berbew | 18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe
Size

337KB
MD5

859be2d21fd0a19ed657c57ca3062086
SHA1

75754e943b41d79581a0a6bea1e23d22a644769b
SHA256

18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36
SHA512

63d57366a0911cdc470cf3707c21d7250452186b1882afc0b3d95fbb59bfec7813e04d5f9a961215b6330c204b53968825e315afa5f42caa893caacf9d9868d5
SSDEEP

3072:3WyzJOiJKhgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:x3Kh1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaebef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehlhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgmdec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joqafgni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbibfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaonbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dakikoom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpaihooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihpcinld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Figgdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gicgpelg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmodajm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nagiji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgjoif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpioin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqnkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjodla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cponen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmnbfhal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jadgnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ganldgib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haaaaeim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cammjakm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgcjfbed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joekag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbihjifh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpdnjple.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
536	Mgnlkfal.exe
4416	Moipoh32.exe
4052	Mgphpe32.exe
672	Mjodla32.exe
2448	Mokmdh32.exe
2160	Mgbefe32.exe
3208	Mfeeabda.exe
5044	Mnmmboed.exe
1020	Mmpmnl32.exe
2584	Monjjgkb.exe
60	Mgeakekd.exe
4544	Nnojho32.exe
3712	Nqmfdj32.exe
1452	Nmdgikhi.exe
508	Npbceggm.exe
220	Njhgbp32.exe
3180	Nqbpojnp.exe
1932	Ncqlkemc.exe
952	Nglhld32.exe
3212	Nmipdk32.exe
5092	Npgmpf32.exe
3316	Nfaemp32.exe
4012	Nnhmnn32.exe
1444	Nagiji32.exe
2536	Nfcabp32.exe
436	Onkidm32.exe
972	Omnjojpo.exe
836	Oplfkeob.exe
1292	Ogcnmc32.exe
2016	Ompfej32.exe
4332	Oakbehfe.exe
924	Ocjoadei.exe
4396	Ombcji32.exe
4692	Opqofe32.exe
64	Oghghb32.exe
464	Onapdl32.exe
5064	Oaplqh32.exe
4660	Opclldhj.exe
3460	Ofmdio32.exe
3196	Omgmeigd.exe
3176	Pfoann32.exe
3260	Pnfiplog.exe
780	Pmiikh32.exe
1480	Ppgegd32.exe
2268	Phonha32.exe
4276	Pjmjdm32.exe
880	Pmlfqh32.exe
3568	Ppjbmc32.exe
2204	Pdenmbkk.exe
1224	Pfdjinjo.exe
1576	Pnkbkk32.exe
2500	Pmnbfhal.exe
3956	Pplobcpp.exe
4880	Phcgcqab.exe
4084	Pjbcplpe.exe
2592	Pnmopk32.exe
4696	Ppolhcnm.exe
4464	Pdjgha32.exe
4672	Pfiddm32.exe
2888	Pnplfj32.exe
2744	Panhbfep.exe
5116	Qhhpop32.exe
4996	Qjfmkk32.exe
4868	Qmeigg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fbplml32.exe	Fndpmndl.exe
File opened for modification	C:\Windows\SysWOW64\Fqeioiam.exe	Fbbicl32.exe
File opened for modification	C:\Windows\SysWOW64\Nfnamjhk.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Pmikmcgp.dll	Ombcji32.exe
File created	C:\Windows\SysWOW64\Kldjcoje.dll	Fbmohmoh.exe
File opened for modification	C:\Windows\SysWOW64\Bogkmgba.exe	Bgpcliao.exe
File opened for modification	C:\Windows\SysWOW64\Ibqnkh32.exe	Inebjihf.exe
File opened for modification	C:\Windows\SysWOW64\Edeeci32.exe	Ebfign32.exe
File opened for modification	C:\Windows\SysWOW64\Aaoaic32.exe	Aopemh32.exe
File opened for modification	C:\Windows\SysWOW64\Ckbemgcp.exe	Chdialdl.exe
File created	C:\Windows\SysWOW64\Bjlfmfbi.dll	Chiblk32.exe
File created	C:\Windows\SysWOW64\Qacameaj.exe	Qmgelf32.exe
File created	C:\Windows\SysWOW64\Hfibla32.dll	Jifecp32.exe
File created	C:\Windows\SysWOW64\Cdimqm32.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Fooclapd.exe	Eghkjdoa.exe
File opened for modification	C:\Windows\SysWOW64\Mljmhflh.exe	Mbdiknlb.exe
File opened for modification	C:\Windows\SysWOW64\Bpfkpp32.exe	Bacjdbch.exe
File created	C:\Windows\SysWOW64\Ebkbbmqj.exe	Enpfan32.exe
File opened for modification	C:\Windows\SysWOW64\Ggmmlamj.exe	Gijmad32.exe
File created	C:\Windows\SysWOW64\Jpehef32.dll	Hpfbcn32.exe
File opened for modification	C:\Windows\SysWOW64\Oflmnh32.exe	Oqoefand.exe
File created	C:\Windows\SysWOW64\Difebl32.dll	Moipoh32.exe
File created	C:\Windows\SysWOW64\Biafno32.dll	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Qimkic32.dll	Nqmfdj32.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bhkfkmmg.exe
File opened for modification	C:\Windows\SysWOW64\Dqpfmlce.exe	Dnajppda.exe
File created	C:\Windows\SysWOW64\Fbplml32.exe	Fndpmndl.exe
File opened for modification	C:\Windows\SysWOW64\Heegad32.exe	Hajkqfoe.exe
File created	C:\Windows\SysWOW64\Pggdhe32.dll	Hiacacpg.exe
File created	C:\Windows\SysWOW64\Dahkpm32.dll	Jhgiim32.exe
File created	C:\Windows\SysWOW64\Ieicjl32.dll	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Nfaemp32.exe	Npgmpf32.exe
File created	C:\Windows\SysWOW64\Ghaeocdd.dll	Oiagde32.exe
File opened for modification	C:\Windows\SysWOW64\Cpbjkn32.exe	Caojpaij.exe
File created	C:\Windows\SysWOW64\Doagjc32.exe	Dgjoif32.exe
File created	C:\Windows\SysWOW64\Fqbliicp.exe	Fbplml32.exe
File created	C:\Windows\SysWOW64\Iacngdgj.exe	Ibqnkh32.exe
File opened for modification	C:\Windows\SysWOW64\Cammjakm.exe	Conanfli.exe
File opened for modification	C:\Windows\SysWOW64\Iehmmb32.exe	Iamamcop.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Dlofiddl.dll	Hhimhobl.exe
File created	C:\Windows\SysWOW64\Mjidgkog.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Nqbpojnp.exe	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Pfiddm32.exe	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Amnlme32.exe	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Pkpbai32.dll	Hppeim32.exe
File created	C:\Windows\SysWOW64\Gcmjja32.dll	Jppnpjel.exe
File opened for modification	C:\Windows\SysWOW64\Jemfhacc.exe	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Johggfha.exe	Jpegkj32.exe
File opened for modification	C:\Windows\SysWOW64\Ooibkpmi.exe	Nofefp32.exe
File created	C:\Windows\SysWOW64\Omgmeigd.exe	Ofmdio32.exe
File created	C:\Windows\SysWOW64\Hccdbf32.dll	Ocjoadei.exe
File opened for modification	C:\Windows\SysWOW64\Gokbgpeg.exe	Fkofga32.exe
File created	C:\Windows\SysWOW64\Gebekb32.dll	Galoohke.exe
File created	C:\Windows\SysWOW64\Jppnpjel.exe	Jldbpl32.exe
File opened for modification	C:\Windows\SysWOW64\Oophlo32.exe	Ojcpdg32.exe
File created	C:\Windows\SysWOW64\Akkeajoj.dll	Mokmdh32.exe
File opened for modification	C:\Windows\SysWOW64\Gkaclqkk.exe	Ggfglb32.exe
File opened for modification	C:\Windows\SysWOW64\Gghdaa32.exe	Giecfejd.exe
File opened for modification	C:\Windows\SysWOW64\Oiagde32.exe	Ooibkpmi.exe
File opened for modification	C:\Windows\SysWOW64\Dkhgod32.exe	Dhikci32.exe
File created	C:\Windows\SysWOW64\Ogpmdqpl.dll	Dhgonidg.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pfojdh32.exe
File created	C:\Windows\SysWOW64\Ocjoadei.exe	Oakbehfe.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10756	10664	WerFault.exe	506

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipdndloi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpkknmgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hihibbjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gghdaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heegad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihpcinld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhgonidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbnajqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhckcgpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eomffaag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckboblp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doagjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehbnigjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iamamcop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojcpdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opqofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieagmcmq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeioiam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hioflcbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifmmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieojgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhanngbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmgelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pafkgphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Filapfbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbphglbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgeenfog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehpadhll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbmohmoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipbaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdjgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpjjmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oonlfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ombcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkofga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplobcpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chfegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcmodajm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiagde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjidgkog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipkdek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onapdl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hppeim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jahqiaeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqgmmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joqafgni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpbjfjci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooibkpmi.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mneoha32.dll"	Jllhpkfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibgdlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaodc32.dll"	Ggmmlamj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahkpm32.dll"	Jhgiim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aemghi32.dll"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imnbiq32.dll"	18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibepke32.dll"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onogcg32.dll"	Kifojnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icbcjhfb.dll"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpegkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cidcnbjk.dll"	Fbbicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpioin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eajbghaq.dll"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amcpgoem.dll"	Lhenai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjodla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaagdbfm.dll"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjieo32.dll"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpghll32.dll"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqgnfcmm.dll"	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjiffif.dll"	Iehmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeclnmik.dll"	Lljdai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdjgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnajppda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hppeim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpceplkl.dll"	Hemmac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kedlip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinclj32.dll"	Dolmodpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebkbbmqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnckgmik.dll"	Fecadghc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbbajjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gakbde32.dll"	Hicpgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipbaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkdpbpih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hioflcbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbldphde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnbepb32.dll"	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Filapfbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlkfbocp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hihibbjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jifecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgplk32.dll"	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngekilj.dll"	Ihpcinld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjaqmkhl.dll"	Jlgoek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmdaih32.dll"	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkfcqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkhpfbce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foclgq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 536	2188	18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe	85
PID 2188 wrote to memory of 536	2188	18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe	85
PID 2188 wrote to memory of 536	2188	18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe	85
PID 536 wrote to memory of 4416	536	Mgnlkfal.exe	86
PID 536 wrote to memory of 4416	536	Mgnlkfal.exe	86
PID 536 wrote to memory of 4416	536	Mgnlkfal.exe	86
PID 4416 wrote to memory of 4052	4416	Moipoh32.exe	87
PID 4416 wrote to memory of 4052	4416	Moipoh32.exe	87
PID 4416 wrote to memory of 4052	4416	Moipoh32.exe	87
PID 4052 wrote to memory of 672	4052	Mgphpe32.exe	88
PID 4052 wrote to memory of 672	4052	Mgphpe32.exe	88
PID 4052 wrote to memory of 672	4052	Mgphpe32.exe	88
PID 672 wrote to memory of 2448	672	Mjodla32.exe	89
PID 672 wrote to memory of 2448	672	Mjodla32.exe	89
PID 672 wrote to memory of 2448	672	Mjodla32.exe	89
PID 2448 wrote to memory of 2160	2448	Mokmdh32.exe	90
PID 2448 wrote to memory of 2160	2448	Mokmdh32.exe	90
PID 2448 wrote to memory of 2160	2448	Mokmdh32.exe	90
PID 2160 wrote to memory of 3208	2160	Mgbefe32.exe	91
PID 2160 wrote to memory of 3208	2160	Mgbefe32.exe	91
PID 2160 wrote to memory of 3208	2160	Mgbefe32.exe	91
PID 3208 wrote to memory of 5044	3208	Mfeeabda.exe	92
PID 3208 wrote to memory of 5044	3208	Mfeeabda.exe	92
PID 3208 wrote to memory of 5044	3208	Mfeeabda.exe	92
PID 5044 wrote to memory of 1020	5044	Mnmmboed.exe	93
PID 5044 wrote to memory of 1020	5044	Mnmmboed.exe	93
PID 5044 wrote to memory of 1020	5044	Mnmmboed.exe	93
PID 1020 wrote to memory of 2584	1020	Mmpmnl32.exe	94
PID 1020 wrote to memory of 2584	1020	Mmpmnl32.exe	94
PID 1020 wrote to memory of 2584	1020	Mmpmnl32.exe	94
PID 2584 wrote to memory of 60	2584	Monjjgkb.exe	95
PID 2584 wrote to memory of 60	2584	Monjjgkb.exe	95
PID 2584 wrote to memory of 60	2584	Monjjgkb.exe	95
PID 60 wrote to memory of 4544	60	Mgeakekd.exe	96
PID 60 wrote to memory of 4544	60	Mgeakekd.exe	96
PID 60 wrote to memory of 4544	60	Mgeakekd.exe	96
PID 4544 wrote to memory of 3712	4544	Nnojho32.exe	97
PID 4544 wrote to memory of 3712	4544	Nnojho32.exe	97
PID 4544 wrote to memory of 3712	4544	Nnojho32.exe	97
PID 3712 wrote to memory of 1452	3712	Nqmfdj32.exe	98
PID 3712 wrote to memory of 1452	3712	Nqmfdj32.exe	98
PID 3712 wrote to memory of 1452	3712	Nqmfdj32.exe	98
PID 1452 wrote to memory of 508	1452	Nmdgikhi.exe	100
PID 1452 wrote to memory of 508	1452	Nmdgikhi.exe	100
PID 1452 wrote to memory of 508	1452	Nmdgikhi.exe	100
PID 508 wrote to memory of 220	508	Npbceggm.exe	101
PID 508 wrote to memory of 220	508	Npbceggm.exe	101
PID 508 wrote to memory of 220	508	Npbceggm.exe	101
PID 220 wrote to memory of 3180	220	Njhgbp32.exe	102
PID 220 wrote to memory of 3180	220	Njhgbp32.exe	102
PID 220 wrote to memory of 3180	220	Njhgbp32.exe	102
PID 3180 wrote to memory of 1932	3180	Nqbpojnp.exe	103
PID 3180 wrote to memory of 1932	3180	Nqbpojnp.exe	103
PID 3180 wrote to memory of 1932	3180	Nqbpojnp.exe	103
PID 1932 wrote to memory of 952	1932	Ncqlkemc.exe	104
PID 1932 wrote to memory of 952	1932	Ncqlkemc.exe	104
PID 1932 wrote to memory of 952	1932	Ncqlkemc.exe	104
PID 952 wrote to memory of 3212	952	Nglhld32.exe	105
PID 952 wrote to memory of 3212	952	Nglhld32.exe	105
PID 952 wrote to memory of 3212	952	Nglhld32.exe	105
PID 3212 wrote to memory of 5092	3212	Nmipdk32.exe	106
PID 3212 wrote to memory of 5092	3212	Nmipdk32.exe	106
PID 3212 wrote to memory of 5092	3212	Nmipdk32.exe	106
PID 5092 wrote to memory of 3316	5092	Npgmpf32.exe	107

C:\Users\Admin\AppData\Local\Temp\18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe
"C:\Users\Admin\AppData\Local\Temp\18abc866abb04ec08a35fd5e06b6c5d6c5e99e032a6cc532aaf693a2a5eb6b36.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\Mgnlkfal.exe
  C:\Windows\system32\Mgnlkfal.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\Moipoh32.exe
    C:\Windows\system32\Moipoh32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\Mgphpe32.exe
      C:\Windows\system32\Mgphpe32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4052
    - - C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:672
      - C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:508
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        23⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        24⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        26⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        27⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:972
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        30⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        31⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:924
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        36⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        38⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3460
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        41⤵
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        42⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        43⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        44⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        45⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        46⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        48⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        50⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        51⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1576
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        55⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        57⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        58⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        60⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        61⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        62⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        63⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        64⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        66⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        68⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        70⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        71⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        72⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        74⤵
        
        PID:920
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        75⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        76⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        77⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        78⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        79⤵
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        80⤵
        Drops file in System32 directory
        
        PID:2652
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        81⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        82⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        83⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        84⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        85⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        86⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        87⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        88⤵
        Drops file in System32 directory
        
        PID:3000
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        89⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2304
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        91⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        92⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        95⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        97⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        99⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        100⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        101⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        102⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        104⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        105⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        106⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        107⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        108⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        109⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        111⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        112⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        113⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        115⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        116⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        121⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        123⤵
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        124⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        126⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        128⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        129⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        130⤵
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        131⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        132⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        133⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        134⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        136⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        139⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        140⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        141⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        142⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        143⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        144⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        145⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        146⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        148⤵
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        150⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        151⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        152⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        153⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6392
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        155⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        160⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        161⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        162⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        163⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        165⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        166⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        167⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        169⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        170⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        171⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        172⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        174⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        176⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        177⤵
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        178⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        179⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6608
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        181⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        184⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        185⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        186⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        187⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        188⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        189⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        190⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        192⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        193⤵
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        194⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        196⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        197⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        199⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        200⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        201⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        202⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        204⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        205⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        206⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        207⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        209⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        210⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        211⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        212⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        213⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6180
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        215⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        216⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        217⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        219⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        220⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        221⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        222⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        223⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        225⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        226⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        227⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        228⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        230⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        231⤵
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        233⤵
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7824
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        235⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        238⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        239⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        240⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        242⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        243⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        244⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7352
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        246⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        247⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        248⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        249⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7688
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        251⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        252⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        253⤵
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        255⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        256⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        257⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        258⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        259⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        261⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:7808
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        264⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        265⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        266⤵
        System Location Discovery: System Language Discovery
        
        PID:8128
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        267⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        269⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        270⤵
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        272⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        273⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        274⤵
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        275⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        277⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        278⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        279⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        281⤵
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        282⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        283⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        284⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        285⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8480
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:8524
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        289⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        290⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:8656
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        292⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        293⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        295⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8876
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        297⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        298⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        299⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        300⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        301⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        302⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        304⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        305⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        306⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        307⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8464
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        309⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        310⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8624
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        311⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        312⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        314⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8972
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        316⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        318⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        319⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8228
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        320⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        321⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        322⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        324⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        326⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        327⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        328⤵
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        333⤵
        Modifies registry class
        
        PID:8992
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        334⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        335⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        336⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        337⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        338⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        339⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        340⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        341⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        342⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8888
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        344⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        345⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:9256
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        347⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        348⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9388
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        350⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        351⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        352⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        353⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        354⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        355⤵
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        357⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        358⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        359⤵
        Modifies registry class
        
        PID:9828
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        360⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        361⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        362⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        363⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        364⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        365⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        366⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        367⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        368⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        369⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        370⤵
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        371⤵
        System Location Discovery: System Language Discovery
        
        PID:9420
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9488
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9548
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        374⤵
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        375⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        376⤵
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:9836
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        378⤵
        Modifies registry class
        
        PID:9900
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        379⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        380⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10132
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9328
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        386⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9880
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        388⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10128
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        390⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:9532
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        392⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        393⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        394⤵
        Drops file in System32 directory
        
        PID:10056
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        395⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        396⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9660
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        397⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10196
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        400⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9992
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        401⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        402⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        403⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        404⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        405⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        406⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10264
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        407⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        408⤵
        System Location Discovery: System Language Discovery
        
        PID:10352
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        409⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        410⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        411⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10524
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        413⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        414⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        415⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10664 -s 400
        416⤵
        Program crash
        
        PID:10756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10664 -ip 10664
1⤵
PID:10732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahofoogd.exe

Filesize
337KB

MD5
4b9af36fa9e9be8ebc1fe1369dad0c5c

SHA1
643b01f36e9fd42a30e82486446c4341c07e494a

SHA256
ff815a7165d417b9244879cbc03fde7df331b6bbdc56967dfc9626eb65559f6d

SHA512
a992cf644dca396f7e6eceb0155158f8814b2b8c27409ca54bd994c5d15acd85d8b87b9416439d6b2ef2fd5e3778dcb2379690ca8b6ac5ceb867d5e9b093df8d

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
337KB

MD5
0d751ecdcffc2355f50fd543b24f5bd8

SHA1
f534f0c4476d9164eacaef07561cb69be33a950a

SHA256
a2e754e4be9ee0262f99fe41a69ac93944484f60b352846c910b8e5e5c7a6bea

SHA512
a22c3d58ee2e477b4e438cc8e4d9bc6ef27d5d229ec1b697671102ba99b2d52fa82fa18b5a078748a6ad749a0d7cad0a83d9ba65cf99a7813dcf776e21eaa676

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
337KB

MD5
276db8db5137acdf7c32dd5a392dd63e

SHA1
01997bbc367c19b44fc6b7a88d5e1a7e42e73d49

SHA256
8bc0bd134c5eb207f7cb8e19a912a0123ab39cd87207c755fd58c459ecdf9c8e

SHA512
e4d9bad2caddd6cf1b90543b2ae268a32516ff4f9831fe21e6939e1dbf42bd107734ff84f1a56c03936fa5ae15c09d51b3c28e7ab5d59f0cdb45393ca6f31122

Download Submit
C:\Windows\SysWOW64\Aopemh32.exe

Filesize
337KB

MD5
3f3ed781b4722b1587124b4aaa324e69

SHA1
29d92fad548de712b500634eb6dc69babffb1feb

SHA256
b140dc8d1196de1626bab53b895bc4f2882ee21189a5fd7da9aa1ed556aa4fd1

SHA512
2b42196fab0d8b48eab61c4c3b2c812bc7dd3920fc74511f9880a0b5a82ba4898bf33f1d63c6544826a864f450b156d17e498c6406aa3c0930a4290f71e1fd9b

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
337KB

MD5
a6232cea94ef6b242fcda595f775be2e

SHA1
80a8a3df813641a64b3d67dd35cdd85c86ba3fe0

SHA256
097fb84e2f91bb62cab208eb3815909b50ed5aef4fc41462856947f50544dca2

SHA512
c0a31412be68a139856e1f6d28d8ecc77a4a9d3b7ba27103c0740556ab1cd8dbeb2bc6a4393905daf33da2641636978e74eac1f0839924dc59bd7068b1c85c77

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
337KB

MD5
acf38731ea8f7289055c2da068181db3

SHA1
e073090ba9b31470189f89fa3e4e71279b69465e

SHA256
a1e5dfe8fcc25ba20074a9b0f0ceb3ff06ce96f56a2a19b372ec6441cb215346

SHA512
869da73fb78b621b05012ee6025d488681029a342e6657b930621bafa8986a5df683750c13d43874e21ee8541f1e3b07c77d516708bb082dbee4e4c094d94eb7

Download Submit
C:\Windows\SysWOW64\Bhkfkmmg.exe

Filesize
337KB

MD5
1346c7c23a1f91712b4c8bf2967e17ce

SHA1
19af41064e8b7a4dc9f3bb2ab1554337b0c204de

SHA256
c659b293f6ce2e82a8aa24928390b63c730def116dcd9e39d76bab43e436216a

SHA512
4a9ac55650e6a528583116fed440091ce06eb1411d1decbef53510dc922b29637ced9780d9b22ecbc7c298d841df6ebc66a64074d479356304ee10a31017018b

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
337KB

MD5
fa2335b95065a0c772fb1ea0402743dc

SHA1
f0eefbf3113a13d5aaa697783a5b1c40a733a2fe

SHA256
4563667095fd3a97ad5a460034f302003b646a950428b17a32dae526b0d6346d

SHA512
1c2d7f213036ede2a096bd5a69978b8d46472ea1ae568780c2f782367f599a402bafa9ca6b58ad8f7d9d0bcf1e664c68650dae25089457f7af9f16c029b7f15f

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
337KB

MD5
1e1867f4d4c9b83df6968e90537efb7d

SHA1
c7929d2eb8be19de0a8903b707b90fac2442b8c6

SHA256
98abf52b1a71fd21a12186be90853bed2578c36305e4b82398c0915e780ee6eb

SHA512
7b51ec47084a0a0edd6565289412b423e11807caeae498a00c2714d65b94b2691a904063486a661333950d9277e178f894a4164e44730e361ff08476bef3acc2

Download Submit
C:\Windows\SysWOW64\Cklhcfle.exe

Filesize
337KB

MD5
9c79136750e1c1b7494043165eb2433f

SHA1
0214f4e31bb4195f0f5837aaa4756150977d28ed

SHA256
2fbd249316ddaf5fe92a3dd91da9e6b06fe1b42a832d94baba9b2df2042471c9

SHA512
7cb0cf3531943f700bfd8fe6cbf8fdc6a37865ac9c4ff22f52d2070bef637598982b433e65a58a590571982ca28b787c5239afce71d426726dbbcb115f15741c

Download Submit
C:\Windows\SysWOW64\Dakikoom.exe

Filesize
337KB

MD5
c992d1c503cc5ae2b5cd90d583cb6512

SHA1
4d632a34e072ba044246ad714c74b0ee5de1eba3

SHA256
2a53098dfb845f33d2ba6c8ece32e82d5e25e40a3b32b53db8593f3877fb71bf

SHA512
681c848b20e34c37a9890cbb2ab27b4d447028a006dfebfe60630518e11e14d97168ededaf4e7a051aa03325ef0f41814b41b1a51bf511e90bd0676fdcbe79d8

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
337KB

MD5
301dafc3aa3f33bd0b6ec1d40dd7c215

SHA1
3674f238537982bf7407e126197ed961c9c0d9d6

SHA256
2a9af39b0f766056234e6128a8a45022c5e8799a71d007be52ba14a00404265c

SHA512
6d1f1a3745bfec66451b95b4cf4bd58403dddc811339fccad4deb4b2505b5542b52238fa3be58a469af4a349b15f69f529b1bb15df757c2154cc8e35149e6a29

Download Submit
C:\Windows\SysWOW64\Dhphmj32.exe

Filesize
337KB

MD5
f417b287293ca6e291b2e44e5d8d1f7d

SHA1
bfcbee0f2d7b9b8b94289f9c5e2b6fbc55038b49

SHA256
3a2c532c9ea66e537c6f5aaa8454560bdcdb7296ba6cd9526791a325108b7ebb

SHA512
64a06496421ba0cc0c3946d355d7d4da9f89b3830b67066c6d70a3973f5432d1da006ded187f6682533f9e9b7af1d882db8ef2977eb08df7455533a2420af9df

Download Submit
C:\Windows\SysWOW64\Doojec32.exe

Filesize
337KB

MD5
fb1121e2d9caa54b706c987967d845e2

SHA1
30da22012aae5ebaea3ebd784f3c606aebb1b88e

SHA256
30a479c888131638e32c9c609acba3185ab65de68ec6b47693bcee258a88ef9b

SHA512
14adc257701547257040e1e834bc385366bdb210ba0854146e0ddb6d82a63bc01c119a58e6b012385b91b99bf3f4da45c0867b4b8af114fc66b56522b5176b08

Download Submit
C:\Windows\SysWOW64\Eghkjdoa.exe

Filesize
337KB

MD5
a31f1c146b31e7dd9befda84e7aa621c

SHA1
99d23ace227023520df96a8172184b50eb353a29

SHA256
d461fe735f4f78352cb58116ff0a21afe2290b3d0f13a820ca7c422ea7ed78e0

SHA512
4790e80da4cf5a64e27d8a70104b59cce140eed738a11fa2acd45a815eaa5facf1984b9620c34b83697bee9e5d255965a49ec74c6ffb9033ffb7a308e6fcf99b

Download Submit
C:\Windows\SysWOW64\Eiekog32.exe

Filesize
337KB

MD5
daa7f8e26e5377659e7e863edc537a4c

SHA1
f388abe501147cfbe7653b34814149d02b818a16

SHA256
291f1b19cb0b17444bac2750641b51962bc2375ea2cf84ae90463920cbc6112a

SHA512
96336938c080a2d36c69bf1f915cb81b1ef322daa8e84a1b7a3b10cf61d95c453c6bc88ace28d17b707b807c8f3f664891024b1819ca0398feab4754b354b987

Download Submit
C:\Windows\SysWOW64\Gijmad32.exe

Filesize
337KB

MD5
c4bde1b1cc3189c3a4721413ed433bb2

SHA1
834f72514c583ebe08afe69e1867787441f45831

SHA256
bcb89c718870916670e7302697cb70ce811d6b239db7a2e8319569bc839d9b0a

SHA512
610dc05a55ff1df65402e8213747def1b7d69bcc4a1329a686fb86d90ec6d4547871a9c161648ed0e9020e788111575700edd9580a68ce9a5eeeda0f8704409b

Download Submit
C:\Windows\SysWOW64\Glfmgp32.exe

Filesize
337KB

MD5
a57c0c45fde777b1862cd529f4a49b34

SHA1
f2e862074d29860035a67ef37bf2a02caa5989df

SHA256
8cc7d218d4c4d5ceaa0bca599f8e7cb01d3fa935f5d9d3a479b1f67ed67cb17f

SHA512
ab01a2b0eb13c66599d45c73e7c4eb0e8ffb32048dc7c795871add59def628a6fc2f5a4854f4486720678f5d02b86be40a24a6f61ae4fb1aaf6f22ef13b61838

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
337KB

MD5
59eed1176564b28746c64ea562ab69af

SHA1
e5dffb89060fd9ac8a80a43dfbf0f2fa7bbb118d

SHA256
69f95b1562f6aee8898fd18acb71be056d3c4ceb79f98dd4b74d1bceabb0cbcd

SHA512
0298bc55b7d8e4e9fe6a4c797657763131a816779fd95e742e1896345edfcf1c6749c35c86e089e7a7f73fafab30f25e07e17698d4b3b331e39ba6ce957002c1

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
337KB

MD5
57dd294387bc2e40731ef9f4f1b5c263

SHA1
e539a40ec4c5548ddd1f603b5b654805e61997dc

SHA256
f0713c1519b8e59d09af15595b3044acbdf4373e3ebc89293eaa6fc08fe9f97b

SHA512
98ee3e688ea1eab50f80175f09108f2ae1f2eb418ff83dafe0612c3ed1fd2c5248150f6e5c48921db90362d0f7d01279483cef4f479f3e4014a8f5a577ef1ce0

Download Submit
C:\Windows\SysWOW64\Hnnljj32.exe

Filesize
337KB

MD5
b9e6692c4373b24dae4907a1ef22e6e5

SHA1
a7375fc3e8954e5d7459877b65abcefab8d59d38

SHA256
54a11062e24b56fc10e3d5c3f62ba7b023c77d74e16a98ce24d319038933e2b3

SHA512
9bdbd74ec56d99b7912a83b685888d9d94ad01b6ace69cd102863c581d70ca1affcec5e22c080b4609f28d3112c63623c2ffa9ca7634a66a39976bfd342a2ab0

Download Submit
C:\Windows\SysWOW64\Hpfbcn32.exe

Filesize
337KB

MD5
0446436fb02dd3833e824a985abb8481

SHA1
55bef05b40c8f024e7fa2c850d0fdd51a891535f

SHA256
0459f105d96fcdc90bf7ba54245b76bf5c0123f56c7853acf01526d274dbc5ab

SHA512
48706d52fabb0f10257a272b05e4a19aab90dade748b167f57867da1335fc58c1781170041376d11284b3d807f9838d7e9d813da4864c747c9b402003916b044

Download Submit
C:\Windows\SysWOW64\Iimcma32.exe

Filesize
337KB

MD5
45acd43a3667c75b9fb6947b1962c2ce

SHA1
0635d097e1c9e16272db1c2ad8b117046455e45c

SHA256
0816f31a0157026ed98ce437229e18f2accb499b2bf8b2fd890e7edb84ccfffc

SHA512
b9bb4e8c5a967f999002202e62a41511bd7b185ed951765dbf6542aa7b9a593c854c5eb5dfee9bde0a25bfba2f3ef8f8590fcbfb9b8e2a77323870f48128c92e

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
337KB

MD5
aceb727a736be2e19a7b82f7eee0a781

SHA1
b228a1404131a437df22af19c8e20fd8eb426b8a

SHA256
1a0d17b1c2c8bfc39cfd1e47231ae8f3a8d6497b64ba439ebb393dcc362ec15b

SHA512
290500ffd27ae7e627159a9a0600524bf7b3e591ebfd2f7a2a47bc08b801aad754697fa5d1d1ddcaee9ae8cb46d06d85c34a2698eed0fd264d6caf076c3893e2

Download Submit
C:\Windows\SysWOW64\Jeocna32.exe

Filesize
337KB

MD5
c7b51c9df981c3eab64b2ce9c335a1b4

SHA1
8046e1aa8bc45355e3eae42fead52292ab0f6e4a

SHA256
aa43f51cf06057b2883d2e9a0777b96945b4a52680f94782cd1373b07fbafbe9

SHA512
d262ce2d3c37f12bee6ec310f36a1b479a9d1b1d77542f87464e84bff48b7e5a59d59e7a184978aac42c865ec15c25ab1aa19ab3ec0234e5cdcc9d4d91ead7cf

Download Submit
C:\Windows\SysWOW64\Jifecp32.exe

Filesize
337KB

MD5
8aca6f55139e4503648795f301af02a1

SHA1
be264d715ee68e07292e00b2c44306fed556deaa

SHA256
8f40aaafb78f696cd24d6ed8edd565818d50bdde1d7dae8282cf1860babd6f81

SHA512
a245f579e85148a48fe0ac9b70295ac9d2662dd0e9472d0cf0a29605b5efb57821fed32cc0e226f4c1c4bc0465c4787ad7a3f555f97bbe49b608514665dce1f1

Download Submit
C:\Windows\SysWOW64\Khbiello.exe

Filesize
337KB

MD5
4ba33abfdc2fbbae366dbacf80936755

SHA1
046b5f438fc91655a9a3fcf54b7fd263779ffeb8

SHA256
ce369252b7d28ea48ce652fbc8faf88c085ebe7ac0e00cdb9b5c740a9744c2f7

SHA512
3da967f432ec4e69abd1d09023bf88fc004dfd4c6305332a893b8ecb44542293039eda9547776db7a6dc22c25a98d0e23b01fa527b8740b1da6679f8c29a2ca2

Download Submit
C:\Windows\SysWOW64\Klbnajqc.exe

Filesize
337KB

MD5
4ff2b32baaa959a236566c779ce79722

SHA1
c56f1b209534c56eae87f6af3ff3386fc8325ed6

SHA256
1e2566fe87b641e11cd31791ff6aea3e5e3fa52f5641cf79a126bdba0d7e1f76

SHA512
7876247a07e6338770758b5c769f87d1b517e79630c8a9726a568023bdd6601274b28562cfed265a84e53178411fa33eee51beb6b36933489823a3da91c8f0e3

Download Submit
C:\Windows\SysWOW64\Klekfinp.exe

Filesize
337KB

MD5
190dd691667d3f84d9b9b1ec38189666

SHA1
6e5772a584438973f2bfd5ba89aaf590c200d936

SHA256
5ea2cd4998491e73de17f0afd165e4a3b230282c021f843e0de46fc62eb7f4d4

SHA512
340d78c445a80884da6753076a4d733f7432ed3abd156ea5566ac9ef1ecfc52e5b71eecc43ecbb6c2beb546fb67174a4f61fc75fad8aa1cbf8ab291125a51fad

Download Submit
C:\Windows\SysWOW64\Klndfj32.exe

Filesize
337KB

MD5
e0757ac9edffa4a1bf206dd1f532eb55

SHA1
1e5b7b9909417c082d3bd5f34173191010a962ca

SHA256
84461ddbf86a61394f91b17119a60a882dc5d783dc0c40e65bf027bd95baee4a

SHA512
8139f47405b4711a550e7a2c95a867c53b144b887e4d9c0294941823a5e8fd70589ffbd2701ae2e39c3b3bd4ca0520747b64256d8c154e72e18e557ac2744830

Download Submit
C:\Windows\SysWOW64\Lhenai32.exe

Filesize
337KB

MD5
6ec779c1be8803f5beb9c686e58bae10

SHA1
b23e3d386a375dfdaec91953bdbfd860409ee6b2

SHA256
e475e888b488503bbf24ec7dd1b86fa0c2db70897b4a7ce31d212a2059679a62

SHA512
a0133becbafc99fe932d2350c54b81aaf9b91391b0e92af3db07abae3f8b8bf08223b93131302083cfd3df22dcea03f6867bdade68f970742dfd362e23c7a823

Download Submit
C:\Windows\SysWOW64\Lpjjmg32.exe

Filesize
337KB

MD5
cd1fc59e290ff7ec67862101fc40a158

SHA1
55d8f291a277103ac88e90fcddf9c104130f05ba

SHA256
0d7469ddf022ede3b1b0fa7fdf9a2ba21c1b299c0f8a46fdb4198a7da97b6763

SHA512
7da6c56662a60f3fbef37fa303e9a9a2275544592f4aab4c17cc9f0848cd7b3f5e39f481b037c3352dffaf69e6c5eb44419665ff335116b2e5bd541e7d5d988b

Download Submit
C:\Windows\SysWOW64\Mfeeabda.exe

Filesize
337KB

MD5
5ad7944a5c29f12474f66316fef5d916

SHA1
b4a32d165030b6b89562e0eddef03007fe776336

SHA256
ccaa23912e654da28a1cb1fa65f4ba2330d7a6409272af25d29ef457827a20f7

SHA512
3e40d3039a0a391b72f0d4d87d996c3150f30146e5f806506093031b29623aea4f865d46345c677e6e83060a1ec0fea6b056adbc6115fc1389e93ba0acb61697

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
337KB

MD5
f221030c5cbcf4815d7bcbcdd86dd427

SHA1
76f61d963dc4f490de21307c5a5ad06c434a34e7

SHA256
704bf34e7b8066c34b7e929d0f11afa21d826076ae5a6243096d125a9900d494

SHA512
5231eb035b35fb9be07a271fbcd65f89589a8f67b4752b905c8d8f214fe6d18e245e3610d0c2de5a0d45ee2cb2613fb839b9f7116256eec8c5753d2909acc17a

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
337KB

MD5
6444a9cae8094edca5ef04b4b5c98a64

SHA1
73dcce0be54efbdf23aab1146edf51bd51c89bef

SHA256
76a8867d9e4a1ec2e2961964d83ce9735e292ea74defcb9b69f8b9ac4f507207

SHA512
c480701b342314ffb4531c52b2c7a96f35a532eda58b050ad8d7937b96e5fcb054b217d5f33441b1f5a14bee7ec2dce8d2c4602d6b57302f9f6990b8eefdeeb2

Download Submit
C:\Windows\SysWOW64\Mgnlkfal.exe

Filesize
337KB

MD5
3ae1adc7c34c79692748e2fd175a3462

SHA1
86c7981566b606a65c828ec09ae20d5ad616cf7d

SHA256
f3e0693deb470996a60d470e32d18f5c1d96dd9a5eda4ed20758a57b66a8a053

SHA512
c4f4090407792be4693a8918849dc5a168d9a29497a2ac328ebaf1ebb08d7916d13cdb26e67fa0ba0b132203a4bc6edc44c6d0c57fa554ffd84fe5b1b8dba245

Download Submit
C:\Windows\SysWOW64\Mgphpe32.exe

Filesize
337KB

MD5
f53e800f63b942ff81a1f9321a373ee5

SHA1
32aad3e2c7e93de29d6867cc0ca4516956cb72cc

SHA256
c4f240f3a49526bc4e5b01dd5748841d3b3a1069ddf5c60d3cbe0975e0419e84

SHA512
268e77fb242406630a3ac93a0d1c23cfd8cfdd6b15ed6abfd35f6c98f959c089308bd9913541a0969d1d67b956e69ab3a36b7de5356e0584d260f04f3d672d1b

Download Submit
C:\Windows\SysWOW64\Mhanngbl.exe

Filesize
337KB

MD5
cfe5a3fabcc8259962d35dc7fb197c36

SHA1
c91e59d2fed62c1b4522f38b4d79ec556e8823f8

SHA256
f5441982d9e3c07ce78916305d57ed5521ec9eb135972457afd861ad2f91e74b

SHA512
6cf1bd0cf9e31bd3b2186cee880d349e984a1b4cae7832cf4cd17168b4c88274e6065287f46e61a0cd8dbb7bc8259c152322ae90e7455043458e5dc182f4234b

Download Submit
C:\Windows\SysWOW64\Mjggal32.exe

Filesize
337KB

MD5
5a88f7a0678dfd0336d3febec482fd7e

SHA1
3731dcffa7a67f25100bfba0ca0d2a11d92d5c88

SHA256
7a15b285f295d6486e5927926e745313cab3e8a078abccb2cabb8fbb93c9d1fc

SHA512
b919380a91263cdbb0812803f308b2fdda7122673b19aa88556ad894cccd703898ae9d1fb6bae6bbb78b98166c65fba05c089ad5e0d735083c65f41716edc4a3

Download Submit
C:\Windows\SysWOW64\Mjidgkog.exe

Filesize
337KB

MD5
61e254007008f2ed5e3a8c9ec42ba367

SHA1
86345b96cf795d652af0ee50f9f5643d97e1004b

SHA256
44cb27395bc27940d73ed08ade73cb78e75999b25b6470be529bff3460f86627

SHA512
0132b690e32cd686e0b614b2f216e198efa9ebc9b8160b06eb2f8e524528b41391e2e22586dfb3def36da19e5b56e37a71978e9d1447df06d8501b6af87d88b7

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
337KB

MD5
cd19f1bb1775604ccc325be4d5d00e4d

SHA1
b09996f3e44c53f90d791ff91aefbe5db5e4fd5f

SHA256
6a8158d3f4a23b853ebe2d9f0fd68b69ca80d8ecd1c3ba4474d2f487fe178e17

SHA512
712b5593ccd621e182375fe9856a236ad4a5946bfed296296317083406693c6234da69b4ded1503245801d04a5e2a00faee9e9eba6264a06d5bcddaadb65f281

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
337KB

MD5
4736af499a9598398e7c2666976dbdc0

SHA1
94e6bb5afa3455d254d71d8594678183cbc2c88f

SHA256
7406ccfe34774965b7cd0b0d19da648c01283218bf7cc3e2d021e84436c1e6ce

SHA512
12ad3a3cb8a1852928eb0c7cd8edc6fb418d0cda11ca71253894f96ed65c3cf36ae84418995f993268cd3b89790686a69f88ddabfd843087d3fb8ba9c4dc9bee

Download Submit
C:\Windows\SysWOW64\Mnmmboed.exe

Filesize
337KB

MD5
47220475dc6175632f4bdd653a48f83d

SHA1
f285a2e7a00b136fc7e73e765af45eaf4ec22bd5

SHA256
ba9792ace57b301e872ba07644d1a643208991da5c588eaf92bc7bbcf9277d95

SHA512
d68cc051ebd3f9f8a4d0a1eda4d0af56ab827237d6e03e7eb90baff989fd4bde669b94ca6d5b188e56b77ca0aae4e2ac6cf7d30b19f2dcea32e9410354198d07

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
337KB

MD5
8d4c459082c188654bf45a341ab338d3

SHA1
1c1ec84fc6ead34fd898798b3469b6bff587f707

SHA256
3092b856a9a741410ab17b3af46e48d3040bf9f00ad8792f99db5ae053057392

SHA512
e0c738d462c640567d66853c15acf58c51a4e1318bc8a91bad7e88b136e400b1fcfa4e0734ed7c85c74971688747f3df738b817885057b1e662cbad360451bce

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
337KB

MD5
cde4d08b6e1a72ec18cc4a4c099165c9

SHA1
4c2991936c6ee2d53ec32573f8f62caa366b27ad

SHA256
fd04e3af76e0bf7ffa6593964f3a270a5bbd07ca8643594aa6aaa1c83577c165

SHA512
d287274fce6c4e1b3b029090d26f08db470d159a42fbedf82f323661031266b2fecef3de5fa28ebae48243ea2a6fe60241ade82b332f748a21791aa0010d8c59

Download Submit
C:\Windows\SysWOW64\Monjjgkb.exe

Filesize
337KB

MD5
78163232d0b071f71111578ac3c477a9

SHA1
1d0910325fe0e73003da7ce1c1970e90ac7d6451

SHA256
7a4982f032200cabdd0c902391fa3ea8b5e3af5f1715c8dd61c2bd3a5e3e1ce1

SHA512
41104f265e10ce412b036f2359085ce4277414b0d475b5914706cadc34e19ef4256a46b9bf2b78a6f2d38ca936cb94898a86d12c6ebc0b7d79ae2bd7c718f15d

Download Submit
C:\Windows\SysWOW64\Nagiji32.exe

Filesize
337KB

MD5
7622bd59321cf14fe0130a3f23e1b9b2

SHA1
12e02235f32e0caabf80a889ee41387ba13f4a14

SHA256
a2f88c538e68fdd30bee111f8d51dadf43147ee1d8055a02ed1295c6b169dff2

SHA512
cc09f65a63a7e37aa8d08db587cd2cdd905b30e39d1795fd2e21b413698fc494fb7a2a7819322c8ad4b741c5033abd443cc4378bc464000fd32d501801984184

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
337KB

MD5
cc0f3a89486aeb9edf0a79cfe6a56712

SHA1
1058e2d5285c71858f933de403824468febad9fd

SHA256
e7141bbe542e4bedb5e5df0dcffb2cb584427eed77ecaca73c2625f96519e2ef

SHA512
3cbdc40c85727fae86405acbe38a907ce46a8dc1e3bd138106f3be6120145c3bf409f1121b220e4b01831e06b75c6afa83af43c4854171c53f8b8cccbfb70584

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
337KB

MD5
a154b100a4b2c77ff267d71fe9025d5c

SHA1
163343457d6ef4288546885d2423a639942b69dc

SHA256
a33ad11a9cb3726c6e8439dd3c86478e5448c8ee8d89e19d82a1c45f3b261bbb

SHA512
b915a37e84a18b3d34d05f355ce1ef15403b7cc8b5f9e128d761b2bbd0b126efc7ba37bb2d03a8a1d49a6758311d2a4d1652b12916959882d5bcd513cd486530

Download Submit
C:\Windows\SysWOW64\Nfcabp32.exe

Filesize
337KB

MD5
1c06e960ee315a8d7e60650fa23e2be0

SHA1
9e02b608c6b9c3cd4b3d67476c3c4d7923e51a51

SHA256
1cfeee2e533f22b60105d9966e1b61337be043b8943e9a09b113fd366bb773e3

SHA512
67dfbc739c59bdf26664fda978ed78e841683f0bffcfed53e5f60bd2ea91c0b0032ee3ee3d46b760a2742e884976efbee0ae2b4ef408f8f223887d0cd4b9b655

Download Submit
C:\Windows\SysWOW64\Nfgklkoc.exe

Filesize
337KB

MD5
f59f85ce0c9c215d4701fb51d54c3092

SHA1
ce5b86bad2364c7d64d9c28a6cfb3823047926e8

SHA256
45c50a2f5d77507099f2ba378924de5be7de5166d192265158c7a6dd35402964

SHA512
44707d373684072ad5c5127e5bf37cfefb64d75e023cb727369818f59a3eea5ba19f6fd298cfd7176763d129e84bdaf916253a426d83dc3c4eff589ace4603d4

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
337KB

MD5
b11af3e531071ad961897c510c79f9b1

SHA1
6441f6965c7dd644803c85378e0b2286c082a923

SHA256
97b04008799b535f85e0df21941fc46414bc840e33806e9e79256e0d8b6352f1

SHA512
968a1c853bf0dbd1453d2c14b4e78d0a960d55158bac3a3e86490c6d60cd674590e3bea6e95db228583f0f043b6bcf2536d3af4233550313e31a6937c7b68e3b

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
337KB

MD5
bc24fcdcfaa51633dd5b11c9eb85073d

SHA1
8af22ef5f55baea8fba36fcf0c96f1164da1236f

SHA256
26d208d6d3134de6bf76a1974e3a473e83a5279db6df451354981769d156db25

SHA512
c16ce6240ae861cf3bf3832cd64dd4604c933584a5e83bf0a7e65d12e43451b0daba2dc0b1b636b2903b38634c56c2f74239c2c660d690f29eb3b844885adedf

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
337KB

MD5
399d71f90322c619da68eb15ee3ac371

SHA1
e0c1eebb84d46cc98564002a1b0387f2cbfbafc6

SHA256
14bb5db0541ce0fa565c019b948630a6fe6cae9c173550531a04c92e9a76f3a0

SHA512
6009084fd81ea409f29d79131a19750a9b1720db54dec6aa326dc2d083f0de855e9352fef3fa092708bf151624b641b4c8dd1b65821b1ddd75e45e183ee0d3f2

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
337KB

MD5
b56b20f57444acc6d973acfc9ff7f5e0

SHA1
f8068fb2b0b3b2cf52a4c46679e1f925ae225fe1

SHA256
0b5d9ec1d3c2ea6a2ec3c6c4a3dc0236a1dd3e89ee596082175c14a82edccdc8

SHA512
c58a8de92ebd5a164ff844ed62973c503afeb44b8951bc64331d4b4f83a2eedcac65f514219bddf5bc3c059fbed5e89d9f8595f451e6f8a445432164c8ad9ae9

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
337KB

MD5
84bda11f97af79a3a2fefdf644dc47d2

SHA1
5c8a95c59c394a7271bcf64458d218466e82402b

SHA256
e60e3f6df75c8a996d6952d17699c8629b8a0bac6fc748f3374bb891201f6f02

SHA512
f1e5c4a4778b2e6447b8edc4833cfececa53141585014b3f2ab0871e4a47ffb405c66ba62c40eff84f046dfd80a3229d935030c403e29ae3cc5afd97cae25c22

Download Submit
C:\Windows\SysWOW64\Nnojho32.exe

Filesize
337KB

MD5
945053fbb1d81a6825a6c2eefa1a184e

SHA1
6b80aabb0145076fc625625a4095c345e7a58849

SHA256
fee30c0492c0be71bee67737f795806884edef2dad9e87961e0a782673559c35

SHA512
1a989b28fb9034f9d73a4e29bf84bb354a8f0040e01de02f3cee15bccb5ed1fae5a1ea1cde2e16177274312856c978ca9e6e479ec785b99c4a233a1d840f5753

Download Submit
C:\Windows\SysWOW64\Nodiqp32.exe

Filesize
337KB

MD5
d63683eb3bb68156b91fba6be7f7c3f4

SHA1
73e3c17a8e376f1da8d6588dc6cfc5f151e02989

SHA256
fc234ece8c7e3774048c8bf34e3a72cc42a99b73c7e84be405cc14ddc09acc77

SHA512
23ec923123240be9cb9afc207012f75edc4f48320f4f8dfe19b48a1ad3e49418c04f4b618868470eb95eecdd0bb4392595711b0a94c74bcdd4e001967710cbbf

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
337KB

MD5
388a367ea1fdfd234dbd10e953b3d52f

SHA1
8eb6e083f383d7bf7a3fc3611d13c58fe67fae01

SHA256
9ca7a1bf52fc3bf386c338f11e4103a28ee2e0fb7dab9076a07dcdc41390faba

SHA512
e1a98403ac17a17fcffd3dff3b00c01096eb02d97008eff9c62fd38d0f6bac8ec6352727da873bfeab72d3338d84408d854b285fbe6ac3b890d8bd9c3eaffd3e

Download Submit
C:\Windows\SysWOW64\Npgmpf32.exe

Filesize
337KB

MD5
e9f2304009f15b67fffd61d59e4b7e11

SHA1
c1162250b756ddcb9a0fb43748ba40cce63c1d56

SHA256
715b8870123b1b0c9dfc8dc6aa3456a2928cf795a00cd8248b96f5d27a8f7aed

SHA512
0066f8c7df31c8120a59e3f9e3052f1b6e9af4ace60f830ae6aeb8bd236b1c750bc531e29ff0bca13a71fe44555b1615656d06b04c00ed74ac639d9aee2c467c

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
337KB

MD5
c67a898f4c2d535568deec6bd6fd265c

SHA1
76f7980160d0c21e45094d7d8c693fb5f1349610

SHA256
3216d031b74f9ff8ae3e40314bb4e67cb53f0eb6c9ed7466ce77f76e48d6d7e8

SHA512
83eb4a678507e738b2e61f0cee7934d8aad5e32ad5ca3640b08ef10f7316935f776104c301181d81aecd70d7857b7efc96c40520f4a1e7a890c33ef002c9eed2

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
337KB

MD5
8cca50a35b4b3112964ed47ec40543b6

SHA1
84dad98d9594fc17fe7c09ff992b216d629a560d

SHA256
e1cdd428d8d2863c1425d698c9cd137a6ae6d9bfe97b33dd8c1c85ad3f503bca

SHA512
24e30f1c82af15e5b46c38e41f53f9b457063cfeffcca7fba8530826551fc99c59134ba2d970f18ace7beb1603760fb97618c6ea5af3012316b6506e9927f3d5

Download Submit
C:\Windows\SysWOW64\Oakbehfe.exe

Filesize
337KB

MD5
d45cdc293b26b99cf9fa79f2c9a48c0c

SHA1
391bbd629c20e1d53ddb43258d37ab87df33737f

SHA256
f41ab00f04233289f9c70dfbb2044d1228f7e945653d48be1614b283b00160a9

SHA512
585a67c8a546e68afcfaff36308220314b471f11b9a10f20834e77f5679ca03ef685b898da6961892ad4c069fa10e1054126733a5c31ff136b5c5e1e8fe7e0e3

Download Submit
C:\Windows\SysWOW64\Objkmkjj.exe

Filesize
337KB

MD5
ecdff600464d3ff3f9e221cd0af33787

SHA1
9dd8ad43ce75c94e0a0993b4063c1af689261edf

SHA256
389e4a9381142ecda13470c8bfb62c4fb959e35df5fb62f7943b2d7fd6720ab6

SHA512
f5e10539b26be301ab8fd828dc8ca214181cbab86e15b1cb73d31d0419a1406d4d65baf008fb686a45dca8e74ca5a26b07b4d1aeead630ad542b7bb9b268b16a

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
337KB

MD5
5fed96bff4b4402401108f2927067b28

SHA1
51d037de5ec344e6e32412002f944cbb87dc1bff

SHA256
6d7b412956b1d72500ac59af9bbc21fef59b72e751efda08bb56240909f8b3f8

SHA512
80fb863177d8ad33c5e60487fabe2bc3b99d627994524f0a0aa1b9c025b9d5c98d394643dd16e8cbd79ceb426ed51ca2c7c261ff8ffdce4be40415ef254d4cb7

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
337KB

MD5
5b1f75dbe89402478151ef4d75c7f6e3

SHA1
125a674a2bcbd06b4815e0fd59550e0d038b2b78

SHA256
623c742219009d8d80dc13896b42ce02d277499f48210e9c86e1bb91c97c696b

SHA512
ab5d4a64f54af891f5e314e72d88ed279803395cb5e1dcc7c95b686a6d8d21a2e681f44128678564db0fffdff883da13d72191ee5babb69be486de7ae323513e

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
337KB

MD5
7b9a5cdf7bd26a16d4b2ba0d7dce05c8

SHA1
649cce1c7d023637e3fa1ae30e8793318fa4619c

SHA256
d9f0d5e49aae82361f1d65247a5f1d8220f13cc85c7b0138c95a4430015bbcfa

SHA512
e14b9f1b683670b71e4f1dfe3024e95bfcd7c8f85efedb268882df8f21bdf723e2abda6d0e6fb14fc876521d20b0f5b3d9439e066e8c8cc22406d6bc10358563

Download Submit
C:\Windows\SysWOW64\Ompfej32.exe

Filesize
337KB

MD5
055d5832045f016abae7f2d66b5d019b

SHA1
c051b636b5a958cc9a40f86b8531cb7a7465a64e

SHA256
52b2927ca349b5a3dabd044cb9b1e28747a2e96a07d7572375ba28f8fb9131a8

SHA512
d3ea7bc9ccce3d55786e44b657a4a8c53f61a5b816bb8c0773d6633bd4c53def2bc5a9fec03e84cc8dd4bfd1c024b0fd0d44c749ebd4dcaf41bccab3e849b1b3

Download Submit
C:\Windows\SysWOW64\Onkidm32.exe

Filesize
337KB

MD5
24417ab34b298cae9f695582c130253f

SHA1
eff6ff7d902c9512bdf6c312c1608e6657825fa3

SHA256
73bdc613b4efbecf06bba4f5ff83674f1a222dbcd688b950ee54f4c0559b4fe2

SHA512
1e1f16cfaad0f872c616679173e808d425b0dbcd6d390a45b3b781305c72e66ae2583c6a28ac9a0c18ae8d8d97c4827b6b89a119a04f9a9b4001eeaebf656b6f

Download Submit
C:\Windows\SysWOW64\Oonlfo32.exe

Filesize
337KB

MD5
bc0d2f5015b3578c7f2537fb129f3e27

SHA1
aff113e73190875c8aac3bd72af7650103eba022

SHA256
d31481dd83bf78e201dcbfd509518646dfb3556720c28722df6f6bb2ddb91ef4

SHA512
7097d0b2c78356ff51efb7b9599c9b33a3f5b5635593b22a42b20724428de4a17eeb2dfc299ab2a70198d0339e1dfe5e03db425c2ec3dbe57e13993d6cabde1c

Download Submit
C:\Windows\SysWOW64\Oophlo32.exe

Filesize
337KB

MD5
b45da518a66f5ef9a1a87d4bf01637fe

SHA1
0fc7ad6a22bdc6282f1681f7d453546c989f3ecc

SHA256
7b61c0f405206c59d3cb1b0918a36c3d5d778fd36ab106c41159925e7b66158a

SHA512
24467ed504cdc09f41d9d2a047e41f8156a6b3038bed4dfc466568dad6e82168b49c239251590ff5190413bd18a632352d12d8a1dd354a395ac7e6593ddc9005

Download Submit
C:\Windows\SysWOW64\Oplfkeob.exe

Filesize
337KB

MD5
d18df214c0d396a983528c82d304f263

SHA1
c120e8515a76e3971074bd0e0b28be66f1a3dc22

SHA256
b4c0577ae321eaac07d38a17a5468df099170624b1a8630bd832cb179034947e

SHA512
ea4dd23e517873a38da8a43ff9888245e8602f7c343db179f240640fd00c5470481cfea02549122f4a03193b0ca99d51eb0d84d37c0c194357ef5902e9d14e6b

Download Submit
C:\Windows\SysWOW64\Pcgdhkem.exe

Filesize
337KB

MD5
059975121c22ad7465220e85a9096eba

SHA1
48fe8b59fb37cf226e5f021a16d22e5f67f80fc0

SHA256
7953eaf04f3deffd5ddd67683cf090dbd60005ae9c3516deee1d4e84d3bddd6d

SHA512
1046bb17f3a90fd453716a5b41bce8274ee612edc4d2b3a63f800a25c7fbefc72bb002dde096371467c4275f9ed9a483ef6063f3093afb43b99ab720effaa9eb

Download Submit
C:\Windows\SysWOW64\Pfojdh32.exe

Filesize
337KB

MD5
3a848ed867c69e8f209c73b3ccaa4981

SHA1
fce948c354e67f3734de9b888af6b379d99e3593

SHA256
aa611f25fc1cfc069ccb635f10ba5fe848957a28b72e6312a294458489419def

SHA512
f2ff93c6832c8eda9d0f1761c3d2804019054d49c3e119547254f40b7086ebe239724dacb432ebe3c35d7c82a41d0575abbe734b47066d7d2e4c985f8be41018

Download Submit
C:\Windows\SysWOW64\Pjbcplpe.exe

Filesize
337KB

MD5
d864a351763fdc78a807fe4e5caa0fa2

SHA1
4a5954feafd72df65cf151dbf0fc8e84805f7cff

SHA256
e1ac81de299df0315462bbfe98f3139181008b09b256198044d27a300aba25b1

SHA512
7216d55afe67a5539a64a7591415c68872523caf26281ca9ebedb7abe0ad56756024f44fd384290bc89f946ac3ef70ce8feb8e46f9d73b8e4bacf6626c195fac

Download Submit
C:\Windows\SysWOW64\Pjmjdm32.exe

Filesize
337KB

MD5
99e044d93d5d5a8094ef55c642a5fe95

SHA1
fa11a5788b71f07a154b85a336ef16c8eb6c1c0e

SHA256
49b7fd3fab15c6df0d37892c43dcd5311ea8eaaaeb2cfce75800e0a7a491ff50

SHA512
90de84533dcb8dbcd1f4b8a6154236db99aa8005a0ee3fe35224b53d88c794ecbd03340a62accb6caa65387bf162fb130ee011ff6a385dfb9644ceb759400db1

Download Submit
C:\Windows\SysWOW64\Pmphaaln.exe

Filesize
337KB

MD5
36da8b82e9c28b109667c64f4063900e

SHA1
42c02437159a3fbeca465288597fa96bb4aaf35b

SHA256
6cac8d7982b2b36c71d161b4abd92d84df1e13f8053cb3f5890a069c74d0afc9

SHA512
14141d2b6924ddebcd72f6ed114d25bb4e1de96e7aeee542ab9cbdd6476db374244bdc4c3547e95a12722b6b911c69e6354dda5c324545956c0533404ee7a5ff

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
337KB

MD5
1103f74d37ed53b7057acae02807fc25

SHA1
34023ce2e20cc0467cb50b8942ac23a1cdbbb97d

SHA256
621d8ae3c0a320b3dd2c2c133de9a9e4fac942e8b74a15873d3714eb0b657def

SHA512
1c375bdaabeae4cc88155b97e1f52688f92181b212c1b1faad677ed520c1b858e5c564fccc649e3ffda7eba30ba28ad72b48f674776736370c84f7d258e7ab9f

Download Submit
C:\Windows\SysWOW64\Qdaniq32.exe

Filesize
337KB

MD5
4c6374fcfb712caf32cc3ab528f4036b

SHA1
6e5996e0eb437082ba9c404dca1de8d284734b1d

SHA256
333ec9633c5871efc5872ea5a2c583061d98d4901d7b9ac9734320e3519fa7a9

SHA512
b97f6cbc6ef065fe54f77780ae322987642b11191f969782937c55bb5a5c1b3f0f4598ffd1b6f919f04f75d7956dfa649889ef729932988a258f3a6f398163ff

Download Submit
memory/60-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/64-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/220-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/508-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/780-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/920-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/924-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/952-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1020-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1052-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1292-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1444-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1452-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1576-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1812-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1872-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2156-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2204-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2320-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2448-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2448-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2500-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2584-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2592-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2888-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3012-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3116-581-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3196-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3220-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3260-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3568-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4012-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4104-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4276-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4320-588-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4464-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4868-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4968-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4992-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9820-2919-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9992-2928-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10524-2915-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads