

Download Submit
C:\Windows\SysWOW64\Icgjmapi.exe

Filesize
76KB

MD5
370fb7b7e5ba968c448d3671b3937635

SHA1
8a7b9ac29515cefcfa0a29a03c9ab7d4635fa267

SHA256
50e6e4be0816351039628abf3c6df32e509e729e9edc9934dede08df13be82a5

SHA512
31e1194e4a7790fa9fbed99b4938d2386e8081d025c39133310d3d4a50755b64f79d7e80fd971a97701b1afcccccfe027832794fa947e0425cba0727010da62b

Download Submit
C:\Windows\SysWOW64\Icifbang.exe

Filesize
76KB

MD5
4dc26c290af1de6b18a039c28d7f1ca6

SHA1
8e581a06c356d14712f03d4a768cdb90bcf4fa0d

SHA256
450367446e6b2777cdad11b5376c9d4c3f99931924dfd9f96eacfff54fa9c756

SHA512
deae3330071095fc5b4ea079803e9dcda1a85d5ce310dc8e0f437a3f8f010d195205a576da5bf82f1ea019bf0b879fd219409be38c57d66c6ba87abdd127f6db

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
76KB

MD5
fbe320f8ba1e3e65d1eeb2484df9360c

SHA1
42edc644634650036617b7888193ea1e226f7b4b

SHA256
c2c6fbff41c3cb6440dd55517c9ebbfb29fb287b334d0f6f1264ff43a037b155

SHA512
05f6da74a6df971570d3bc9375417dea96ecba5c495904dbd849faa971aaf556bae0d4750c7558ca27a6d4035de1b6ad75d0cca7d72c211b80fdc01ecb66fee4

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
76KB

MD5
47945e917b6d34ca7b0a9029f355572e

SHA1
482822778c118f40ea94feadf6f0253ba8fb604e

SHA256
0a3327bea8ebe64db9bbee3a799c833c62dfd319572743304ec8d291d35c28cb

SHA512
6daaf7101e81d79a3ca1bb17b5e0fb2cbc80c3a64246d308e29adf5a4e993ff6f3832f2f16fe5d045dc357e3c77d59df670ef82cc75baabdd3aecf5ee10b0942

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
76KB

MD5
a76241fcb54ee63b15cda848fa2c34a0

SHA1
01a9264fcfd9a9551f6c96b3c4a3c7384e729119

SHA256
526fe207bdea0f7b60171eea9c48a6417e2b936c0cffdb6b78d58397d7f8fbe3

SHA512
a42f9ab4e4767cb3834a28923a22a7b87fffb8b8ae6c223fd16601af99a67bb0e4e4b0b9443ba627aeda1b9ee40e51f067da1f71a5b20f4d9ded73be3ea4636d

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
76KB

MD5
d85381d42594f02396fe021d6c9e3384

SHA1
c4397fddbc5c8e211d74df5e533e853a4941bcf4

SHA256
d8116473a7b9ea03f2851eadb96b14ba30340da66844cfad838ac6e00d72f99d

SHA512
100f77cfcc7bff08ba00f04a8156fcd4070467be235f91d5ee2292a5332a0853e8b244c8098516be528bcb01330262dd0ec9f570451880495920efba62afa3cb

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
76KB

MD5
5502a1ce542d0f8dc49642f82ec9b344

SHA1
4c7448d0408069e9901c475c98317a87cbb8df24

SHA256
2e3a12079a21eac59701d59f154c76da6830caec82a3d8cada56436fbb042120

SHA512
e1e3422b9ea574f676519d8351beac253128197bdf65ceb503d47c5aece48670266ddf7ae5ded25ede9dcff242392c08c2c8c6cf258dfffbf499390cf28fa762

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
76KB

MD5
5f4a560475d9754a81377a85156318d2

SHA1
b17b2a844ddd8c9312e7ce6294d1232e9c804275

SHA256
696d8657c7caa223261d188ac80e36a78016f7cbf797c41aa464e944f75bb917

SHA512
6ba553007b415b196805741808f96081fef2d9b9bc121cfb4c88b67a2d3489549ee3854546132813513d084cd2d117c852d8082280360d60551eb9fc7f3182d3

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
76KB

MD5
df4dc069f8ce4f55fbad1dd5cffd3986

SHA1
7a8443dbff8cf2d6512d3443b557d7720b79e1f2

SHA256
3438278b8f855ee004fe1858630dae45a611da13c7fd910895ecc546d38580aa

SHA512
1a2d5ae35210facae27d9642ac0b67a215a5d11b20380caab6bd4a62af195e97c85355c9c3c2babe93a478f18b9ade251d0884e386dd10ee923667e3ad458720

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
76KB

MD5
e8a6745ba50cc70812a671de31fcebda

SHA1
5f4df38fece21344f520f4b375715804b4f2d3d1

SHA256
2230e178b4cee4b69c1f122aa3e067e7b8f2ccb836e117735ea0519586c24dfb

SHA512
b0798527a544777e7e84cd6d6e93fc77130edd549f8b4e19f7a00f047a132d1d8dafa385d29f0111766534152774e81bf662f01637d9b4120d431ef74a643762

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
76KB

MD5
d3b0cfd02f93dc5d03afda688ef0cf2c

SHA1
06b314e6596b4bcae7ce42746e4e5be7dabbd28d

SHA256
6036d75fe6abe4187bc8bccd60a7e69032db92d02fdc506e41516b0bebc773f8

SHA512
67a74889e498c3e369b94932ecb499363c6ae00cb6d2b34d96de9778b4b87ca03c0b6da54d5ac9ac88be159c7316626d2c30a07eaff1600c10f5d9d9d83a50f5

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
76KB

MD5
a2f7623afd26ee922277e39e4d196449

SHA1
351da29e074a67115fd2c0e0e3ba548bb9ac4c77

SHA256
4cd823a27c2b6834bf42bd3fbb3ce14773b49cbb128ba97eecf5d5830191a181

SHA512
abbd994e0aa8d38d2b07888e7d55483a3e9f9a4f545ffd3a99ed022d27f79cd93858346b1673a442c92b1ed3ac68839b81949e4407a31d531302576952f1a4ed

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
76KB

MD5
43afd8a21535015708927030cab333f1

SHA1
e3433b25a5e387d98393028026cb1f314e63e96a

SHA256
be8706439491513aeb52cf08b1b45fd72fe8c605eaddee191e5b144e84dce0f9

SHA512
b259855b392f92d7909301c80cbc4c5da9b1070e2c1e109a4f5b8b633276b96ad860180d42f75d6ed5ab0f13078fd9d341c959a1b9130d875b8314031879ceb5

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
76KB

MD5
de1e036266ba55d1bbac24f2253686c6

SHA1
fc91a8da1fb1e1b8ef69d71c841743e833e8aa03

SHA256
b12d53ecc23fef8ec57e747e4d0eda3ee2ccd2702f02c784a2c24c6a2b6e4e4b

SHA512
2174c301ee20cc60d1a83acfa289a72eb4274c3439c70f98bcd4b34fe2e05c723d39316b696733765bb6bdacfa13e3f857617999e4f0154fbd70ba5606c1fe4b

Download Submit
C:\Windows\SysWOW64\Kbhoqj32.exe

Filesize
76KB

MD5
4d5d67b9ff7b07a3fce899e9a66830d2

SHA1
84129be8c289b0680058ab353145bae6bbc7e47d

SHA256
e15d35e3bf371557e98a2c64aedac67ab8357f06d700d2d7f96f2dc02ec71204

SHA512
1d31e88b83a8a1b5c3727611deff6c4be18db7687be242ff69c47ee12cc161ff447319fa7dc4596431d4a62a8f6e5b47456be16eebec4c9d10cd52f59ad19a51

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
76KB

MD5
5ff53f3dac18f39dbbc21c70e0dc1453

SHA1
d9a4d6865960e41b17d8641672c50296055e7438

SHA256
0cd85edad663084fa8d0b096f1c4dcf834345b00ca6ea83bf4206dc5254844d6

SHA512
0f05657bc512b6c0c2946b225ca323bfbc1ed97805fd8f8ac3d286efad908bd489cffcb4f7628182e06438e988c3aa5106e721d5f7b5df6e0e17525d80a2ca42

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
76KB

MD5
82c9cac4fc6761cb737a1b73274e93ad

SHA1
61e9b7cc027c32ce125245eafa7e4b839dc22cdb

SHA256
f2f780724acbe0679b56f8cff680d774ec1f677096b5d9c06356ff0d752b01eb

SHA512
f0b4aed701de84d41e6f5de0ffdeb1a38540a250aa5282c43a6cc63f67e36da2cb93b947beb0d5fbbc62f29c348bbf9295183f5ce3ed6676dfa3190d4e318b38

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
76KB

MD5
369d56008dcffef0f2f6f12b62571502

SHA1
08a5f3149b25309c4746169bd216b47d37787061

SHA256
067791c6dbe69e09c7d230c50f3021753c52d044f068dcb0039dba58f72f6b7b

SHA512
3f9f334077b3c4cf6f24743ba9f1fd1d0c4d693fc35d0a9066b3b467d95ffb2ec1aa41072d1d5ccdd9886140205b4845916b6e5ccb17542769221ac61589ba40

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
76KB

MD5
37297ae014bc0859ae4791c6e43db4d0

SHA1
9e2bef7797bc5cc22e9dcb48f8821d943f53e75c

SHA256
4ddd2ed34902a4bdb516a3b39d8a8d3e23d619bf43b88cc1d1349e3ac1a77931

SHA512
99202f66450a97cf61e527e7592c0456b03fcb36a30915e4309a00360b9481654e5f668430481445f32463048ea885e8601655344fd7d2fea5291bd258ed3080

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
76KB

MD5
62e33b0aced261e4cb1d1e0495b8ec30

SHA1
4e15de59626174642ebe904b3ce1c9c0a3029b4f

SHA256
ff8644ed2d35d54f45a233592b00934c28e79b8fd6314ec837acf553f50de013

SHA512
26142796a837ecfba267e749b9797d3f371214fd82be3261e0062e2443fbd21f60ad9d00e33bd137ff8cbbfdc8ad29d698ad1f2e3c645f49557b0d2749f6a193

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
76KB

MD5
ced9a15f187d536e526fa27d8de5ffa9

SHA1
7f5df8939ad1df8aac479d52c6e72305d6ecee4f

SHA256
b2e69f01600fc840f095272c66d1a73d81e96a270b4717872ed4cfebf5fa45f9

SHA512
67e11a0069f2662335e044df77ba3582935f98b3d20334b9e290a5ffffba5fdd30e42051798980a183cd009b502971033d788a795feefc2329304f60630ef1f0

Download Submit
C:\Windows\SysWOW64\Mbfkbhpa.exe

Filesize
76KB

MD5
218aec35c51414d6ffc4ad2054a9287d

SHA1
05f4104931d0600d039248e37b913c5b9024070d

SHA256
887967f04c16f9269c4f33eb51cb80abe80e42c8f4be127ac06c5d3cb530ffb3

SHA512
5417d518ced60df47d6ca769e049efa816b0b511e36e87c7499b65568cd75f82e0ef6cd718b95f45113dbeba10b41911c6b15d5a882c16f63a992611e6cc7ab8

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
76KB

MD5
35cad4c5cb1ebaf291bb01858800b076

SHA1
f770d85c00e4e44d82a013b9938164327f98f3ce

SHA256
b22844bd8208cab3e20a3b78664c3b7ddea9e4d3b63393115e13dd54ac66b292

SHA512
55c03f3fae771dc6ab6bbbb0ebce636106cd19a23e0378a53dfc906150634713331c7ad7234ed6bb6484102ab94c3a4eca6f44ed28c877b7d0194c28f909f795

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
76KB

MD5
07850e99a5fc44459cef776d5e417715

SHA1
096e49d46b7a30ab3f680c90bc8451f8ba6025ea

SHA256
de28737cead89e1a63200935481a4e07e9307d4928335192337f7ddca7c39c9d

SHA512
d50291476d71faef0c6bc5c0b8c887564f5b42b082b69f1a6aec5aa0bd155fad086e8935d4da7fa8acce4910bf974478d8bd582a6e36f21bd9e9386375bd8d4c

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
76KB

MD5
17877d568c6862d1e09480314e50a599

SHA1
575ce43e0f5905b40391d82922616dd9237e8430

SHA256
a12b0618c53ba6159cf24ad2c5b578940e3d0c5c7039905d82a657421a73470b

SHA512
cb6e1025e5b2a903fe0f86dfe71e8c0f4a51e3eec65f0860e9693a61f38a377e518fda4913d2a4628a3e206e96a4433fe7140027d3c303b71cc431172a7f8c49

Download Submit
C:\Windows\SysWOW64\Mmbfpp32.exe

Filesize
76KB

MD5
613b9e5005eb085cd5f2fcd04dce2801

SHA1
aa43ca94fa0c6bd8f961e031bcd4d2a3c387a885

SHA256
f3d83a204119f6fcd9e633ba720fe00398c9e748125dcb01adabcc1be0448681

SHA512
4aa2a8c117b0e8e3cdbeff80a43b471a728ec6812123b470b3843163a3f5ee11d94698a03b2507859efa93eeb940f065043267c989630b860003ba0dbfcf6662

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
76KB

MD5
473781429b2c4ce5a52b61b5a8f6728a

SHA1
457f2a21e089ea79f304b3092e944ea89ecbb247

SHA256
806d6a602d42f0ed4e11c65e89918de96619b5a77aa9de6e90ba87cb088d7790

SHA512
68b2ec5e201c2460eb726ce562936ca42c0cdac17c5886745f22bca9190c90e04e891d5cd8658fcbf0d69d7af6aaa50e309cdf2dd4344ba711526e01d10e90d0

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
76KB

MD5
a1763987455bfa86af6ff473cafbcfa1

SHA1
fefdf721902510a5fa93360a9d95faea841b0463

SHA256
d45e51178f984ffed520ee77edb27fc11971c239922772c17d181c74d183b172

SHA512
cacbfd61167370dc927b7b22200d74a3e3918c2b5c8e512e840380e7edc96a3bbd024620a208e97abb97a5be6db75625cdaed2a537ee6e17c1b3f85702b7d44b

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
76KB

MD5
73ff4b5f585350dee997f31e24eedcf4

SHA1
4571f27669b8d2934572df6111da94efd38138f9

SHA256
2a10fed9feff00f3be99bc4ea385b0708f9fee418e195680be6df9a4ea3ff425

SHA512
43c3c940c9bf0b4e16348912849119e75f4b06baef2c808c368dfdb112155eee2670689c1a0d6e6c9a94cc6e262352bfcb5892c658181c7d4a105ed9f8a12797

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
76KB

MD5
b1da5c3253a2fe7b50213df53fc208c4

SHA1
2024e12e10753c066d72c3f49d78598cd0be9b0e

SHA256
040055a2a399a4955cebf311d291553e9d3aa8b4eb786868132a6f00bcfc2757

SHA512
e6bcdd20816106f6c702c64f18c96d5291f680372b1f5170de4e1ecf10b883df10a5793a834739addf7b854e855bc41e80978a7007db889de55a07204e1a1792

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
76KB

MD5
4c7328cb0c2bd487c29d82e75c6a3ca5

SHA1
b61eb45f9f8b7a47d2696e4416ae7c941191e747

SHA256
dd3c6c56c5807b112affa9988a74455a72f2f999c730181e2e47b4391f96172b

SHA512
e07897d8bd2b763300020fb37fb603cab8a95c041bde2a8c8bfb47dd452c957608f9d275ac487834943190d868b428be4fe19072db0ab27d368b4284e30b3a6a

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
76KB

MD5
ab75e45c19abbef9f7038bb06db718cb

SHA1
a4ff4a0f3e3093742e63f0940096479b85123ab6

SHA256
e2266b864cff40eda0d9bfcb589bc1321999a476028824ce22a256626c1573cf

SHA512
ccf6007bbf5a8ccd53d789068a211777ffff2d4f8e1beba2895ce40f54574b7b12a8615ed6712b7dc3f743a7c2f95c0d408d879d27ccb7000607de5395f89ca7

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
76KB

MD5
42ea0aa7e98e01bdae1c4c68237c0610

SHA1
95352598ce90e0b211ebe3556ff4a98ca8640c78

SHA256
59fa5ed40e583c21757c79871dea21834938461ca75d74626fc4956a63f2976b

SHA512
68b11808559f3c98dd354d107b9ebb8359ebe8b566f09432699df5a245ff402fd6a92246764c60647fbdd5006ed1e58fc2c9ce7f4dbbe408b4502a902952798b

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
76KB

MD5
aed5144224c2b9a4d5bfec3b929cfdd3

SHA1
e4bd7f34d364c87a00497b0be192ceb992bcab19

SHA256
67db9b3984dd3389027fb27ee876f8a54b1c15f5213dd4db2f1627d5aad40030

SHA512
f33b1d9468c768853440591756183b8b04889c8c783ce6606153bbdafbed8d650a1bf66c9de2c8bb47ca244f178c51aa9f8b9f123155d742157cdc53cf174570

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
76KB

MD5
fc783fb5f07a89df1b4972fffedcc315

SHA1
20a5163b0e558a07654089a93912617416da9744

SHA256
ce51f6720822156347518bf78bb0e2fe6d760d6a73b85e7926a8621b725a04f4

SHA512
0d4388d265e07d74a18fdf824b61a813b79e13b3096662bce8154d8875ee6421b6146dc9d06f8e9c972d51bb4cbdf2a68ee68fd6457fbf7813fc88470bfb8c1b

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
76KB

MD5
0067a7c4b56a40faf7f36b4aed2c60fa

SHA1
0edd85b1fb94d369067226b9a52c2a47a11c30e7

SHA256
ae8bf6697fae1a09fb959a4443d76bee0891d3f4ee3413786bd75b29b05cb90c

SHA512
f1ff4102d2ad7681ae4be4db34e5fd88c0bebfb3a2a782d638f3b83471cd680b520e1156af09f58530c31c48c8afbd22c7576a88eee52cc3d8a975ed09b9d2b5

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
76KB

MD5
3ea585149dbfec91576713636fee84c4

SHA1
6d1746b8cedbbe00636daf4282bef5a963c7ec8a

SHA256
92c97514083da2956b5f8471a22140623e1954e9d85a73f95df110b58769d375

SHA512
ed5683b377efe47ea38faed3a1e97c9125d6d621955e33725bc9085593caec8b57544ef3bf002e0efaeb0d7d2ded4f2056cfb2fcf158bcf3262a7932a05c8251

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
76KB

MD5
778d852e8cee85ba72ff75bcd03b30df

SHA1
c5b2e91a82564c8b5f40231bb696146b71d00778

SHA256
7adaff33e28817e9e71d22967bb8dc0a705b2c8d3cb3f68f1351f45ca88c8bbc

SHA512
09dd9829ce5c8a840e89abdf87b803aabb94b03036518326947a2523a337341292f4bf2edc3f684cfbcc73c017792dad13d0625c4e0e5efa8c80180b5763e0f6

Download Submit
C:\Windows\SysWOW64\Pdkcde32.exe

Filesize
76KB

MD5
75d731a25d8b83da67297869b757e6aa

SHA1
ce0ad54f7f1c9f3f87948c4947cdd51afa804b34

SHA256
8198e75abc267a9d9c280d6bc8d2d65089a216c5c67fabca0547d7b643359a1d

SHA512
f5d5f3a34a730f5462de4f5144780832783f6ffcca6ba39ea14e4a77e94a986d131d2792b9a078d41648c75f1af9d2ccf2509023598788ed017f2e4449a91ed8

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
76KB

MD5
475959337ea766530c9ccbbb325f0297

SHA1
eea9e0f06ac5328835c4576275da7c1e27bf3ce3

SHA256
d166132f6969009360bcdc6b050d9a57630a1665942214fd56a5ed6d3aaf84ef

SHA512
958d1e63a56e8da8ec702bcb334687feb5eae6e4741b3f86bc50b59ee4e906ed7a84aad6bba5b5c794329488c2c042e814c2cf55acbee8c7763372f9120d7106

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
76KB

MD5
a9de1522b538167b1e15e1e157bbcb37

SHA1
fe3fdcde2db020ae94e3fd470d9559673a71b2f2

SHA256
c44b67eddc0d4b54f076f9ef6fc84c21ee1ae7d4c7fc11f4384ee5d10f47ecaf

SHA512
f18766a8a1bd2b75eb443596192d822444a1af1304d265295a578392d5b8da3a9c974e96c5b417f74d63b124a867b52c256070fe3766b058568709ac7b371fcb

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
76KB

MD5
66d156732c1d7fd270ff773dcfce93b3

SHA1
60256f2c6819f7643cc325846de8d1aaf5d2a872

SHA256
462e0ab76791ccbfb1d5fe85c6f87924c8d6340d332e1d3d08a5cb7457cc8f50

SHA512
b7047fad6be3247de60d0e96242ca88deb7eca6c91bfa719416730def3e76aaaae34a761c2f9b066a70e80753cbcfa2f8a24ba7f6a9c672cfb3ecc3f70aeebd3

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
76KB

MD5
e70e151b3f7bcde396e2c1534ecf1602

SHA1
b9a19e00567032a8deeda5885c5b7dad4daefa4b

SHA256
6601318bf72846be7c4941b306cf9bfeb46550cda1944850835a210a3ebb1c83

SHA512
c13f5fa1d8428a79215607b077655c5db3dcccebcbb518b0ba6a9486b501a2dac50ec160f62b4413f91a02e5ecb93b4c8161c23f0e6325d2c5a66624bcee5cf8

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
76KB

MD5
7b0fdb7fc4c28ffd7589360e8915eace

SHA1
d135d0f46a27832e94780a3acb0957d502227709

SHA256
7bbff722874bdb129caf75e0e6657edcf0bab37c201a1d43c2a1aa55da7c6cdb

SHA512
b58efa718e7e585a8d4b7d26309ff4fffed73066bd0e7101df02173ff33d3e36d1b1abc512adb944e0f3285d72e95df134952bf13ee959729e80392af44993df

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
76KB

MD5
4b5da435f03a7d278d6f0460c9f56ed4

SHA1
d5becbe1af5f4f8a2fdd0c456e50e7aefd9c3e6d

SHA256
300dfd07e1d56ebf08065005e22cca67f9e3e07efc9fed2e3846972f721402a6

SHA512
dfecf300f4c3ba8a833799a4679a7d37c8ba4f76ae7d2c4c36870ca3b5a33dc2cce37efd3efcf63b873672ccaaefc43d5b758257b808783b0d22d8a1d2faec05

Download Submit
memory/116-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/224-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/368-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/380-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/460-554-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/460-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/536-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/544-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/636-528-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/640-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/728-297-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/828-541-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/852-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/920-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/928-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1020-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1036-569-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1060-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1060-575-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1236-474-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1400-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1416-547-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1416-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1428-480-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1552-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1592-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1768-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1788-526-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1796-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1796-568-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1920-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1948-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2024-468-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2036-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2124-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2128-555-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2272-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2312-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2792-534-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2800-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3036-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3108-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3124-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3132-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3284-567-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3348-136-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3592-462-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3680-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3808-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3816-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3816-589-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3848-492-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3944-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4008-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4148-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4160-535-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4172-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4184-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4188-278-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4220-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4240-548-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4336-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4348-514-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4368-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4416-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4420-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4448-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4448-561-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4464-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4504-583-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4564-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4568-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4596-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4620-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4632-516-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4692-160-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4736-486-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4784-393-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4808-504-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4828-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4964-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-576-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5056-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5076-582-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5076-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5108-498-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads