berbew | fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76

Analysis

max time kernel
7s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe
Size

337KB
MD5

e28a38298965b03ee3d8604a2b91b83c
SHA1

2deac11da19744ba59dbcd29d108b4cbc454e8b8
SHA256

fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76
SHA512

5075bce27f0a04a08448cb97d26f0363ba09b6f7cf0d50c564583f8738f67f8875c958716280e52d14bb460fb0ad1affaab921db4b5dab980ef054a9a87c8290
SSDEEP

3072:NIPBYlm9BX2dhngYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:COW12dhn1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkpool32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqbbpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklbmllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poomegpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iqmidndd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkhgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnfcia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbbagk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okgaijaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajbmdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjedffig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgnoki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqpoakco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kndojobi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nknobkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pakllc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhkikq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qebhhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdkpma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghhhcomg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaamlecg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghmbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjjnae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqlefl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aomifecf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alqjpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmlneg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkdhjknm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkmioc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llflea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnhghcki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idbodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgogbgei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjmcnbdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Najceeoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Papfgbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idbodn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdbhkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqpoakco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llflea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qebhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edopabqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fineoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpfjma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbngllob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhmmjbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdkpma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leenhhdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhbolp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeaoab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpfjma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgogbgei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lacdmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiknlagg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alqjpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhabbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gijekg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmeakf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gilapgqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inmpcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poajkgnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkhjph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkpheidp.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
3700	Emehdh32.exe
1328	Edopabqn.exe
1840	Efmmmn32.exe
2844	Fmgejhgn.exe
2456	Fdamgb32.exe
3312	Ffpicn32.exe
1508	Fineoi32.exe
4940	Faenpf32.exe
1596	Fdcjlb32.exe
2088	Fgbfhmll.exe
716	Fknbil32.exe
3168	Fmlneg32.exe
3128	Fpjjac32.exe
4180	Fhabbp32.exe
3752	Fkpool32.exe
1160	Fmnkkg32.exe
1520	Fpmggb32.exe
4556	Fdhcgaic.exe
3060	Fkbkdkpp.exe
1416	Fielph32.exe
1640	Falcae32.exe
4612	Fdkpma32.exe
4548	Fhflnpoi.exe
1996	Gkdhjknm.exe
396	Gmcdffmq.exe
2720	Gpaqbbld.exe
2224	Ghhhcomg.exe
4380	Ggkiol32.exe
2284	Gijekg32.exe
3008	Gmeakf32.exe
4000	Gaamlecg.exe
4704	Gdoihpbk.exe
1744	Ghkeio32.exe
1872	Gkiaej32.exe
4020	Gilapgqb.exe
4420	Gacjadad.exe
2248	Gpfjma32.exe
3516	Ghmbno32.exe
3924	Ggpbjkpl.exe
1560	Ginnfgop.exe
1844	Gaefgd32.exe
456	Gddbcp32.exe
3468	Ggbook32.exe
1376	Gknkpjfb.exe
4780	Gahcmd32.exe
4472	Gpkchqdj.exe
4544	Hhbkinel.exe
3500	Hkpheidp.exe
3028	Hjchaf32.exe
5000	Hajpbckl.exe
3520	Hpmpnp32.exe
3712	Hhdhon32.exe
2992	Hkbdki32.exe
3288	Hjedffig.exe
3140	Hammhcij.exe
3996	Hdkidohn.exe
2228	Hncmmd32.exe
2180	Hpbiip32.exe
1436	Hhiajmod.exe
3260	Hjjnae32.exe
5128	Haafcb32.exe
5168	Hpdfnolo.exe
5208	Hgnoki32.exe
5248	Hkjjlhle.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ggpbjkpl.exe	Ghmbno32.exe
File created	C:\Windows\SysWOW64\Qkmdkgob.exe	Qikgco32.exe
File created	C:\Windows\SysWOW64\Fjjcdn32.dll	Fdkpma32.exe
File created	C:\Windows\SysWOW64\Mlkepaam.exe	Milidebi.exe
File created	C:\Windows\SysWOW64\Bnhpfjhc.dll	Obcceg32.exe
File opened for modification	C:\Windows\SysWOW64\Fkbkdkpp.exe	Fdhcgaic.exe
File created	C:\Windows\SysWOW64\Ikcmbfcj.exe	Ihdafkdg.exe
File created	C:\Windows\SysWOW64\Aokkdnic.dll	Indfca32.exe
File created	C:\Windows\SysWOW64\Kkfcndce.exe	Kiggbhda.exe
File created	C:\Windows\SysWOW64\Gmpbnakj.dll	Gknkpjfb.exe
File created	C:\Windows\SysWOW64\Kejocggj.dll	Lankbigo.exe
File opened for modification	C:\Windows\SysWOW64\Emehdh32.exe	fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe
File opened for modification	C:\Windows\SysWOW64\Fmnkkg32.exe	Fkpool32.exe
File opened for modification	C:\Windows\SysWOW64\Gkdhjknm.exe	Fhflnpoi.exe
File created	C:\Windows\SysWOW64\Hjjnae32.exe	Hhiajmod.exe
File created	C:\Windows\SysWOW64\Haafcb32.exe	Hjjnae32.exe
File created	C:\Windows\SysWOW64\Heolpdjf.dll	Iqpfjnba.exe
File opened for modification	C:\Windows\SysWOW64\Jgogbgei.exe	Jdpkflfe.exe
File opened for modification	C:\Windows\SysWOW64\Kqpoakco.exe	Knbbep32.exe
File created	C:\Windows\SysWOW64\Jgnboabc.dll	Fknbil32.exe
File created	C:\Windows\SysWOW64\Faikapbo.dll	Aoofle32.exe
File created	C:\Windows\SysWOW64\Enqjamin.dll	Jjopcb32.exe
File created	C:\Windows\SysWOW64\Pakllc32.exe	Plndcl32.exe
File created	C:\Windows\SysWOW64\Pqfkck32.dll	Falcae32.exe
File created	C:\Windows\SysWOW64\Mnneheln.dll	Hncmmd32.exe
File opened for modification	C:\Windows\SysWOW64\Hnhghcki.exe	Hkjjlhle.exe
File created	C:\Windows\SysWOW64\Phmgghbe.dll	Hkjjlhle.exe
File created	C:\Windows\SysWOW64\Kgopidgf.exe	Kaehljpj.exe
File created	C:\Windows\SysWOW64\Ofimgb32.dll	Plbmokop.exe
File created	C:\Windows\SysWOW64\Kifona32.dll	Pabblb32.exe
File created	C:\Windows\SysWOW64\Hkjmbk32.dll	Qkjgegae.exe
File opened for modification	C:\Windows\SysWOW64\Gacjadad.exe	Gilapgqb.exe
File opened for modification	C:\Windows\SysWOW64\Hjedffig.exe	Hkbdki32.exe
File created	C:\Windows\SysWOW64\Mapmipen.dll	Jnmijq32.exe
File opened for modification	C:\Windows\SysWOW64\Knbbep32.exe	Kkcfid32.exe
File created	C:\Windows\SysWOW64\Fjbhpb32.dll	Kgmcce32.exe
File created	C:\Windows\SysWOW64\Nogiifoh.dll	Leenhhdn.exe
File created	C:\Windows\SysWOW64\Anbpqqmm.dll	Mldhfpib.exe
File created	C:\Windows\SysWOW64\Nhbolp32.exe	Neccpd32.exe
File created	C:\Windows\SysWOW64\Fkpool32.exe	Fhabbp32.exe
File created	C:\Windows\SysWOW64\Cclaff32.dll	Ginnfgop.exe
File created	C:\Windows\SysWOW64\Ikndgg32.exe	Igchfiof.exe
File opened for modification	C:\Windows\SysWOW64\Plbmokop.exe	Poomegpf.exe
File opened for modification	C:\Windows\SysWOW64\Qkmdkgob.exe	Qikgco32.exe
File created	C:\Windows\SysWOW64\Dbilgi32.dll	Gmcdffmq.exe
File opened for modification	C:\Windows\SysWOW64\Hhdhon32.exe	Hpmpnp32.exe
File created	C:\Windows\SysWOW64\Jklaah32.dll	Iqklon32.exe
File created	C:\Windows\SysWOW64\Inainbcn.exe	Ikcmbfcj.exe
File opened for modification	C:\Windows\SysWOW64\Jjopcb32.exe	Jklphekp.exe
File opened for modification	C:\Windows\SysWOW64\Jhpqaiji.exe	Jbfheo32.exe
File opened for modification	C:\Windows\SysWOW64\Fhflnpoi.exe	Fdkpma32.exe
File opened for modification	C:\Windows\SysWOW64\Hgnoki32.exe	Hpdfnolo.exe
File created	C:\Windows\SysWOW64\Jklphekp.exe	Jdbhkk32.exe
File created	C:\Windows\SysWOW64\Nbqmiinl.exe	Nhkikq32.exe
File created	C:\Windows\SysWOW64\Pcepkfld.exe	Pllgnl32.exe
File opened for modification	C:\Windows\SysWOW64\Ffpicn32.exe	Fdamgb32.exe
File created	C:\Windows\SysWOW64\Lbmoin32.dll	Hhdhon32.exe
File opened for modification	C:\Windows\SysWOW64\Hncmmd32.exe	Hgiepjga.exe
File created	C:\Windows\SysWOW64\Hkjjlhle.exe	Hgnoki32.exe
File created	C:\Windows\SysWOW64\Oklkdi32.exe	Oiknlagg.exe
File created	C:\Windows\SysWOW64\Plndcl32.exe	Pedlgbkh.exe
File created	C:\Windows\SysWOW64\Gahcmd32.exe	Gknkpjfb.exe
File created	C:\Windows\SysWOW64\Kaedkn32.dll	Llflea32.exe
File created	C:\Windows\SysWOW64\Ohpkmn32.exe	Oeaoab32.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hncmmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgmcce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbefdijg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaajed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oklkdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakllc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmgejhgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmlneg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkjgegae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nijeec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeaoab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Poomegpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmcdffmq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqpoakco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obcceg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpfjma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iqmidndd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iqbbpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqlefl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkcfid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmmjbkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeoblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkdhjknm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghkeio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcepkfld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qikgco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikejgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnfcia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjopcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lankbigo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlkepaam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhbolp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gijekg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjchaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkmdkgob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajbmdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbdki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqnbkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oehlkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piijno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhflnpoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaamlecg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikqqlgem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihgnkkbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkiaej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idbodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indfca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgogbgei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkaicd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leenhhdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emehdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpmggb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohpkmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlphbnoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okgaijaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgbfhmll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiggbhda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jibmgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbinam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkabjbih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbngllob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nliaao32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Inainbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocedmfn.dll"	Lbgalmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nijeec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qebhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmgejhgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iqklon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iangld32.dll"	Inomhbeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kndojobi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgopidgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgcjdd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Licfngjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbefdijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbhkjmnj.dll"	Fkbkdkpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpfjma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iqpfjnba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjmmepfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchace32.dll"	Lkabjbih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jebqacjl.dll"	Nhkikq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohpkmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkpheidp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpdfnolo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnhghcki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpfcdojl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkmdkgob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfinqm32.dll"	Ahqddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpaqbbld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hplfookn.dll"	Idbodn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkmioc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlphbnoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Palbkhoj.dll"	Oklkdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pllgnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lojkhk32.dll"	Qebhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaefgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbngllob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nafjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnpfop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gahcmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgiepjga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Inmpcc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihdafkdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqpoakco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdapai32.dll"	Ghkeio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lacdmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmnkkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggpbjkpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhdhon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbbagk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mifljdjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fineoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iddljmpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikcmbfcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadenp32.dll"	Nbgcih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahqddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faikapbo.dll"	Aoofle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggebqoki.dll"	Faenpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Indfca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiejmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkcfid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Najceeoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlmhkg32.dll"	Ikejgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhabbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Haafcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekojppef.dll"	Hpfcdojl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3700	2760	fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe	83
PID 2760 wrote to memory of 3700	2760	fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe	83
PID 2760 wrote to memory of 3700	2760	fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe	83
PID 3700 wrote to memory of 1328	3700	Emehdh32.exe	84
PID 3700 wrote to memory of 1328	3700	Emehdh32.exe	84
PID 3700 wrote to memory of 1328	3700	Emehdh32.exe	84
PID 1328 wrote to memory of 1840	1328	Edopabqn.exe	85
PID 1328 wrote to memory of 1840	1328	Edopabqn.exe	85
PID 1328 wrote to memory of 1840	1328	Edopabqn.exe	85
PID 1840 wrote to memory of 2844	1840	Efmmmn32.exe	86
PID 1840 wrote to memory of 2844	1840	Efmmmn32.exe	86
PID 1840 wrote to memory of 2844	1840	Efmmmn32.exe	86
PID 2844 wrote to memory of 2456	2844	Fmgejhgn.exe	87
PID 2844 wrote to memory of 2456	2844	Fmgejhgn.exe	87
PID 2844 wrote to memory of 2456	2844	Fmgejhgn.exe	87
PID 2456 wrote to memory of 3312	2456	Fdamgb32.exe	88
PID 2456 wrote to memory of 3312	2456	Fdamgb32.exe	88
PID 2456 wrote to memory of 3312	2456	Fdamgb32.exe	88
PID 3312 wrote to memory of 1508	3312	Ffpicn32.exe	89
PID 3312 wrote to memory of 1508	3312	Ffpicn32.exe	89
PID 3312 wrote to memory of 1508	3312	Ffpicn32.exe	89
PID 1508 wrote to memory of 4940	1508	Fineoi32.exe	90
PID 1508 wrote to memory of 4940	1508	Fineoi32.exe	90
PID 1508 wrote to memory of 4940	1508	Fineoi32.exe	90
PID 4940 wrote to memory of 1596	4940	Faenpf32.exe	91
PID 4940 wrote to memory of 1596	4940	Faenpf32.exe	91
PID 4940 wrote to memory of 1596	4940	Faenpf32.exe	91
PID 1596 wrote to memory of 2088	1596	Fdcjlb32.exe	92
PID 1596 wrote to memory of 2088	1596	Fdcjlb32.exe	92
PID 1596 wrote to memory of 2088	1596	Fdcjlb32.exe	92
PID 2088 wrote to memory of 716	2088	Fgbfhmll.exe	93
PID 2088 wrote to memory of 716	2088	Fgbfhmll.exe	93
PID 2088 wrote to memory of 716	2088	Fgbfhmll.exe	93
PID 716 wrote to memory of 3168	716	Fknbil32.exe	94
PID 716 wrote to memory of 3168	716	Fknbil32.exe	94
PID 716 wrote to memory of 3168	716	Fknbil32.exe	94
PID 3168 wrote to memory of 3128	3168	Fmlneg32.exe	95
PID 3168 wrote to memory of 3128	3168	Fmlneg32.exe	95
PID 3168 wrote to memory of 3128	3168	Fmlneg32.exe	95
PID 3128 wrote to memory of 4180	3128	Fpjjac32.exe	96
PID 3128 wrote to memory of 4180	3128	Fpjjac32.exe	96
PID 3128 wrote to memory of 4180	3128	Fpjjac32.exe	96
PID 4180 wrote to memory of 3752	4180	Fhabbp32.exe	97
PID 4180 wrote to memory of 3752	4180	Fhabbp32.exe	97
PID 4180 wrote to memory of 3752	4180	Fhabbp32.exe	97
PID 3752 wrote to memory of 1160	3752	Fkpool32.exe	98
PID 3752 wrote to memory of 1160	3752	Fkpool32.exe	98
PID 3752 wrote to memory of 1160	3752	Fkpool32.exe	98
PID 1160 wrote to memory of 1520	1160	Fmnkkg32.exe	99
PID 1160 wrote to memory of 1520	1160	Fmnkkg32.exe	99
PID 1160 wrote to memory of 1520	1160	Fmnkkg32.exe	99
PID 1520 wrote to memory of 4556	1520	Fpmggb32.exe	100
PID 1520 wrote to memory of 4556	1520	Fpmggb32.exe	100
PID 1520 wrote to memory of 4556	1520	Fpmggb32.exe	100
PID 4556 wrote to memory of 3060	4556	Fdhcgaic.exe	101
PID 4556 wrote to memory of 3060	4556	Fdhcgaic.exe	101
PID 4556 wrote to memory of 3060	4556	Fdhcgaic.exe	101
PID 3060 wrote to memory of 1416	3060	Fkbkdkpp.exe	102
PID 3060 wrote to memory of 1416	3060	Fkbkdkpp.exe	102
PID 3060 wrote to memory of 1416	3060	Fkbkdkpp.exe	102
PID 1416 wrote to memory of 1640	1416	Fielph32.exe	103
PID 1416 wrote to memory of 1640	1416	Fielph32.exe	103
PID 1416 wrote to memory of 1640	1416	Fielph32.exe	103
PID 1640 wrote to memory of 4612	1640	Falcae32.exe	104

C:\Users\Admin\AppData\Local\Temp\fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe
"C:\Users\Admin\AppData\Local\Temp\fb5a40e223fb506ff0ad2413fc62dccc066e28a036cc269aff7a0a60437bbf76.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\Emehdh32.exe
  C:\Windows\system32\Emehdh32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\Edopabqn.exe
    C:\Windows\system32\Edopabqn.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\Windows\SysWOW64\Efmmmn32.exe
      C:\Windows\system32\Efmmmn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2844
      - C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:396
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2720
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        29⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        33⤵
        Executes dropped EXE
        
        PID:4704
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1872
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        37⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2248
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        43⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        44⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1376
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        47⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        48⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        51⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        56⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        57⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        58⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        60⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1436
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        68⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        70⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        71⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        72⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        73⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        74⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        75⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        78⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        80⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        84⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1248
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        90⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4440
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        93⤵
        Drops file in System32 directory
        
        PID:3408
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1496
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        96⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        98⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        101⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        102⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        103⤵
        Drops file in System32 directory
        
        PID:1648
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        107⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        109⤵
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:440
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        114⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        116⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        118⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        119⤵
        Drops file in System32 directory
        
        PID:1312
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        120⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        121⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        122⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        123⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        125⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        127⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        129⤵
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        131⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        133⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        138⤵
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        140⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        141⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        142⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2700
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        145⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:228
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2016
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        148⤵
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        150⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        151⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        153⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        155⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        156⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        158⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        164⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:436
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        165⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:748
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4388
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        167⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        170⤵
        Drops file in System32 directory
        
        PID:1544
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        171⤵
        Drops file in System32 directory
        
        PID:4856
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2148
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        173⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1112
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        175⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        178⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        182⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        183⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        184⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        185⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        187⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        188⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6740
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        190⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        193⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        194⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        195⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        196⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        197⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        198⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        199⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        200⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        201⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        202⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        203⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        204⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        205⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        206⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        207⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        208⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        209⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        210⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        211⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        212⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        213⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        214⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        215⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        216⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        217⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        218⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        219⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        220⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        221⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        222⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        223⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        224⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        225⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        226⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        227⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        228⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        229⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        230⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        231⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        232⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        233⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        234⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        235⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        236⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        237⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        238⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        239⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        240⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        241⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        242⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        243⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        244⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        245⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        246⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        247⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        248⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        249⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        250⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        251⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        252⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        253⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        254⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        255⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        256⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        257⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        258⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        259⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        260⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        261⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        262⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        263⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        264⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        265⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        266⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        267⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        268⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        269⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        270⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        271⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        272⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        273⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        274⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        275⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        276⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        277⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        278⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        279⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        280⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        281⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        282⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        283⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        284⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        285⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        286⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        287⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        288⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        289⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        290⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        291⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        292⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        293⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        294⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        295⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        296⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        297⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        298⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        299⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        300⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        301⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        302⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        303⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        304⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        305⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        306⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        307⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        308⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        309⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        310⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        311⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        312⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        313⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        314⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        315⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        316⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        317⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        318⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        319⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        320⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        321⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        322⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        323⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        324⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        325⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        326⤵
        
        PID:8772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acfhad32.exe

Filesize
337KB

MD5
9b7e21963e244ee2e7af06ec06193e35

SHA1
1dccb24cc53b4a55dddc16cee75488f637b7e123

SHA256
83e55e3b680e59d564ad97a4be7faf9a690f19c51cc738e146d101edb58e0299

SHA512
e364a677d53532510b99a8d4dc70f4cbd015bca16cb5b8a95bfe783f72d59b66b404f108cc5796890940139bef145e7458074e2a29924b42940ec7fab49d6ec7

Download Submit
C:\Windows\SysWOW64\Bhldpj32.exe

Filesize
337KB

MD5
a84b3b5869f294dbb5c04f21ea04c643

SHA1
7304db3dd039a299b385db6c838d94abb0413adb

SHA256
a288615f0399a54353cae13116ba9fb2db73c9b56d21cfb3faffd1e66a336e94

SHA512
24bf940e321211ac044f17f51554c03770ef0a5be79e033b0a0e120f0a390b1b0d6b41bc0735b9c80346cf111d37ae5a93a5c63c3333225f2ef79d166f6539d7

Download Submit
C:\Windows\SysWOW64\Cfldelik.exe

Filesize
337KB

MD5
db672302e0dd472aa909b285b6444592

SHA1
3af67fb0c4891cecec1f877f0bb376c8ba89f2d9

SHA256
27fdfc8021bb5aa5a02b9c6acb67728366db5c183ce3cd8d1a2d71860a8d36e4

SHA512
1b6d179e3d684f826e8064c1add82c41c12b024be6430b64e074e3c8a6898c910809fa6778631e439e49e6c64693319771e01eb08bd2d603bce99d96511f2a48

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
337KB

MD5
3953b3e36687f70819f4c1c905801cd7

SHA1
129d7d398ae7de63c96671e160d99a3ebe323d3c

SHA256
62e3d136e64689802cb28e679516a4eebfec96c3dc04c840525d6752a6f39a51

SHA512
f031fc602d7191ff03d3621f79d7c45f23436702385a747e5126c65b4809abb49b90f5ca84c8d94d98d6bf56decab3012c5b55862c5721fb747724a7a010c812

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
337KB

MD5
142e7c8d63286331de58b9b1cd4cac22

SHA1
0d670bca023ff1898d873812ca0404fb0a1745f6

SHA256
e57c82d501251f1879c5188bdc08d8d78a1b605138af145ac52d2745abe21926

SHA512
93151a27f6a4bf7c7e661ece4cedb13bd3752d9ee25e9490ca8f2568e8efc1e570fca64866a5c8025244f8f2a3ba7e205d9a03d32db24fe3ecb6198bbfcda8ee

Download Submit
C:\Windows\SysWOW64\Eclmamod.exe

Filesize
337KB

MD5
6ebc926eb5cb66ee637fe0a2c8e6c547

SHA1
b00c380681084db764a2c992278550b12ff2a6e9

SHA256
c127f05adadb1ee74c39045442705be221ade9aa347b14afb0ce6b6957234ffd

SHA512
5166a5ca709c04e8d0a3a63bc5ab0043233fd76a6e160ee830ffd09fae6807a93f2f1f7a2a70fcab6f1dfb2c97139c31ec12c4d9714ab06998bafd0979cd8338

Download Submit
C:\Windows\SysWOW64\Edopabqn.exe

Filesize
337KB

MD5
e43ff4421e21c15ce14c9ecefdb4f29f

SHA1
75d9f1c585632d1aec920c46fa46b7367efdf282

SHA256
6fb4d01c9b91cf8bf32524c2f41003dab9e35faf31f80793d06882f9c0432257

SHA512
405c45388af510e38e7ceb378852d401d347bad5084872b26e43bedc7edc7f1692c4bc6bd00cb1c89a7d6e38d451684f4d92c401335f3ddfafa1320d717f5904

Download Submit
C:\Windows\SysWOW64\Efmmmn32.exe

Filesize
337KB

MD5
b6f7ade9554cb464b0f90dd600c9384f

SHA1
d2c098ff433db3da394b815300bd157d38b6bdbd

SHA256
819f1dacd1e9c42b792e692d21070fe1f9ceacd8a931452b665cd79e23744819

SHA512
0e071195d015b22427ce9097914f1e3ded42a4caa7b572b97ae15a0bffa238d15e5584b2a504d8c6a6f00e7ea2ddf40555b8c9ba61a863403f0d36c3da706957

Download Submit
C:\Windows\SysWOW64\Elpkep32.exe

Filesize
337KB

MD5
ab2efe39ef30d3ea619644c3bbdd8b6d

SHA1
1d430f5f21f91f37017ed0282dfa07d4f56a5aee

SHA256
9a23f61a0b715b36223347caf37080ba7a40f8bcd8d8faa4d23ccecd364210bd

SHA512
0a1a57b1ad05ac0b6eb4a2dc9ef2719ff0d2e85bae25a97658c619037272a34ba757b92fd0891a87a57548fe808a50ab6f471e20b44919ab3df062e7495e131c

Download Submit
C:\Windows\SysWOW64\Emehdh32.exe

Filesize
337KB

MD5
2e5001f5ddbbfec2c87ba0d482fcb3e1

SHA1
43e2ded927b2974d20ee4f9c37940a463fa03f9d

SHA256
88e35ace4f29fa24c33ef509dace069d03f7413dc80e6c2a021ad7157c60c7e9

SHA512
59575c111b8ae5f22f75b3444731183a005a03e90410ab195a63fc3f155d32e1e12249c584889c343ca0c763821f670b654af2cc987ddf2448688f061bf3eb68

Download Submit
C:\Windows\SysWOW64\Faenpf32.exe

Filesize
337KB

MD5
36e776890e72a17b5712c041260aeda1

SHA1
d19b3c63a2bafc4a4bd251cec554fb8200134bc4

SHA256
2735c5f15e177f24608e66f41afb879f32c664a7eb4ad7b9a6f2e064bee9a5ed

SHA512
96e8e80f79b0879d822a73613dc05a8d5d5c91fe355bd538c9457d9db5e6d942cbab553ea506f9b90db6cd91e12bc62b21c52a0a5dd47c491e2819a2df994d1a

Download Submit
C:\Windows\SysWOW64\Falcae32.exe

Filesize
337KB

MD5
f8bf3ea90a868a07d4dcf7b000cb5b82

SHA1
ae046945eb819aefc93303432a514f417ac97772

SHA256
8030d6d27bf473dcec81cd52bd0b97ca446c89bcb95d593ded544f0cc6429eaf

SHA512
d03029dea6fb0c8e2e008463655af08118b00af20d06fa5d20895cb6ba1020156509e1b77958a369c499c44075e23c9d9dd014d93371c651ed347ebacc097c10

Download Submit
C:\Windows\SysWOW64\Fdamgb32.exe

Filesize
337KB

MD5
fcc38e41a6a0dd99028272f1c9500a57

SHA1
36b86bf63054316e300325a2a3884d1dc603a08a

SHA256
223152c542898a34211075ba41ce05edd45e526bbac9cb63c4660fbf5b8c1572

SHA512
1997796c2c96b7fe66a6511921bd98125ca723b58ba6f821ebf369a22765cf5bb8ac837a23df4051335a5eb97f6d09cd29d4e441ed77f3b22633a6f9ca8a28d4

Download Submit
C:\Windows\SysWOW64\Fdcjlb32.exe

Filesize
337KB

MD5
87526abf0b1482219fcf55739fe79cba

SHA1
16abf2133b1b84e9139cf4e3e083c586e134508c

SHA256
3efd9f796761b00e4aae44e92b8f0213134041223f87ea9b7176adc920e0a455

SHA512
1e9cf4ff71e8be55990a20463cdb109efc762e2bb5a1f22c3d02b317b7196ba6c6683bc228e32f08d3a827a3980f61df24350423f51f92d0390430d5e2e291f5

Download Submit
C:\Windows\SysWOW64\Fdhcgaic.exe

Filesize
337KB

MD5
82a5f0c336b4194d463557d30a0b7c8f

SHA1
090c878c7880995dd678a166200d0f8643c1572c

SHA256
eb639e30daa57cadf465f280f9384471cea503a9c8e0e97a0862d8a98f370582

SHA512
58ef4ddd83256585ba7d1c97e1c70475fffdcf5caff2227dd8e0b53a570721bb86825a151709afa388bc8d35384a998362c0ace1940af13e035f8817788bff26

Download Submit
C:\Windows\SysWOW64\Fdkpma32.exe

Filesize
337KB

MD5
34e53d2fa351d3dab9ada3b9d324a86f

SHA1
a91f80627f586c282d85900de5bcc432595ca90a

SHA256
afaca67436ac0193c51c1ff6af9ae7e918163f3ac0ed60749dfd3a0e4921932e

SHA512
701c51f3a3f7c0076cdfdaf05180ed1fc3c8386c1403adf41889eb3d44df471a38e8d6da934c118205715806cc84c769b24b54ee9cb763f9a88f0cfc5aa78672

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
337KB

MD5
50827e8662cf786fc13c9dee72d70656

SHA1
7d265c730f307e4b070cb13bfbe233588454ff07

SHA256
105e92753c7437fe56818ef248295f5a6ff04776bf972d8088baa4cda111c3a5

SHA512
c022dcc0cb33754c575465cf615a97c07602a25752cfd56d2dd61e0a700a20c3e944bd83a65ea609e07444797bc44a414d558c3fad23563136887014db806b1a

Download Submit
C:\Windows\SysWOW64\Fgbfhmll.exe

Filesize
337KB

MD5
76529a6be518cd10dcbac1350fdf4cfa

SHA1
29c19b22f6416fd956843753415388d120a3cc9e

SHA256
6e9cca906e2c61c7566a0e648382f82ffd7bcaee4701027f85db6fa49797c351

SHA512
dd5541703239b4e06dc894a081305230591e78edb590eb7aa9c8b65fcbdabef7d635273abeeb5b8b3fa5786f1716046343d3c3cef723617e72e65ea6bfc9b45e

Download Submit
C:\Windows\SysWOW64\Fhabbp32.exe

Filesize
337KB

MD5
8a5bbdd2f502f01e258d6d98b2daca91

SHA1
a7518d8f1d5ccb397cc69d292bd91696dd8e7a31

SHA256
b30f30c12480e82d50350ec5af4a641e43ec38b46cd27655044d3480b57ed467

SHA512
3cfa5bfb97be57815aeb195acb3852d6606abea9bf4043f34a92ad19b2a7c03be481f33dfd74a4ffd6ca4d2e7db9ae962078595293e9ab92d52a0c5c40e575b8

Download Submit
C:\Windows\SysWOW64\Fhflnpoi.exe

Filesize
337KB

MD5
10f326663352eab80e979f336790c6cc

SHA1
87c222f23815f61a4c0d533039bb486da9d0e55f

SHA256
0671ccaa664d04489108a5afb77b6ee920102bb64534a7158d85fdf2305d08d4

SHA512
ed22b535160cae8cfb820cde9762e5bd934f4db9d21661206a72abee8e89d2191ed7118036217786e8da97aff23bdd7a3bdab4d67bca16a4ac385d9e4c6f79f7

Download Submit
C:\Windows\SysWOW64\Fielph32.exe

Filesize
337KB

MD5
56809919c46f270e804ca43bbba76008

SHA1
f0dce03e466eb2fc69b06424532ce9619fbcf394

SHA256
99fc5e01f2be54ae9c3b2d037d90ef49d6d12f8118380331e63093c909fde402

SHA512
ce5be186c45f76f6c1d437e4a0baedc5ec3d35c4dc31a234b618b05c325e0d0161e61598e2aa5b1441bf95c963a002e5024e1cc2080e190e10b4a3a154dd28eb

Download Submit
C:\Windows\SysWOW64\Fineoi32.exe

Filesize
337KB

MD5
938972ce25dd6bbf5287934729c27f24

SHA1
14cc2a2cb8dfcb8e8a1fb6ae1b1f12dd48ef178c

SHA256
665c1e4e26416689cbef076f1dfce52169a0f758c45625cf38bb8248eac3b774

SHA512
cde4e463ff1dfe2dae8a76b92d367f58bf39c288b4012e64828e5bc63133cc617fa2c6fe3c15a7d9f74ca6d284f44ed03c55f53b7b014c9675503499bf2fa53a

Download Submit
C:\Windows\SysWOW64\Fkbkdkpp.exe

Filesize
337KB

MD5
1f4f594ab6b3f8520826ed78e32160c3

SHA1
70d6ee3855ab64f730a7c3f4db8bea3ebad8ec83

SHA256
d973722d688c1cf07c3409d5261182b516bedd5e0cb9a53464bb370e0c0732a8

SHA512
2adb610c4c66cd6d65ff0a072d8ca51e1b401b25dfce61a757e44dd5b14454ca51072856b0a7f64b1477a19362459819d841bc7dcd9cd30805c00db7be127811

Download Submit
C:\Windows\SysWOW64\Fknbil32.exe

Filesize
337KB

MD5
7083a1f522ed4bc70f475ac6e66b8048

SHA1
dddc3ba84cbb73d0d642952c470b5f9c68ea67e0

SHA256
48faf0e920e3591a638502d84cb0a02c3e10118ddc402b7243472abe67f72220

SHA512
2a0376c995ca46b8ab0c96c7fade8430bf04c588c098c5c34911a4d966543e5e3df5e8781368e593971bf829ba09266fee629abb9460187ecb60067de9c9ef8d

Download Submit
C:\Windows\SysWOW64\Fkpool32.exe

Filesize
337KB

MD5
6c2523ae76a79f84229d1033e8b3b28b

SHA1
3c85267dcf6323e81034cfa4fdc5238b773b118f

SHA256
ac1d781c4fe3f5eca96c5f0d55e13ba4d4e10fbb1d0e9af9a430b80836a0de13

SHA512
ce9c5a5b25d9085c8bf01f8eff1df8326653528a43863ff45af98513ab3638d161b876b9732fbd2f51da4ad904e8cdc6c273b98039e356d952eab4d0e12d2f59

Download Submit
C:\Windows\SysWOW64\Fmgejhgn.exe

Filesize
337KB

MD5
0b9c4938da3e633f1fc1e80031868ee5

SHA1
2832ce82c9c1ef9b0a6ad1ca28d915a1104b2107

SHA256
595d5d8194b288bbcd9c45ff549b5bb66606b385d7ddf5f1dae292e69b18af01

SHA512
fbd5a119682879562260679a49970db68f7fae724890eb09f065829614586b5b7f8cbb8c60c7e06727c68322dfc0ed4d6dad91a97ad42e64790f7a1604a9d03d

Download Submit
C:\Windows\SysWOW64\Fmlneg32.exe

Filesize
337KB

MD5
e5e352f3630f2ff4508bbbc34be20147

SHA1
4f29d4f5bf3a9a26ad44bfa7efbc6db53f36e61b

SHA256
8d3242531d688eb60d93f4c8458ec64d3f60e34d57f43d954fc379147e47c08d

SHA512
fdb2caa403431d3db4d5bf570c927c00bd068af8c43812a15761031045922ddc3b4f5d63d0df3cdb31c122daf2afa37fd91f2daba6a203f896bbc9d82c13e13c

Download Submit
C:\Windows\SysWOW64\Fmnkkg32.exe

Filesize
337KB

MD5
6c36fce138b991c75904d6d9ea25c9c2

SHA1
506f595cd91567c61406e5d833d80f8846a24bb9

SHA256
535512268520b633eb2c5fd1329454888821f4eefee49cf274830e82d4dac561

SHA512
f7280e4d58ee65138d4e71de995149a3720dd9fe4e8cd3c7afb8b258af9d48d3393050d9e07ea3df7e05be79732fc4cb471b3cd47ffe56d355e6ae8c4e5f14c0

Download Submit
C:\Windows\SysWOW64\Fpjjac32.exe

Filesize
337KB

MD5
7a8c0b036102749f70f13bc6faae8420

SHA1
f393cce8376dbb13dc21139a0bb59ea98382f60e

SHA256
8322967fbb99050bbedd12f42aba287cfa026b159cc84054e4b0af7beaca244a

SHA512
623c6d77c9741a5646bded63ee804fed6fcf814a8a74998ceecc2c10a537eb879beb6b52bfd9cde04d84e1d7f2181f2c27b6fdf3778e907afb0486d54d71febe

Download Submit
C:\Windows\SysWOW64\Fpmggb32.exe

Filesize
337KB

MD5
de4e686270c31df267c9b5aa883f24ef

SHA1
d41938ebe608db4d1d0da3c62b3803c87d9a5295

SHA256
aab6e66bfd83a0534f15fa40b42a8c11878878e344b8fd2ab8296afb53201290

SHA512
815de23ba50a132727c972d4b7b452cebe5aaa343cc1422b6a3d18cb3acf45d7ef516f65e668f375321030b693d8b563bb26e4a7091481fc02d2cc39e89d62fd

Download Submit
C:\Windows\SysWOW64\Gaamlecg.exe

Filesize
337KB

MD5
f5282673fc8e5e769f2589c3056523d5

SHA1
4aece9cd270ac496e5b88d47ce4e3255b8fdee3b

SHA256
38353b98ba22eed8650bc559d427a54e4f2cfe47b2793ba7a16462f52c7824df

SHA512
9bc0df5440f50853778c0ea7a4895d04f74528011efe5c591380e6ff1a7bce2c797c0ef93d6bc96f1d4655f7ecd3bafd7f22355dbb147d790e8607b9834af902

Download Submit
C:\Windows\SysWOW64\Gdoihpbk.exe

Filesize
337KB

MD5
a207eeef33ebb5be46fb23a9d965d62c

SHA1
35083419495db7bc191db3373d480d515a9de6df

SHA256
d7a25ad947150afc9f8d93876e2462787c135bf3f7c7fb2d594654fd4cbf6213

SHA512
ed805b302714827228f036846b089a1c53168f535b03946a61717dd88d226b94fa53c97e41262da562506de732c58e4433a209305cf8f11c0827fc24befa61db

Download Submit
C:\Windows\SysWOW64\Gfmojenc.exe

Filesize
337KB

MD5
d323e0cf47383d8f646dc8115a7e7272

SHA1
59434253229b93d6fab3c31eaf969f4b2a940bdc

SHA256
3567a9abae41f6db5c6082f236330f9cdf0fd247d769085c5d2b79c87689e48c

SHA512
6e310938f7dbc7e314e79fe576d896e5f211f974cd0b010a805ef04a7cbfc1b9b96cc04611617e54662082bd28555221ba9cfaae56c79284d2265c970165b741

Download Submit
C:\Windows\SysWOW64\Gfokoelp.exe

Filesize
337KB

MD5
af64b3c5284c6f6fb1b849e165c53db1

SHA1
c1a81a7a2cd2b86f1c5092110baee6b7528ee67f

SHA256
df2ed992c20a7210fcd531bf04bc5799b3f6c166df79a39fce5e8db08dde885e

SHA512
86433b8e556e03223b99f934b653c9716a28bee61dc24087da18b76f4870b09d2084151f79fc8b72238c5082248cf02bc56270bc37ebb9675ea6804511d3a270

Download Submit
C:\Windows\SysWOW64\Ggkiol32.exe

Filesize
337KB

MD5
06c2a86f3840dc04f37272edd3128e99

SHA1
a83fa26a0bae55d80ca1a97fa0e9a26772293c33

SHA256
61358d049042242b3aee39603f35c1a6ca0a3e854aeeb984bc9806aba1497c01

SHA512
15b5860685268aa984a297e9b34e8fffade847523b650ee699dfca45607b61856a8304741b1b25cb46a53f02cdac0037a1f4d15915cdbfc0f018610173c45b36

Download Submit
C:\Windows\SysWOW64\Ghhhcomg.exe

Filesize
337KB

MD5
b76ba379e44240f7237a535651e31d77

SHA1
adc94672112b9a3d2f3d80d334b0d405fb3db374

SHA256
89b6aa3394383d2dfa3eb2a5e34f6a86d22ddaa070e4ef08d0fd74cd4d87fe55

SHA512
e2ce937d8fc97489fb99c58ac3ac605f697fef7a7a9ad4e2dff24a9bccce4d6d1a9ad617393057b8a3bf29ab90cf2003f220045f35e95d1ae4d82901cef63b50

Download Submit
C:\Windows\SysWOW64\Gijekg32.exe

Filesize
337KB

MD5
514f96bb97b77839825331cc99f1f1f2

SHA1
2a7c174da47992899e0d49d6d697934cf63b3573

SHA256
218a7543d02658f6abe528b9318017d18475e7865ede36f8c679f132d66e09f2

SHA512
52d7bc3cafc921fb0527ce7d535e903a4f356bad11b0e2834b64213e6594dacdc402cb42af0b53dce8d511ca2d58d5ebb838cf6d36feabf0523d6483a4386d86

Download Submit
C:\Windows\SysWOW64\Gkdhjknm.exe

Filesize
337KB

MD5
7f5c5a4b3686fe1e69e5475c80ba1896

SHA1
e320c804acafa5449ed9820edae18e4967f7e2d6

SHA256
f809bd97ab2d61acd04c807aba1ac14294edaac46467cc0ee379fb96fe9f98e4

SHA512
be3be5e389c4aebfe7bafa7181e5d6b48abb9ab105c7ceaf442e75ee4ad8a508d743fb4f429d202a8bb44a0362d7ed43bdf81c5685ec7bb2f7db4e8ba780e248

Download Submit
C:\Windows\SysWOW64\Gmcdffmq.exe

Filesize
337KB

MD5
5601564e12f10e9cec32461f07924c0f

SHA1
e81fdbc2086c52e3531498320b969b4ab8fd9c87

SHA256
e9c6f8dfc4f59310e2d2afcc37902849ed45d45a1fbdb196ba24e1dec6c6b3ee

SHA512
ee72bd27062fd574f9490b530fdf955306454c9ab6be2e2c015c1b66ff756e5cef3132a3afbd0355b3e958e50e3d01be4e456ff1abf4baf97234378c45cd0a08

Download Submit
C:\Windows\SysWOW64\Gmeakf32.exe

Filesize
337KB

MD5
229e7886634dbb348a9f66b45a2522fc

SHA1
3a635dfb3d8a30d460e56cebb2bcd1c04d58c704

SHA256
9cac016a8e012648045ffeeee5bfa6208551ea12e9b5305f90fd87efdacc4cc7

SHA512
5cfff055ac0a389e8f592bd055af93d852b28361da3e7927e4bbfa7d82b29a5c454e93b0dc17ff7433690dc78e0883234620fbed3d55c738de8004caabcdec15

Download Submit
C:\Windows\SysWOW64\Gpaqbbld.exe

Filesize
337KB

MD5
f9b1fd6379d485d1d4beca372aac08a7

SHA1
7a006b47e51362c569335aa2b74a1d041d47de45

SHA256
ac68e47003c1d7c4906ff227ffdecbb7faa66edf2bf05b705a96504a2a4b9750

SHA512
5ff019fc98ab44e60ba27716799bff8d662e810eb9b3bbf9b47fdbb119bd22128711a218d277640f174bdd3c0aba334d289ddc3bf46bc249aafffbb4f2fe2a1c

Download Submit
C:\Windows\SysWOW64\Hcmbee32.exe

Filesize
337KB

MD5
b5a36ff6e9b5462851ce236f6d4a8495

SHA1
7083cf5b1f97a4b449866bf4c8e98c3c6a3a8035

SHA256
d1289e89834d0a40bbf013f8d5565446fccd72ffa8f0a4cacaa38cd6048cc79d

SHA512
84921f761e762a4b69f96985b90f792bcb572307ed2178c3743ba51a7e9e039ee8891d2fdfe191810106b7dc181a30fc24261362f64e1b2956bd5543d88367b3

Download Submit
C:\Windows\SysWOW64\Idcepgmg.exe

Filesize
337KB

MD5
c0249d8efc6694ffe56f5138d70fbe0a

SHA1
49a59071f6ed9bf02776f97752aae50d31df7d62

SHA256
ee1fd0d273de4b609b1d806156502dba670d39994d6d0091a5fdca12fb57ce8f

SHA512
0a2a1244877fe9a717dde46f7189c81be8509cf481a868fcc0e0f6cdc569ac1b196699e6a27ef25edb12bcbf34233fdb41fefd4b83066389f6fa2946e85c89e2

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
337KB

MD5
4ec31aa87b59b5169d4d50de7856dfab

SHA1
5a91636db6756b64478f53f00a468b8d94905373

SHA256
acf38e7674c2ad975b19823766d3925c32ae669e181306b93f9b008372d66d1e

SHA512
12623297ea078c488c5c9d3c0c2f99338bdf5c2c1f90a2de1f610a4e10007ea3070f85c38d283e74f30f0b8c755831ade558bab8fd1008da3c1d7c1f3a92f739

Download Submit
C:\Windows\SysWOW64\Jdodkebj.exe

Filesize
337KB

MD5
417d8764be5d7e13d729a73363ae445f

SHA1
11fd1d271beef3012d68e9eac5b81602e3c28610

SHA256
b275085154ec5b29abbd04fc0dc4aa5782c98ae36786d2538b4a97d0b25319b4

SHA512
a00cc892af3a4b3aea2892a265b79d8d98fc0d1d97aeda032d9bf38ff1b8fe584375ef10bd5aadb138525f542ae2c44f06fcc2df76c062b735e5e278071f1840

Download Submit
C:\Windows\SysWOW64\Kmdlffhj.exe

Filesize
337KB

MD5
aff211f74b44d198287d0a81e240a9e4

SHA1
695674b6acf9ecd46e0a59fabd340639ea6e1bfb

SHA256
569b39bb93d4cb0dd1dca1856e06cb1c2526e9de802bcebb584a060921d07c73

SHA512
a51955f3a5cc8f4da96ab156d049ea230f1c8df0814ae75dfdd215d80b849c07bf4fc2dd231ba11f9b1af891e20fb7043ef4006c786986981ed778a3859edf32

Download Submit
C:\Windows\SysWOW64\Lankbigo.exe

Filesize
337KB

MD5
c1638edc4933609760d294d98782a6ce

SHA1
96fb52d3dcf7389d1219ba7b1ab0fed571fabcee

SHA256
110623adefa3645310d643ebc01a9bc4e7594517bea7a00810ba0712da96dd66

SHA512
31a8da8f52e8a1858976c038f3912cefc410a21e5ee37bd4bf6b0a38ff490c655a0644179700f98c381883113d179a93b1a432547f5145ecdcb2cf0b1c180b11

Download Submit
C:\Windows\SysWOW64\Lggldm32.exe

Filesize
337KB

MD5
8205ca8f7b845a98e8fd76d5143d5a5d

SHA1
f03d5c27157d41e2a5fead7b2fd60779f778d3ac

SHA256
df1a0636e5dfbc2384d0627092f322820dbe5e2008d98be0def21f5ac76783b5

SHA512
e93397d4e7934fd442035618cb771530799e4070b98628d61c6b15902fd89c900b8e4274857d921f9af772a07a20fd388c0d6f2e0f35c8a450f645194e17cccc

Download Submit
C:\Windows\SysWOW64\Lhmmjbkf.exe

Filesize
337KB

MD5
29d2d902c1e3b8c2dfed2efaa252137f

SHA1
5edbbd80511d9706f797b440a1089df0d6bf337b

SHA256
5c4ac9a9ed1e9699eb254e829c0b93f22920298924eecc9da45a70469e541952

SHA512
70dbd7d147db1109808e072c15687c33e2252ac9fc1e1dd51bc49142a78fd64dc15761c0ec2668f8ef69b8546b9e5239e121c6952b1264be9289344263dfc467

Download Submit
C:\Windows\SysWOW64\Llflea32.exe

Filesize
337KB

MD5
0f761f7501cc789e7c9ebc41bd7b022f

SHA1
97184d213b465eccbe5fb50659b4e1d3a1041384

SHA256
d8b19961a42020a03a5820e66c402a9d153994d1257bf15b3953fb3d36c22276

SHA512
3e855c21b7fc39d9e1ab478db43aa286bdc66aea8c473d36eb086cff110261ce1379c9b6b6f856e5c24a1d6e0b009893f222eb6e041f527963e5c839a2b8d693

Download Submit
C:\Windows\SysWOW64\Lnmkfh32.exe

Filesize
337KB

MD5
38996aff8e12775d5b63f5ce23bec87e

SHA1
22fa76bdcc1c99637df31c7a9babe88cc2519dad

SHA256
ebf04ac3544878fdd5aec14e64d1f7da870ac1632286bb5a95a436de7a2fd12e

SHA512
d3e6fe47ef92af4087aa3401ccca4df080df8bf231b4abbedeb7692bb55dcc8b2b23040ec459dd5959101f1a95f6e86695ef23b9cfcd7e28014738d55d240090

Download Submit
C:\Windows\SysWOW64\Nhbolp32.exe

Filesize
337KB

MD5
b45f7de46e004fd08ceb38e7eaf1869d

SHA1
bedb97081200af4ca7815d9738e96bd3165fa477

SHA256
e6bb690e453f0f0dc6298adc68cd9be6f74858a727279b7716d8989f3b594bb2

SHA512
00972bc332ae6b8d3566df878763cde953623ff0105aca77294b889a043d538a1ad0db0f264fb9ff44fd7bd414a2d50f51e9ca542c0542667a111f50625c5403

Download Submit
C:\Windows\SysWOW64\Nlphbnoe.exe

Filesize
337KB

MD5
b17b202d1f4c4da7ec3273082767047f

SHA1
d43ff12c73ef21018ace9e30af28f34a84821f34

SHA256
d9a0317cfdd039bb86b2a4c626bdc5a932ee3cb00ba2daa97e03df15e1d424a8

SHA512
d03626aff1c828b6d4ee7fcdc9b5eb96a934190e8ecf6d766eced3cddc38966eef12a0fa73b821362fa015b3fe5f49589a18d96bf23455324130f3ac0fc71256

Download Submit
C:\Windows\SysWOW64\Oiknlagg.exe

Filesize
337KB

MD5
631a993a5ac74e31dfa57e0411ee9f44

SHA1
e366febcf467d925715a852089a73f98d3983c8b

SHA256
0befcd0c7e462ba60b5dbe6b0f4344884c24c330ab524429aa5166c740b02c2a

SHA512
a5c8bf0eff81ec4fabf63fdd8a2e6576a71be2b9d266f670c3be72f7e47d7634ef301731b18662059850778907cf593bc5c92454b6e514c524baf8a73a707a19

Download Submit
C:\Windows\SysWOW64\Olbdhn32.exe

Filesize
337KB

MD5
b72d766e15bb67914c1ee3fa08415706

SHA1
3b5e28038ac715eff2a1cd525f931182fe943242

SHA256
10c215a88fa315dd715a16b7227845262f878dd2526521b1440fc7fdb0f94577

SHA512
fe9c195e6809c985e69f4ad373122c1ebeb29c92784cbf0ea48488962f8728bbf4fffe8d3b8a9c20114e225215869b54da8cf5d266ef8927ff8279b832de3ec7

Download Submit
C:\Windows\SysWOW64\Piijno32.exe

Filesize
337KB

MD5
287bcd3558f9717dcf4c56367fd4c8c6

SHA1
2f3b0a9b115781a13255015984d11a786b0b1712

SHA256
9e5c45c6d9fc5a61ab866716dea5cb4f2c77f3f3db3884c1cc98e7bd88fc71c1

SHA512
5057b1636d5bef74474734623abecf385b7eced168aea85941127e43b716cdd1b79a8220587215f2f7936e2e49ac87cf7dd26bc723c1220446bd4732a84d0c17

Download Submit
C:\Windows\SysWOW64\Pllgnl32.exe

Filesize
337KB

MD5
a9bbfc9f0fe9597d8cfc305d574e2bbc

SHA1
f1397957b02afb9c197f11ae483b3115d85dc2b1

SHA256
98d6e2a4a0c821b7ad02970d8a3a90b77afad5e1c720cfe44477e4cc13b91aaf

SHA512
60cc98cacc613adef56abdc9989afeacd8d3ec3f26a6bb076dc9d1375359f0c02209b3bc44b6ed8db0eff0c2785c3e54f108536f9d5aee1faddc072c00e006c2

Download Submit
C:\Windows\SysWOW64\Plndcl32.exe

Filesize
337KB

MD5
f016f543f9e69e3cec75b413642fb357

SHA1
98e925022e234984a1b35aae172da9e97c4b77b4

SHA256
719d755d5ef9f4f6e739207a76de87449ada8c8d9d3e687c2f21b63c9072b00e

SHA512
c8fc2c4bf0dbb5c26eb337863173e0f44b03042ea688830718a6b8bd8e2575942d96999a2c252cea37a2e5ac32890e2fbe0bf65c384eff37c4fc42f59dcdb514

Download Submit
C:\Windows\SysWOW64\Poomegpf.exe

Filesize
337KB

MD5
1a28db436a0746a74d8e491080158923

SHA1
a9f80600845fff213612f32afad7914db6a32ea4

SHA256
c8dc9a7a6a7b5c5b2cf2ef5e58a585a143077edd256c8ec9727ff26d28f80506

SHA512
1216c4fbe02cc11d1d28cb7c0fdd357a045e45358e31750066d4e8cf0627b4ac8e99fa1c44fcef66bc19de152e0c2100cc70237a649bb9b647c02a13a45942b4

Download Submit
memory/396-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/456-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/716-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1160-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1328-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1328-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1436-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1508-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1744-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1872-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1996-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2088-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-601-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2180-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2248-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2284-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2760-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2760-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2760-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2844-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3060-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3128-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3260-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3288-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3468-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3500-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3520-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3700-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3700-551-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4180-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4248-613-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4380-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-607-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4548-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4612-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4780-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5128-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5168-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5208-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5248-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5292-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5328-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5368-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5408-478-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5448-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5488-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5528-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5568-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5608-508-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5648-514-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5688-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5728-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5768-532-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5808-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5848-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5892-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5936-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5976-565-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6020-571-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6060-577-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6100-583-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6140-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads