berbew | 0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4

Analysis

max time kernel
94s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe
Size

384KB
MD5

91f0a04513778183138e922c9364ae58
SHA1

59a00007ebaf0dfe1601fb7dcc9dc4ab21caa728
SHA256

0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4
SHA512

ffa3b3be0f3449cd3292ea42324f6cddf3a81b42c2d91456c9762465e5f571bb56ca29c51858f3acecaa4c80e0e7feaabbc0e3100fba2a1e746b1b91a255ba7d
SSDEEP

6144:b5QVXlzrpui6yYPaIGckpyWO63t5YNpui6yYPaIGcky0PVd68LwYwI+8mkUr1GA0:b25pV6yYPI3cpV6yYPZ0PVdvcY9+8hka

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebnfbcbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoeieolb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coohhlpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbcke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcgpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdnbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gimqajgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kflide32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amnlme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akblfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anclbkbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lfgipd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondljl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdnmfclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gncchb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfhbga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgloefco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iedjmioj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjaabq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Imgicgca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paeelgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbcke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnojho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmcjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgnlkfal.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3084	Albpkc32.exe
4404	Anclbkbp.exe
3640	Alelqb32.exe
1908	Bochmn32.exe
4796	Bhkmec32.exe
4876	Boeebnhp.exe
732	Bepmoh32.exe
4576	Bklfgo32.exe
3792	Bebjdgmj.exe
3020	Bllbaa32.exe
4780	Bedgjgkg.exe
1588	Bnoknihb.exe
2140	Bdickcpo.exe
3644	Coohhlpe.exe
216	Cdlqqcnl.exe
1536	Cndeii32.exe
2200	Cdnmfclj.exe
2308	Ckhecmcf.exe
2996	Cofnik32.exe
4104	Cfpffeaj.exe
4924	Chnbbqpn.exe
4908	Cohkokgj.exe
2132	Cfbcke32.exe
4628	Dmlkhofd.exe
3248	Ddgplado.exe
728	Dmohno32.exe
3544	Ddjmba32.exe
2552	Dooaoj32.exe
2748	Digehphc.exe
4212	Dndnpf32.exe
4388	Dijbno32.exe
2616	Dbbffdlq.exe
2264	Ekkkoj32.exe
432	Efpomccg.exe
2700	Ekmhejao.exe
4456	Ebgpad32.exe
2392	Eokqkh32.exe
756	Eehicoel.exe
4236	Ekaapi32.exe
4632	Eblimcdf.exe
3668	Eifaim32.exe
2512	Eppjfgcp.exe
656	Ebnfbcbc.exe
5040	Fmcjpl32.exe
1064	Fpbflg32.exe
2272	Fflohaij.exe
3688	Fijkdmhn.exe
2036	Fligqhga.exe
4896	Fngcmcfe.exe
4800	Ffnknafg.exe
2952	Fmhdkknd.exe
700	Fbelcblk.exe
456	Fiodpl32.exe
3240	Flmqlg32.exe
4884	Ffceip32.exe
2240	Flpmagqi.exe
1472	Fbjena32.exe
3128	Gehbjm32.exe
212	Gpnfge32.exe
1156	Gblbca32.exe
1548	Gejopl32.exe
3700	Gldglf32.exe
1576	Gncchb32.exe
2764	Gemkelcd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ppcbba32.dll	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Jlkidpke.dll	Ckebcg32.exe
File opened for modification	C:\Windows\SysWOW64\Dojqjdbl.exe	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Ahbohd32.dll	Gehbjm32.exe
File created	C:\Windows\SysWOW64\Jinboekc.exe	Johnamkm.exe
File created	C:\Windows\SysWOW64\Ibcbfe32.dll	Jokkgl32.exe
File opened for modification	C:\Windows\SysWOW64\Ocjoadei.exe	Opnbae32.exe
File created	C:\Windows\SysWOW64\Qjfmkk32.exe	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Fmhdkknd.exe	Ffnknafg.exe
File created	C:\Windows\SysWOW64\Jofalmmp.exe	Jgkmgk32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpoihnl.exe	Lpfgmnfp.exe
File created	C:\Windows\SysWOW64\Nnojho32.exe	Mfhbga32.exe
File created	C:\Windows\SysWOW64\Alelqb32.exe	Anclbkbp.exe
File opened for modification	C:\Windows\SysWOW64\Dbbffdlq.exe	Dijbno32.exe
File created	C:\Windows\SysWOW64\Ekaapi32.exe	Eehicoel.exe
File opened for modification	C:\Windows\SysWOW64\Ffnknafg.exe	Fngcmcfe.exe
File opened for modification	C:\Windows\SysWOW64\Imgicgca.exe	Iepaaico.exe
File created	C:\Windows\SysWOW64\Efmnhl32.dll	Lcnfohmi.exe
File created	C:\Windows\SysWOW64\Mgloefco.exe	Modgdicm.exe
File opened for modification	C:\Windows\SysWOW64\Mgloefco.exe	Modgdicm.exe
File created	C:\Windows\SysWOW64\Mncilb32.dll	Cdnmfclj.exe
File created	C:\Windows\SysWOW64\Bhpopokm.dll	Ffnknafg.exe
File opened for modification	C:\Windows\SysWOW64\Glgcbf32.exe	Gemkelcd.exe
File opened for modification	C:\Windows\SysWOW64\Gimqajgh.exe	Glipgf32.exe
File created	C:\Windows\SysWOW64\Jleiba32.dll	Jinboekc.exe
File created	C:\Windows\SysWOW64\Eleqaiga.dll	Mfhbga32.exe
File opened for modification	C:\Windows\SysWOW64\Opclldhj.exe	Onapdl32.exe
File created	C:\Windows\SysWOW64\Bgnffj32.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hibjli32.exe
File opened for modification	C:\Windows\SysWOW64\Hfhgkmpj.exe	Hoaojp32.exe
File created	C:\Windows\SysWOW64\Cedckdaj.dll	Pjkmomfn.exe
File created	C:\Windows\SysWOW64\Hiebgmkm.dll	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Adhdjpjf.exe	Amnlme32.exe
File opened for modification	C:\Windows\SysWOW64\Chfegk32.exe	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Dgeenfog.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Hmlephen.dll	Cndeii32.exe
File created	C:\Windows\SysWOW64\Dpaagldf.dll	Fngcmcfe.exe
File opened for modification	C:\Windows\SysWOW64\Chnlgjlb.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Bgmioggn.dll	Fpbflg32.exe
File created	C:\Windows\SysWOW64\Ifolcq32.dll	Mjjkaabc.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Dbbffdlq.exe	Dijbno32.exe
File opened for modification	C:\Windows\SysWOW64\Flmqlg32.exe	Fiodpl32.exe
File opened for modification	C:\Windows\SysWOW64\Gehbjm32.exe	Fbjena32.exe
File created	C:\Windows\SysWOW64\Njjdho32.exe	Nglhld32.exe
File created	C:\Windows\SysWOW64\Agimkk32.exe	Adkqoohc.exe
File created	C:\Windows\SysWOW64\Ndmdae32.dll	Hplbickp.exe
File created	C:\Windows\SysWOW64\Kmephjke.dll	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Dllfqd32.dll	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Kpoalo32.exe	Knqepc32.exe
File created	C:\Windows\SysWOW64\Fhgcme32.dll	Boeebnhp.exe
File created	C:\Windows\SysWOW64\Oidalg32.dll	Digehphc.exe
File opened for modification	C:\Windows\SysWOW64\Ekkkoj32.exe	Dbbffdlq.exe
File opened for modification	C:\Windows\SysWOW64\Eblimcdf.exe	Ekaapi32.exe
File created	C:\Windows\SysWOW64\Nlnhqepf.dll	Eblimcdf.exe
File created	C:\Windows\SysWOW64\Hiipmhmk.exe	Hbohpn32.exe
File created	C:\Windows\SysWOW64\Ehkaqc32.dll	Ifomll32.exe
File created	C:\Windows\SysWOW64\Iidphgcn.exe	Ickglm32.exe
File created	C:\Windows\SysWOW64\Bedgjgkg.exe	Bllbaa32.exe
File opened for modification	C:\Windows\SysWOW64\Cofnik32.exe	Ckhecmcf.exe
File created	C:\Windows\SysWOW64\Ambfbo32.dll	Fbjena32.exe
File created	C:\Windows\SysWOW64\Gqhejb32.dll	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Ekamnhne.dll	Kcbfcigf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8056	7440	WerFault.exe	349

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbbffdlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fligqhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iepaaico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgflcifg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmmhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdjinjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phfcipoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kngkqbgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjodla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpmnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgeenfog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gblbca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoeieolb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jokkgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpoalo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhecmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imiehfao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llodgnja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igdgglfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iibccgep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phonha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpnfge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejopl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eehicoel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibjli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kflide32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnojho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbjena32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fijkdmhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gehbjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmfkhmdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmcjpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlglidlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljeafb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dojqjdbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedgjgkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efpomccg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnepna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dooaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eppjfgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gncchb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cocopa32.dll"	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fbelcblk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hplbickp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geqnma32.dll"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjhhfnd.dll"	Bedgjgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chnbbqpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmphblgf.dll"	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Folnlh32.dll"	Nnojho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcdqdie.dll"	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cohkokgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jgkmgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqpcjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbhafkok.dll"	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdlqqcnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhejhfp.dll"	Jgkmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjceejee.dll"	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bebjdgmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpcnkaj.dll"	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akfiji32.dll"	Nclbpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghien32.dll"	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkdgfllg.dll"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckkpjkai.dll"	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieoigp32.dll"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iikikigb.dll"	Cfpffeaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dooaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgmioggn.dll"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mgloefco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Opeiadfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iepaaico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkaqc32.dll"	Ifomll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cndeii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eokqkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbjena32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjllddpj.dll"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekgliip.dll"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjgdg32.dll"	Albpkc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3084	4268	0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe	87
PID 4268 wrote to memory of 3084	4268	0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe	87
PID 4268 wrote to memory of 3084	4268	0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe	87
PID 3084 wrote to memory of 4404	3084	Albpkc32.exe	88
PID 3084 wrote to memory of 4404	3084	Albpkc32.exe	88
PID 3084 wrote to memory of 4404	3084	Albpkc32.exe	88
PID 4404 wrote to memory of 3640	4404	Anclbkbp.exe	89
PID 4404 wrote to memory of 3640	4404	Anclbkbp.exe	89
PID 4404 wrote to memory of 3640	4404	Anclbkbp.exe	89
PID 3640 wrote to memory of 1908	3640	Alelqb32.exe	90
PID 3640 wrote to memory of 1908	3640	Alelqb32.exe	90
PID 3640 wrote to memory of 1908	3640	Alelqb32.exe	90
PID 1908 wrote to memory of 4796	1908	Bochmn32.exe	91
PID 1908 wrote to memory of 4796	1908	Bochmn32.exe	91
PID 1908 wrote to memory of 4796	1908	Bochmn32.exe	91
PID 4796 wrote to memory of 4876	4796	Bhkmec32.exe	92
PID 4796 wrote to memory of 4876	4796	Bhkmec32.exe	92
PID 4796 wrote to memory of 4876	4796	Bhkmec32.exe	92
PID 4876 wrote to memory of 732	4876	Boeebnhp.exe	93
PID 4876 wrote to memory of 732	4876	Boeebnhp.exe	93
PID 4876 wrote to memory of 732	4876	Boeebnhp.exe	93
PID 732 wrote to memory of 4576	732	Bepmoh32.exe	95
PID 732 wrote to memory of 4576	732	Bepmoh32.exe	95
PID 732 wrote to memory of 4576	732	Bepmoh32.exe	95
PID 4576 wrote to memory of 3792	4576	Bklfgo32.exe	96
PID 4576 wrote to memory of 3792	4576	Bklfgo32.exe	96
PID 4576 wrote to memory of 3792	4576	Bklfgo32.exe	96
PID 3792 wrote to memory of 3020	3792	Bebjdgmj.exe	97
PID 3792 wrote to memory of 3020	3792	Bebjdgmj.exe	97
PID 3792 wrote to memory of 3020	3792	Bebjdgmj.exe	97
PID 3020 wrote to memory of 4780	3020	Bllbaa32.exe	98
PID 3020 wrote to memory of 4780	3020	Bllbaa32.exe	98
PID 3020 wrote to memory of 4780	3020	Bllbaa32.exe	98
PID 4780 wrote to memory of 1588	4780	Bedgjgkg.exe	99
PID 4780 wrote to memory of 1588	4780	Bedgjgkg.exe	99
PID 4780 wrote to memory of 1588	4780	Bedgjgkg.exe	99
PID 1588 wrote to memory of 2140	1588	Bnoknihb.exe	100
PID 1588 wrote to memory of 2140	1588	Bnoknihb.exe	100
PID 1588 wrote to memory of 2140	1588	Bnoknihb.exe	100
PID 2140 wrote to memory of 3644	2140	Bdickcpo.exe	102
PID 2140 wrote to memory of 3644	2140	Bdickcpo.exe	102
PID 2140 wrote to memory of 3644	2140	Bdickcpo.exe	102
PID 3644 wrote to memory of 216	3644	Coohhlpe.exe	103
PID 3644 wrote to memory of 216	3644	Coohhlpe.exe	103
PID 3644 wrote to memory of 216	3644	Coohhlpe.exe	103
PID 216 wrote to memory of 1536	216	Cdlqqcnl.exe	104
PID 216 wrote to memory of 1536	216	Cdlqqcnl.exe	104
PID 216 wrote to memory of 1536	216	Cdlqqcnl.exe	104
PID 1536 wrote to memory of 2200	1536	Cndeii32.exe	105
PID 1536 wrote to memory of 2200	1536	Cndeii32.exe	105
PID 1536 wrote to memory of 2200	1536	Cndeii32.exe	105
PID 2200 wrote to memory of 2308	2200	Cdnmfclj.exe	106
PID 2200 wrote to memory of 2308	2200	Cdnmfclj.exe	106
PID 2200 wrote to memory of 2308	2200	Cdnmfclj.exe	106
PID 2308 wrote to memory of 2996	2308	Ckhecmcf.exe	107
PID 2308 wrote to memory of 2996	2308	Ckhecmcf.exe	107
PID 2308 wrote to memory of 2996	2308	Ckhecmcf.exe	107
PID 2996 wrote to memory of 4104	2996	Cofnik32.exe	108
PID 2996 wrote to memory of 4104	2996	Cofnik32.exe	108
PID 2996 wrote to memory of 4104	2996	Cofnik32.exe	108
PID 4104 wrote to memory of 4924	4104	Cfpffeaj.exe	109
PID 4104 wrote to memory of 4924	4104	Cfpffeaj.exe	109
PID 4104 wrote to memory of 4924	4104	Cfpffeaj.exe	109
PID 4924 wrote to memory of 4908	4924	Chnbbqpn.exe	110

C:\Users\Admin\AppData\Local\Temp\0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe
"C:\Users\Admin\AppData\Local\Temp\0b0923e87ba3b6d5171fec828bad1985387570bda6bd1bc565415820bf55eae4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\Albpkc32.exe
  C:\Windows\system32\Albpkc32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\Anclbkbp.exe
    C:\Windows\system32\Anclbkbp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\SysWOW64\Alelqb32.exe
      C:\Windows\system32\Alelqb32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1908
      - C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        25⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        27⤵
        Executes dropped EXE
        
        PID:728
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2748
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        31⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        34⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        36⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        37⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:756
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4236
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:656
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        47⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        52⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:700
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        55⤵
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        56⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        57⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1472
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1156
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3700
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2764
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        66⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        68⤵
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        69⤵
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:540
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        71⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        72⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        75⤵
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        76⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4256
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        78⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        79⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        80⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        81⤵
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5400
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        87⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        92⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        93⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        97⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        98⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        99⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        100⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        101⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        103⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        104⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        105⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        106⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        107⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        109⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        110⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        111⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        112⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        114⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        118⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        120⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        121⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        122⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        123⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        124⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        127⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        128⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        129⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        133⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        135⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        136⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        137⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        139⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        140⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        144⤵
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6156
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6200
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        147⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        148⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        149⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        151⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        152⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        153⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        158⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        159⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        160⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        161⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        162⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        163⤵
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        164⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        165⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        166⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        168⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        169⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6328
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        171⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        174⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        176⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        177⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        179⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        180⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        181⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        183⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        184⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        186⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        191⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        192⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        193⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        194⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        196⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        198⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        199⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        201⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        202⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        203⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        206⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        209⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        210⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        212⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7476
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        216⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        217⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        218⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        219⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        220⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7824
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        222⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        223⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        225⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        226⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        227⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        228⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        230⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        231⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        232⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        233⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        234⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7684
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        236⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        240⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        242⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        243⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        244⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        245⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        246⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        250⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        252⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        254⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8156
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 224
        256⤵
        Program crash
        
        PID:8056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7440 -ip 7440
1⤵
PID:7840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agimkk32.exe

Filesize
384KB

MD5
5ea5d34ae47880f9a870a831a661b627

SHA1
884a80244a7d861bac67d20462bcd6bd8c56f96c

SHA256
918ff90b67f54d5e948802953717e72a77f84b7f933286ea880ee045ac000130

SHA512
80725ea3559781c90f7dbd823bdbe5ff6c180854e2fc5b2161e7820e037345ca47543513cfd131c3b9b16ac7f14f860210388ef7bcd9364e3321d51dbe6058e5

Download Submit
C:\Windows\SysWOW64\Ahofoogd.exe

Filesize
384KB

MD5
c8935011f8f49bb391db7b7903bedf72

SHA1
bd33e5d7167c90dc0a955701ebab164c1d2f0e76

SHA256
6a87bb96bd8fa336e4d4fa134136b30e064f3062b48e36e9e8163f5b17b344d5

SHA512
a4b7726d3370895c219ad5535c687dd0f4c114f69a650e3eda5dc75826071776301c0264e723b84be8b08ad901d83ce34bdd11897bae6ae78d5de430ebcef2d1

Download Submit
C:\Windows\SysWOW64\Albpkc32.exe

Filesize
384KB

MD5
960b6ad44e716d469f17119374c7c42b

SHA1
9a638639b0106c114262d158018d4db550a81072

SHA256
1b919819371fb50724f2c3f8b6d54ca04c065dfb1288eccf5ec95d61a77a6e3e

SHA512
07f5c4811aed2d8f4afcf7860fa4f16b50f1fa1528b8217dbc4041d9dbe2fc10c83922426116edc898b56e7d348edbf9f0e7749f50c90c602f582a8744b237be

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
384KB

MD5
89fddeb9298f98076e391444c67169fb

SHA1
23b3dd03ddbe3383754e52991e344d81dbc18734

SHA256
d23fd27e70887bfc2b74b9ad48a9ba2a81c5792f73f7e2d31ec4d6c984b7cb3b

SHA512
6e09bfec5c49f72c204d163c25ba9ea9f21560157064eeb9e50a45ced4fded2651b7fb7d6c7f949699309a5bb0313ce969707ca456bb88f5f5b1baf6942f9f7f

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
384KB

MD5
f0cb7a0f474a0a2c9feeeb91f8c32820

SHA1
736d2087bfd3a638de3519d0ff7fa779a8b3729e

SHA256
fa27f8b81fc55a89cf7f79374ee8071d3aac3f50490bb45de32bdfa0b29a4431

SHA512
6202ec6bb44e73e078dbe45051abfa8eca452c55558c645091095ac18f7affd245e3d551e2df2d6614785d19da9a8817d8206f2c41870431a6e41500344a72dd

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
384KB

MD5
7e84c067e4a6688c7c128c0413896bd1

SHA1
0af5e4773d78746bc792e70008ea87188e05ae33

SHA256
737d29e0799d63d845029c30d86689e6c1aa4dd1cd43b64a27b5328e764590f1

SHA512
0e81887921db65e8d1d95ef45d9abd3a694d079150dee06dad641bbe041e556d409e3473d2ba25cd74296a97e33731686c52161e1f39c00b888b084080ecf917

Download Submit
C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
384KB

MD5
4697122547d146c9d51230d7832d5bd5

SHA1
bde208dde7d28271d02e3fe5f959cef679502b2c

SHA256
b78d7624ce5a87bb7a345a830dc25f2e3e5c5884c7ad3448065f6f718ae77842

SHA512
85769814108b8ec185d450c0442030d6c4af55e74ee20d6fec4d5b0500e162117003b374ebe3bfc8c04b930c4fa5924974ba1a80a3e40d8a7f946b7324fe9bb2

Download Submit
C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
384KB

MD5
59f15e85002d3ab0e53804f7ad9addb4

SHA1
4533b808a2cbf875301a8af9c22891a95c8fa0f7

SHA256
562e3dfd64c00b25c645a873c7719abc4f2f12f8c8fdd6281d9d7d8f3fb7be5c

SHA512
83e0073ddcdeb4a5099597c1675e19797d1d58cde8393a465507fc9a52284c2441472bdf17e8ee3b1a0a77e69105bf1bb27fbabbd8327d87a9d99e8769ab6c74

Download Submit
C:\Windows\SysWOW64\Bebjdgmj.exe

Filesize
384KB

MD5
116415dbfcb70c3e907fdb698bdfb113

SHA1
be8eddc34034a1eeba2798e0fb3a2f456428a0a7

SHA256
73cb50fa5e7f05e472e39a47e9448ae5cab4a1d4cf7fb6bc38ad4cbbc61b98a6

SHA512
bd09fedfe5c21833330a380c27d49925a98c306988326dd4c9431159b45ed258d44bba72e26b41dc14ed455536ccf85f2e111df0c9fbd8986c357c168e4c6e83

Download Submit
C:\Windows\SysWOW64\Bedgjgkg.exe

Filesize
384KB

MD5
ace2c293cc35a5d55bf7536b4a8cf5fa

SHA1
a7a67c5417d948123a7a465a785d1a3879663e9b

SHA256
13977fcfbd110eb2c78b3b1d8031a3256ff89b14eea0946d019b2a3a467c27ab

SHA512
71ee7f0da0f61c404bd105c86dca217e2450bba1d0e08a81e7b880c5ec6e419c0f192fb1273db3604b09de64b764d19fc496c7509e1356e718508da1ff889ac5

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
384KB

MD5
2bdc5fbff5fc88434d9bd232e4ffc403

SHA1
3604b6e14f1c00916c96aad9d78d2e9e852a3c58

SHA256
e0d48c535edff9719271109b281540fbeb8f350aa493faeb0869eafe5330e590

SHA512
fd4928417baaa815a4c18120daac7f2922d341d5a7fd3d984c4a60ed0d2bb2c8bf53bc2dccbed4ca854fca9e5a7d6e80934c02c28e71c9a496ee06b922d6e185

Download Submit
C:\Windows\SysWOW64\Bhkmec32.exe

Filesize
384KB

MD5
62ec8d7ebddff22b28b2e22de3268042

SHA1
8cbbaa1e2e5d987d9528d3f5d379d6fa390c7c8a

SHA256
5883f29f29dd98bd2427cd13594986e48dad9482f5402ac53b7502058789d3ba

SHA512
fc0d9e894e2c70fc642664fd914e2b3d81126de00a4fb7f5fb861b9fd00dad03964fc7f16820d37d7f25253775f809a04f341c35b2da730f35b1e7b053c61286

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
384KB

MD5
6c74e6645ea5aeaff8b77dfd993b933a

SHA1
4d3ad5a2e32da252829ecf833ce7d66d917d6dfe

SHA256
2601edff81e5ad5ac53ded877715f9aa403a38718b7a6d7e70d62a19e32a2437

SHA512
20000727a053afe7e6d64da4543ca73ee48ed5aad076e4c657222e530acd51396ff4d43503429e80851911df5e6eaeccc899acd2866fde20164b0d9c3b0bd28d

Download Submit
C:\Windows\SysWOW64\Bklfgo32.exe

Filesize
384KB

MD5
b06b17c0508e5b606655b4a9c93e3ac8

SHA1
eaf7eab1cd11ced7a8e09c17e48acde262adfa7a

SHA256
77a74d92d3840a99087376ece85f15952f0a22f94f0a72c3aade9b3b082cc394

SHA512
e0abf9c2d1a04bc2d0c199153c489cf00b662569b4fe317735955dc736727b63ee22deb9281bcc8ad6abcc764de891034445d1b4e08fb98b6be40e98e043ed93

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
384KB

MD5
28801454736a66b4bb6c77cff0415091

SHA1
04a7fe3faf13d94d85bba409ff13cf3089857a26

SHA256
0c7c457a681b6f85e9e9e53e401ba138d05f589a0863de5d6356179b6e545277

SHA512
48fbb1f2cc63abfb70f3e20c302d0e1a2c3e37ca0761a3b803d0672e12b5c36940dba6c7dadc939acb65d2f0683026cc8ec63564d9057f46daba6feb3780e8f1

Download Submit
C:\Windows\SysWOW64\Bnoknihb.exe

Filesize
384KB

MD5
69ef26e37856cfad70cfd8a1129cf96f

SHA1
d69fae5b89efd7ba3595c20e2b8e9d81f8e294a6

SHA256
1126216e34b816ea654c75f08ba250dde55bf1a4e7d4820b8443cbe7909f32aa

SHA512
492caa169cd9fe4649ff6ca0a578ba621b02d3a2f5c12ebc8b2c4546932c12ccf498bebebfe2175d3ca656439a89e40480f146860c91c439c42975277b10c4a1

Download Submit
C:\Windows\SysWOW64\Bochmn32.exe

Filesize
384KB

MD5
152efcdd8c2ddb1395a26d0d498f9568

SHA1
19a87e6921783b45c742a441ac31b3b8a2ba6d5a

SHA256
04cc7bd601fbc11f347d8e97bcf4f3a58a3c0d96d1a20dc9219732a712a8b892

SHA512
378b00eafe3499e4fbc9babc9aef935ac4aed42f8f3dc233ebca5371276dfef4f168806d889fe452c325eb082e6156f6dc5241549545d22fbae8f6631e98fa99

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
384KB

MD5
6219e3d785eacd69fb41834b35f10457

SHA1
8fe348d287bdb943c725bc6f486e2d73cd4cc2c4

SHA256
0ef88a16285fbb392f0ddcdbee716505cf4d6e653c58596390635a9f8494192d

SHA512
21820a38ed54c0db0ade96ad14079e4a71870b6d85d7fe4238e422f19a4de0216a73834495afcdfd723296d049ffedab0954d6f50d604a3d8a6a2c9f439b1943

Download Submit
C:\Windows\SysWOW64\Caageq32.exe

Filesize
128KB

MD5
1ee5a7b07dc6ac25ef62deca8d540fb0

SHA1
7ede7802a956f6317c6f191bebfd4d5daffe09f0

SHA256
c592be5cf9646eedbaf3f9077dc979ba80ae7250d5c42d3b4f3d5bd1b89dd69f

SHA512
08e2b2b7afce7fa6369cdfb564f1e639bccf041f5162c373820777d5e1c6095e00f273f48635d5d909681a34bf463021c1107ce29e3575cd144a23c73f75ad24

Download Submit
C:\Windows\SysWOW64\Cdlqqcnl.exe

Filesize
384KB

MD5
ee39fa70323e537cde585bf7264dc633

SHA1
0dc850f2ff5c35cddaa478dd86462a55071f0f0d

SHA256
cd336a36dfba6ef1300db1a01808c90ecedd7b70b9ef1879e00ceccb88125608

SHA512
643b733bbabb453e68fa6d8eb884c290fa79538bcf6170dd86619cdf071573734f202ad1a22c87863945686705ea2fbb84a50eb942b9c655ee5e3fde64535014

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
384KB

MD5
6dcbfaef6faee9a96bfd40b23670dff7

SHA1
1bd0fc048738ec137b7a5b6b46ca99d89f609d6a

SHA256
7d956f8e0ba415dc352d15e0c847c9cf2f1e8a6204cd15725236272400bde111

SHA512
b76fde2bbeaba69b4ee1ac14c48bd265ec71765978da9c119420061ee767fa7bb2ce5a02db30a54a7b09a77d805a688837ca943c910677667cc98ca937faf957

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
384KB

MD5
cbb7887267fc0940ffe18d4c8cbf6820

SHA1
6a9cfa90e8a082d71258ec8478ac5e1c717e078c

SHA256
cae63c5ee9badaf328043a80fc44e51e0e5facee19acb7ded13c1409f9f13eae

SHA512
0ba8d5d5db39ddc1addd3b2efc9ee370691f6ec0d4b44a4b27e255d034957999c7dba3c112f18e804b83904d6463c481754568c60522c7c4db2326c1c875dae2

Download Submit
C:\Windows\SysWOW64\Cfpffeaj.exe

Filesize
384KB

MD5
2ee3ba1ab0d5832b5967dd85f524deb7

SHA1
d9daf5bfe5db477b1497e3b5d287dd958f4fc264

SHA256
7e083a72d76b2d3b7014021858b062aff3e1f1efca1c4ed6e28542ffb3c3abb2

SHA512
548a5f6d44b8f62461f3246a82db2fd012ac60c06ca33424f5df12386f8d16fa225031e4179d6fd0a2395c125c0a65dac69e2e81e60182e5d74da738cc34ed96

Download Submit
C:\Windows\SysWOW64\Cggimh32.exe

Filesize
384KB

MD5
f72177eb11c9daacf53155415dc88fe4

SHA1
7207cf6c5e68aa1f3c37a0430916d337fe73628c

SHA256
77cc08a4952c4e2b01cb8a6b493b31e8ba80c46890e32f392967af73348f83db

SHA512
a614f7ca46ef454fac58f80179e7e25adcba5b93d66d1fea46c880fc816a7ddae38a19c3d388987a1100707f643e399f332be7faa33a731a1beb39946961c56d

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
384KB

MD5
7078713756896ca25e563a3090ba4654

SHA1
82753c851a2bb22b86183939f932f5f1557e21cc

SHA256
46c51d6d45dc3c311181a6d5cf6a8d5a32b6dc8e9540d228e7fd95cb3034df77

SHA512
967ef3ac743b7a50ef2de97fa1fdcf5bd59274c87d90c3a0708224a21a238a930c08ac0033716b2a308714fef2924daf0c53cede5b95aa66a4f4779ca0ad61d5

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
384KB

MD5
4a68ffe4dce4f245d4104592e78d9f28

SHA1
fef8ece5ad55ad303bca92bdf3773771b792c9dc

SHA256
0ed7cf03ef00bd71b727118ce5fd9ac164f89367f2819a34b539d727fdf31bff

SHA512
42fe9a071432d1b1eb1a0beaaf277b50fe7162651b7a7839ff04697d52d0825badca90173041ddae598eb3b2f072b3580f5dfb4956955bd4462184de43432438

Download Submit
C:\Windows\SysWOW64\Ckhecmcf.exe

Filesize
384KB

MD5
73a44c445ec3a41f798b07cafe057575

SHA1
ee8f0c15fadfba262fb06b051e94a5798755ed53

SHA256
72a0040c1c600f742f50530842c5a83c2813701507a8fc0d39228660c2502eb0

SHA512
b52150a70e1f4f5f6cb91148a9f9cc29d6948ffbf05b9cd3d5839ac13a59f78fe70267be0aa29e060722ac7fac895eee2ba012093d50aa565cb5407ac3d29ae1

Download Submit
C:\Windows\SysWOW64\Cndeii32.exe

Filesize
384KB

MD5
4b19c095ac08acdd3ce70b9ceda72234

SHA1
19d29c1eb971b97912f908d00af33ad437e01c71

SHA256
8eeaef5bea99ab8467a0211be1b7444e6d7d26193be691e5b7962fc4b64acb3a

SHA512
21e2f6237dde45bf37feab3688104602e6127ed5f9a85f91a12b66d671fce02a1958146b6272d1166d690719536d8a3255957f34cb5a6f23539125029c043c6d

Download Submit
C:\Windows\SysWOW64\Cofnik32.exe

Filesize
384KB

MD5
355d1dae01096a786c53d2907783e596

SHA1
19d0d39d8e41031ca6bfb8ceae535ab7faec5403

SHA256
3dc698d3e08f51d2090cad7c64127e91d391902280769aa168dbc1d669e7f3cb

SHA512
0ca4fb973eef2807266b74b0ea18a307c6172432bd54f655171c70c4460909ddffa22779121dc6ffc867406ba97b5fa318863b07cf4f0840847724792538edf8

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
384KB

MD5
3981f285445907242bfb98f301091e87

SHA1
8e772c3a4409bdfbbae01502054f6191336a8f39

SHA256
c463a6ff0bfd2231403132cc01318302edd2e35e0b1b6d9dcd41617cc25ff1a3

SHA512
101558c5dff1c31b394f96badb4f0b274b94a8300bcdec65c28509975d2135a69f27ac2f44811f02b1dae1172d2fe2b62d4deb2ae95c9976dca200faafd7749c

Download Submit
C:\Windows\SysWOW64\Coohhlpe.exe

Filesize
384KB

MD5
686db7e5f45f03bcb1e3ed99b094bc34

SHA1
1e0d17ae7c6f1de46f2ff700379b4d44fe0e9b17

SHA256
56e1089133bc218fb695dca60754c522d15bbdeac26f76499339fff1687a37b4

SHA512
8b543495c51540932e766a872d48cf1dc1111d25b5ce289bf6eacd15505856712db6780b900a7197cc4afb49929085ea64d08ce2d18e9614a8c236c4603f1ddf

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
384KB

MD5
ab9b9ee0c5815634711ebbdff7b3fdb8

SHA1
09159cd71b794b42bbb75d44053cd4c5645b7ae6

SHA256
e169f3eee7d66aa47dc8d4380315ffdb10d07f4a576e0a62328e7bf47be02a20

SHA512
3930fc14924e05df36be77f8f3ed752280ffa9e0bd66c35088b7c6bd917c525d5446ee621708ac62ab8c6ebaaa9ec4ec29f70fd4ccc475a0f2a6bc559d08518e

Download Submit
C:\Windows\SysWOW64\Ddgplado.exe

Filesize
384KB

MD5
8abae41337b82bb1920e669f182eb3fb

SHA1
ab1a87883423ec4d4c66c9ccfd2324e1f3891d98

SHA256
79e9524809e30dbbe8892615b660ce848b6459fe7c4fd3be6ff7d2e7d4e6c003

SHA512
4014af6ef9825ad6a9ce46a0e0173d3166ac1c531e23436ef2ba79549a417a3dd1e9fa8c4c53aaadef2e877b4b98f79cd1c2ff7f9ec1664f3040e2a6d8fde7b6

Download Submit
C:\Windows\SysWOW64\Ddjmba32.exe

Filesize
384KB

MD5
05eb3a1c414035ecd5bbce917626d32a

SHA1
8354ade8b5ea80049d704fb0fd1d86915b3d34d3

SHA256
3b7c5529fe36fc88873b04103ddc1a2e186cfc776f8758b8d8cb93a60fbbe995

SHA512
c61dcad69520254cf37b51f7c85a5b033de1dfa5e66833da4a3651ca3d1b7a186ba394b9f34c91fa7b385c5e5da35f875075226c988ab01df14ab66f233de168

Download Submit
C:\Windows\SysWOW64\Dgcihgaj.exe

Filesize
384KB

MD5
fd82599a4c631ce8bdf33031b3b58375

SHA1
eb613fd3be45c28de68c9d94785edd8fada4f02e

SHA256
499eaaf7752d544093cd9c95fff4b99268a7b5e5b4bb3e0b457800fde3c5c94b

SHA512
793f66644230d084418c11139782376bb85630001f6f27840dc8963b4e0822c49ac73784b0b73383c0c1c767f8ea4ab0c5b5467d890587b5ec2267dd670735b6

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
384KB

MD5
f9de535e3c23a2afd42e774287698f14

SHA1
c709848f15e8d062503cc2a2ee43275560841067

SHA256
ddb75b19ace0416d630d7e84fbb3006c244f8bff95668e265452daa5d481ddcd

SHA512
e4068d9612928da68e2fa39cf1f340055e0c66392ae84335eac4791caa75d3e4859f1ddedc5d2df8827fac370b096b03527a3024542d8027eea3634c31e289d0

Download Submit
C:\Windows\SysWOW64\Dijbno32.exe

Filesize
384KB

MD5
512f26f73e36d1f22cfa1c335bb2b2b8

SHA1
9bcecc9f73539a605781d2a74141ae3c42b93270

SHA256
88266df1bc5abe243e761852c5bb380584faf412590e3616db2d59af1a5fa16e

SHA512
a6fb2bc29ee38fa63f6420fed955189aea6021f088cd8091295d36d557cb162d027ed27af43173fe781ad19eab584f95fe15978bf414bb27e2afa027fb163540

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
384KB

MD5
23e4360483788ac8d6bb77e03cc99b8b

SHA1
a2f514652c52e1f0e1f7864fec2436c9ee556a5d

SHA256
f2bc6485892aa34f1fec330d39e83bbd6edba631847210997f711b3dd1f04c2d

SHA512
33c1075fa329c55d0abdbb485e1339acc92fd4c944ac44af620a07898c4ed78d8726c9d701304b604327518248c5e695f6040f04f43e834b557685c295cf351e

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
384KB

MD5
98e6f597f992d26a0f22f79f4f87243d

SHA1
cb2780962f6f23d831ceb3a4a14f7326ff7c0618

SHA256
1ed2c1fcfeaa85d9d466fb238d949c87152dbc5be9fa3319e040b3eb813013b0

SHA512
a8263026bda671943f4f34ee20977e8428891ae2b3401d674ddd9bb7783f60b8aafd5bdf585fee401e9e2f42bc3aba260805bcdd30b9b5d89db7d05ee3fa90ed

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
384KB

MD5
40557db947dc65a594e440e05bdff934

SHA1
3a284c14a665696441d62d54dc714414f9d1da2e

SHA256
d071cfb26884c913d393d74c3202b0f2a3a5decc49a11c3acbe1789c6fe080b2

SHA512
5a50efc70991eac49ee29fc00f6f467b550b5b1082f7973b1b6061d923b56414acb499af6c66a67812975e46e90d6ca7aee977b353b809e4249ffc5900635470

Download Submit
C:\Windows\SysWOW64\Dnjfibml.dll

Filesize
7KB

MD5
17969b65fb3d034c347020e273636ca2

SHA1
d7ec149bb34926d25ff8affe4b90e01dda797cac

SHA256
271a7651848bfb9b109bc9b6af1cef0f469ab5bcd9d8c2fb9791011701ece46c

SHA512
97e742d11b877f3c1c97a272a596eabfe660a46c55acdd834b896223e3d8b45129406624e5d73f241d3b62c4ece2b5d3ce2473842eb98cf52ea5441a8420675d

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
384KB

MD5
ba4424726e037158158692b24ad1ef34

SHA1
c1b1eb8b656912430ae70ed6ac342778a6c3f19c

SHA256
3b4076878861892de5408a69e0093e1e78e7d97ce7ef96c1fac1979c233c152c

SHA512
f8dc9ff3214ec74160550c07b9a1ec40d7e2a08ea52cb319cba2b98b0f7e850421c6e34a3fae67c2b24de719d096374eae95ca47510a032402b18e4a441548ea

Download Submit
C:\Windows\SysWOW64\Dooaoj32.exe

Filesize
384KB

MD5
edff0117bbcbe546b04526a50de9f230

SHA1
801cb4db2bd817e88c232beb8d908fc0ff90d402

SHA256
b1bf1965431e14b856b9e6495c766dfbfb50c1956feb8a1c118341cb7b1a0c3c

SHA512
b39e4e00ae69b672ea7c112dbcdb6b9195e9826c6a4142db04fa2d8b122bf305655481eeca69a3bc146acd287e583e668bf074c41a74b834271091a30ed8fb6f

Download Submit
C:\Windows\SysWOW64\Dooaoj32.exe

Filesize
384KB

MD5
5a38c59f49cf5186e7a4572d22db8b74

SHA1
8242e86345d154cbeba632680dd956506e59c9bf

SHA256
4ddfe447469895ed7d5828f5065a4d4e157a79389540056fafc544713c289d31

SHA512
262ccaeda277770a566f3bd9ff400df556ddae0df6b773949dc2c36e6132297d39da64b910479f8ce4186c148a9e9934e1b01c397f40d2e361616b76158602bf

Download Submit
C:\Windows\SysWOW64\Ebgpad32.exe

Filesize
384KB

MD5
696f13f2acdc8e1cd3f029bbeb63e0e9

SHA1
9ecb6e6dfaac6c84718554349147119894adde75

SHA256
e50b18bca260bc6b5e50f601579bbd1274832dd850881166a155568e8e5881b5

SHA512
f5584efa71a8289cd66e62c3fa0a589e8d0a68b2bab29614dd222bbd33930a9c67fea894b813c8c65a55244ba0e0dfb426872320b67f1baa9735e5ad26859666

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
384KB

MD5
b38ae674925b9ee6091b71339b1cb830

SHA1
852f55a89237873aa27d2bb43a220e7aa67147e2

SHA256
1fb99bc4296af16bd71a08ea7aa85720786af2de95cf906ff29cc3bea877a697

SHA512
a6170351971a1f9f54bfba176f071c79c9c01517fd9f65638c9d71deee733a7f21e99207b236206b71a3c8b90d94b28e00dbd18c271cbe6ac2f35897cb678ea8

Download Submit
C:\Windows\SysWOW64\Eokqkh32.exe

Filesize
64KB

MD5
b69b1b95a34b4bdf3613af8c286cf518

SHA1
c110415ba605db44f763b9841b2b0407a4539530

SHA256
1319a15ee3018b4bb577437f3428755c11639963cad9bf414bcc4392961b05e4

SHA512
ec9ed6caa91ad0130bf2ec2118d00b76f76dad310016a4975714c8976b44ce6c2dc90ad49dd9a28732adf5d6e1426f03a948b21f8e5ae8869b52d45cc4bc1a1e

Download Submit
C:\Windows\SysWOW64\Fbjena32.exe

Filesize
384KB

MD5
7f52fbaf3e2f0cb5e21057439a6c7d68

SHA1
9d2b187f694711f7689666389a933dd12f680375

SHA256
7d4d35939aa1fe729c029551cd0dd5d9bd8feaf1728fd075f6ac6192802c27d6

SHA512
7f979ad38efb8be7312ce2d258eea041a20dc326fc8a50058367f41d235c44d8a281b604afef2df22299439e40e1f35c1b4bb39a7dbf60e950a032c4825ae2a5

Download Submit
C:\Windows\SysWOW64\Gbeejp32.exe

Filesize
384KB

MD5
5715d822371a603c49437e7ba71e6be7

SHA1
178d98a29a6f0aae2c3039e2f8bfa41417178c9b

SHA256
3e04aa2d934a113e5aed49d8fe33ced4dc82b5d5978f8d12a342d4c184c30295

SHA512
6cdaa1d09ced33809307cc711f8f2f53d705e6a97de55ada73f07562a00e370a163141f926cf065f4c77bf73afab6b0b002a9be5c28e922568a308d126900c6c

Download Submit
C:\Windows\SysWOW64\Glipgf32.exe

Filesize
384KB

MD5
2cf5d370ff160238a7e3b49016c14569

SHA1
3e947b1017498ed4e10187c085edfec44eb10882

SHA256
b2f3aa22dec58d31b77f06660c2553447d8d83b99bfb446bcd63e170fd1d5695

SHA512
97be4b10bfb6f9e10742ad5e896301a9bc2dff4c9d33e6dde3817ac3f2a8a01bd9f716d252a78a8052c53e7c1c21ee1d739baad136e6deac926986c8b1e48833

Download Submit
C:\Windows\SysWOW64\Gncchb32.exe

Filesize
384KB

MD5
6337766bb689c879351779a46f1e21a3

SHA1
0952d2cd14ffdcaba2e3b33a94cb2006ed42ea8a

SHA256
521dd94096b01d7e978406d352e82f883d905d0630ede40bfa22afdbd7304cae

SHA512
d812693d86871a57db8d23141708ce4b8ebff618d601c6eb802f879e932d528c51540f1debe13d6a9c27fab7213211a5e5cc7df87f6d2b4596327eb864bf483d

Download Submit
C:\Windows\SysWOW64\Gnepna32.exe

Filesize
384KB

MD5
61e38d840954080a54ec42f33a33e991

SHA1
a09d3ff1906ab6106f31eb12b8e5409d0f02e9e7

SHA256
cbfe0bbc4d8200b57a9f55c33f4ffa0cb511b377839e5cb2577aa659623de24a

SHA512
9e24baa85604ac3ba41337df4ac9a116cd987a164bc2c9a0fbc916b85e0eef95834978aca2356a419f4d5c8e8712821233a0402751fac31e1962482777a15ef4

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
384KB

MD5
35f7185b91e4469441715a8b9e72098f

SHA1
ba6556c60cf767b88517f8a625297962479f98fe

SHA256
a395678e5285d1ea54e265c01386c46ded59eb2917144296172fa214ea80d9ea

SHA512
c4894bd63b54db7c7942d59b3263719072145b71e254b7b1879ed6ee1e5364d613151488ee6048e01dce509116a566a3b0236cbd696a855c87cc209c96f4e944

Download Submit
C:\Windows\SysWOW64\Iibccgep.exe

Filesize
384KB

MD5
b104369b6806007eca34944b8175e8f1

SHA1
dc60410a07613d58b48627311d0f20668d41f861

SHA256
85ac18a2630a2c923c272070b52bfd500548e68c58cf74eb477dd156d47f6a14

SHA512
ec399719c83dce22788248fe43c948332911a269d18c74e26c723d7a10e12b9f9052957cbb4e8a912b92ae8d44843037599bf0fc30b86fb1e1c8a3f6fbf0e5ec

Download Submit
C:\Windows\SysWOW64\Ilcldb32.exe

Filesize
384KB

MD5
bb40715490ab2b3c691e342f191c0683

SHA1
ac33032a47110991ba7afa0137fa153cf4381643

SHA256
f742e6bef4ccf2e599421ad85a0f7b81380f9b14a8fc1bc28d40128ce1cccc47

SHA512
4dd5a6749b997e61160248e96b4eb547fed0ab4d47e030e091d3fb4585bf8f3d5b95eb7ed7ea0b0808fa44c5465b6be2b5909dfba045603c00257bbe6d385a60

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
384KB

MD5
a92172e67731a0078f1f8d9f3c1d3f9f

SHA1
7dcdfc620db24e05c035de97581d1138fa486ac6

SHA256
23d1d0f98755612a350fa9ecd84cf68dac6f29dc10e45355aaabb8195b2a2713

SHA512
0c51d98cda2ed41cadf69ffb97e026a4e9ff695734824f6b88ddc461165957b1c18887ffceafbdeb119988f88d86731e0e158b79857658170e02ac5689ff6810

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
384KB

MD5
19e6c876f824416afd4e21bda09e77f8

SHA1
cf4df4c0c1f88fa25853be19b52535880ba38cfb

SHA256
173271520293faf94b19b182069787b504e1a1a01991db0e80cd7293abdfc180

SHA512
be13f74b5693b91d2d49da4c73cef8ec47111ab94af03236dda1a60250a519bad93596b644990e01ea97a3a28904a410fce7d6017387b0df961aa39f67ffe3f4

Download Submit
C:\Windows\SysWOW64\Jnlkedai.exe

Filesize
384KB

MD5
751e3be2a7872306090e9564e273602e

SHA1
f6704f4ccb170d2d8e25811da0b18163d076aa7a

SHA256
14806d800e1f267b7337c552634d8d0a57dde61622336de68abefce89c373a07

SHA512
2471d047616d3b222e1773a110fa882d9ad17e42e7a666218f9c558765a774622f192980dd4307e6ec645378790e5ed96bef41c6a046d8047befdf561cd43311

Download Submit
C:\Windows\SysWOW64\Johnamkm.exe

Filesize
384KB

MD5
d23064e3229ad8f4447fe3e9c0b268dd

SHA1
03bf156067ffb797ac99177853ed55931a2459dc

SHA256
1217096c10bfc56628d2b5991795bca6c3cc7121aa553762dd0340178dd1f4c3

SHA512
5ef3a480a8091f801c0220fdbe4ca68b0aa32172373a4ec54e0ef15b275388a1ce872ddfd41d325c23b59902a68ba720c36ca1a002129416701d9dd1041fdf08

Download Submit
C:\Windows\SysWOW64\Kgnbdh32.exe

Filesize
384KB

MD5
117495440d3a5e93ad1cfad9134d068d

SHA1
95953286a0377351e6dac49e5b5de449a7680fd8

SHA256
7815a27e5d88008bcbd5bc7c4b59e767815ab59e88a615b158ffa30b75b7899b

SHA512
f7484c50d97d9b6e09165b5b43e08d638c77e6ea586d87b58f2619f2eba03610b2d4388794f77efb7aeab8027d89d5c969ce640b32b2630fcf42d230ea3a3ddc

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
384KB

MD5
5e080000996f99b263a53e41710e6b43

SHA1
abe3c3733625d5e9e5e9b2c2411092e274c05862

SHA256
5c6a673ff6b7039b2d560012f047e12b0040b00f7f1de1b973e876f6d2466fa8

SHA512
3a496bebd30e08c57908bfadba789404eecf95910c54ea471ab9864e1ce1c1a4c0f6c85deb9fc3f0cf8845908fd7ef4c4c61f1380ddf65c91d1aa1aecc8ccd68

Download Submit
C:\Windows\SysWOW64\Kjjbjd32.exe

Filesize
384KB

MD5
765e39820141be779590d35ea67ad648

SHA1
227608eb82a780d993852d26baace6c1ea0791b3

SHA256
2cd4d3cafb1d7d6ee36cd14a0119127a90d0f2dcd2c5a8202a42d6e869d519ca

SHA512
38ae211bcc34617d35071613b393daab5ccfe862585e179bded1fb5f0fdcb134a4bace34d33db0eb21bbdd4383e517a265f65d5491f65bece601a0870677cebe

Download Submit
C:\Windows\SysWOW64\Knnhjcog.exe

Filesize
384KB

MD5
5bbe221ec763796f332b0e8fd725e49e

SHA1
4093f2b697779ee4514b4911990e61c622e71ebf

SHA256
e361d4f7dc38a5dc7c1ae385c0b7d78d1bfbb3a589893ea8fa401656d2a177c6

SHA512
b67c8ce768b36812356af020f5e4762eefb3fe7b5984c3939fe296be2dd82030bc94ba3410d861dc228080b8290ba1af9f0a93dbf74592454311670e3c43bbc0

Download Submit
C:\Windows\SysWOW64\Lckiihok.exe

Filesize
384KB

MD5
4aa704ca4f8297f91ba5260d1a3f4cda

SHA1
d8d87295028cdc2d192bd5258afb10bb5e75ee04

SHA256
d6d8a6e3126fc89c437e89dd4a69b3c85f532453cfffaa792602f2c5a89cb3a1

SHA512
268afd7931b06726563e614f3bfef831e93deb31c30c543119d2f614c6de036be354f221391cc299f5cb95c469c682b526d9e84743be9550111da292a512f080

Download Submit
C:\Windows\SysWOW64\Lcnfohmi.exe

Filesize
384KB

MD5
03d8ab2256b0ae32be82cbfa61307dbb

SHA1
3218a11691308b24e9409962340a036575eadeb8

SHA256
d969ec9b46bdefc262e1acf814fef1bc964c10355898415a16d2524fb0984c74

SHA512
e3c3dd32c8c30970b7dada7221c7d0e45bb9cf6bf5a6e467134ee2e27dab9d949e6fcd4b33103ae727d73f4dfb3cea54ef28e6dab019db847b689ea0c1b8cc2c

Download Submit
C:\Windows\SysWOW64\Lgpoihnl.exe

Filesize
64KB

MD5
409ce92d2d9b616d8ddda0bf092cdc02

SHA1
678c6815226bd2b26fb1365127a34a47e92d787e

SHA256
cf4f73071b1e61f0800d2107510e099b812e50a47d9aab0e5232278a03c3476f

SHA512
958f47f441d30884656eac33f990ec2e8087ba786bfee656cfe33a6ef2fb304e5b568fca8fd39082631e685f80e0fadfaff2b8dc9e9c82aca49214ed3ab1de67

Download Submit
C:\Windows\SysWOW64\Lomqcjie.exe

Filesize
384KB

MD5
c44a94a187ee87d564aeb7d563566d48

SHA1
fa4c7ed8c50efd7225c5a4ee8d5100564c7f3e92

SHA256
b5acd08efbeafe62db7be6ec581bf58b1ecad12ea3eccd8ccf07bbc67d9e3b8d

SHA512
8bae6f73cc2b36f7efccab89381329f638bc312d4606e0b5cde0e0a7f7989dfa992435120138e0f67d8852bbb1a5403614afc059e2a2894543458c4a297c0915

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
384KB

MD5
9c1ffa7ffd70290164dca6016a2a7b52

SHA1
96beeaab0ea80fae8107e3232f7f9892452b606f

SHA256
5ef5da834d67abadaba8471e9b82c6ac3678e4a3d3fe982d17d6e60b565864ad

SHA512
fbed4af29d22545dddb2debdcfb2ebdf5f0ca3f44dca1951389d5b0dc8aa4a2c1b8518eea780b52268dc69160570a66b368bdf456bd0dc2259ba91a6dece9d99

Download Submit
C:\Windows\SysWOW64\Mnegbp32.exe

Filesize
384KB

MD5
032bcfaed05436a1001a63d66864775e

SHA1
16b583a0c051a841c4c854fcda5794a5bd4bbd3e

SHA256
875baf61c0cafdeaf438271b5dc3a09f2b10ce6fc37c248ea728abf5b8332bdf

SHA512
f924a02244303b665f5a0a3dac0534ff5d2f22c3fc101fa07eac03d8a6d3d857fb02bb0e61f0cfb384cbea8904379c9698bc2a8a3d83d91bd0a19780a16cfc37

Download Submit
C:\Windows\SysWOW64\Ncchae32.exe

Filesize
384KB

MD5
08602f5d74d38f0cb538d2589c30d0c1

SHA1
8756af3a5e2844a34ec7bbe50ef4968f0b2e7074

SHA256
30eb9b2c834c9cb9d13192e42d7a8b286add39b19b3033e42184dd5f069de482

SHA512
41b91c1f1ee6378ab68a8ce73ba77b8945d8f7340a5adbce76948075a37e1b4ef18b49a77ac209d0a2b4bd1eb151ff11bad5f41e170f378411e1c44f240b6d64

Download Submit
C:\Windows\SysWOW64\Nclbpf32.exe

Filesize
384KB

MD5
7c76ff7d0ab7411f0482a1bfdd3ce93d

SHA1
c919a2afe833f3f686033a185c7c694b95ea0b23

SHA256
0138008e3ee4a0c839b13d9c262923646bebe269a9be6e20e9afc2b618b58cac

SHA512
0a96472b0f19804ed063456370a102402c3f6b83b1af80237127ead8592b066477570ed3743863e948cf6011acb3fa2e8a0238d6cf184ffb3838f9d6c8be4346

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
384KB

MD5
a59999e884d9d1f37cfe55e26bcc670c

SHA1
32072fe3b40938b1dc3fcf8d9e5cf7a6d0b35f5d

SHA256
7eaa8e5e02b98e900ba80e8f74b4b03ea0ffc9dd3d8b2e5b0a753a5714090b2b

SHA512
e48f4e19b8eddd72d0ccd25ef04f1ece685aaa1833703a74724fe839589d43d65ec108fafc8a08bf05061faf9d7764755a4f312a8285f062e7225dfd2d265ca6

Download Submit
C:\Windows\SysWOW64\Nmkmjjaa.exe

Filesize
384KB

MD5
5d3523e6fdbe42a46bcdfe805584f8dd

SHA1
23fa2b1db67554cf3adf67043269f27a1f22e8b0

SHA256
64c5e3e98d372970524c2ed72f849c78412bcfefab1e1afe35205e39864908be

SHA512
1bb14267ce15525a16b649866e6f6afaa99896599fc4dd9eeb3fcd4219262a4acdcbb854768b28cac74c9912da7a52f5e0f823370d9959f79fa07ea856fa10ce

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
384KB

MD5
aa4dc60ddd0a913e78dfe8ebf371acc7

SHA1
9864df84cd344a4fd4207fbbead9c63590740e42

SHA256
bd9d050fb68d249f25b103710a81ea55225d09d111f5bcb0c81d9ef9a44b4f10

SHA512
3a233d27661ce62c0c2a81381c42e02635e6df3d23bacb3287d1f062540d5dccf05cbc2d2f80c985474db05a189480127af440e192414489181cdafc40ff8d7b

Download Submit
C:\Windows\SysWOW64\Offnhpfo.exe

Filesize
384KB

MD5
1bb0e83efc54a4354f447e3526cb78a1

SHA1
6f1a2b447a923fdd12f4db601a9ee997a039ae8e

SHA256
2220428710bf463afd527bdca68a84a633ad321c9031ac46e6b6206f5400928c

SHA512
66f391e47213f6da5ea3294be7d92720ce9a8cd0660cad89f3da378cb67332078e389b19cf242d75f13f74ad8bce3bd87e61645160cb1a1682de0c7e7dead9cd

Download Submit
C:\Windows\SysWOW64\Ogjdmbil.exe

Filesize
384KB

MD5
a26d919329f3a3b763075dcae1b45fe1

SHA1
de6cc0938733aba15ffe4317f0558f2bb71a16bc

SHA256
dfacad3d1483e3cd28ce9531123943be5786f754b11cd91c7d7245b0e9fbbdaa

SHA512
4875f498979064ba24e277e631aafe9b5959442e940e7dd858695c6c56827990de706b1fbffd590cd9b9be1e3580d15284d062232431a7c6b73b7f58a2c7b892

Download Submit
C:\Windows\SysWOW64\Palklf32.exe

Filesize
384KB

MD5
48e64b39e329a43da04cd6fa46f26941

SHA1
981933e2c05e909eded934a4ddbc969e99dec99d

SHA256
f7b8a85dc115484eeaf28f031da84ace906413f867c2d8bd14e2e8ff589e7275

SHA512
53133896cd3c75c7d2b1b736b74fa14132b4f20fb1b0a7501c79db047d49643fefb4f11d339d864a7f6511f8e938699687ea25621ec69cbbf434c109dbdd72e5

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
384KB

MD5
501743fab5e2fadcb13d08a5dd2d19c8

SHA1
84cbd9da3bf61ff1984126d6e7451339626927b3

SHA256
3940aeec3de894cc566a8f20c150c41ef911bd65f938d1755ae1c93ce83c00eb

SHA512
89215994793e2c9afdfbfe80dd0c0ce7b06c4109c055e2d2540b7d2dcc166fd83dd8950b5657a5725528738924ad9ca7c45f7a29753a504b792d9df2db8fcc76

Download Submit
C:\Windows\SysWOW64\Pjkmomfn.exe

Filesize
384KB

MD5
381298d5d4771543aa88789e7f7f71cb

SHA1
02214091f47d4423a19520481339cacff8a6d215

SHA256
acca37826975fee99cfba3a18efbc88aaa164f6f0d695b7c94eb81f05dde6b61

SHA512
9e43b795c0c17cdc524e7ae89200cd2087d5db0dacc93d1541b49beb0fc9a5f50b1854ed88041bbdede7522f99a5d44a6c07df34bf6338abc4076aed4cdd1d7b

Download Submit
C:\Windows\SysWOW64\Qjiipk32.exe

Filesize
384KB

MD5
40001ace584a1e98400c7e5035e11ecf

SHA1
a4ab48871f71103cf2742c2fb65ad0c61e31833c

SHA256
02d7966c069ad394a21ba16eb2b7dba1c2e2fb2c467db2a7f5f1dc533f33d388

SHA512
e57c14367f77454546201b0d694b82af30457d4893794886a5c260b12a94cfb7c5886ec98d503ec53ed187f8d3d866ae19bd3e288b64d3e569ab118156df3d69

Download Submit
C:\Windows\SysWOW64\Qpcecb32.exe

Filesize
384KB

MD5
4bbf52abde1a1aab647e0f9399c2a10a

SHA1
40c903d1a8072eaf006b01b53e2e1f71eb282a57

SHA256
df78c8cdcdfcb5a0a9e9dc03e3e36e2f0580875292feb609f643bbfcc03659ad

SHA512
c87975cd45f503db028db8397947362484b8babf2ce31122d4ba4e0e6ac26874a172481838b64502e4ef3a43beaae61ad4c5db444c4a7c35c6860c7e51dce4f4

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
384KB

MD5
b94711ca813b031ea462c28112f4fe24

SHA1
10f9e3efdf9984501ffeb6a506c7144215880914

SHA256
5eac80b5e3d9d16b122e4e2e6afa7b709e3d128e9593767f38c729bd809d0388

SHA512
05bcad5213c7783696e7d2749bc656d828bcfd3c0465dc0ef7adc7b1edf105c9b7a3633424e7be696f867c98f45fbd255bb6caf712809ad98c2b383aed28681c

Download Submit
memory/212-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/432-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/456-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/540-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/656-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/700-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/728-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/756-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1064-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1156-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1392-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1472-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1536-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1548-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1564-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1588-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1692-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1752-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2132-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2140-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2200-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2240-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2264-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2272-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2308-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2392-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2512-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2552-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2700-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2748-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2952-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3020-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3084-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3084-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3168-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3240-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3248-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3544-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3644-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3668-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3688-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3792-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3928-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4032-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4104-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4236-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4256-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4268-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4268-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4456-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4548-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4576-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4628-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4704-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4780-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4796-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4796-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4800-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4924-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4980-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5140-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5184-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5256-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5348-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5400-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5448-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5492-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads