berbew | d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe
Size

69KB
MD5

478ed8716aeeef7e1bdc9fc11c616730
SHA1

59cc69b5db722a1bb0e8ba7539db1a245cd17c2b
SHA256

d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3
SHA512

1c33ae685e07530e4055577f1c6ebe8755aba696e86e91d1e5c538418c2afc660891f81e3dcbd9ce5419810553b188a1db7c280259dd01784c1ec1ac52815e66
SSDEEP

1536:sezX8yfGblOXoVIfWuwI+uTfQNein/GFZCeDAyY:nRubOoqILuTYNFn/GFZC1yY

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paelfmaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boldhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bedgjgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mepfiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndeii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpenfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fihnomjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feoodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgpoihnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcqjon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgobel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ponfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omqmop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdickcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndeii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Napjdpcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlfnaicd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlmdbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohhnbhok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgjndno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fngcmcfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geohklaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phaahggp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phdnngdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoobdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgkmgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknojl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bakgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phonha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baegibae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohkkhhmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkhnjk32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4808	Lmmolepp.exe
4872	Lddgmbpb.exe
4620	Lknojl32.exe
1548	Lmpkadnm.exe
4048	Lcjcnoej.exe
3092	Ljclki32.exe
4392	Lmbhgd32.exe
2832	Ldipha32.exe
1052	Ljfhqh32.exe
2312	Lqpamb32.exe
2036	Lgjijmin.exe
3104	Lmgabcge.exe
4452	Mcqjon32.exe
1992	Mkhapk32.exe
100	Mminhceb.exe
1768	Mepfiq32.exe
936	Mgobel32.exe
1184	Mjmoag32.exe
4800	Mebcop32.exe
1324	Mkmkkjko.exe
5036	Mnkggfkb.exe
3376	Meepdp32.exe
1504	Mgclpkac.exe
1824	Mjahlgpf.exe
4072	Mmpdhboj.exe
4108	Megljppl.exe
5008	Mkadfj32.exe
1932	Mnpabe32.exe
3464	Mmbanbmg.exe
2668	Meiioonj.exe
4052	Nghekkmn.exe
4528	Nlcalieg.exe
4424	Nnbnhedj.exe
4632	Napjdpcn.exe
1300	Ncofplba.exe
4576	Nlfnaicd.exe
4456	Nmgjia32.exe
1372	Nhmofj32.exe
4920	Njkkbehl.exe
3044	Naecop32.exe
3308	Neqopnhb.exe
4828	Nlkgmh32.exe
964	Nnicid32.exe
4344	Nagpeo32.exe
1764	Nhahaiec.exe
5064	Nlmdbh32.exe
3940	Nmnqjp32.exe
1936	Ohcegi32.exe
3700	Onnmdcjm.exe
2560	Omqmop32.exe
3908	Oeheqm32.exe
4356	Ohfami32.exe
976	Ojdnid32.exe
3968	Oanfen32.exe
3384	Ohhnbhok.exe
404	Ojgjndno.exe
3184	Oaqbkn32.exe
2300	Ohkkhhmh.exe
1108	Ojigdcll.exe
8	Oacoqnci.exe
1608	Ohmhmh32.exe
4508	Okkdic32.exe
4996	Paelfmaf.exe
3408	Pddhbipj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Paeelgnj.exe	Pnfiplog.exe
File opened for modification	C:\Windows\SysWOW64\Bnoddcef.exe	Boldhf32.exe
File created	C:\Windows\SysWOW64\Glfdiedd.dll	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Nhahaiec.exe	Nagpeo32.exe
File created	C:\Windows\SysWOW64\Igpoaebh.dll	Phaahggp.exe
File opened for modification	C:\Windows\SysWOW64\Hoobdp32.exe	Hibjli32.exe
File created	C:\Windows\SysWOW64\Ickglm32.exe	Iefgbh32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbloglj.exe	Lfbped32.exe
File created	C:\Windows\SysWOW64\Okehmlqi.dll	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Nqpcjj32.exe	Nnafno32.exe
File created	C:\Windows\SysWOW64\Pfandnla.exe	Phonha32.exe
File opened for modification	C:\Windows\SysWOW64\Onnmdcjm.exe	Ohcegi32.exe
File created	C:\Windows\SysWOW64\Iahici32.dll	Bemqih32.exe
File created	C:\Windows\SysWOW64\Aiffheej.dll	Bllbaa32.exe
File created	C:\Windows\SysWOW64\Coohhlpe.exe	Ckclhn32.exe
File created	C:\Windows\SysWOW64\Angdnk32.dll	Dkahilkl.exe
File created	C:\Windows\SysWOW64\Anoipp32.dll	Lgdidgjg.exe
File opened for modification	C:\Windows\SysWOW64\Ojhpimhp.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Ejphhm32.dll	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Dpglbfpm.dll	Mjahlgpf.exe
File created	C:\Windows\SysWOW64\Ncofplba.exe	Napjdpcn.exe
File created	C:\Windows\SysWOW64\Gbdqegoi.dll	Ojgjndno.exe
File created	C:\Windows\SysWOW64\Agchinmk.dll	Bepmoh32.exe
File created	C:\Windows\SysWOW64\Bklfgo32.exe	Bhnikc32.exe
File opened for modification	C:\Windows\SysWOW64\Cohkokgj.exe	Cljobphg.exe
File opened for modification	C:\Windows\SysWOW64\Dbicpfdk.exe	Dnmhpg32.exe
File created	C:\Windows\SysWOW64\Lielhgaa.dll	Amqhbe32.exe
File opened for modification	C:\Windows\SysWOW64\Ljfhqh32.exe	Ldipha32.exe
File created	C:\Windows\SysWOW64\Jfdnfdoa.dll	Nhahaiec.exe
File created	C:\Windows\SysWOW64\Ojigdcll.exe	Ohkkhhmh.exe
File created	C:\Windows\SysWOW64\Bnfihkqm.exe	Ahippdbe.exe
File created	C:\Windows\SysWOW64\Mmjpbc32.dll	Blnoga32.exe
File created	C:\Windows\SysWOW64\Ipoheakj.exe	Ilcldb32.exe
File created	C:\Windows\SysWOW64\Dkodcb32.dll	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Mcgiefen.exe	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Lddgmbpb.exe	Lmmolepp.exe
File created	C:\Windows\SysWOW64\Hmnajl32.dll	Nghekkmn.exe
File created	C:\Windows\SysWOW64\Phdnngdn.exe	Pmoiqneg.exe
File created	C:\Windows\SysWOW64\Hkajlm32.dll	Ahpmjejp.exe
File opened for modification	C:\Windows\SysWOW64\Hoaojp32.exe	Hlbcnd32.exe
File opened for modification	C:\Windows\SysWOW64\Ibcaknbi.exe	Hpchib32.exe
File created	C:\Windows\SysWOW64\Ljcpchlo.dll	Ickglm32.exe
File created	C:\Windows\SysWOW64\Mmhgmmbf.exe	Mqafhl32.exe
File opened for modification	C:\Windows\SysWOW64\Phdnngdn.exe	Pmoiqneg.exe
File opened for modification	C:\Windows\SysWOW64\Bkjiao32.exe	Bemqih32.exe
File opened for modification	C:\Windows\SysWOW64\Dmcain32.exe	Ddligq32.exe
File created	C:\Windows\SysWOW64\Kghfphob.dll	Ipoheakj.exe
File opened for modification	C:\Windows\SysWOW64\Jngbjd32.exe	Jgmjmjnb.exe
File created	C:\Windows\SysWOW64\Ngjkfd32.exe	Npbceggm.exe
File created	C:\Windows\SysWOW64\Kfcfimfi.dll	Pfandnla.exe
File opened for modification	C:\Windows\SysWOW64\Bgkiaj32.exe	Bdmmeo32.exe
File opened for modification	C:\Windows\SysWOW64\Nmgjia32.exe	Nlfnaicd.exe
File created	C:\Windows\SysWOW64\Cncijina.dll	Oeheqm32.exe
File created	C:\Windows\SysWOW64\Hoobdp32.exe	Hibjli32.exe
File created	C:\Windows\SysWOW64\Iefgbh32.exe	Ilnbicff.exe
File opened for modification	C:\Windows\SysWOW64\Nfjola32.exe	Nggnadib.exe
File opened for modification	C:\Windows\SysWOW64\Ngjkfd32.exe	Npbceggm.exe
File created	C:\Windows\SysWOW64\Qfmmplad.exe	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Iigkob32.dll	Ldipha32.exe
File opened for modification	C:\Windows\SysWOW64\Ojdnid32.exe	Ohfami32.exe
File opened for modification	C:\Windows\SysWOW64\Adfnofpd.exe	Alkijdci.exe
File created	C:\Windows\SysWOW64\Njfkmphe.exe	Nfjola32.exe
File created	C:\Windows\SysWOW64\Dicdcemd.dll	Npbceggm.exe
File created	C:\Windows\SysWOW64\Apjkcadp.exe	Afbgkl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8360	7556	WerFault.exe	390

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfkmkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feoodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmdlmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddgmbpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okkdic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blnoga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efblbbqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahpmjejp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjahlgpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbalopbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nagpeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaalblgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaohcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhnikc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoaojp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoiqneg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdcfidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpiecd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjmoag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nghekkmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnmfclj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlbcnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onnmdcjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkijdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiildio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfjdqmng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefgbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlolpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpmnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndeii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imiehfao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paeelgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljclki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhmofj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhecmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgkmgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcfggkac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpcjgnhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlimed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkkjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiodpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifomll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlmdbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemqih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efeihb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpchib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgbloglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onocomdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpcecb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmadco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkhnjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddjpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkahilkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfhndpol.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfkmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqcmdnk.dll"	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcokoohi.dll"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lngqkhda.dll"	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieoigp32.dll"	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqindg32.dll"	Ckclhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbcke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fimhjl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpiecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdcghbo.dll"	Jgmjmjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgpecj32.dll"	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Megljppl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqadgkdb.dll"	Chqogq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gahamgib.dll"	Dfiildio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcncmnn.dll"	Imiehfao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknojl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjahlgpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkajlm32.dll"	Ahpmjejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mokmqben.dll"	Ahbjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bemqih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bklfgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glipgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqfpckhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eignjamf.dll"	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaohcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciipkkdj.dll"	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkhqmjb.dll"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohcegi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Domdjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gojiiafp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lobjni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqjpajgi.dll"	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjmoag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmbanbmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njkkbehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chqogq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaabap32.dll"	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akfiji32.dll"	Nggnadib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baegibae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmmolepp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlihmi32.dll"	Mnkggfkb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4808	4236	d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe	85
PID 4236 wrote to memory of 4808	4236	d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe	85
PID 4236 wrote to memory of 4808	4236	d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe	85
PID 4808 wrote to memory of 4872	4808	Lmmolepp.exe	86
PID 4808 wrote to memory of 4872	4808	Lmmolepp.exe	86
PID 4808 wrote to memory of 4872	4808	Lmmolepp.exe	86
PID 4872 wrote to memory of 4620	4872	Lddgmbpb.exe	87
PID 4872 wrote to memory of 4620	4872	Lddgmbpb.exe	87
PID 4872 wrote to memory of 4620	4872	Lddgmbpb.exe	87
PID 4620 wrote to memory of 1548	4620	Lknojl32.exe	88
PID 4620 wrote to memory of 1548	4620	Lknojl32.exe	88
PID 4620 wrote to memory of 1548	4620	Lknojl32.exe	88
PID 1548 wrote to memory of 4048	1548	Lmpkadnm.exe	89
PID 1548 wrote to memory of 4048	1548	Lmpkadnm.exe	89
PID 1548 wrote to memory of 4048	1548	Lmpkadnm.exe	89
PID 4048 wrote to memory of 3092	4048	Lcjcnoej.exe	90
PID 4048 wrote to memory of 3092	4048	Lcjcnoej.exe	90
PID 4048 wrote to memory of 3092	4048	Lcjcnoej.exe	90
PID 3092 wrote to memory of 4392	3092	Ljclki32.exe	91
PID 3092 wrote to memory of 4392	3092	Ljclki32.exe	91
PID 3092 wrote to memory of 4392	3092	Ljclki32.exe	91
PID 4392 wrote to memory of 2832	4392	Lmbhgd32.exe	92
PID 4392 wrote to memory of 2832	4392	Lmbhgd32.exe	92
PID 4392 wrote to memory of 2832	4392	Lmbhgd32.exe	92
PID 2832 wrote to memory of 1052	2832	Ldipha32.exe	93
PID 2832 wrote to memory of 1052	2832	Ldipha32.exe	93
PID 2832 wrote to memory of 1052	2832	Ldipha32.exe	93
PID 1052 wrote to memory of 2312	1052	Ljfhqh32.exe	94
PID 1052 wrote to memory of 2312	1052	Ljfhqh32.exe	94
PID 1052 wrote to memory of 2312	1052	Ljfhqh32.exe	94
PID 2312 wrote to memory of 2036	2312	Lqpamb32.exe	95
PID 2312 wrote to memory of 2036	2312	Lqpamb32.exe	95
PID 2312 wrote to memory of 2036	2312	Lqpamb32.exe	95
PID 2036 wrote to memory of 3104	2036	Lgjijmin.exe	96
PID 2036 wrote to memory of 3104	2036	Lgjijmin.exe	96
PID 2036 wrote to memory of 3104	2036	Lgjijmin.exe	96
PID 3104 wrote to memory of 4452	3104	Lmgabcge.exe	97
PID 3104 wrote to memory of 4452	3104	Lmgabcge.exe	97
PID 3104 wrote to memory of 4452	3104	Lmgabcge.exe	97
PID 4452 wrote to memory of 1992	4452	Mcqjon32.exe	99
PID 4452 wrote to memory of 1992	4452	Mcqjon32.exe	99
PID 4452 wrote to memory of 1992	4452	Mcqjon32.exe	99
PID 1992 wrote to memory of 100	1992	Mkhapk32.exe	100
PID 1992 wrote to memory of 100	1992	Mkhapk32.exe	100
PID 1992 wrote to memory of 100	1992	Mkhapk32.exe	100
PID 100 wrote to memory of 1768	100	Mminhceb.exe	101
PID 100 wrote to memory of 1768	100	Mminhceb.exe	101
PID 100 wrote to memory of 1768	100	Mminhceb.exe	101
PID 1768 wrote to memory of 936	1768	Mepfiq32.exe	102
PID 1768 wrote to memory of 936	1768	Mepfiq32.exe	102
PID 1768 wrote to memory of 936	1768	Mepfiq32.exe	102
PID 936 wrote to memory of 1184	936	Mgobel32.exe	103
PID 936 wrote to memory of 1184	936	Mgobel32.exe	103
PID 936 wrote to memory of 1184	936	Mgobel32.exe	103
PID 1184 wrote to memory of 4800	1184	Mjmoag32.exe	104
PID 1184 wrote to memory of 4800	1184	Mjmoag32.exe	104
PID 1184 wrote to memory of 4800	1184	Mjmoag32.exe	104
PID 4800 wrote to memory of 1324	4800	Mebcop32.exe	105
PID 4800 wrote to memory of 1324	4800	Mebcop32.exe	105
PID 4800 wrote to memory of 1324	4800	Mebcop32.exe	105
PID 1324 wrote to memory of 5036	1324	Mkmkkjko.exe	106
PID 1324 wrote to memory of 5036	1324	Mkmkkjko.exe	106
PID 1324 wrote to memory of 5036	1324	Mkmkkjko.exe	106
PID 5036 wrote to memory of 3376	5036	Mnkggfkb.exe	107

C:\Users\Admin\AppData\Local\Temp\d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe
"C:\Users\Admin\AppData\Local\Temp\d804e968fd0d198fe2bdbda6fff5a68ef7c081f5a8cc5e92e1c6b0413a2fcdb3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\Lmmolepp.exe
  C:\Windows\system32\Lmmolepp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\Lddgmbpb.exe
    C:\Windows\system32\Lddgmbpb.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\SysWOW64\Lknojl32.exe
      C:\Windows\system32\Lknojl32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
      - C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:100
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        23⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        24⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1824
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        26⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        28⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        29⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        31⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        33⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        34⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        36⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        38⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        41⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        42⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        43⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        44⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1764
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        48⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3908
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        54⤵
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        55⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        58⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        60⤵
        Executes dropped EXE
        
        PID:1108
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        61⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        62⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        65⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        66⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4484
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2996
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1892
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        72⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        73⤵
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        74⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        75⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        76⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        77⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:672
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        79⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        80⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        81⤵
        Modifies registry class
        
        PID:2864
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        83⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        86⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        87⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        88⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        89⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        90⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        91⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        92⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        93⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        94⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        95⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        97⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        98⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        101⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        104⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        105⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        106⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        109⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5344
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        113⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        114⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        115⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        116⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        117⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        119⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        122⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        123⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        124⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        125⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        126⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        128⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        129⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        130⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        132⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        133⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        134⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        136⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        137⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        138⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        140⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        142⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        144⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        146⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        148⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        149⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        150⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        151⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        152⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        154⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        156⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        157⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        158⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        162⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        164⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        165⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        166⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        167⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        168⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        172⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        173⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        175⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        178⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        179⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        180⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        181⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        182⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        186⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        188⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        190⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        192⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        193⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        195⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        196⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        199⤵
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        201⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        202⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7252
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        204⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7296
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        205⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        207⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7512
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        210⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        211⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        216⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        218⤵
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        220⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        222⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        223⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        224⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8180
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        225⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7260
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        227⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        228⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        231⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        232⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        233⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        234⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        235⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8124
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        237⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        238⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        240⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        241⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        245⤵
        Drops file in System32 directory
        
        PID:7172
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7364
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        249⤵
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        250⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        251⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        252⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        253⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        254⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:7960
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        256⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        257⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        258⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        259⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8324
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        261⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        262⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        263⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8500
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        265⤵
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8588
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        267⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        269⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        270⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        272⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        273⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8988
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        277⤵
        Modifies registry class
        
        PID:9080
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        279⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9208
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8272
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        283⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        284⤵
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        285⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        286⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8624
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        288⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        289⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        290⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        291⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        292⤵
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        293⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        294⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9072
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        296⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        297⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7556 -s 220
        298⤵
        Program crash
        
        PID:8360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7556 -ip 7556
1⤵
PID:8320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afbgkl32.exe

Filesize
69KB

MD5
f77115df50d907a18a45d01614e3c89d

SHA1
cad49e55d6aa1311d286d5adffb1b853a854edb0

SHA256
4fb3bcd852a5c9fbb88b1721ff378e371e1bc04516f21a050b0d9885485af631

SHA512
dd662d7d956506b18a5216fc7007291e8b33f983d5a55932e53bd0ceba4841e15c2f2b76bc36b2030a34c8e62c9fc04caf8526eb9927df8573522185ad7b3bb0

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
69KB

MD5
fa75454557ba9dffef012a660a135f72

SHA1
9f6fe3b8b90bd817a94822bc0f3c853eb8656d06

SHA256
4a962a0396c22e52f33ad63bb1b6d46b7facbf070de72944c0fdb4e774942c2e

SHA512
c2ec65cda9e63ae27fc36d7c439030f7e7a5296b0ec0db91d60f8696e5b5e72d94241f9e877b32729a806da1c4aa1b196e19de756c2681989e0311f436785cf6

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
64KB

MD5
55c88fab654ed0160b0654dfe14424cd

SHA1
d8ca9feb00e0f7162dae31c6ec966c073044c297

SHA256
958b571ce3a1dd8e826513f65640775d35788b39979e6c87029149bec9c9452e

SHA512
5bf3286ac98b50afa4d0844c1a1e499bc0e51fb7dbf294fc7fbfc44bea7e4dbc8678b01f2082bde9daabfbb1e0e9c922bd3337016b9f923559f530946826226d

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
69KB

MD5
a39ea0a53903089ca2f29c0ef515db8d

SHA1
43cbd03b5b05e55589bb624ea6620e7b2b66f150

SHA256
3cd06e2b1e59b68b32660733262633260c69e2fd91ed786e9f0e1f2d982c6176

SHA512
2906a9a27a3b52c6d0742ade2832f391bc5b1c47ed8a542821814154f1fff0bb4f8ba34d69c464a1500b471f3db93b100672ca9cae8357b99ae9e77a814762b7

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
69KB

MD5
b050bd72f189684f6cc327106a59c714

SHA1
e9364e843a8590eb66a4d3b07955363b5df17057

SHA256
af93c96d6d9e99b3babae01c4bb08d6e3dda1d27dee6d3168021feaa6d8d0257

SHA512
e2f03a406ec2845d24a6c50325a6e9e3680f0d26a9be7087d6272fafbc5f5c69be607e8a2213bcda74afb1162561375b2d69d933e9ce69dc389869f599081b56

Download Submit
C:\Windows\SysWOW64\Bpfkpp32.exe

Filesize
69KB

MD5
5fc2b123882be4632d99c9c8d8bcbbe3

SHA1
80dece19c940c89f86e71b00e302e2fe473ff221

SHA256
3d8a876eb787ed6cd0221e8b6f324b8631ee4f1872f571a8c922398a0388185d

SHA512
1afbd7c5a7aa96990f859b17cfa2eb992bf45379fd9ee5b2e14f27fdde3afca0676f6de4bb7f163299f26183d4e452fd4525746e9472e1881c368eb20365f92c

Download Submit
C:\Windows\SysWOW64\Cfpffeaj.exe

Filesize
69KB

MD5
d945fa2794b061e82537f99bac3a78c8

SHA1
4390683e57fafd452c4eeef3c0fb0fcfd3659ee4

SHA256
c30af6be312d22c92e6e908038c442ad790ba7e0c01cf70de7d43e942efb9af2

SHA512
6bc88a700f2f7521607e35b8f37b8747b8c99d892e589ad7f589c4e294782a7d07d1bd60559a3533a188e72bc2d6c262cc987ebdf42cf0884505370d14da2fdc

Download Submit
C:\Windows\SysWOW64\Cgifbhid.exe

Filesize
69KB

MD5
b9d0b8daabc6805f3cbd84bd4ab41715

SHA1
c648c284d53c7ab8223b1940da084962f3ac569a

SHA256
8f7befeb870ad211b96da2f3884b38dfb6386b711fbc414248b4fc2bb6eafec1

SHA512
e0f1cebc7e4d08f9fbda6872b4b2ca335b10a7d1c71340f244f4c37043d9251e1ac70c65b541379cca94e04fbca0cb7eb6362e9603bd78e818ac47cba681c8a7

Download Submit
C:\Windows\SysWOW64\Ckgohf32.exe

Filesize
69KB

MD5
a1c732ffd32e73effdee9e6f5a20f7eb

SHA1
f1dfc9d0cb6639c9f255f9a16267a81d9c0005c1

SHA256
3771bb65b5bfa47469b96c92093a30bda32a06ebd592d93165754616632718ac

SHA512
92a7dcae4a3ac1a5fef82c9cb0e89b18a4279e110a236069d9109fd12af8c99ebfc728f71faaa380aa992eacf47628bce2167949b5e4904f30afca3a344d9a1c

Download Submit
C:\Windows\SysWOW64\Clchbqoo.exe

Filesize
69KB

MD5
d14278aa09914eb23e2501605891a5d6

SHA1
3122d4766c47e000df70a5779e342b881051b631

SHA256
41f9d41f26a9d11618e377d935660e2b202dcc94f09d11a0a9e97e393b842f4d

SHA512
1ba290bd9b79d4e06d19ebb7085771befc82484ecfbebc66e01a34ce3607dbe738a802e0bdc28bc6d3cb73b77dfe898c0664c8190f68e3cdbf9cf1efcc76e1fd

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
69KB

MD5
b1f482d8af92e29745f1243aec194486

SHA1
e2333abfb2ed3fd22b0ce20ddf3872094fc7b132

SHA256
c33363ee41657db997fd8d53712aeb7cde84b9b50cb0b2277950e0625d97fa71

SHA512
c7f6323dffb9a4470569d769bf5e7129f4e23c512360ac82cf48a5bca5fab2650152f85d8b68a110c946a65c8bc4ce3e9221dbf272251e5bf0bce04b6f97e11b

Download Submit
C:\Windows\SysWOW64\Cnjdpaki.exe

Filesize
69KB

MD5
87d83e778d305bee2da6ee97254a73b0

SHA1
c1a45e579699406b62a2d3442dbc88ea6aa8cfaf

SHA256
6d5aa02cc62b8395e769a96d5d7357825243a18ea89cd70e795222647fbe8cc8

SHA512
a55bdc8a736006b4da1eb3e1b8a7402233cf4bb858e231fd34f4f8620690c256e14e661ff4647c5582433495cf26e119a04d681c930fceaacd2ffb22ec224c3b

Download Submit
C:\Windows\SysWOW64\Dahmfpap.exe

Filesize
69KB

MD5
4f4f1448be62e30024f4d84d9078fb91

SHA1
36d4a7e3abdaed20f93aef1892926f47b098f376

SHA256
d0b09736525b9f299d1aa08e864ffcd6cc9d0348b27b3d082d07979deee7e195

SHA512
411e915fcaf6283db0b355e7e5c22205cfb92414dbc1edde6b9bab4a19161313f643e8d9e567fa6be2c16433323a8316492bce5c7a1ebbc7976786dbf607cd44

Download Submit
C:\Windows\SysWOW64\Dflfac32.exe

Filesize
69KB

MD5
41cd2e86848dd6ae44489a54f3de64fe

SHA1
b312fbb357b3171dc13850b86995d994eb385786

SHA256
0abecb7344ab55a8b07a1235b49c3954c28c015693654ce6a34afcd611cbbd98

SHA512
5f7dfd7f82e989d46399f7f2bb3d445b46bf99e098d72379d3083e3c33ed791b22c2742ccf7170e4a9423ca017b16bae198567f9be0dc6ce4cb1dd8f6ecd1d57

Download Submit
C:\Windows\SysWOW64\Dngjff32.exe

Filesize
69KB

MD5
cb3a9218ce3c110571dd231f0758253e

SHA1
219f83dd618b8c2874e89b466a7f584a01f6750c

SHA256
27e0d0d1a7ee9da69f96e36cf53e509aa70a827cb7df00b29698a0cb5e587dab

SHA512
4291f8a74431430bb9ccb7c4272b90b3c6c3628156ac430a2a0cdf30dc2a35f966b0474444d775b59d08dd492996f95a0ebe37fe61cd9f92cc3cd820068054ab

Download Submit
C:\Windows\SysWOW64\Eehicoel.exe

Filesize
69KB

MD5
8f91b1d4631efc2ef32193eb3e6f12bd

SHA1
12473976dfcbf1bb9d7c810845b3899ce1e3b870

SHA256
e6990387208112acaa33a17864b45524a4de03ef01325b7fc87ae1a75c6b4fe7

SHA512
bdae57ba1ee395a8dc56e248cfd64f48a06d694d25f61ad93bf41f06f096d2b718c3f2a8b2bc671c2daf8e807b39fea1876ba8fc2b7b3cc8e56d541e98e22691

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
69KB

MD5
daff8f31d6fa5b894988493dcb224c05

SHA1
229a84c3b9a5f45509b60048b35cc4b931648eac

SHA256
899abaf5ae831af5dd98bc301a762139b60e118a4cfd1291ad33f99e0a3eab05

SHA512
ecafbf899a85ce124e2460c99442f4d8a3134b38bea668195303e1c28bef65919729a46409bc90174fd2a646d40fbab0fdacb38639887be5d035d643385036bc

Download Submit
C:\Windows\SysWOW64\Feoodn32.exe

Filesize
69KB

MD5
caa93c1f862f5d2cc5f87abdf4a9a62f

SHA1
0bdf4f1ffc2961e2616ee4b30a32777866fe0bf4

SHA256
4796b55464abf8c2b11514da68990533922b4df56b40034128fdb0b9338b343e

SHA512
4cceac770a5f098ede5d0f4c5c6a4b8c5224c4410287c9002447437d9c1f8acb75b5fcfc420c0f4f150066f3b991a36d1011bb9b039a42c6ee764f03f3d8b9c2

Download Submit
C:\Windows\SysWOW64\Fiodpl32.exe

Filesize
69KB

MD5
093d6b09e3e05a070d9ec571de3435c5

SHA1
69bd6dc12e87680b4190861997e663ef0c1fa8fc

SHA256
5f35599e725457ea3ffc672297de0d65890bb526701e91d89d7a97b4303937aa

SHA512
be21e510c5da5b36515763cae95391908a879757757142371bb74c583c01c68900e568e15d55c0d139303c54bcdfdff1c187e7e214d073171c2636e529eec9fd

Download Submit
C:\Windows\SysWOW64\Hlbcnd32.exe

Filesize
69KB

MD5
552e2463a054eca64f2a7efb284e6869

SHA1
77fe4bdfa9d054e4e515f5276b7b673262545931

SHA256
b6188d1912f13738ec53136f8b2ac865f5712efb61df9030b7be2ca0d672f5d8

SHA512
553381104eec2578e177b1f9596cb8e3cac45fd9c842487e742ee47409d6f93de6cc4f22b62c2597227f79684b939f1d7666f9de77b9a8467d261d45c4809e5c

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
69KB

MD5
bdbdb0b6ea30625e5fafb1388fbc7050

SHA1
715acc5c8dab385de28820d0e24b1435e650d40f

SHA256
467923799b296bcc2e1d29745c8fae175bee1ae3d1fc44b562bcea09acb18fc1

SHA512
36af98ac5f2e92f6fdb8ce29d6dba95368dfcb61a8a13e6b0e746b7537088d5ee654dc2f928ebc22fce39c4a32e7e7147fce816cc12e5ac513e1a2f9b6390bcd

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
69KB

MD5
ba6e4ca792d919cdedfd561382dbf720

SHA1
2b8a87ba859def267289452a68947a9cbc669f5a

SHA256
151e04151ccfa44e6010ff637e60fff5a3a24ad2669971d247ce3fb6d6462284

SHA512
2031c615f3746875fb9de9c46fcb67c49a349e735ebc1f960c496acd15e983fdb89748993bff3831944d2ca1d58208a25a8939a18176541d7932131bac69a4ea

Download Submit
C:\Windows\SysWOW64\Kcidmkpq.exe

Filesize
69KB

MD5
3e522bebd224dcb39997bf727e4487a0

SHA1
793790b38eda9c5bbe73b17793818ca6adbc5f9f

SHA256
6a117df9d9d94b379c1e838dc764bb5b4b4df886f6f158c61f23a53f0c47fcc5

SHA512
b64bf4e718db84f1cb984263c05c6cf44c20d2112205152fccb6e6ba885f0ffec50a66f295f738240d9cd352c247ce0986968dd814ab5179ac0462b9d8f8d99c

Download Submit
C:\Windows\SysWOW64\Lcjcnoej.exe

Filesize
69KB

MD5
7c6623aa5e87e8faffac3546d043511c

SHA1
735380f8b4089138437c68bc1b82811e867c70fe

SHA256
979d40a1bcd6f59db90292d151d0c4873bc81c3e9279925a68444eb36fd5376b

SHA512
a86002ebe05929390add8f2efe19a751efc76ef37a742fa17e44c3e311a36d27517f54b1b36d12b0c927797ef1b04f80a0d08a20cfead50b84da42d05a2a8208

Download Submit
C:\Windows\SysWOW64\Lddgmbpb.exe

Filesize
69KB

MD5
f215f659e2872e392fab06269c8d111a

SHA1
5d5a216bfb94be79402db417691ada016ab1bc5b

SHA256
3afc51086e40c9d429ba17d0d005d50ce9ce54ca4ae98dc51744a912f148d4bd

SHA512
c3a3365c13c358212dadc9e2082d484238e39a0b8f0491d5cf78913568641980feb9ca3bfda9dda0940ce586981c7361adb0f6952ded5f37af2dce0cb321b13e

Download Submit
C:\Windows\SysWOW64\Ldipha32.exe

Filesize
69KB

MD5
57758527bc7c07a535ad579a6a50ba17

SHA1
ee1116d5760741a8059ce150ef3b995888fe5cff

SHA256
30cf088c5da0b34db0cba92b47e4bcd252022f68fa3421bbd8d67882d70e2f73

SHA512
c375ee08ad59eb085e372b262098c0d3140889089e26bf4b4fdbc2d70ce8aab92e8e660a5daa6310ae6295eeeb8990076e96811686239eb993f8a3bc727647af

Download Submit
C:\Windows\SysWOW64\Lfbped32.exe

Filesize
69KB

MD5
3e7acd6af700ce978f9731f49077ce96

SHA1
dc1ff48ba784d53b62c20d712962482512d0b01f

SHA256
d8a228bec476053673d87e1ec70f51e59ddd3dec636cc07f58402ebbfe0896c6

SHA512
866e75d0e1e840e56ca36d837af8036de4cb5c07ddddd82f4e171bb5b84edf201a1aa8a017ddea7a42f584253106a1c330ee3e925181010939bc3b2b574e268b

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
69KB

MD5
3c30b4218c4f38bb2958bd6dd3c5d9a5

SHA1
07006c4ad769987222b52ae08288c7b2f4efc36d

SHA256
f1d72e60174b5df01261465ee513d10805de01366070b85b924255086d4bc0b1

SHA512
f8c3d3c9a75f6f80fd1755471cfd207b0803e4fd09ab4b0cfce59c13c730d17171534f445df69627df34ad5e6ea9ec03e6ab541f6cbfd714af48270b8d3dc5db

Download Submit
C:\Windows\SysWOW64\Ljclki32.exe

Filesize
69KB

MD5
29d7ae086eb827160564c523f3e5bac3

SHA1
4e2fab30fb464e3ff8c14c88e0a54844b6b707ab

SHA256
1aa1498f026be79d4fab28332864e7287c42cce2080eda64106f1d32c46f8494

SHA512
818eaa9224149675edf0742ab695484b80c26fd6434e49bc91078050f4bb61bca1dfc8386282eb42a18ae8ff593365e94612731febbe597e2c066c86b8073801

Download Submit
C:\Windows\SysWOW64\Ljfhqh32.exe

Filesize
69KB

MD5
de2874ce5138332e9bce29b76bfa2905

SHA1
0706878bec53f533308d689767888002e3acbbe7

SHA256
acffbdc23df6d769364f1c63f0c3af9ecd8996812fe605288e55f9f7c73a8a96

SHA512
92e6fce1951addf98da5ae7deb28d330f864b47a7ddafd7552a388ae32d24ef1238571edb549ea65303e6e144e659dfab64d0b6696524ae11ce286fd145d7dbf

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
69KB

MD5
fcc9a71ede711b3c9d4531d12445b07c

SHA1
2f8de726bdd87880d425720eb6a1c4a0ce65b51e

SHA256
61f53e961b6e7b7a4d9f6614688e3df59284cd17eda451a59dc21278c8bfa13b

SHA512
cd5ffb86c88e77470cfacb0dbe996dde9ae32df93e7a4d84d061c591e61e5d1e87d73cf3c73a54bdd1fd24366069df38e1dfc24a5c0666158e656a948886604a

Download Submit
C:\Windows\SysWOW64\Lmbhgd32.exe

Filesize
69KB

MD5
fb7afe77f9e5d1f273b59c8134712020

SHA1
2b40dd7064d178dec92c9c9dae97bfbf5ee9d0dd

SHA256
5b666817a43c26a9943c421da4a5e7542a1758fde85ef6f87ba20afe5cc586c0

SHA512
5ba0d368d37c249265500a64f24b02254b647ff9bf33261f876da585695234dc49fa72f5e197b9ab2e5dcc12fc2035abb71d0afd9f5c018577812e861dbf9617

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
69KB

MD5
7f99425a38a6bbd65eb35ebfcf5e31ce

SHA1
2cbf5af1edcb9ad9f572aecbe5a1c483e11c02b4

SHA256
ca205ab185fb8934d4f25249e5599b509dc2fd0a4624ab22f37d89c6bb99846f

SHA512
f53c0cf939ddd661ad37ba60e3c2bbf107ee286035e3c70243b73f553cf8e28722d5d8413b50ceeadcc2bddf4caba0772302767c270d9f3ad32efd2ac6e76ec3

Download Submit
C:\Windows\SysWOW64\Lmmolepp.exe

Filesize
69KB

MD5
a42f2fe37a488d96757340c34aaa58d3

SHA1
34fa13209d911a945724d5bfab016c165c0d3647

SHA256
1abbf6b167e1d38e75c724feff13d39348aad046aff6534f42698396ff352d99

SHA512
30cf378742beabb334b921e954a8e17a76af9ebb4224d25f46630707dbb2ffc3e65e13417c1ca3e05cf54ab141def3bae9b643c9b97741d7d3d6415313a0dbae

Download Submit
C:\Windows\SysWOW64\Lmpkadnm.exe

Filesize
69KB

MD5
07e2dc148e06501b4219c7faa1ac7421

SHA1
1119f11a20d9b4b043b44c5d605a3ec4ac4d0c9e

SHA256
e3ee393886fdb900b7c935a923018f9adc8baeba31e1ac588cf2d354476a968b

SHA512
ad2aa328e6814475052035d8e99f32923777203ec7e21c129e0c14144f7074e7583654c847830109994fd3ff8691285472e443f15e3d020d54ced57c18839119

Download Submit
C:\Windows\SysWOW64\Lqpamb32.exe

Filesize
69KB

MD5
dbedda4544750c7cec13e5d52e9eb291

SHA1
0394a7e7b0160c34968f54fc3669e7e3b6582f3f

SHA256
195ef7303b7ac9ceb8de1f5d8d197a49e7aa3ad1a9afa80e3f0940ca459ba3fa

SHA512
b98463306f0fdaa031e28b0f8062789cea768e4426a72b680f6cca96335546fd53991232025bb4b0d067466b3b32719628ff5b76246fcfb80347e19f4f2afb15

Download Submit
C:\Windows\SysWOW64\Mcqjon32.exe

Filesize
69KB

MD5
77a3012267352ccf39bf027cfa2423ac

SHA1
8b45674736f6b8bf67d4c27d47ff1a4674d26ab1

SHA256
71c1bd51adfd5f45b0d6364639f909f86f5406546103ec8756e813b9251bc6cc

SHA512
cdba33b850607067226607622c3c340bd40447c910ec42f75b28e6f3b11857d824c144f21c08675e6d94411eb24e395e534d33dc7165c8983808db383adfdf32

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
69KB

MD5
18862f3496fc7363a73624c0354e1c87

SHA1
0a700666f3dbfbf65b9342bd1afbdc93f1664b7b

SHA256
b6ecef20cde140164ca8cfed817064dfb169ae3ab0325469016f0048d87948bf

SHA512
c737c4d6173fd56d891d99a1e1a882ec338fb9c6875384849a7c2902f9c5b5666e4177e46a54355612fc0a4b5710d6d0e0606ff38e8fd8d32dce4c49d3c36083

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
69KB

MD5
346e15528d9fc642b0ee78fae7f0b8f7

SHA1
1a12c169f464bdcdb376e33ff0f4a6c70e84909a

SHA256
f536de5d66cc132d7fb369e3f694edf48f334bd6836c197be38231f12922a357

SHA512
97779db8d77409bf9961f931333d8e1b365a6b6d501dc7171f1cb342d0ab6bd9547a58d1d43760df6dade28b3521885ae68604b431a1c1bff0d69fe4cebf181f

Download Submit
C:\Windows\SysWOW64\Megljppl.exe

Filesize
69KB

MD5
221d18d0019948f079b3baadc6e0b37d

SHA1
cb08e4b2e74cd6c9ca870a8694c690512231e413

SHA256
f60c8de1eae7a9b356af8c4ebe36729e43667c5c14ff5bc9775765a42bec25ce

SHA512
961eef31ddef15c696c4d6daef07585b511ff64a82e804d9c1cc3620c39fd066343ba781cc5ec76f76b157dcb2dfccdb7f2a86a623ccdeac90b7ad5dc481a0e5

Download Submit
C:\Windows\SysWOW64\Meiioonj.exe

Filesize
69KB

MD5
73e6ec22443e763b93e475f4f33d8d63

SHA1
02340462f1cd87a638600634ed99ec7d7834761d

SHA256
9edc26c459592d8d4f30b8d547527f4aba6d401788144ddacbeae8449540efb0

SHA512
9ab27b7ddd1e1bf5c31cfc2ebb817c4f43f7648f622c2516342a4f194b328abea75e469514477872be7935a250d2a0a451b0398077be9c4c389caf1f4a923d5b

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
69KB

MD5
eccf53ed95c9b037463371f933db153c

SHA1
c4808d1a140d22663411cf032670b6023a4c1207

SHA256
1b50d7c877f2afe59a7dbccedd590dbec7048b3d204e65b88392404a85e8feab

SHA512
3932e5ea4bdc14d8cf3ed70f9874545601a9a91132776df5852c6acd5571864a73a0a0146b5ef3970e280aa640717e6f98222d63ab7ec5407d7ffda15ef08cd1

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
69KB

MD5
065ce3ed208c02b7f94287a5bc9ac369

SHA1
dfd8f8ff5af7ae87a1747c014c090af0e773d1d6

SHA256
899b9e74848d932e37ad81b06e112d97cc0af133e89bf62908f5595c07e2cf7c

SHA512
770792c83df3ba07c2cf394f411c2d0e085572a9b21bc662d7710d10772f0ad9ab537617ee215b68b0e30e1dc72867e00bf6c11360c8b8a5f1b0aff5af896f7a

Download Submit
C:\Windows\SysWOW64\Mgobel32.exe

Filesize
69KB

MD5
e2238039520ec25b86ba89f7a86b5e39

SHA1
b3504a56ad0c662d107bc748de9e4c9f4b611b36

SHA256
55419b715ab714ad0b8c34739bc4f06f275b2b5ef7500209b9c064922392c067

SHA512
a3af53054914babf7dbfa8c3463c268c5bd07e276b5a7615c14ee751d37c6b71ccd1f894128eed2aa3e783911a05b9d51be9480291fca3e7d805fa1b1a53c672

Download Submit
C:\Windows\SysWOW64\Mjahlgpf.exe

Filesize
69KB

MD5
04a5717fa08f94f71c53a27bbaf1d52e

SHA1
6b0c2f02898462013e0a5e91876a89a62ef4e431

SHA256
b662ab9fa547592398f59695795170debadab4ebfdf3aad63eeb1d0f1c86a4b8

SHA512
e1643c1f2dfb5614962538d7c63c0e47e3a0269f254e0f2cbf8f69add9608e0304428b3902fa0d0db7df8f89ef20db38d71b0af985712bac37b1278ea2fd6700

Download Submit
C:\Windows\SysWOW64\Mjmoag32.exe

Filesize
69KB

MD5
6b02274ed4ad44721b6d5d47c160a4b7

SHA1
356436fd2d8dbeb50ed66f823b18465fccccd00b

SHA256
95170fe6f1a158752feed4d1c15ebf9c9ccad4c05ec222defe810d9b76fc4c86

SHA512
e257dec3e29da258afeff0f700db4ab323cd0d1f5d4d022bd443d4350e93487a1e257a78a4a4cf6c6d96534bcd877d6d8504dd54e33aa115803f661f4bf59e91

Download Submit
C:\Windows\SysWOW64\Mkadfj32.exe

Filesize
69KB

MD5
a698af4c4d5ae2d03e9fd3c90b8bce6b

SHA1
47a3c4d50985915193e9231c757e862550ff4583

SHA256
072d36f1b2e90a1b70ad36b46f0e1c570bf727b721e1d0a72e9837b2af178ec4

SHA512
e4f1f95dd4ae2caa4acea79a8068378c1028b6a5c4bb13f1b94356831ce2d3d3a710191715d7e7934a8d56585f1752febd68c49f6cf7de145ad1fa865b912fe5

Download Submit
C:\Windows\SysWOW64\Mkhapk32.exe

Filesize
69KB

MD5
bd9f0cd5b94d64d1416f3028020da0fd

SHA1
b05fbda33d55978822902356e25e63c3c8a7ce89

SHA256
26241aae50c0a5a6b37eed566fa57a8fa9ef3f31afd2ee6cacb3d997b3df5d16

SHA512
6464756a2ba70490cb87b91dd4f16eff2fd3515f9637ec3bcaea4a753abc1ff1b43da6aac4a81a1fa4a443f71ab45db2c07409c3445e672b0541b2ceddafa222

Download Submit
C:\Windows\SysWOW64\Mkmkkjko.exe

Filesize
69KB

MD5
0b27f5355d8931c5e6909853a2c870dc

SHA1
66b84b8b366b9ff673b3bd934182d0752ee7140a

SHA256
aaa68bc756a8f811230dc35306b9102e73d217b0482ad02f584dcc8ee150ccab

SHA512
eb744a2ed5a5cc7ddcc3ba05726336dce538e4841b7d43717683a65fb74a19594e3cf469be0446d23ec1f5a63322bef6d27acde016f1ecae03034fef02c3e95d

Download Submit
C:\Windows\SysWOW64\Mmbanbmg.exe

Filesize
69KB

MD5
75271d2a7e400561eb690c6cb5e6870f

SHA1
7ed5c9916d3e9d44bb5c7c5405bfc2f1a564fa8c

SHA256
0c84c5484c5ed4926fda23dbe2cc5f2590c6f8f94a548b66e429744f06b9bb47

SHA512
d161ffedad638a83dbc979364ca4e5bf88ed6dd5abe08560851de1c04be50d20738d1139b53eef3177dc7d0afe43c90d560ed257afcc1495e538644db1f6eea3

Download Submit
C:\Windows\SysWOW64\Mmhgmmbf.exe

Filesize
69KB

MD5
640df44e5ba44cfd70b8b40c62157ec5

SHA1
3aaf5063595f9f8f916fb3a1b7fce58c89eac1cf

SHA256
b7d5ef921e8bbf6f48e0ff02fcef43b62044ae56e189d2bab61c52c0e6c7fabc

SHA512
1be22af56a3dde8920811dd8f86a1a47de62bbaa0f36e7814ef8ea56f98514317b08dd4b328aafbb4b5c2330d1e891e76a9b64d9bf9adb35e0f472d974dfab48

Download Submit
C:\Windows\SysWOW64\Mminhceb.exe

Filesize
69KB

MD5
7f19d0d607afe8274c904e221bc0c301

SHA1
8d24cabff3a32e2abc4d3cdfa064fb480011587e

SHA256
44d40873faaff3c588f5fb9abc6b36d4c388d29d879f319b04c8729ad44e986a

SHA512
69841d7d07cf8e51f4b8778c69f4ad1cd3cbe1034071aa163447e4b154c870ac0d464fc92546a950cf539a8d54f54269db7410f8bd63a9f7f4b44f15f11b84a6

Download Submit
C:\Windows\SysWOW64\Mmpdhboj.exe

Filesize
69KB

MD5
da4c7400e86ef4972523597f76f6f7e2

SHA1
45254c61c1526c53f5caf3b2a123c301353af681

SHA256
00ad6655c1001e681931fc1a61a64eda0651f9a4d2b5d78192cabc02c9d16421

SHA512
5126f9c6ab5734bbbaece054b6df21d4e995251439ad08fd4dfb89725f68d57cda803b02bab1e8517b67956ef16e6bf386f19ba52c732c143871c017552aee4f

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
69KB

MD5
c5126f45871e403a521b3f5108eba918

SHA1
ca9a19aef37b15e8dc2e92974d31c5a448357af1

SHA256
cd85c9dbd0727594ff98d03dc618ebabf6b7c599e14e4dc5db4a58a6611114d6

SHA512
29d721b686011819f69e46b39ec905a8a29ca440250ba07c426a9c631e94e63256c227b9bd0a91149e729eeee21c72a6e9bd0d07c263a63c9fd22fd443a2d63d

Download Submit
C:\Windows\SysWOW64\Mnpabe32.exe

Filesize
69KB

MD5
8398bdc9231f928e394b9dc5f0f06f84

SHA1
9020b0b824b8e56eccc6dcda522ff63f97191e71

SHA256
a1a2d5af47f11089954bb0cd51d4b604ee3f2598e7414a845eb3bb159f08e0c1

SHA512
4e89f20a06bd04dae508b63d4473768d42528cca9748c90505184f08932d31417e24a025eb8e51ea86598ddc7acc7dc27b5d84f7fed4c832ae4b6dda4dc191d3

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
69KB

MD5
484a5b9c6fbdaa3db4dd90a397969aaa

SHA1
b4b359ea7cb8765145b7280774eb5245185b6a0a

SHA256
dd1c419bedd96797d7cb8eee4f05aafcdd995bb85453c040ecff5a5795d0b77c

SHA512
095e0da5d546b8a1a2e0ff3067649c9ad48b38032eb2e7fded4f441b84f04a8d9965bdbf813d7201f8af9135b7910e18797fd850af1db8f1df9c81cbe407b476

Download Submit
C:\Windows\SysWOW64\Nfjola32.exe

Filesize
69KB

MD5
97ad3c82fcb5184e34c49cb83a298d84

SHA1
03c5c48c4cd4bf9738233bd9518c5141c5c3b579

SHA256
7c84346b3129b2297542757dc3e8d286a96f4ba273ddd7891d43d68a8cbbd2c1

SHA512
98b3730ac6708c4cad1646c8fb30c013ec32247ee8b3a3627375078aa4f4b2cae894a52f32698a92526636f97f16a718005c487a3f6b0b30302775883b7ec97f

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
69KB

MD5
8e1bf7fb04c096930776dc676db5e53b

SHA1
0d115c722b303cc04adb24f73f5a3e8bf8e21051

SHA256
18ddecc0b61f1d21240b69496b56f5b030bb47902ac087267b0b8a9836a12d46

SHA512
16648212f45ab8c1a6403b10f0dcb985ed8a1c252519acda30a677b1d0e5d0854ffc858a42400b482d0bb6617ef43d43ad9763336154fb19659bdc568c423393

Download Submit
C:\Windows\SysWOW64\Nlcalieg.exe

Filesize
69KB

MD5
288a262ca5c57f10eda28f65056419a4

SHA1
ad90ea22ef5052ebac8bf8fcd3e2d7e65ef83aaa

SHA256
e16b8357ecd9acad860bd3498753a1271877fbeb3c322f6475888ba56156bd0c

SHA512
df70ce30039c8076d1935f2a03f509b53cb7d96cad9bb3ef86eea34a886f406a967e9640bfde1ac52e2a2fc8c6713787c33234e4c6b0bb0f098b5bb275cb65e9

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
69KB

MD5
c195ae9140d3a27349cfdde15001bd1e

SHA1
96be89dd590de9b1718c5c0371c6e7f812d30fac

SHA256
544a55e6bce6106e00e47ada81acdf957812e8b2507b12b558246aaedef6fe19

SHA512
737ade0dd78c695de7563e2a4b4825c053fdc4815b71bb498d4db311822a4e0dcf6f8cf3304823719056d1ed4683e56b78fbff1fe2481b4915433745c032d972

Download Submit
C:\Windows\SysWOW64\Oakbehfe.exe

Filesize
69KB

MD5
8457a48d1983ce1c000ec02f3291aaac

SHA1
b086a2abac8f5b30c2917212d3fbd0cdc54126b9

SHA256
4b75be1e67593dcce276bcca36c57d192db35be41ed6655d7f9942c9481962d4

SHA512
7290248c8e39a32b63d0a04b73a5f60759871322928b028762c2a9a82b8631771dab99a880841bc9d649d7a7e8cd540359213779b94d04a0118773bfdfaa70ee

Download Submit
C:\Windows\SysWOW64\Paoollik.exe

Filesize
69KB

MD5
ef0bff577d46d1793fe8e8b6d95ec4c6

SHA1
f6f3ff9c5bb491dba012e67c67c8f2369392910a

SHA256
00051d3445a12987b368e4637e6ca6a7e0621b1a5315699a9171ad329a188f33

SHA512
8171c5990d938f211a814006405c698ae2a67dc442f8f5e8aaa04a078f43b28093c8590ea968402d011da2e557fe6fc1ec33d856c880a3bebf3130655f69d399

Download Submit
C:\Windows\SysWOW64\Pddhbipj.exe

Filesize
69KB

MD5
2919f1e02345589276d7fc60a8b54ec5

SHA1
1f9f24844c48a101e2eea89e384650dc8858e7d9

SHA256
1af6eeda705c63e286d7a21bc8323930d2532df7c56c1afcfc8e91fc99219b9b

SHA512
d920539c67cc68e7443a099fc1359c2628078ff954c157a1c2fbdf9e779cb1ee3569b4d842e3e86803ac099646e4f3d1a9133156b90b4315ad06dd70c8c0b8b3

Download Submit
C:\Windows\SysWOW64\Pmnbfhal.exe

Filesize
69KB

MD5
9dc95176ccb74cf23b03271d3cdfce6f

SHA1
d74098ef66e114c639e1c3ad8c61e48f2a4922c0

SHA256
f2c3281e6815341eb8c94a8ec04f27e06b6232d067f88904c1133e466b46d236

SHA512
a9e042d8f78d0f8209b25266d6db9dfcb6c14df871eefca12dcc636b1052466a49712f8ed22ebfd0cd92e78932f317fd22d71890b10d4e068ddb44156b5db8f2

Download Submit
C:\Windows\SysWOW64\Pmoiqneg.exe

Filesize
69KB

MD5
660c8fa746e1f01a960e4ffb15d40996

SHA1
ae5ee6e4ba31e227c25a0494530945861db3da1f

SHA256
34d51f8704f6b0c17431eb2c13181781e139d5954a6061fbc4cb42e5560c92ff

SHA512
3d24989b1ebfa1791a675082c591cb142822685b41e0b72a948b11de94f04bf902f82860b35cb3c3a3b7800c2c0ded63fe7b5aa1c7a063ebe1cc0ebd83fda144

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
69KB

MD5
4840e5a82efbef2e3104d19ed258a36d

SHA1
a71d78f7ca8819dba690ae62c4ba044a2462b4f1

SHA256
1982aba9b0f66a2417b7408361b25a2c431042c313e418b11293061e7df9f721

SHA512
63fbebda91b0ea2d27e07e8536bfdc8bea7549fc5a9476e735d24290e9cb8f0b58cdd75d4c99ac22bbc87b5194996d6f305a2085a8bc277284c3a42235264996

Download Submit
memory/8-424-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/100-119-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/404-400-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/672-526-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/936-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/964-322-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/976-382-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1052-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1064-490-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1108-418-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1184-143-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1300-278-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1324-160-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1372-292-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1500-466-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1504-184-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1548-567-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1548-31-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1608-430-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1764-338-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1768-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1824-191-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1892-484-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1932-228-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1936-352-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1992-111-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2036-87-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2300-412-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2312-79-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2416-514-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2560-368-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2668-244-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2812-472-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2832-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2864-545-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2996-478-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3044-304-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3092-47-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3092-581-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3104-95-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3184-406-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3308-310-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3376-176-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3384-394-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3408-452-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3464-235-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3576-532-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3652-454-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3700-362-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3832-508-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3908-370-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3940-346-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3968-388-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4004-496-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4048-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4048-574-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4052-252-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4072-199-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4108-207-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4212-538-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4236-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4236-544-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4308-552-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4344-328-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4356-380-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4392-588-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4392-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4424-266-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4452-104-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4456-286-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4484-460-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4508-436-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4528-260-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4576-280-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4620-560-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4620-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4632-273-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4708-520-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4800-151-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4808-551-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4808-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4828-316-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4872-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4872-558-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4908-502-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4920-298-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4996-442-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5008-216-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5036-167-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5064-340-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5068-559-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5100-561-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5136-568-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5180-579-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5224-582-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5272-592-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads