berbew | 9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833.exe
Size

90KB
MD5

bb48f698cc41a6ff134493e77fb8387f
SHA1

ff29a7125cf89d9fbb2038988efe255e4e630fbc
SHA256

9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833
SHA512

e82851c270b3a57edbdb21c68a96eb3904319753fd8c01a9f257a4159894042947629d20e1064dda2371a35c6b8336b2ebae0af2976ec8524cd31825c9d1d620
SSDEEP

1536:7GXnO5CNKd7BgdKa7YvWfG1Ofu85fI9yVnQQC4fl8k/7TZP:7ynaGw6ExWOUfDf83T498a7TZP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhglbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amkagb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfhhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idbfbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgoecgef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhokmgpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edfdhego.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjjheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aokcngdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nockpmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agmbde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeodm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edfdhego.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iglhckde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnpcfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mikclg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlqgkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fncblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aofjch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmddma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emgbqldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mihffh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbchemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opngfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjnbobdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bijnhleg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaogdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onekoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkfjoagf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hddiqaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoakd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Golamlib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Celeel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mppbnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhppmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moleonmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nidmml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjbcfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgdfim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hohahjod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojgegoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nidfbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohbfiage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ammgblek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acicol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibffkcpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagfooep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emlllk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emniakno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeffce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agkeoeki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocmjlpfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddmga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjodmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnmbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klapqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acicol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoadoigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikhdcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbbono32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopecoga.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1536	Mchhjbii.exe
1132	Mnnlgkho.exe
316	Mplhdghc.exe
3616	Nckepbgf.exe
476	Nidmml32.exe
2540	Ndjajeni.exe
2772	Nghmfqmm.exe
3096	Nnbebk32.exe
2324	Npabof32.exe
3540	Ngkjlpkj.exe
1468	Nlhbdgia.exe
2992	Ncakqaqo.exe
4576	Njlcmk32.exe
3492	Npekjeph.exe
4568	Ncdgfaol.exe
2120	Ngpcgp32.exe
228	Njnpck32.exe
3152	Nlllof32.exe
5104	Odcdpd32.exe
1792	Ogbploeb.exe
3864	Onlhii32.exe
1472	Opjeee32.exe
4176	Ociaap32.exe
3632	Ogdmaocp.exe
3548	Opmakd32.exe
4076	Ojefcj32.exe
1168	Ocmjlpfa.exe
2696	Ojgbij32.exe
1120	Ocpgbodo.exe
4912	Onekoh32.exe
3984	Pnghdh32.exe
1400	Pfcmij32.exe
4784	Pddmga32.exe
4800	Pfeiojnj.exe
688	Pmoakd32.exe
3600	Pgdfim32.exe
3848	Pqmjab32.exe
3456	Pggbnlbj.exe
4340	Pnakkf32.exe
2852	Qdkcgqad.exe
1616	Qgiodlqh.exe
1148	Qncgqf32.exe
1160	Qmfhlcoo.exe
960	Qdmpmp32.exe
4948	Qjjheg32.exe
4504	Amhdab32.exe
4716	Aqdqbaee.exe
4744	Acbmnmdi.exe
1032	Anhaledo.exe
448	Amkagb32.exe
3236	Agpedkjp.exe
876	Ammnmbig.exe
3980	Aedfnoii.exe
4972	Afebeg32.exe
1552	Ampkbagd.exe
3800	Acicol32.exe
4844	Afhokgme.exe
1504	Ajcklf32.exe
1872	Ambgha32.exe
3104	Afjlqgkb.exe
4116	Bmddma32.exe
4528	Bcnljkjl.exe
2308	Bncqgd32.exe
2632	Benidnao.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pgdfim32.exe	Pmoakd32.exe
File opened for modification	C:\Windows\SysWOW64\Emniakno.exe	Egdqdagb.exe
File created	C:\Windows\SysWOW64\Gnecnd32.dll	Knnpgbgg.exe
File opened for modification	C:\Windows\SysWOW64\Noehelej.exe	Nlgliaef.exe
File opened for modification	C:\Windows\SysWOW64\Pgminggi.exe	Pcammi32.exe
File created	C:\Windows\SysWOW64\Pohnbjdd.exe	Pljafneq.exe
File opened for modification	C:\Windows\SysWOW64\Ocmjlpfa.exe	Ojefcj32.exe
File opened for modification	C:\Windows\SysWOW64\Afebeg32.exe	Aedfnoii.exe
File created	C:\Windows\SysWOW64\Kbnggn32.dll	Cfhhbe32.exe
File created	C:\Windows\SysWOW64\Jnbpkcad.exe	Jiehcmcm.exe
File opened for modification	C:\Windows\SysWOW64\Pjkejcfm.exe	Pgminggi.exe
File opened for modification	C:\Windows\SysWOW64\Eeokaiei.exe	Emgbqldg.exe
File created	C:\Windows\SysWOW64\Pphjlm32.exe	Phqbko32.exe
File created	C:\Windows\SysWOW64\Qlilanbh.dll	Nlhbdgia.exe
File created	C:\Windows\SysWOW64\Onekoh32.exe	Ocpgbodo.exe
File created	C:\Windows\SysWOW64\Ldjbokge.dll	Pnakkf32.exe
File created	C:\Windows\SysWOW64\Jeilbn32.exe	Jfglgadi.exe
File opened for modification	C:\Windows\SysWOW64\Nidfbf32.exe	Nplaiqdg.exe
File opened for modification	C:\Windows\SysWOW64\Jfnbgp32.exe	Jpdikffd.exe
File created	C:\Windows\SysWOW64\Joanpj32.dll	Knbiba32.exe
File opened for modification	C:\Windows\SysWOW64\Mefmlh32.exe	Mfcmqknf.exe
File created	C:\Windows\SysWOW64\Qjhpan32.dll	Ohiljpam.exe
File created	C:\Windows\SysWOW64\Pfgojchl.exe	Pjpoeb32.exe
File created	C:\Windows\SysWOW64\Onlhii32.exe	Ogbploeb.exe
File opened for modification	C:\Windows\SysWOW64\Cegljmid.exe	Cnmcnb32.exe
File created	C:\Windows\SysWOW64\Jfociegn.dll	Edfdhego.exe
File opened for modification	C:\Windows\SysWOW64\Eonekn32.exe	Eggmjq32.exe
File opened for modification	C:\Windows\SysWOW64\Mfjjjl32.exe	Mppbnb32.exe
File created	C:\Windows\SysWOW64\Nockpmgl.exe	Nhiccb32.exe
File created	C:\Windows\SysWOW64\Cfhdmdld.dll	Amhdab32.exe
File created	C:\Windows\SysWOW64\Libnjkek.dll	Fnhlgjfd.exe
File opened for modification	C:\Windows\SysWOW64\Leedejbd.exe	Lbghiocp.exe
File created	C:\Windows\SysWOW64\Gcmieg32.dll	Afekka32.exe
File opened for modification	C:\Windows\SysWOW64\Ikagjh32.exe	Iegomnmf.exe
File created	C:\Windows\SysWOW64\Lpilmcdl.exe	Lhadlfcj.exe
File created	C:\Windows\SysWOW64\Lehakj32.exe	Loninpid.exe
File opened for modification	C:\Windows\SysWOW64\Pmoakd32.exe	Pfeiojnj.exe
File created	C:\Windows\SysWOW64\Bbhjcj32.dll	Gdkgjb32.exe
File created	C:\Windows\SysWOW64\Bljmpb32.dll	Olpoppnk.exe
File created	C:\Windows\SysWOW64\Dohcnbae.dll	Aichgm32.exe
File created	C:\Windows\SysWOW64\Caddef32.dll	Faonmibc.exe
File created	C:\Windows\SysWOW64\Fobofmal.exe	Fgkgepqj.exe
File created	C:\Windows\SysWOW64\Mjmilige.dll	Nckepbgf.exe
File created	C:\Windows\SysWOW64\Nghmfqmm.exe	Ndjajeni.exe
File created	C:\Windows\SysWOW64\Npgojn32.dll	Dmbiem32.exe
File created	C:\Windows\SysWOW64\Ncbfki32.dll	Khmjqf32.exe
File opened for modification	C:\Windows\SysWOW64\Meadah32.exe	Mbchemic.exe
File created	C:\Windows\SysWOW64\Bggdkd32.exe	Bopmif32.exe
File opened for modification	C:\Windows\SysWOW64\Emgbqldg.exe	Ekifdqec.exe
File created	C:\Windows\SysWOW64\Bcdkpdph.exe	Bqfodh32.exe
File opened for modification	C:\Windows\SysWOW64\Bfcogecg.exe	Bagfooep.exe
File opened for modification	C:\Windows\SysWOW64\Kfiaco32.exe	Knbiba32.exe
File created	C:\Windows\SysWOW64\Dllcch32.dll	Mlnicbnq.exe
File created	C:\Windows\SysWOW64\Ndnojjpq.dll	Ngjcajgo.exe
File created	C:\Windows\SysWOW64\Hlkcoo32.dll	Olehko32.exe
File opened for modification	C:\Windows\SysWOW64\Pfcmij32.exe	Pnghdh32.exe
File created	C:\Windows\SysWOW64\Fnjhmida.exe	Fkllanen.exe
File created	C:\Windows\SysWOW64\Opbdanco.dll	Fnjhmida.exe
File opened for modification	C:\Windows\SysWOW64\Iofmjh32.exe	Igoehk32.exe
File created	C:\Windows\SysWOW64\Mihffh32.exe	Mfjjjl32.exe
File created	C:\Windows\SysWOW64\Koqgnp32.dll	Facghh32.exe
File opened for modification	C:\Windows\SysWOW64\Inkjkd32.exe	Iklnoihi.exe
File created	C:\Windows\SysWOW64\Hlenmajn.dll	Mfjjjl32.exe
File opened for modification	C:\Windows\SysWOW64\Bgnkkckd.exe	Bpfcjeja.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8808	7448	WerFault.exe	427

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfjjjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bglepipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dokpoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emniakno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbbono32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgknnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npabof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlllof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opjeee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjbcfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oolnfkoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdmpmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnjhmida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jelihn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nccqlkkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnafinp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Domldpcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjeago32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefklfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idpilp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhppmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nidfbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nekgggpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njlcmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfeiojnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnpcfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khknkgjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpcgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hohahjod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jniflb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hojnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aofjch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bopmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcdkpdph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfqgdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhfmge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oipend32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agkeoeki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ociaap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmbpoofo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Celeel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edfdhego.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meadah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nockpmgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fejjnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlmgegjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khfdpgng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knbiba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieebgooi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mikclg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mecqfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjnbobdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgfaol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qncgqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmifon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ammgblek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoadoigj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkfaehpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klapqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnipcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlhbdgia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npekjeph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onekoh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eapijcmq.dll"	Cffkleae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fageamqg.dll"	Dhokmgpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpilmcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccghfcne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjjheg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amhdab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bglepipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgmbll32.dll"	Igoehk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeilbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdokfa32.dll"	Mikclg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mchhjbii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jioojpgh.dll"	Hoadoigj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjkejcfm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bihablgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndjajeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bglepipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Biadhkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncakqaqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nijlieef.dll"	Iojgegoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhjodd32.dll"	Bimkmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olheph32.dll"	Bmddma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gabgjf32.dll"	Emlllk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbhfao32.dll"	Deehkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmefklfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhgqdabm.dll"	Pgoecgef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjcako32.dll"	Qqopml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlllof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghbgn32.dll"	Ambgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iglhckde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngcjocan.dll"	Olledp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjnbobdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mplhdghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acfoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkaflc32.dll"	Fkdfpokf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hojnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaajlppf.dll"	Mihffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidlnd32.dll"	Bjlggnjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amhdab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocmjlpfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dejafj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgijpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khfdpgng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgpgab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ociaap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Limgkiob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahooenki.dll"	Lpilmcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lopecoga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohgodq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enhqln32.dll"	Fkllanen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlqgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkfaehpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkcdfoba.dll"	Ajiaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ammgblek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onekoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jiehcmcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnbpkcad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bljmpb32.dll"	Olpoppnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acdbifok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emgbqldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dadqfhla.dll"	Kbgoba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aiedml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keabimfi.dll"	Bfnnap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fncblj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Benidnao.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1536	1656	9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833.exe	81
PID 1656 wrote to memory of 1536	1656	9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833.exe	81
PID 1656 wrote to memory of 1536	1656	9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833.exe	81
PID 1536 wrote to memory of 1132	1536	Mchhjbii.exe	82
PID 1536 wrote to memory of 1132	1536	Mchhjbii.exe	82
PID 1536 wrote to memory of 1132	1536	Mchhjbii.exe	82
PID 1132 wrote to memory of 316	1132	Mnnlgkho.exe	83
PID 1132 wrote to memory of 316	1132	Mnnlgkho.exe	83
PID 1132 wrote to memory of 316	1132	Mnnlgkho.exe	83
PID 316 wrote to memory of 3616	316	Mplhdghc.exe	84
PID 316 wrote to memory of 3616	316	Mplhdghc.exe	84
PID 316 wrote to memory of 3616	316	Mplhdghc.exe	84
PID 3616 wrote to memory of 476	3616	Nckepbgf.exe	85
PID 3616 wrote to memory of 476	3616	Nckepbgf.exe	85
PID 3616 wrote to memory of 476	3616	Nckepbgf.exe	85
PID 476 wrote to memory of 2540	476	Nidmml32.exe	86
PID 476 wrote to memory of 2540	476	Nidmml32.exe	86
PID 476 wrote to memory of 2540	476	Nidmml32.exe	86
PID 2540 wrote to memory of 2772	2540	Ndjajeni.exe	87
PID 2540 wrote to memory of 2772	2540	Ndjajeni.exe	87
PID 2540 wrote to memory of 2772	2540	Ndjajeni.exe	87
PID 2772 wrote to memory of 3096	2772	Nghmfqmm.exe	88
PID 2772 wrote to memory of 3096	2772	Nghmfqmm.exe	88
PID 2772 wrote to memory of 3096	2772	Nghmfqmm.exe	88
PID 3096 wrote to memory of 2324	3096	Nnbebk32.exe	89
PID 3096 wrote to memory of 2324	3096	Nnbebk32.exe	89
PID 3096 wrote to memory of 2324	3096	Nnbebk32.exe	89
PID 2324 wrote to memory of 3540	2324	Npabof32.exe	90
PID 2324 wrote to memory of 3540	2324	Npabof32.exe	90
PID 2324 wrote to memory of 3540	2324	Npabof32.exe	90
PID 3540 wrote to memory of 1468	3540	Ngkjlpkj.exe	91
PID 3540 wrote to memory of 1468	3540	Ngkjlpkj.exe	91
PID 3540 wrote to memory of 1468	3540	Ngkjlpkj.exe	91
PID 1468 wrote to memory of 2992	1468	Nlhbdgia.exe	92
PID 1468 wrote to memory of 2992	1468	Nlhbdgia.exe	92
PID 1468 wrote to memory of 2992	1468	Nlhbdgia.exe	92
PID 2992 wrote to memory of 4576	2992	Ncakqaqo.exe	93
PID 2992 wrote to memory of 4576	2992	Ncakqaqo.exe	93
PID 2992 wrote to memory of 4576	2992	Ncakqaqo.exe	93
PID 4576 wrote to memory of 3492	4576	Njlcmk32.exe	94
PID 4576 wrote to memory of 3492	4576	Njlcmk32.exe	94
PID 4576 wrote to memory of 3492	4576	Njlcmk32.exe	94
PID 3492 wrote to memory of 4568	3492	Npekjeph.exe	95
PID 3492 wrote to memory of 4568	3492	Npekjeph.exe	95
PID 3492 wrote to memory of 4568	3492	Npekjeph.exe	95
PID 4568 wrote to memory of 2120	4568	Ncdgfaol.exe	96
PID 4568 wrote to memory of 2120	4568	Ncdgfaol.exe	96
PID 4568 wrote to memory of 2120	4568	Ncdgfaol.exe	96
PID 2120 wrote to memory of 228	2120	Ngpcgp32.exe	97
PID 2120 wrote to memory of 228	2120	Ngpcgp32.exe	97
PID 2120 wrote to memory of 228	2120	Ngpcgp32.exe	97
PID 228 wrote to memory of 3152	228	Njnpck32.exe	98
PID 228 wrote to memory of 3152	228	Njnpck32.exe	98
PID 228 wrote to memory of 3152	228	Njnpck32.exe	98
PID 3152 wrote to memory of 5104	3152	Nlllof32.exe	99
PID 3152 wrote to memory of 5104	3152	Nlllof32.exe	99
PID 3152 wrote to memory of 5104	3152	Nlllof32.exe	99
PID 5104 wrote to memory of 1792	5104	Odcdpd32.exe	100
PID 5104 wrote to memory of 1792	5104	Odcdpd32.exe	100
PID 5104 wrote to memory of 1792	5104	Odcdpd32.exe	100
PID 1792 wrote to memory of 3864	1792	Ogbploeb.exe	101
PID 1792 wrote to memory of 3864	1792	Ogbploeb.exe	101
PID 1792 wrote to memory of 3864	1792	Ogbploeb.exe	101
PID 3864 wrote to memory of 1472	3864	Onlhii32.exe	102

C:\Users\Admin\AppData\Local\Temp\9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833.exe
"C:\Users\Admin\AppData\Local\Temp\9705fc4cfd37917f667230b8f0f52c3cfa5a2e38e5945c9aa22e2f40f856a833.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\Mchhjbii.exe
  C:\Windows\system32\Mchhjbii.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\Mnnlgkho.exe
    C:\Windows\system32\Mnnlgkho.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\Mplhdghc.exe
      C:\Windows\system32\Mplhdghc.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:316
    - - C:\Windows\SysWOW64\Nckepbgf.exe
        
        C:\Windows\system32\Nckepbgf.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3616
      - C:\Windows\SysWOW64\Nidmml32.exe
        
        C:\Windows\system32\Nidmml32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:476
        
        C:\Windows\SysWOW64\Ndjajeni.exe
        
        C:\Windows\system32\Ndjajeni.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Nghmfqmm.exe
        
        C:\Windows\system32\Nghmfqmm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Nnbebk32.exe
        
        C:\Windows\system32\Nnbebk32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Npabof32.exe
        
        C:\Windows\system32\Npabof32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Ngkjlpkj.exe
        
        C:\Windows\system32\Ngkjlpkj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Nlhbdgia.exe
        
        C:\Windows\system32\Nlhbdgia.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Ncakqaqo.exe
        
        C:\Windows\system32\Ncakqaqo.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Njlcmk32.exe
        
        C:\Windows\system32\Njlcmk32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Npekjeph.exe
        
        C:\Windows\system32\Npekjeph.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Ncdgfaol.exe
        
        C:\Windows\system32\Ncdgfaol.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Ngpcgp32.exe
        
        C:\Windows\system32\Ngpcgp32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Njnpck32.exe
        
        C:\Windows\system32\Njnpck32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Nlllof32.exe
        
        C:\Windows\system32\Nlllof32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Odcdpd32.exe
        
        C:\Windows\system32\Odcdpd32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Ogbploeb.exe
        
        C:\Windows\system32\Ogbploeb.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Onlhii32.exe
        
        C:\Windows\system32\Onlhii32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Opjeee32.exe
        
        C:\Windows\system32\Opjeee32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1472
        
        C:\Windows\SysWOW64\Ociaap32.exe
        
        C:\Windows\system32\Ociaap32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4176
        
        C:\Windows\SysWOW64\Ogdmaocp.exe
        
        C:\Windows\system32\Ogdmaocp.exe
        25⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Opmakd32.exe
        
        C:\Windows\system32\Opmakd32.exe
        26⤵
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Ojefcj32.exe
        
        C:\Windows\system32\Ojefcj32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\Ocmjlpfa.exe
        
        C:\Windows\system32\Ocmjlpfa.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1168
        
        C:\Windows\SysWOW64\Ojgbij32.exe
        
        C:\Windows\system32\Ojgbij32.exe
        29⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Windows\SysWOW64\Ocpgbodo.exe
        
        C:\Windows\system32\Ocpgbodo.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1120
        
        C:\Windows\SysWOW64\Onekoh32.exe
        
        C:\Windows\system32\Onekoh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Pnghdh32.exe
        
        C:\Windows\system32\Pnghdh32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3984
        
        C:\Windows\SysWOW64\Pfcmij32.exe
        
        C:\Windows\system32\Pfcmij32.exe
        33⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Windows\SysWOW64\Pddmga32.exe
        
        C:\Windows\system32\Pddmga32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Pfeiojnj.exe
        
        C:\Windows\system32\Pfeiojnj.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\Pmoakd32.exe
        
        C:\Windows\system32\Pmoakd32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:688
        
        C:\Windows\SysWOW64\Pgdfim32.exe
        
        C:\Windows\system32\Pgdfim32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Pqmjab32.exe
        
        C:\Windows\system32\Pqmjab32.exe
        38⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Pggbnlbj.exe
        
        C:\Windows\system32\Pggbnlbj.exe
        39⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Pnakkf32.exe
        
        C:\Windows\system32\Pnakkf32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Qdkcgqad.exe
        
        C:\Windows\system32\Qdkcgqad.exe
        41⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Qgiodlqh.exe
        
        C:\Windows\system32\Qgiodlqh.exe
        42⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Qncgqf32.exe
        
        C:\Windows\system32\Qncgqf32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Windows\SysWOW64\Qmfhlcoo.exe
        
        C:\Windows\system32\Qmfhlcoo.exe
        44⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Qdmpmp32.exe
        
        C:\Windows\system32\Qdmpmp32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\Qjjheg32.exe
        
        C:\Windows\system32\Qjjheg32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Amhdab32.exe
        
        C:\Windows\system32\Amhdab32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Aqdqbaee.exe
        
        C:\Windows\system32\Aqdqbaee.exe
        48⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Acbmnmdi.exe
        
        C:\Windows\system32\Acbmnmdi.exe
        49⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Anhaledo.exe
        
        C:\Windows\system32\Anhaledo.exe
        50⤵
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\Amkagb32.exe
        
        C:\Windows\system32\Amkagb32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Agpedkjp.exe
        
        C:\Windows\system32\Agpedkjp.exe
        52⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Ammnmbig.exe
        
        C:\Windows\system32\Ammnmbig.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Aedfnoii.exe
        
        C:\Windows\system32\Aedfnoii.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3980
        
        C:\Windows\SysWOW64\Afebeg32.exe
        
        C:\Windows\system32\Afebeg32.exe
        55⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Ampkbagd.exe
        
        C:\Windows\system32\Ampkbagd.exe
        56⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Acicol32.exe
        
        C:\Windows\system32\Acicol32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Afhokgme.exe
        
        C:\Windows\system32\Afhokgme.exe
        58⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Ajcklf32.exe
        
        C:\Windows\system32\Ajcklf32.exe
        59⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Ambgha32.exe
        
        C:\Windows\system32\Ambgha32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Afjlqgkb.exe
        
        C:\Windows\system32\Afjlqgkb.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Bmddma32.exe
        
        C:\Windows\system32\Bmddma32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Bcnljkjl.exe
        
        C:\Windows\system32\Bcnljkjl.exe
        63⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Bncqgd32.exe
        
        C:\Windows\system32\Bncqgd32.exe
        64⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Benidnao.exe
        
        C:\Windows\system32\Benidnao.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Bglepipb.exe
        
        C:\Windows\system32\Bglepipb.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Bnfmmc32.exe
        
        C:\Windows\system32\Bnfmmc32.exe
        67⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Badiio32.exe
        
        C:\Windows\system32\Badiio32.exe
        68⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Bgnafinp.exe
        
        C:\Windows\system32\Bgnafinp.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\Bnhjbcfl.exe
        
        C:\Windows\system32\Bnhjbcfl.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\Bagfooep.exe
        
        C:\Windows\system32\Bagfooep.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:896
        
        C:\Windows\SysWOW64\Bfcogecg.exe
        
        C:\Windows\system32\Bfcogecg.exe
        72⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Bmngcp32.exe
        
        C:\Windows\system32\Bmngcp32.exe
        73⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Beeodm32.exe
        
        C:\Windows\system32\Beeodm32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3532
        
        C:\Windows\SysWOW64\Cffkleae.exe
        
        C:\Windows\system32\Cffkleae.exe
        75⤵
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Cnmcnb32.exe
        
        C:\Windows\system32\Cnmcnb32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Cegljmid.exe
        
        C:\Windows\system32\Cegljmid.exe
        77⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Cfhhbe32.exe
        
        C:\Windows\system32\Cfhhbe32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\Cmbpoofo.exe
        
        C:\Windows\system32\Cmbpoofo.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Windows\SysWOW64\Cdlhki32.exe
        
        C:\Windows\system32\Cdlhki32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
        
        C:\Windows\SysWOW64\Cfkegd32.exe
        
        C:\Windows\system32\Cfkegd32.exe
        81⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Celeel32.exe
        
        C:\Windows\system32\Celeel32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\Cfmamdkm.exe
        
        C:\Windows\system32\Cfmamdkm.exe
        83⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Cjhmnc32.exe
        
        C:\Windows\system32\Cjhmnc32.exe
        84⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Cmgjjn32.exe
        
        C:\Windows\system32\Cmgjjn32.exe
        85⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Chlngg32.exe
        
        C:\Windows\system32\Chlngg32.exe
        86⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Cmifon32.exe
        
        C:\Windows\system32\Cmifon32.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Windows\SysWOW64\Dhokmgpm.exe
        
        C:\Windows\system32\Dhokmgpm.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:472
        
        C:\Windows\SysWOW64\Doicia32.exe
        
        C:\Windows\system32\Doicia32.exe
        89⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Deckfkof.exe
        
        C:\Windows\system32\Deckfkof.exe
        90⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Dfdgnc32.exe
        
        C:\Windows\system32\Dfdgnc32.exe
        91⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Dokpoq32.exe
        
        C:\Windows\system32\Dokpoq32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\Dmnpjmla.exe
        
        C:\Windows\system32\Dmnpjmla.exe
        93⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Deehkk32.exe
        
        C:\Windows\system32\Deehkk32.exe
        94⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Dffdcccb.exe
        
        C:\Windows\system32\Dffdcccb.exe
        95⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Domldpcd.exe
        
        C:\Windows\system32\Domldpcd.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Windows\SysWOW64\Ddjemgal.exe
        
        C:\Windows\system32\Ddjemgal.exe
        97⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Dmbiem32.exe
        
        C:\Windows\system32\Dmbiem32.exe
        98⤵
        Drops file in System32 directory
        
        PID:4732
        
        C:\Windows\SysWOW64\Dejafj32.exe
        
        C:\Windows\system32\Dejafj32.exe
        99⤵
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Dgknnb32.exe
        
        C:\Windows\system32\Dgknnb32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Dkfjoagf.exe
        
        C:\Windows\system32\Dkfjoagf.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3608
        
        C:\Windows\SysWOW64\Dmefklfj.exe
        
        C:\Windows\system32\Dmefklfj.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:868
        
        C:\Windows\SysWOW64\Ddonhf32.exe
        
        C:\Windows\system32\Ddonhf32.exe
        103⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Ekifdqec.exe
        
        C:\Windows\system32\Ekifdqec.exe
        104⤵
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Emgbqldg.exe
        
        C:\Windows\system32\Emgbqldg.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2640
        
        C:\Windows\SysWOW64\Eeokaiei.exe
        
        C:\Windows\system32\Eeokaiei.exe
        106⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Egpgiakg.exe
        
        C:\Windows\system32\Egpgiakg.exe
        107⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Ekkcjp32.exe
        
        C:\Windows\system32\Ekkcjp32.exe
        108⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Eknppp32.exe
        
        C:\Windows\system32\Eknppp32.exe
        109⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Emlllk32.exe
        
        C:\Windows\system32\Emlllk32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Edfdhego.exe
        
        C:\Windows\system32\Edfdhego.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\Egdqdagb.exe
        
        C:\Windows\system32\Egdqdagb.exe
        112⤵
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\Emniakno.exe
        
        C:\Windows\system32\Emniakno.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Windows\SysWOW64\Eeeqbhoa.exe
        
        C:\Windows\system32\Eeeqbhoa.exe
        114⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Eggmjq32.exe
        
        C:\Windows\system32\Eggmjq32.exe
        115⤵
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\Eonekn32.exe
        
        C:\Windows\system32\Eonekn32.exe
        116⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Ealagi32.exe
        
        C:\Windows\system32\Ealagi32.exe
        117⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Eehnhhmo.exe
        
        C:\Windows\system32\Eehnhhmo.exe
        118⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Fgijpp32.exe
        
        C:\Windows\system32\Fgijpp32.exe
        119⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Fkdfpokf.exe
        
        C:\Windows\system32\Fkdfpokf.exe
        120⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Fncblj32.exe
        
        C:\Windows\system32\Fncblj32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Faonmibc.exe
        
        C:\Windows\system32\Faonmibc.exe
        122⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Fejjnh32.exe
        
        C:\Windows\system32\Fejjnh32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Fhhfjc32.exe
        
        C:\Windows\system32\Fhhfjc32.exe
        124⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Fgkgepqj.exe
        
        C:\Windows\system32\Fgkgepqj.exe
        125⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Fobofmal.exe
        
        C:\Windows\system32\Fobofmal.exe
        126⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Fneobj32.exe
        
        C:\Windows\system32\Fneobj32.exe
        127⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Femgcg32.exe
        
        C:\Windows\system32\Femgcg32.exe
        128⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Fdogodpd.exe
        
        C:\Windows\system32\Fdogodpd.exe
        129⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fhkcoc32.exe
        
        C:\Windows\system32\Fhkcoc32.exe
        130⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Fkiokn32.exe
        
        C:\Windows\system32\Fkiokn32.exe
        131⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Fnhlgjfd.exe
        
        C:\Windows\system32\Fnhlgjfd.exe
        132⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Facghh32.exe
        
        C:\Windows\system32\Facghh32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Feochgff.exe
        
        C:\Windows\system32\Feochgff.exe
        134⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Fgpppo32.exe
        
        C:\Windows\system32\Fgpppo32.exe
        135⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Fkllanen.exe
        
        C:\Windows\system32\Fkllanen.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Fnjhmida.exe
        
        C:\Windows\system32\Fnjhmida.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\Fddqjc32.exe
        
        C:\Windows\system32\Fddqjc32.exe
        138⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ghbipb32.exe
        
        C:\Windows\system32\Ghbipb32.exe
        139⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Golamlib.exe
        
        C:\Windows\system32\Golamlib.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Gdijecgi.exe
        
        C:\Windows\system32\Gdijecgi.exe
        141⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Gdkgjb32.exe
        
        C:\Windows\system32\Gdkgjb32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Gaogdg32.exe
        
        C:\Windows\system32\Gaogdg32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Gdmcpb32.exe
        
        C:\Windows\system32\Gdmcpb32.exe
        144⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Gglpln32.exe
        
        C:\Windows\system32\Gglpln32.exe
        145⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Gkglmlkq.exe
        
        C:\Windows\system32\Gkglmlkq.exe
        146⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Gfmpjejf.exe
        
        C:\Windows\system32\Gfmpjejf.exe
        147⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ghklfq32.exe
        
        C:\Windows\system32\Ghklfq32.exe
        148⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Gkjhbl32.exe
        
        C:\Windows\system32\Gkjhbl32.exe
        149⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Gnhdng32.exe
        
        C:\Windows\system32\Gnhdng32.exe
        150⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Hdbmkaoo.exe
        
        C:\Windows\system32\Hdbmkaoo.exe
        151⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Hgqigmnb.exe
        
        C:\Windows\system32\Hgqigmnb.exe
        152⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Hohahjod.exe
        
        C:\Windows\system32\Hohahjod.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\Hbfmdfnh.exe
        
        C:\Windows\system32\Hbfmdfnh.exe
        154⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Hddiqaml.exe
        
        C:\Windows\system32\Hddiqaml.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Hhpeapee.exe
        
        C:\Windows\system32\Hhpeapee.exe
        156⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Hojnnj32.exe
        
        C:\Windows\system32\Hojnnj32.exe
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Hbhjje32.exe
        
        C:\Windows\system32\Hbhjje32.exe
        158⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hhbbgpcb.exe
        
        C:\Windows\system32\Hhbbgpcb.exe
        159⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Hkqockbf.exe
        
        C:\Windows\system32\Hkqockbf.exe
        160⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Hnokofaj.exe
        
        C:\Windows\system32\Hnokofaj.exe
        161⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Hhdoloap.exe
        
        C:\Windows\system32\Hhdoloap.exe
        162⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Hoogiiil.exe
        
        C:\Windows\system32\Hoogiiil.exe
        163⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Hfioec32.exe
        
        C:\Windows\system32\Hfioec32.exe
        164⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Hhglbo32.exe
        
        C:\Windows\system32\Hhglbo32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5492
        
        C:\Windows\SysWOW64\Hkehnj32.exe
        
        C:\Windows\system32\Hkehnj32.exe
        166⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Hoadoigj.exe
        
        C:\Windows\system32\Hoadoigj.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Ifklkc32.exe
        
        C:\Windows\system32\Ifklkc32.exe
        168⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Iglhckde.exe
        
        C:\Windows\system32\Iglhckde.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Ikhdcj32.exe
        
        C:\Windows\system32\Ikhdcj32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Ibampd32.exe
        
        C:\Windows\system32\Ibampd32.exe
        171⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Idpilp32.exe
        
        C:\Windows\system32\Idpilp32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Windows\SysWOW64\Igoehk32.exe
        
        C:\Windows\system32\Igoehk32.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Iofmjh32.exe
        
        C:\Windows\system32\Iofmjh32.exe
        174⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Ibdifc32.exe
        
        C:\Windows\system32\Ibdifc32.exe
        175⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Idbfbo32.exe
        
        C:\Windows\system32\Idbfbo32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Iklnoihi.exe
        
        C:\Windows\system32\Iklnoihi.exe
        177⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Inkjkd32.exe
        
        C:\Windows\system32\Inkjkd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Ibffkcpe.exe
        
        C:\Windows\system32\Ibffkcpe.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Ieebgooi.exe
        
        C:\Windows\system32\Ieebgooi.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Windows\SysWOW64\Iojgegoo.exe
        
        C:\Windows\system32\Iojgegoo.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Ibicacnc.exe
        
        C:\Windows\system32\Ibicacnc.exe
        182⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Iegomnmf.exe
        
        C:\Windows\system32\Iegomnmf.exe
        183⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Ikagjh32.exe
        
        C:\Windows\system32\Ikagjh32.exe
        184⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Jnpcfd32.exe
        
        C:\Windows\system32\Jnpcfd32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\Jfglgadi.exe
        
        C:\Windows\system32\Jfglgadi.exe
        186⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Jeilbn32.exe
        
        C:\Windows\system32\Jeilbn32.exe
        187⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Jiehcmcm.exe
        
        C:\Windows\system32\Jiehcmcm.exe
        188⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Jnbpkcad.exe
        
        C:\Windows\system32\Jnbpkcad.exe
        189⤵
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Jelihn32.exe
        
        C:\Windows\system32\Jelihn32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:7048
        
        C:\Windows\SysWOW64\Jgjedi32.exe
        
        C:\Windows\system32\Jgjedi32.exe
        191⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Jkfaehpn.exe
        
        C:\Windows\system32\Jkfaehpn.exe
        192⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Jbpiab32.exe
        
        C:\Windows\system32\Jbpiab32.exe
        193⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Jfkebq32.exe
        
        C:\Windows\system32\Jfkebq32.exe
        194⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Jgmajifb.exe
        
        C:\Windows\system32\Jgmajifb.exe
        195⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Jpdikffd.exe
        
        C:\Windows\system32\Jpdikffd.exe
        196⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Jfnbgp32.exe
        
        C:\Windows\system32\Jfnbgp32.exe
        197⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Jilndl32.exe
        
        C:\Windows\system32\Jilndl32.exe
        198⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Jniflb32.exe
        
        C:\Windows\system32\Jniflb32.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\Jfpomp32.exe
        
        C:\Windows\system32\Jfpomp32.exe
        200⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Jgakeh32.exe
        
        C:\Windows\system32\Jgakeh32.exe
        201⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jlmgegjf.exe
        
        C:\Windows\system32\Jlmgegjf.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Windows\SysWOW64\Kbgoba32.exe
        
        C:\Windows\system32\Kbgoba32.exe
        203⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Keeknl32.exe
        
        C:\Windows\system32\Keeknl32.exe
        204⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Kgchjh32.exe
        
        C:\Windows\system32\Kgchjh32.exe
        205⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Knnpgbgg.exe
        
        C:\Windows\system32\Knnpgbgg.exe
        206⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Keghdl32.exe
        
        C:\Windows\system32\Keghdl32.exe
        207⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Khfdpgng.exe
        
        C:\Windows\system32\Khfdpgng.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Klapqf32.exe
        
        C:\Windows\system32\Klapqf32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Kbkimpnn.exe
        
        C:\Windows\system32\Kbkimpnn.exe
        210⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Kejeilma.exe
        
        C:\Windows\system32\Kejeilma.exe
        211⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Khhaegle.exe
        
        C:\Windows\system32\Khhaegle.exe
        212⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Knbiba32.exe
        
        C:\Windows\system32\Knbiba32.exe
        213⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Windows\SysWOW64\Kfiaco32.exe
        
        C:\Windows\system32\Kfiaco32.exe
        214⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Khknkgjb.exe
        
        C:\Windows\system32\Khknkgjb.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Windows\SysWOW64\Kndfhaao.exe
        
        C:\Windows\system32\Kndfhaao.exe
        216⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Kflninba.exe
        
        C:\Windows\system32\Kflninba.exe
        217⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Khmjqf32.exe
        
        C:\Windows\system32\Khmjqf32.exe
        218⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Lpdbbd32.exe
        
        C:\Windows\system32\Lpdbbd32.exe
        219⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Lbbono32.exe
        
        C:\Windows\system32\Lbbono32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Windows\SysWOW64\Limgkiob.exe
        
        C:\Windows\system32\Limgkiob.exe
        221⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Llkcgenf.exe
        
        C:\Windows\system32\Llkcgenf.exe
        222⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Lnipcp32.exe
        
        C:\Windows\system32\Lnipcp32.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Windows\SysWOW64\Lfqgdn32.exe
        
        C:\Windows\system32\Lfqgdn32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Windows\SysWOW64\Lhadlfcj.exe
        
        C:\Windows\system32\Lhadlfcj.exe
        225⤵
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Lpilmcdl.exe
        
        C:\Windows\system32\Lpilmcdl.exe
        226⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Lbghiocp.exe
        
        C:\Windows\system32\Lbghiocp.exe
        227⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Leedejbd.exe
        
        C:\Windows\system32\Leedejbd.exe
        228⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Lhdqaeag.exe
        
        C:\Windows\system32\Lhdqaeag.exe
        229⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Loninpid.exe
        
        C:\Windows\system32\Loninpid.exe
        230⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Lehakj32.exe
        
        C:\Windows\system32\Lehakj32.exe
        231⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Lhfmge32.exe
        
        C:\Windows\system32\Lhfmge32.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
        
        C:\Windows\SysWOW64\Lopecoga.exe
        
        C:\Windows\system32\Lopecoga.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Lfgndmhd.exe
        
        C:\Windows\system32\Lfgndmhd.exe
        234⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Mhijle32.exe
        
        C:\Windows\system32\Mhijle32.exe
        235⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Mppbnb32.exe
        
        C:\Windows\system32\Mppbnb32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Mfjjjl32.exe
        
        C:\Windows\system32\Mfjjjl32.exe
        237⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7420
        
        C:\Windows\SysWOW64\Mihffh32.exe
        
        C:\Windows\system32\Mihffh32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Mlfcbc32.exe
        
        C:\Windows\system32\Mlfcbc32.exe
        239⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Moeooo32.exe
        
        C:\Windows\system32\Moeooo32.exe
        240⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Mflgpl32.exe
        
        C:\Windows\system32\Mflgpl32.exe
        241⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Mikclg32.exe
        
        C:\Windows\system32\Mikclg32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Mpdkiajo.exe
        
        C:\Windows\system32\Mpdkiajo.exe
        243⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Mbchemic.exe
        
        C:\Windows\system32\Mbchemic.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7728
        
        C:\Windows\SysWOW64\Meadah32.exe
        
        C:\Windows\system32\Meadah32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
        
        C:\Windows\SysWOW64\Mhppmd32.exe
        
        C:\Windows\system32\Mhppmd32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Windows\SysWOW64\Mecqfh32.exe
        
        C:\Windows\system32\Mecqfh32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:7864
        
        C:\Windows\SysWOW64\Mlnicbnq.exe
        
        C:\Windows\system32\Mlnicbnq.exe
        248⤵
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Moleonmd.exe
        
        C:\Windows\system32\Moleonmd.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Mfcmqknf.exe
        
        C:\Windows\system32\Mfcmqknf.exe
        250⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Mefmlh32.exe
        
        C:\Windows\system32\Mefmlh32.exe
        251⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Nhdjhcce.exe
        
        C:\Windows\system32\Nhdjhcce.exe
        252⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Nplaiqdg.exe
        
        C:\Windows\system32\Nplaiqdg.exe
        253⤵
        Drops file in System32 directory
        
        PID:8144
        
        C:\Windows\SysWOW64\Nidfbf32.exe
        
        C:\Windows\system32\Nidfbf32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6996
        
        C:\Windows\SysWOW64\Npnnopbd.exe
        
        C:\Windows\system32\Npnnopbd.exe
        255⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Noqojm32.exe
        
        C:\Windows\system32\Noqojm32.exe
        256⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Nekgggpl.exe
        
        C:\Windows\system32\Nekgggpl.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:7404
        
        C:\Windows\SysWOW64\Nhiccb32.exe
        
        C:\Windows\system32\Nhiccb32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Nockpmgl.exe
        
        C:\Windows\system32\Nockpmgl.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7544
        
        C:\Windows\SysWOW64\Ngjcajgo.exe
        
        C:\Windows\system32\Ngjcajgo.exe
        260⤵
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Nhkpib32.exe
        
        C:\Windows\system32\Nhkpib32.exe
        261⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Nlgliaef.exe
        
        C:\Windows\system32\Nlgliaef.exe
        262⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Noehelej.exe
        
        C:\Windows\system32\Noehelej.exe
        263⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Ngmpgjel.exe
        
        C:\Windows\system32\Ngmpgjel.exe
        264⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Npedpoll.exe
        
        C:\Windows\system32\Npedpoll.exe
        265⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Nccqlkkp.exe
        
        C:\Windows\system32\Nccqlkkp.exe
        266⤵
        System Location Discovery: System Language Discovery
        
        PID:8064
        
        C:\Windows\SysWOW64\Oimihe32.exe
        
        C:\Windows\system32\Oimihe32.exe
        267⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Olledp32.exe
        
        C:\Windows\system32\Olledp32.exe
        268⤵
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Oojaql32.exe
        
        C:\Windows\system32\Oojaql32.exe
        269⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Oipend32.exe
        
        C:\Windows\system32\Oipend32.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:7224
        
        C:\Windows\SysWOW64\Ohbfiage.exe
        
        C:\Windows\system32\Ohbfiage.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7536
        
        C:\Windows\SysWOW64\Oolnfkoa.exe
        
        C:\Windows\system32\Oolnfkoa.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Windows\SysWOW64\Oeffce32.exe
        
        C:\Windows\system32\Oeffce32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Olpoppnk.exe
        
        C:\Windows\system32\Olpoppnk.exe
        274⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Ocjglj32.exe
        
        C:\Windows\system32\Ocjglj32.exe
        275⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ogfcmhma.exe
        
        C:\Windows\system32\Ogfcmhma.exe
        276⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ohgodq32.exe
        
        C:\Windows\system32\Ohgodq32.exe
        277⤵
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Opngfn32.exe
        
        C:\Windows\system32\Opngfn32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Oghpbh32.exe
        
        C:\Windows\system32\Oghpbh32.exe
        279⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Ohiljpam.exe
        
        C:\Windows\system32\Ohiljpam.exe
        280⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Olehko32.exe
        
        C:\Windows\system32\Olehko32.exe
        281⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Ocopgiac.exe
        
        C:\Windows\system32\Ocopgiac.exe
        282⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Pemlcdpf.exe
        
        C:\Windows\system32\Pemlcdpf.exe
        283⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Phlippoj.exe
        
        C:\Windows\system32\Phlippoj.exe
        284⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ppcqampl.exe
        
        C:\Windows\system32\Ppcqampl.exe
        285⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Pcammi32.exe
        
        C:\Windows\system32\Pcammi32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Pgminggi.exe
        
        C:\Windows\system32\Pgminggi.exe
        287⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Pjkejcfm.exe
        
        C:\Windows\system32\Pjkejcfm.exe
        288⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Pljafneq.exe
        
        C:\Windows\system32\Pljafneq.exe
        289⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Pohnbjdd.exe
        
        C:\Windows\system32\Pohnbjdd.exe
        290⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pgoecgef.exe
        
        C:\Windows\system32\Pgoecgef.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Pjnbobdj.exe
        
        C:\Windows\system32\Pjnbobdj.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Phqbko32.exe
        
        C:\Windows\system32\Phqbko32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Pphjlm32.exe
        
        C:\Windows\system32\Pphjlm32.exe
        294⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Pjpoeb32.exe
        
        C:\Windows\system32\Pjpoeb32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Pfgojchl.exe
        
        C:\Windows\system32\Pfgojchl.exe
        296⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Poodbi32.exe
        
        C:\Windows\system32\Poodbi32.exe
        297⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Qfilocfi.exe
        
        C:\Windows\system32\Qfilocfi.exe
        298⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Qjehpanb.exe
        
        C:\Windows\system32\Qjehpanb.exe
        299⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Qqopml32.exe
        
        C:\Windows\system32\Qqopml32.exe
        300⤵
        Modifies registry class
        
        PID:8728
        
        C:\Windows\SysWOW64\Qgihifml.exe
        
        C:\Windows\system32\Qgihifml.exe
        301⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Qjgdealp.exe
        
        C:\Windows\system32\Qjgdealp.exe
        302⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Qleaamkc.exe
        
        C:\Windows\system32\Qleaamkc.exe
        303⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Qodmnhjg.exe
        
        C:\Windows\system32\Qodmnhjg.exe
        304⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Agkeoeki.exe
        
        C:\Windows\system32\Agkeoeki.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Ajiaka32.exe
        
        C:\Windows\system32\Ajiaka32.exe
        306⤵
        Modifies registry class
        
        PID:8992
        
        C:\Windows\SysWOW64\Aofjch32.exe
        
        C:\Windows\system32\Aofjch32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Windows\SysWOW64\Agmbde32.exe
        
        C:\Windows\system32\Agmbde32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Ahonlmoe.exe
        
        C:\Windows\system32\Ahonlmoe.exe
        309⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Aqffmkpg.exe
        
        C:\Windows\system32\Aqffmkpg.exe
        310⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Acdbifok.exe
        
        C:\Windows\system32\Acdbifok.exe
        311⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Afboeano.exe
        
        C:\Windows\system32\Afboeano.exe
        312⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Ammgblek.exe
        
        C:\Windows\system32\Ammgblek.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Aokcngdo.exe
        
        C:\Windows\system32\Aokcngdo.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8408
        
        C:\Windows\SysWOW64\Acfoof32.exe
        
        C:\Windows\system32\Acfoof32.exe
        315⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Afekka32.exe
        
        C:\Windows\system32\Afekka32.exe
        316⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Aichgm32.exe
        
        C:\Windows\system32\Aichgm32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Afghqa32.exe
        
        C:\Windows\system32\Afghqa32.exe
        318⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Aiedml32.exe
        
        C:\Windows\system32\Aiedml32.exe
        319⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Bopmif32.exe
        
        C:\Windows\system32\Bopmif32.exe
        320⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8828
        
        C:\Windows\SysWOW64\Bggdkd32.exe
        
        C:\Windows\system32\Bggdkd32.exe
        321⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Bjeago32.exe
        
        C:\Windows\system32\Bjeago32.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:8960
        
        C:\Windows\SysWOW64\Bihablgj.exe
        
        C:\Windows\system32\Bihablgj.exe
        323⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Bobiof32.exe
        
        C:\Windows\system32\Bobiof32.exe
        324⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Bgiapc32.exe
        
        C:\Windows\system32\Bgiapc32.exe
        325⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Bijnhleg.exe
        
        C:\Windows\system32\Bijnhleg.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Bqafii32.exe
        
        C:\Windows\system32\Bqafii32.exe
        327⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Bcpbed32.exe
        
        C:\Windows\system32\Bcpbed32.exe
        328⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Bfnnap32.exe
        
        C:\Windows\system32\Bfnnap32.exe
        329⤵
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Bimkmk32.exe
        
        C:\Windows\system32\Bimkmk32.exe
        330⤵
        Modifies registry class
        
        PID:8700
        
        C:\Windows\SysWOW64\Bpfcjeja.exe
        
        C:\Windows\system32\Bpfcjeja.exe
        331⤵
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Bgnkkckd.exe
        
        C:\Windows\system32\Bgnkkckd.exe
        332⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Bjlggnjh.exe
        
        C:\Windows\system32\Bjlggnjh.exe
        333⤵
        Modifies registry class
        
        PID:9032
        
        C:\Windows\SysWOW64\Bqfodh32.exe
        
        C:\Windows\system32\Bqfodh32.exe
        334⤵
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Bcdkpdph.exe
        
        C:\Windows\system32\Bcdkpdph.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:9196
        
        C:\Windows\SysWOW64\Bgpgab32.exe
        
        C:\Windows\system32\Bgpgab32.exe
        336⤵
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Bjodmn32.exe
        
        C:\Windows\system32\Bjodmn32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Biadhkop.exe
        
        C:\Windows\system32\Biadhkop.exe
        338⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Ccghfcne.exe
        
        C:\Windows\system32\Ccghfcne.exe
        339⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Cicqnjmm.exe
        
        C:\Windows\system32\Cicqnjmm.exe
        340⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Cakiohmo.exe
        
        C:\Windows\system32\Cakiohmo.exe
        341⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 224
        342⤵
        Program crash
        
        PID:8808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 7448 -ip 7448
1⤵
PID:8536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acbmnmdi.exe

Filesize
90KB

MD5
db960c36f7c88403209e27b7666b7df6

SHA1
44da10f4ce7f13322a28b4c0d21a99261c01351f

SHA256
c1986a5370f5384465b4e95d4bcdbd72fdf6e2d0799f05cc9d6e827326f7e5f9

SHA512
4c26aceb507679cfcb2c045356015132cfccee03ff04639bc1b21bc9b9090c4070546e7535c11b1ff6bbeca54b269d72b5c7afa2c5ca1b083a18d0d9dffcddf1

Download Submit
C:\Windows\SysWOW64\Afebeg32.exe

Filesize
90KB

MD5
4977e98308720f84a974ce4938e5981c

SHA1
d61356f195f061e4f1cafb0ad883841f9f98657d

SHA256
b76d36a497c49c29edb363edaf53495d101f7f4b86264146f35a31016d3a2201

SHA512
77f0770bdda8ea059825b011e4d03e9253e2e6d89a789720da676858cef837ed83df02e5ec36be99b50a635287d679ce22fd8a6c468fff2ee94a10615201896a

Download Submit
C:\Windows\SysWOW64\Afghqa32.exe

Filesize
90KB

MD5
1f94707b8b3dfbe533396ccbe40b85dd

SHA1
9abaa28741ed54f71fea94203b392678754396e6

SHA256
a374b1953fdeb75c5c4df01b3add2296c07739b7541f47ffdd126b9eacf4be07

SHA512
bea61c21b754191deda365f0d6696202ebe77936bb54d0bfda873a92fd6f3abdb0a9d8c6e532b1199ec6a11d9eaffbe7db89c8491d62c194e76e1db9d1dee1db

Download Submit
C:\Windows\SysWOW64\Afjlqgkb.exe

Filesize
90KB

MD5
f8339558e5f640055b7442bd6d5cb021

SHA1
3eaaa5c829d02d11ea1de2f147c80ce6150c4562

SHA256
49457eecfa15b2c655e53e48b5611d9010630511c4f78fdc6250bad4f74e3c3c

SHA512
3a12d0f8fb7154eab56c0af454673db9ea46a86d6f828c5a628c5b8fb9ce1e7ef4e9a263b7a4390f602f16e17c55872d968a3ec18b47018ecd788bcd7302a902

Download Submit
C:\Windows\SysWOW64\Agpedkjp.exe

Filesize
90KB

MD5
0c57d018820c07a07b71024afb57f067

SHA1
0491f67168a5124d69d556104a51b6acc4a28d0b

SHA256
109720cef1dd120ff9c02b25eb997ca04a6a5df05d5c0be3256e9b7f6785ac09

SHA512
9e1e2792bad0aa2c34bed4a2b1c5a81b4851b6a8955dd608ccf66515df67928fa5f0644cdf3c87327dcc0c82467d6fb48576eceeef0ec56c7a4d575fc9871ea8

Download Submit
C:\Windows\SysWOW64\Ajiaka32.exe

Filesize
90KB

MD5
0a79fbc1b1d3d6a2cfebae627d193bc5

SHA1
81be3ea0a989e7269cd4db21f0997c6188fa09a3

SHA256
82c448f344794c1c2223e900e6454b91c5332ac04e4f8e95868c595d30eea223

SHA512
476a5684c3b5d70774b3bf0706bb21655e247d9136acaec868dc6700e4b7c171bf22ad101fcb45ddda92b42915f8b651ca08335dc9bd426f56df859701d1341d

Download Submit
C:\Windows\SysWOW64\Ammgblek.exe

Filesize
90KB

MD5
8c4a0313fdba562a602cda8ae84a4886

SHA1
23f58cb9811b5ea01404ff4388905e54f695bb40

SHA256
1e91e8e10f5141802dbaeb53d701a874696954397cc00eac87c40ae640b4cbb4

SHA512
97eb23f6e1c61422a1463126f3979fc3c287e809ba85c8167e5673c5174beb495cb64864c4f0f0e5e0d4fd1ec325ff7ea8dcf07a16694e744a9c4f6ea5de0fae

Download Submit
C:\Windows\SysWOW64\Benidnao.exe

Filesize
90KB

MD5
b95afd0a431fc9d1814410bb1e0398a2

SHA1
2c8439cefedad6ace31f65ad6c863b3c83ae6601

SHA256
63a032ab89763691dbe16bf35c0cc299402f63c206ab12def20b7d7d57129c60

SHA512
94041fdcb92d6fb39cbee094f616f2ca62b803047a6a0a031cc8056f11228578255b509777369cbcd0eaf84b07bbd78637075448f14c98e790c55af399b4d417

Download Submit
C:\Windows\SysWOW64\Bfcogecg.exe

Filesize
90KB

MD5
edfd08ab33e9babb661da003d7855289

SHA1
b8114a73b6b431f4f8eeff83d19fc004b24b075d

SHA256
72d1639a2e2a99291cad68e9ff0afb4cde2b093dd0c3910689282e5351fe5cf7

SHA512
41c613c7557a594f0f32593c3b57712e8d03437c5804117f18aab1ae27fa876707784720ad6d0cbbc57764059a4226e12b2aff4559bb75d0f5e663f8c50ad6bd

Download Submit
C:\Windows\SysWOW64\Bgnkkckd.exe

Filesize
90KB

MD5
2231d0b19b05c86367887bf793bae247

SHA1
e140179399b0218c8f710e08ebf2ff482284959e

SHA256
96b52d4abd838ab68928966b9df1790460a3f25fd685ee778b4c1d27b1aaae95

SHA512
63a260cb7f930836add20ab42c3fbddf4874426db02cdb2d136fc8928f9c7399831d4d6004a697ddeaab8b6fe59760f34af803686d283e3ab7332c589aa00715

Download Submit
C:\Windows\SysWOW64\Biadhkop.exe

Filesize
90KB

MD5
7b894f18c2b2ece54e28ce587bdd7b2c

SHA1
e6bb29f2724b252ada50c2e462f5bd3744072e99

SHA256
ed2f28655e2a605b5a5cd93829ac5cf9530340c7de5742e4102ee40c9c36c333

SHA512
5b917e0f790eb6cd596f4d71f6ad12c02c77f47b969930f326504e4da16d2c989e033cddb2972c0d6849228af2f615954943873dd39e0b6d0a13585fc0fca4a6

Download Submit
C:\Windows\SysWOW64\Bmddma32.exe

Filesize
90KB

MD5
f88409cf7a0255d2afbccf9fcc865c52

SHA1
07b7b44aaddf62041861ec89f496209bdddb13b0

SHA256
961f064d77bd44550e6ece7c9476ced0cfd5a42b17cbc433f419fd69991ce782

SHA512
d257e610973066790b2c6fe33710b995fa28ecc747eb995bd3b0a6e06cd3dd203e6d4c4f51a403c732c536f66969495a67dead88f3eb221c48b3ef646d8f23a4

Download Submit
C:\Windows\SysWOW64\Bnfmmc32.exe

Filesize
90KB

MD5
2a105e7357eb0733e80751ad15098a7f

SHA1
f51f30ee3d572de2877a63256d3408665e1e3732

SHA256
8a7889f5cdb4c92fcbba2c9ea80ec968e59c22cb41746de4e11effc2bc5e2c11

SHA512
64f71d3b51e036e8257c483074ae56cedf42ae8f4ccdf66fd73297f1388e01c079e4e9278a6e25fb92db4b4ca051a774fb8dffe90572daf3b94479877d973bd2

Download Submit
C:\Windows\SysWOW64\Bqfodh32.exe

Filesize
90KB

MD5
51345c1d4947471624e51dae7adbec15

SHA1
b96f547c021c247993806f3d4bb66d5356bb51eb

SHA256
2b0ccb5d9703a16c48c7d4fca7f92a9c10fbe1c5d0ec7f9506335555b3b97c18

SHA512
71dcb0bb7bb288e0ceae479dd864749a6f6c80fcf5b5122b7cf97d934a8de713c9e37e5c871d2409588d98255d394115f93403c5775c42cc112369b768638d73

Download Submit
C:\Windows\SysWOW64\Ccghfcne.exe

Filesize
64KB

MD5
440d24790ffa3b6ab349e5197aa12b8f

SHA1
52df312f324509805bbe61968e7cb22376153486

SHA256
2f71e271c53ae9c9fca31c8ccaa9745c705e214325f3d192b8eea6a783ef86c8

SHA512
3b9e1b7e8cffd30fbf4dab7a2de44b08d29a55aa7db4ba8303b7d4fc963890307f0995baed21c7d715e0b309481801bc76efd106edda21094edf7e268fcf067d

Download Submit
C:\Windows\SysWOW64\Cffkleae.exe

Filesize
90KB

MD5
bfc508e9725d576ad794d738931d8e23

SHA1
b051a48215f869c109692e81211d63a3d5a8be71

SHA256
99157b40c9840eeffdc11bdf772749d56604e6959914e17a6c37d88acb60e45f

SHA512
417660c3ecf89387d9e7c2631d6f5ead8ee8e00e3f061056dc2708af0894e4a9044b6881efa788b7519e87efe31f110318ac3bba326053a27f415a6533d91b50

Download Submit
C:\Windows\SysWOW64\Cfhhbe32.exe

Filesize
90KB

MD5
91164cd121efcf4eaa241b2ad7f67345

SHA1
f3e78b4ac1b62e0a7d5395eac35b88f53cf81c9a

SHA256
f501ad1be0d65061a0212e2c7bd08fcb9a6ab27509c1d355127ed0ad8e258de6

SHA512
b0c3c1974fe8afb4c710364e18f9b5adb6938f9ea27569a78e1728484e6c180067e32e884e26a9d416da5ef0effae9f023d5fca406a013d10a184d575cdef6be

Download Submit
C:\Windows\SysWOW64\Ddjemgal.exe

Filesize
90KB

MD5
8c8110e29d7523db128636593bb76cbe

SHA1
6158339d2d0bf6c29db9dd5ed9024052fce7c455

SHA256
f630c93e8f3e17785d3467b77f471945ffea6ba769cc900de48f5eeecc7bd1da

SHA512
f64292703b663995363531043f1e1339c296fafc00befdfefc8d4ca1a4cd2cffeea7df9e61c362aa4b2f38b4394b6e91827ec17ca7f37da0e954d23367844815

Download Submit
C:\Windows\SysWOW64\Ddonhf32.exe

Filesize
90KB

MD5
763b65d5ddda441632e8b5e12b902382

SHA1
ef40dd52038c30f52a1e2bfad84413d6dcd5612b

SHA256
35d42fafb08dc989c3458ef85e3fc693e9fa5a330b7bf87f4e754b34018009e9

SHA512
add0cc759331c73e79f83d18cafe59b89b6a89cc8df7d4e3f00219ac55b7397b404d8bdadefa6c21adf24d176b2520a946ff9effd25a2f92f9dedbfab3217310

Download Submit
C:\Windows\SysWOW64\Dffdcccb.exe

Filesize
90KB

MD5
98e8270c0415b52a51226f745ad4a7ae

SHA1
75286142311cc5aa90b4bd0e5607bdfe61df8755

SHA256
e5fbe08927fc93edb9360900c4cae9fb202b7d10c65157b48c0ce8604143f69c

SHA512
6c3e2f9f98019f833a52bfed8bf50d29390e126afe59b1feea89698a9693e5d43acc2a9e4800fad68e200f3efa541d1cecc2a77ade8e2cbe9d4bdfdc8f9d7eb9

Download Submit
C:\Windows\SysWOW64\Doicia32.exe

Filesize
90KB

MD5
f9b651643ccab5b469866e2bcff34ee4

SHA1
3433c08a603ca5b6478f337bee99a828b924507e

SHA256
02efe3611a22de37d8bc25bdea1aa8aa5a53549d188eb7bc70e135e52de3631f

SHA512
66d9fc20a0900bca64c63946c45c4202f1ee063fd689fd748562c2983dcc20a9ec046727ca26e76df7e10178c99842a31eb9e26e8ac8e028d16c4e90a8d1c1ff

Download Submit
C:\Windows\SysWOW64\Eknppp32.exe

Filesize
90KB

MD5
d77b8d9ccfc369fb43880a2b6f645e9c

SHA1
a6303e2ad3b3d06bdeb7e92821a7bedc1200a571

SHA256
f2285e5884b9431e3598d2464ddb3b41689e1a28b65ba827de8be75cfc6186bb

SHA512
60dd19c7693c91672d6c521bf234eca608f2b95ddfb9d91488b29ad99e573c0331c30ab8fa9c9ea29acda9e3d4905a1c594aeb7b0a30de85e963ee84f2ffed50

Download Submit
C:\Windows\SysWOW64\Eonekn32.exe

Filesize
90KB

MD5
b78b97d6e564a0da82ea347a8814744a

SHA1
67adf7bd0abd8e313671cb7bc32b1f8e05445b09

SHA256
9a3a384cf3b7f7a1020b932e4fcf59e906289511adc41e4bf52256e86be08f8b

SHA512
2040126f81526cd2293b186c4b621c8728d12785d8ba54f22310fbcd1805cf452fae85139a83dc1bf98e99ec0b1961db5ca8603908c60cddfefb7e7a3d665e57

Download Submit
C:\Windows\SysWOW64\Fncblj32.exe

Filesize
90KB

MD5
9e3dd19ab6666260ba1a7fa2983b69bb

SHA1
f3b2b9f977a7ac7c4734603dc264a3ff31c28708

SHA256
da3f91843987e89a9da15fe75732061e4f04ddf212acf43ba109e3bbafe85af8

SHA512
01899cc47da212de9f2bb28ce91591a059a9d8dc7ae3b4e06063825d818cb187f2a5120590bb81a24333ba3c96b003b0df48bd5aeae61be38cf5f2a02fc77d9b

Download Submit
C:\Windows\SysWOW64\Fnjhmida.exe

Filesize
90KB

MD5
0b09406158cef0da551fb2ba937ac81d

SHA1
60cfad16ad1d7c35fcff7c47df80733cdc007224

SHA256
c826e9958780f9044a5b45ce22dbc5b485daaee287302faca094b972a8e6fed9

SHA512
69e6ab92f9e6502a9407bc767c7d4636c63688ead9d41e9dd04cbfe501a44d5e2db481b58427b2ac7c694b10655f89c42a17d16c2e41f70e0967b3583f070fc7

Download Submit
C:\Windows\SysWOW64\Gdkgjb32.exe

Filesize
90KB

MD5
70e65b6558133fad0b2677e1ce9c569b

SHA1
acc665f00836a2fb0ffb57d889b68ebee3f26f66

SHA256
ddd225f72e3ab43f10835f54dd1a81a5ae17c9a8f6fde44d91057001b867b358

SHA512
72df7bca6d60da94fdf7a66603013cbb6ace084a578db46a48f950cb97683e6eccd6f5f589143d210f75085640d2feeddbe99b1093cdcc61d259163953e71e7e

Download Submit
C:\Windows\SysWOW64\Gfmpjejf.exe

Filesize
90KB

MD5
3db63f2558ef9f3c4940cafed2c876d4

SHA1
eb17424ddc9ab9f521c1f0d623616b6211a0248a

SHA256
f0834210d2d7dfbed7d273b5c8cf8f4181e147dc747d159d44e10785613efeb3

SHA512
abd30d40cdd0f104ac5b855474e73aa08015d1862650390a61af39ec1187737f67d3b08a49bcb261a36445d9ccd8e4044e12b584baf31db6873107ae61eeb23c

Download Submit
C:\Windows\SysWOW64\Ghbipb32.exe

Filesize
90KB

MD5
b3cef2e2a326226af9ca9ae57c22ae0a

SHA1
c1c32cdecca52259db4782ce214129b1e8ef03c4

SHA256
fa0aedc7e117f75eb6f453596c28af8335800608695cf64b638467692238055a

SHA512
4c77bb5f31a769416c46df6b5742db12bedf227ff3477ae8880b039d128446ca4d5639c6a71c8163ad15c2348eb747b08d578223b3869705e2891e65bbe6fa71

Download Submit
C:\Windows\SysWOW64\Hddiqaml.exe

Filesize
90KB

MD5
4c503036d0c659a2344e06afacb85fce

SHA1
c46d1f5e0eae2b0cf8ec620f2e9e49be40cbd8d2

SHA256
746cebe4e0eac3e143883030cc5675a6210b73ef18eaa1c514ee6e3aa8379a69

SHA512
e32661fe147ecfa8b1a8b4cdc6c78afe5df257b6a6fdbaf78e3cc15e1e71161d4b73d18b75e14ad161fbe83bba3205cf7e4a840e4e0dea3d5cadaf2ed1d3e5da

Download Submit
C:\Windows\SysWOW64\Hgqigmnb.exe

Filesize
90KB

MD5
28e5871fb3f1e10d1d59f76cd5794818

SHA1
4faf83505f23a7d31991741acb0b102bc5bab24b

SHA256
477b6bfc95f03965ca34e5f4a37a224c8dd921e0b762ea70169b12af698a8103

SHA512
d4cd8f16f9dad0f45bff75bacc62766e1250e23968eb52c7c5602d41f6d7d86e53731d1c3f4dd1e5cbc91f9ddd79557a4e22d3a7dffd8cfa872911095857b7e5

Download Submit
C:\Windows\SysWOW64\Hhbbgpcb.exe

Filesize
64KB

MD5
2dcf079a7cd185f5cd2ebc94ce9d2a74

SHA1
c0905ce3d708b4382a880f766e56d4e6c8749d0f

SHA256
399bb0b6b8c4f3529a006bb66f8a429f53d7735c16b23851217350ecb2eabd91

SHA512
93377f8f7d5bc7831ca4ec1a520d200e7b24e6034ea2b0b5c1727437bad8aa4fc767c3072b5e8396e50fd9549f096093c14e136a51d6b3b64eb73cf3189651f9

Download Submit
C:\Windows\SysWOW64\Hnokofaj.exe

Filesize
90KB

MD5
b28263879a22e12578eacf96523f4019

SHA1
f1805e77eebb709d291ab7d49a1d86b3e28b8d69

SHA256
5ec9c02800370a592c366e2a7b8d55f315148f3bab5046c15aec12d2bcbec7d4

SHA512
63da798cbdd722e2c6dcb463121c936f842f1a19d972bde1d963ed850a32a850b4dc3a90f2d8626d2ce34a74c07e08a27e9bde03bb944d43fbb486593d108c0f

Download Submit
C:\Windows\SysWOW64\Hojnnj32.exe

Filesize
90KB

MD5
171114667bcb5a2e8214579139835eb9

SHA1
561ac7bb7239659d01f26b48afc3fdbe95b7af95

SHA256
513de72f460e03d051dcb01286fce7f5000e7e3c2bec0af41b57235d6d9a4d51

SHA512
78724a2d4a48f77024ee4570fa505e486b4435ec519a0ba3c4ae358e938e4aeb8faab65ace3ca58b046abfbe25562d9b9459f3409b940e7e12bab976208ea29a

Download Submit
C:\Windows\SysWOW64\Hoogiiil.exe

Filesize
90KB

MD5
1e4de2faeef2a46689514f0d6295cfbc

SHA1
28de39b1872fe2f050cc87c5a7a4e02c4c998acc

SHA256
45fb95bc1d940e1914dcb045141f6ee6e22ef295abffa02897dff7d3a4c01c12

SHA512
e01257f44556f89c44a8a842b57bea3661539eaff2c5ead2c0a51fbaae42724d2f5da27e77d1aa1c8335bbff2e68ccb213cbb65f67e5288db675e2cb4ef3ff5e

Download Submit
C:\Windows\SysWOW64\Idbfbo32.exe

Filesize
90KB

MD5
2c64b0eb61d288f01007aaced9f2811e

SHA1
12880c89489a9060249f6f62ae08bafae0e319d9

SHA256
ec723032503e10f4cba4923090c43b4da0209546753a08a187dfb25aad0a9203

SHA512
0114e50f2334e96fc126f70472869e267fd329dfb3c3cf581d46610c5bfa888bb549c2493f233b4d174b823184f2187043c889ed145ac9c77781465a9ed8f745

Download Submit
C:\Windows\SysWOW64\Iegomnmf.exe

Filesize
90KB

MD5
2cd826cc1fda5a75cb34b995c5fcc027

SHA1
ef6f796e64187fceff361a6a790ebe5feb70156b

SHA256
94f5cb1da44810f0fec0e89af5e780e07ed19b5f91811961aa9628dd98e2f9d1

SHA512
75ed86da7ea1a984ad280b617b112473b986e19166f9d7ccc4bd10cd321509154f580048198d57e2696c8d3e1efce950f475ca52a94759fcea8ec74c02008d6c

Download Submit
C:\Windows\SysWOW64\Ifklkc32.exe

Filesize
90KB

MD5
09a5d92be8b9f158808e7cca36d5b4a6

SHA1
027051afa1e11a5932c3ff674d1adb9f6e170c23

SHA256
ac991f7d55f00153be816decfcf75b7958600991ab3f144d2f2f80cce2273379

SHA512
571dcd2862b4292309d9a3d1466bf5dab4136c9ea9ad6c46e34b27495fa0bb4dd528b04d1c851f778381af813472440cc9304bb354bddeb40cb837e5c68483d7

Download Submit
C:\Windows\SysWOW64\Inkjkd32.exe

Filesize
90KB

MD5
b7eaa3dd5ef0a1c8c301f4e9fc5259a2

SHA1
b38ba1a8dc315962b67310d86ad6539c89659150

SHA256
9fa813a66d8fe4f5f935a42a0d36b1a0d2387dc113c255182557e0fa076f0f13

SHA512
84c925ba15d2324883106a43a8d477078b858b190b51f1786185c1f2585d672e6fee24e80cab9f18b621facbeb3600860a687a50d61d9ef7507da4bca25a8f61

Download Submit
C:\Windows\SysWOW64\Iofmjh32.exe

Filesize
90KB

MD5
976bf42c626fc575d8ba699a2c387c95

SHA1
4d5add6c5fa23154f9c47c4df0bb107e5d15f19d

SHA256
ae45734026fac95c16989d1e556ff63affb3cc2f0e2f66a6bf8712382aa4ad36

SHA512
92480ab78568e97b7ca3683a3aa46163b3a1b164413cd586190192ca5019df31aa15eeae9290b502bf08845b5006870aaf503f2d07c98b7fd8a931c941ccd6c3

Download Submit
C:\Windows\SysWOW64\Iojgegoo.exe

Filesize
90KB

MD5
541004f38dc2fb998a1726442bb7cd5a

SHA1
07430b83722140d33697360237e60bd0c4eead40

SHA256
7c76d88dd7b2be0ec949d1a279a91c0926dc35dacac22545b3595fc3a5f3329d

SHA512
25d631466e9af9282eee2a2b8dd3fbee70b515a1263781bc1541f39d09fbe73b607b34864cac39d6068c83123c82da302a8fbe1101d357725a77b9c28848be71

Download Submit
C:\Windows\SysWOW64\Jfnbgp32.exe

Filesize
90KB

MD5
1bae3906d18c960c9202f1beead5a3c9

SHA1
322a1584fbae3b6f1a6f02b3ed3cc2c61fdd16ce

SHA256
ab1de838a0dad332ae1affad6333dd842c29177606ac4642fd9f2a2b5c2ed379

SHA512
6edf375aef3bdb75ca65fc271ae5bb46d29f34e02d3f899b9e4bd814300e830179793e965992b01bfddd82355052075cd2c68199cedc0097c1614396b8aa8824

Download Submit
C:\Windows\SysWOW64\Jgmajifb.exe

Filesize
90KB

MD5
ef948d1e95710dee3297577a9cfae35f

SHA1
951059a3378c13e069d27956d19ec722cf132807

SHA256
6e9c1dd37c403373cfbfdee579f014c7499085d7a1f894b065e735523443cf7c

SHA512
8a86706195c5635701cdb6ca4b85fcc26fe53334eb5dc62c8fde414ec52b6b41cbf412c3435e06471164c46885fbb46a2c747dccc179f863c5841488f198bfe5

Download Submit
C:\Windows\SysWOW64\Jnbpkcad.exe

Filesize
90KB

MD5
20b613268a0a60d5bf0243172e37069e

SHA1
8e861108d7a29d12fc156945cb202c2c1e438a78

SHA256
29a00b2358f28644faa784590e3c6598fcb0bf8c49dbd13a4048cc2fa7385680

SHA512
3eb1443f2ff96709e4bdc0672c5c70d9dfde7d0db3fac3f002c6e3fd6144c4dd93d8053ab3ae13fca7dc26f0c1bffd996b5fd9f7a51b7b6367ab460abb44f175

Download Submit
C:\Windows\SysWOW64\Kbgoba32.exe

Filesize
90KB

MD5
b2916dde3987fcc1e188d6673e5812dd

SHA1
63a5694b56b79bef4c00cb68035ba943ddaa6e11

SHA256
bcd634b9aeb9ee186bb8290e5fdd95168c70ad5c8d8fcd02ee3dbedb56c2618e

SHA512
e66c6987473275e2940b879bfd670f8307b6fca7a5e2001a8f8bc9a3b00b707305ea37e864da089483550b9dd8a4b09aa6a5038295a31fca1a0e66885a6f3409

Download Submit
C:\Windows\SysWOW64\Kejeilma.exe

Filesize
90KB

MD5
e12b45e389ee9ee8eefb5796474b79d6

SHA1
ec091b42ed95e13a4ed1d6d3d084b044d61aa9c1

SHA256
1daad6a685dc27c1b07bfd859bd0a85fc0ea2a1a890869b7b5a1a88c7a1baef4

SHA512
b94faf52a004c4dd46c39c9380f8e92caa4e6974fd917011ff671855be1800006676d3d2d6b0112904f64eab4f98be7699e9d3fddfba5ec6fe5e4249b3b47b88

Download Submit
C:\Windows\SysWOW64\Khknkgjb.exe

Filesize
90KB

MD5
a3d467030cfffd16a24a49fb40562c82

SHA1
77482938e6abdfc5b413c0a74d0dcc73999e0470

SHA256
479ab4655ce544e0ef7fcae7e04b1eb9c8d14458e0c50779eb052fb1397836ec

SHA512
0c1b39a5eb0ef046ee7bbc7c64d377a9b6545ecc7e798c8de5907b79076e40b543d6656bee785f74af8b148f9a61958980dc9c075ab6e17509cf9d77ceb1815f

Download Submit
C:\Windows\SysWOW64\Knbiba32.exe

Filesize
90KB

MD5
627d3d3fe944f7d7b4093f0f319ce0aa

SHA1
dc54def72054d12400209456b85560cf177a03ef

SHA256
e5eb3d0aa312faeebe65788e8081c467c5539236942292b7d2e1de70490bd62d

SHA512
05dd286766f85d58e03c9806fcfa07855f46ccd48fe2f4651b24350c303f4eb0ab147cdfeef0da726829601ac68a8c95dc433a457a4c79948f46e54df28cf2cc

Download Submit
C:\Windows\SysWOW64\Knnpgbgg.exe

Filesize
90KB

MD5
de050875000a13b59e1c2e1b1080bdc4

SHA1
117ef1b2d89debe275ee15b5bd7d5c347ce7435a

SHA256
2d74ad1ea27bf4e5da4a9c0c3fe0b9ed0875bd448cc5ab3cda54345e0b218604

SHA512
b7fcc8950bf5c41ccaccc72edb121b66da987d5d77545c9040af5ccb2feed0ff1860478d96924271b462dcf3cd29e08b81e1bb9a6067006e13de509f5da77b82

Download Submit
C:\Windows\SysWOW64\Lfgndmhd.exe

Filesize
90KB

MD5
433d456aed746d26fe4ab7ddbdb5c052

SHA1
8580fa5382ca02859cfd8268f1930f88aa17b9d6

SHA256
1dff726d343888fd99830388e1cd711db912ac996efa953d0dbc6e29eb230035

SHA512
62ea73dc4e1bb7d809056ffcb4b3a237a079ef65302402d52da1ec2c283a767d70a1f66adcb45c0a30c1cff7b14c6eced562d4733da84b70d0cea7fc00c034cf

Download Submit
C:\Windows\SysWOW64\Loninpid.exe

Filesize
90KB

MD5
7fff55fac9996d58aaf00ac34e6e60f9

SHA1
47fe2030535862564fd3920f7bfc15b6c900387c

SHA256
1ce5c26eeca3038ac3605ee8aaaab7d4ff1bf41448c4e61df5e6069694f76f1a

SHA512
b9e32ffe5a8088bba138383dc44db729bc46eafafbba04ce6102e721a8c73e9356c0ef81afb52c6e17a7b8845570813e7b8e91a3f57d520be067084263170300

Download Submit
C:\Windows\SysWOW64\Mchhjbii.exe

Filesize
90KB

MD5
082d99c03b480f4e65d0df95100b3e7a

SHA1
5edaa522250a9b4a680ec215e32a276dc57343c2

SHA256
1d842b1e12c75e4cef3518339f4c0633ed0a69ae816140fd2a2fd8f5eba29018

SHA512
13444df6ecc7f046b4f4db0303512183adec19580889df1bf11763d7ff4c029de0d76dd2bdf4a1e98e11467c8bc4d69ba1a452f41848b84272c45158f71a79ef

Download Submit
C:\Windows\SysWOW64\Mecqfh32.exe

Filesize
90KB

MD5
d16d9dc475be6aa8bb0182a41118edbf

SHA1
bc787017083b63ad8f5d38fe3d76db0384ec4ef6

SHA256
b692a837c7459713b91146fd51ba98a8686e4f9e73cb903afdaaef5f99bdf5ce

SHA512
ad4453bc863f21e2c46abc26e9d3b876b9d88fcaead018261d40a7d3be9f059252528e84c98d6687fa2ba1a8df6ee7130e687eb23f45167aa0393ee670bd8565

Download Submit
C:\Windows\SysWOW64\Mnnlgkho.exe

Filesize
90KB

MD5
710b5d9df157ae67dfc8319aed02a193

SHA1
7635f0aef0632c6cd7f6e58b8993399a8ff0d1d2

SHA256
7c19e39e41a56a4d247fd199d023a1e644d2101aeaf00863ff8f316ff55586b3

SHA512
967098c90e6ab038c016fa30dcc33b48dc56a418b431bb91bfaf8799631e118a5cdfda10737c104f8a4bded13f4e32708681cbc2634adfe6382935206b4d7834

Download Submit
C:\Windows\SysWOW64\Mpdkiajo.exe

Filesize
90KB

MD5
43784aa2cb300e506cc9c7d90dc857b4

SHA1
5fb4c362226d6f1ab0dae8f84aa25c2d59a4d34c

SHA256
d9e76fae8f1f4f807d63ad347a8fc2393641582bae1a864722eba7e2a2d39f06

SHA512
5ef4239ea0ceb18ffc058a91c918e34dabd0c4122d8862cc157b2b702bdddd4cf69e4995502a17e2ac1d92948438be8349656bc5b55f8040ca637bf25fc64d09

Download Submit
C:\Windows\SysWOW64\Mplhdghc.exe

Filesize
90KB

MD5
b885ea9388d1871b0bccfe286cddcee3

SHA1
ab92c60215c1c92aedb239b78304a308bd62d3df

SHA256
b7703961e3c31eebf23c5092198e4ae7406655f53c656390c2d790e034de50a8

SHA512
6d67e105329b80eb2f7004fb899ae4e622ffc96c441f151fb005f7c176169dc1614487f31f81a3dff513596b8597ff18aee33ce31d80956d31897b5a2f293421

Download Submit
C:\Windows\SysWOW64\Ncakqaqo.exe

Filesize
90KB

MD5
f20120cad38e01dabff89165de455cd2

SHA1
ba70d4482673a6a317bdf03c0f0166bf9a45b2e8

SHA256
df6f0f328534914f3e498009d641c1809a8fcf335b3be0e5430a6c6e9205bca1

SHA512
328c6cc22bfbf20cee57cad3ae4805a934c4d1f3e7c016c0025cb55b181f00542aff3e4c9a70a5917b589e16903a51023eeed4921ecb4cb17cf4c492108da0b9

Download Submit
C:\Windows\SysWOW64\Ncdgfaol.exe

Filesize
90KB

MD5
07e75bd56dbf196facb35ccde122f846

SHA1
eff85738b992be1003dffdc180e24c185e1702d3

SHA256
e9648a67e382a2973b02bb47d6c22e1cb45baa407c47c59654e157eedd91a75e

SHA512
3370338a435c1a4d9b4463b56f827b7a9fb4ce289e25db229016fd286dbe7841f545479848a1cecb90dcac2babca28594f2e88d290283835ff26730c17a56891

Download Submit
C:\Windows\SysWOW64\Nckepbgf.exe

Filesize
90KB

MD5
b8be5e1a1d4dd9cacc1f8478aca61158

SHA1
99ab6b759773422da6c38cf6e7e667d5452a71d9

SHA256
c99a9476e31ea6d1f866ca9637f1a0eff29c6951c33258ee19739a3eba1a188c

SHA512
fb61a6f6da6f44834344a2eb8385b59571809276238175371727b1b05212db1d8e0af5a3d3d5111f0e5c14339999f4cb4e67de1d34de287f53eaef1856bab3ed

Download Submit
C:\Windows\SysWOW64\Ndjajeni.exe

Filesize
90KB

MD5
daac1024dd94721887e83eacf7d82068

SHA1
af1827ceb745e49941ddada0f46f2a9838990535

SHA256
47bc07a8b293c79c4b52c4580b841e499002d3a32e7d750adf03d1d4b83bf241

SHA512
ffb151ad6e393b9bea76d750a73a9db29baedf033fec9ab3b9aff4b3db615db7cb86bfe6a5efe2600cf42820806c0fa2084f872478dbd4dfa6875e586148156b

Download Submit
C:\Windows\SysWOW64\Nekgggpl.exe

Filesize
90KB

MD5
2baa0d736a240ce5847a750901055958

SHA1
3f2b021b676cb714a509748019c51e7be6d6fc4c

SHA256
4c4621ffc3089c7aa045c6f8f22ab3dbaa0d9695e0de6bf15505610e91fbe0c0

SHA512
19a2a0d0f0501d5dcb025dbadc6287fd42045e5fb9d3b0003e755c62d531f98c9216b311154ec84a6f62e109f51dc3cb380e1266d4a852899f144ea2f1ffeef2

Download Submit
C:\Windows\SysWOW64\Nghmfqmm.exe

Filesize
90KB

MD5
11d0d49c60a3d5ebadceb41e6274fdae

SHA1
4d0011ca04ce6048944e5d365fde47c648855ed7

SHA256
0bc61fd06da78717b7e249367f1ba88b30b1b255a05e38dce82696931a9d5643

SHA512
e3f37ca4a9dbb4921431072e512e8890590dbe78490ec7855afa2ff145c3a08a5baa65bca8269a15d5269814410a95c55e32e49f76df457921d885d133874230

Download Submit
C:\Windows\SysWOW64\Ngkjlpkj.exe

Filesize
90KB

MD5
9b1ca0123c3c81b6b50f1fd811c6c299

SHA1
dc3e87d09a39e69eedb0645006c0f16ee7e2d6f3

SHA256
ce08e2646b75c23684179b1a58df03078925bce56278c815e1606c4f4ed2090f

SHA512
6a96b7de4ac369d2f51f102b5f66e1e9aeddd2a3ee5d98b6d9713d799fa4b0532b6f21aa0a5f175faddde44a693b244b4a90c57c0140f31db2a84bda149ea936

Download Submit
C:\Windows\SysWOW64\Ngpcgp32.exe

Filesize
90KB

MD5
e238d001371683945e123d7313534efa

SHA1
041cb3969e033812fe41bedbef24baae2e6ae7a6

SHA256
d5bc0b76699cc39c54188c154f8ef1cfbf79cca923397f93e2086ac334e0957d

SHA512
86c7db80327e23fbd7f5339146b3e8a07b34df653bbc37e73d20a1b6950119e9e56f6be5f9efb5f7199f98ff739231c4f7ec558f972dd4df152ad256074adf9d

Download Submit
C:\Windows\SysWOW64\Nhkpib32.exe

Filesize
90KB

MD5
c168d2706433c8a81083706d7fa61da6

SHA1
12c60ba157da3df2a823a4b697817ac1932962dc

SHA256
c4c33ab4c2953b10bf9b6414db0228077328b4b96000750358f8b0a57de6e4cd

SHA512
91c048b7b331622bad4ba055b3137832966a77c678bd6679f1661036f26182783144c7be5c66a6bc40ed2e0167b364b1850616f8435fb6e17851bfff0e456a30

Download Submit
C:\Windows\SysWOW64\Nidmml32.exe

Filesize
90KB

MD5
cfe7c22882d01810368ae5ecab17834c

SHA1
d1e7ad9804cd51cd8aaa4e4542bdcbef1c534259

SHA256
27ebaac1612d4b89efe09e7d2a72e94d5e0256956b165812c748f18a8b8d05b6

SHA512
88f42a603fb1213b6a795003b5df4da88f17e4a65846fcd53f78b85a45dcfc46a713444adf49888b37b15a63fff48e8323f2082c24905885ea246142105ddd8a

Download Submit
C:\Windows\SysWOW64\Njlcmk32.exe

Filesize
90KB

MD5
59a2a632deb3124bee248a2ea34b4681

SHA1
ed587c8e97511eb2a640d3e1a99ce52136332c5e

SHA256
c924cfc270a6c213132621d2af188bb9d3fc611e706966be6c9016cb1a916e2f

SHA512
0a9e54d6396b10053dd7b638ea09fcccf943103c699cecd1edc3a5ce80a671b0c4f8e6f160bbef9bcfb0e1afc6998dfbe253898ad8b91251d678af17a86bd5e6

Download Submit
C:\Windows\SysWOW64\Njnpck32.exe

Filesize
90KB

MD5
4fe6baaef1fd63ae87107eae702f2d47

SHA1
0b6eb269cfccff9230c917fa523dc20836c20fda

SHA256
6901464221917d4755a9a63cc7795c887f20cc7c6ea2123205893dc75602c599

SHA512
e994ddb769d8170218aa136c3a08dec0f61fcdc8e5c737d8a2c44f2c538a1df50000fadd67adbc12bab529e9c8d5a50690e1bfe2077c1b9749e78c376383f728

Download Submit
C:\Windows\SysWOW64\Nlhbdgia.exe

Filesize
90KB

MD5
43777e4b38c9466d422f3e087461e4f3

SHA1
5bd8aa2e78ac56efaf91e1c9b619a9fb4a90435b

SHA256
17ac1f5028477376bb22e13a92e159b6f6fcdd8e98cc39b60053286ed97a9728

SHA512
3ad7fd7990bdce47065520379987b4ecf5e0ee632b716cbbcfd6cf62094563739bb00a78968770a73718811eaa18b9e22742be979b6e3f6ddd127d4c8557137b

Download Submit
C:\Windows\SysWOW64\Nlllof32.exe

Filesize
90KB

MD5
6cc511254653e067fb4b3dd8dd8cc955

SHA1
dd44b5d22655ffed81f1fc2d48061210b8d32f85

SHA256
d60e76ad538da237123359cbb1a3ce276391ebe3f5fe19cec6ff5bbc7669960e

SHA512
b51c1f27ee03b2093df45354bee4e1c47684bec2da954a31edb02bb20d321415c65a46d36a2f221d735322855de51b7d9f18cdcd147a7489a0dcfaed6c54cce2

Download Submit
C:\Windows\SysWOW64\Nnbebk32.exe

Filesize
90KB

MD5
6df9e84b166ddab015e15ee2765e4a17

SHA1
c934dc4edf2407314c42b504f8deddc0846e2403

SHA256
b7f37d3da8509f2ed74b7270f77e79222a45c80429e7e408176d972b5eadfede

SHA512
43abd6680070375ae3c26a50931f5e67efa3ca23c884ca6cf373ca8cf83df3995d210a189c9875029b277e7547e8f40035ec3f2b43a36bdde83d6d41a2fb5b59

Download Submit
C:\Windows\SysWOW64\Nockpmgl.exe

Filesize
90KB

MD5
8b9d028135ebd0c66d7499361bff1c52

SHA1
c53845c1e35098a384d38e2367039f68605b6a33

SHA256
3c8a9d2dbbaf7980ff3da57060dbb840195fa2876436f8a090a47c65289a5245

SHA512
1d57ad1bc11ac125292e969bfa18a1944bcaa93bc2b19ff609dd050739d8cf9a89c12aeaf2671762c6fc51a3afd75cb0ddf1cd1823cd1ad5b48b42b432fb253b

Download Submit
C:\Windows\SysWOW64\Npabof32.exe

Filesize
90KB

MD5
aa9e303a212b27a7c40a98d084ad17e1

SHA1
db3a8dcf20b9258648d6d5a85f7b92b8e659c1c4

SHA256
fa63117b03485ba6de026a5641d0047825947662dbcb9b11b95922c28f84912c

SHA512
9a1710d6a8567715bc71a71259ba8053a6a7841a4ede888f67f17b306d028b5aa9a38b162b59f11820ebc5c8092e24225e948ce06e51a25421c92d9c09c00bbb

Download Submit
C:\Windows\SysWOW64\Npedpoll.exe

Filesize
90KB

MD5
be176abd5991ba77b71a0616843117db

SHA1
3fdeb7745543a20ec42d820a883f05d467d9f013

SHA256
e19201ffd9af5358dc7cecfc006009e72814044fdaedb4f9918e9f317fec4471

SHA512
c19d9622d4583923fe714fed8e6c84d7894dd5c4ec419e8334064f6cac521a2a06c93778f88a3a19c08c64ba596089a11c4225ab0f1523ff0aa58aaa3e8c8a93

Download Submit
C:\Windows\SysWOW64\Npekjeph.exe

Filesize
90KB

MD5
68409583464ecbb58024dfb0b7a690ac

SHA1
5e12faedef335aba925696493e9198bdf306f9d0

SHA256
27711ab1430998f8966072c1283cae125d1cf7eee6fec6e5d23b464a08db9942

SHA512
6f90cb9c4b7e97c6c3e9c73ddb25225e98c6e2e21bfbb68af0a35e8acf8c0c799b5101dd1c33657d39100145cd15bf14229f7c1d1de58a3752ef088dece3f21a

Download Submit
C:\Windows\SysWOW64\Nplaiqdg.exe

Filesize
90KB

MD5
3057e9bc5431e27610c6973c0a47e6cf

SHA1
522941a9160b2ffe7b6106df18ce6f49c808e43f

SHA256
d28f2b43a2aacd97d9ca6b960085e14b4032ac2fb4786a264dc5b4693ece9a39

SHA512
e63b12c31a0f8d136d1635eb2785b17de2c473fcf1c61f90a859d66432b2e9a9ef329aefab0e27a51bf2e122bcfbf8ac3179466b3c12ea5c6558d90cdf0393d5

Download Submit
C:\Windows\SysWOW64\Ociaap32.exe

Filesize
90KB

MD5
b918b3387d04ace0f6df19b70ad3db64

SHA1
5f3d96c186191e08e560b521cd83b6256010500f

SHA256
58b2874372b691b85f9cc207feada65649fa1375f72d10ea5ebda72f09dfca38

SHA512
bcba299f68ab84ad412ff3c7503fc41e6bf78d7475b9a39693f7dcaa6b6877f2f3cb321d670b48638f99d0815e65fca0b3597afaa4c42b85b2aefca14cf0b633

Download Submit
C:\Windows\SysWOW64\Ocmjlpfa.exe

Filesize
90KB

MD5
b239b3648005c2dcf618f1a0685ed224

SHA1
0ad301b3e3474a5bbfaa3a11c5a1300585eff9a4

SHA256
6134a50843838c12958b326fada5c3f1159839423b870278e7ee5d718074e9a6

SHA512
0e077a0c5bdd977e5ff43690b52ecad42a2468652ca90ee92180801c715165fb9356149bcb221b72707bbae3c09a0bdc8c4a0f3775595c5c985e883635be771a

Download Submit
C:\Windows\SysWOW64\Ocpgbodo.exe

Filesize
90KB

MD5
113e58ef600925a90ebf160b512ce6bc

SHA1
53a5be03502475247b0377cf39c7ef08f2527f9c

SHA256
056e7f43ec5678e7291bcf767e239b6e66cc8c6eab14452fbd1a036fc5a34b05

SHA512
4be55ae41266b2de5880184ca05d5f68beaa0a56fd2773b85f6d680f333545108e98261ddeea0a6b265d0dbab14a456896efcccba65ab0ace615977a54585931

Download Submit
C:\Windows\SysWOW64\Odcdpd32.exe

Filesize
90KB

MD5
3917feb9ca66c08149999f6ed1dcca15

SHA1
aee8852cdb3ba28de5c959a85a7ceeff434bec5f

SHA256
f295c248da143b5ec7fb6f4e32de9c4be91b7d876b3cc3cede21f10acb5a353f

SHA512
05c21bdfdf8e5edf4b6c72e05d2a43660f3bb442aa2754178b0d2b18082e38ed318f8905c93aec7408088af1931f526c61c34d3c1c63d7b2b6e8f5a65658e46d

Download Submit
C:\Windows\SysWOW64\Ogbploeb.exe

Filesize
90KB

MD5
19096f1833480df060d6f224197341bf

SHA1
6757c55766c95f194544f929e85940b52531c20f

SHA256
47a8104f416bf950edb56747feb8d2e3f3e9b626c81c33e1161871501bfc641e

SHA512
3e46365179d5e4a8121c225609210d84ac6bab7f1fd522fa59e59c35fa0638f7cced90f974894acf66be7671269f2bcb3019a53bd75018323bfcb60420e3286f

Download Submit
C:\Windows\SysWOW64\Ogdmaocp.exe

Filesize
90KB

MD5
10b51a7c43a4355c63356043cd78c5da

SHA1
eea4ad81a36736b2c760e3bba2a5c2a861526448

SHA256
ee2a804a2a9cd7f8c22b9df5c42510458d2c428fcdc5bb1a942eb755a6567729

SHA512
e14651684c0cee620d0cdea40060cc40243e088026b2df0d3991e2cba4b6322dcfdbbd464105d3ab4815b3104cc9d810ec80c29094972ad0a653dc2cf01f3c4a

Download Submit
C:\Windows\SysWOW64\Oghpbh32.exe

Filesize
90KB

MD5
edb670b253a99e6693265bcf6043b683

SHA1
19b0604791e6271de3f13f5686dc8f78097a7cac

SHA256
abffdd95839ccdcaabaf47f919be8ea98448de5864f23365f49fbb6e23a7b29d

SHA512
abfd951b2c6927bbde41fb82d9aedcdf542a876d6823153552975ed5e6f7665f21c37c42d14f1ff5a69c1415b350d4ccbf7d7941e470637c51b6f233ceb3ef63

Download Submit
C:\Windows\SysWOW64\Ohgodq32.exe

Filesize
90KB

MD5
6dfeba1ea32a42028a1c3f9a2c6ea714

SHA1
778d083b03a9a4abd6a0329f8588e7528003bd6d

SHA256
7c1800b3c016b4cb2bfd6ad776d3bf3c0069ae24dd84476b4a265d17bea69612

SHA512
50f9536e4b7d4ad26fec7f3fbf524af47607d6b8d46d266cb5189657ae6a34e325f0ca3d3977f8934626bbaa3344108804eee02550ec83f9f76d0afd13552bc4

Download Submit
C:\Windows\SysWOW64\Oimihe32.exe

Filesize
90KB

MD5
6fe95ad73d15b82547c48ded5d340ecc

SHA1
2e7ca466ca2249ed7cfd55ad62a2f5154835c450

SHA256
35867a85218d0239087b5c453efcf81cedd650d646ed64ff05b8d634229fa524

SHA512
0fb48945c59c435b7353b4056370c047e13851bf1094865df87158cac5114d8db11312afe782b4dba201f9c886211ba16e530778ad3d7e871e933097545aef47

Download Submit
C:\Windows\SysWOW64\Oipend32.exe

Filesize
90KB

MD5
2fb147ac665bfc6db8529b276711155b

SHA1
00a3dd4ebb49bb26e02e73b129be106918377842

SHA256
fcfec77220e73c1d04456360ab9caaa5cce31871afbed01e3e5466b7c39d3e96

SHA512
4f1948cc2224ef6bf5864a0169921bda4c1a9252c7a3a56219dcc0c32ee37b752befe82e750fe3f87f5463ec00777f209789fa04baa93447a18c92ab8cc7ce4d

Download Submit
C:\Windows\SysWOW64\Ojefcj32.exe

Filesize
90KB

MD5
dbd2af75b118800a70cb417c9043f644

SHA1
652f7385a00df3fda0c7f13927ef2253ed3361df

SHA256
1c54bc595b5e1db92428c4853b7c564d91128145ddbc52dc20bc5fd7ebd2f4ff

SHA512
e8d48ab77cb8435562f0c34de3716b7cc689633cd9ed0caf39e222f3b7912574589e1ca66dc609282e34496a4d5dd17daae9eccd38039b534a787a9149bdbcc2

Download Submit
C:\Windows\SysWOW64\Ojgbij32.exe

Filesize
90KB

MD5
01b2db148d5944ceb2a1f5e57afbf535

SHA1
76f8336c62af3581e9946466b9183d49ad3bae06

SHA256
2642f1fc62eebb062fc63d544fec858f71be62ef42f6e668bd0db3e1031c078c

SHA512
b711c6577463b49134c913c3ade3583f91c2fbe44417af1eb6d1a33d9d9b3c698514d634f6d2470fd39cc502a820f6dbd3ff03357416079c13b113019e21e9fd

Download Submit
C:\Windows\SysWOW64\Onekoh32.exe

Filesize
90KB

MD5
0e6549fd679b022c7f902c95f2497ed6

SHA1
ec1fd9dc196a2b6bca3779a8b8ec45663e9df090

SHA256
e48407e3821da145483cae16a6a84029421aa31580287910aeb015c17004bee0

SHA512
021459b1748b057b903f5d3a66aa64747fdc018a1c57e06f017679fe990a8f4a5ec0b13ca067a72dad1216c9d2c90370d0fcb9d7aee970b4aac5bc5beabec671

Download Submit
C:\Windows\SysWOW64\Onlhii32.exe

Filesize
90KB

MD5
d574c634fecf51ab30cfd950ad67b2ab

SHA1
d8669a3b1a94d97a68527b45ddb2d423ce80df41

SHA256
cda0e33dfc027057c0dfdd72ecfdd8dd8e1c0ac8dc25b14678bf98479d90415b

SHA512
6ad7571009fcc7fdffce5827565e0fec5550408c090db538b7f0f20867f176c98cbae7118a3ae40db9810389cd33cdfa74d0d5a5265c7ffd08c42ab78870bfb3

Download Submit
C:\Windows\SysWOW64\Oolnfkoa.exe

Filesize
90KB

MD5
ae326c10dca546a98a5576e52d721036

SHA1
a76c66eba377d2ad11e9c901ea9344b37eb8c5b1

SHA256
7060ab8a27654614c846a6c61d3f332be5de403860b42aabd192fcec10745e5c

SHA512
fd056ec96577c08c18a71502485979befffaf9ae27e612d5fc4c4126e7a8e9cdd2a9648cf557eeb117dd03be7f71062ef12e864d6ca2c91527a969e8237b280c

Download Submit
C:\Windows\SysWOW64\Opjeee32.exe

Filesize
90KB

MD5
e8796f1213c7b7eda4f177cc0933f196

SHA1
eaa2399c5f1bebea7c804bfde184f99e90a64d0c

SHA256
c3cdc38127f703502ae144de4cc2f00670a747526a9e8cac0c36878c49ca0cb9

SHA512
192d4bc85cd50901e2d6494514082bea495e15455aa524e7d9698da8ec6e0bf3cbf7ebee25241ffd4d8a50ee553a6fa3b855eb67875bbec3c721df9f5321d99f

Download Submit
C:\Windows\SysWOW64\Opmakd32.exe

Filesize
90KB

MD5
433b084420ba85e3ceba5234d78b441b

SHA1
c1d310b7f805c1208f924e697d9cbb3b97f3339b

SHA256
25b4c51bb3c2ae41731189df22a8a631d82a4991d9750f526709471d03b5a83f

SHA512
a60461a444255512060ae82792daffdb89a672965b0ee3d31fd7059f37f09adfb34084d821066d36f7f90b53cf0552292f4c9d9b5473e63fc10819c94b961b2f

Download Submit
C:\Windows\SysWOW64\Pfcmij32.exe

Filesize
90KB

MD5
c9b21d261e38b85e9548124b38839332

SHA1
6acc5754f280ca2fafd6e227031684220a52e123

SHA256
3aa87654ec899cb69e78fa8eeab65d3aa8c2cbd7110ccaf4f20a8cd308b3045c

SHA512
e6d923c1b65f359a8abaf408fa08fb5802d0b0303aecee3d595b1ddb9571971e4c586a703f05761228a6d89d0aca5ee3ea0cf0cda0a46602c7153d284b78cc7d

Download Submit
C:\Windows\SysWOW64\Pgdfim32.exe

Filesize
90KB

MD5
d372927c2748eef8baf26e1292096e06

SHA1
e1dcbbca3e877b7537bbf67d79a435b966a0cd69

SHA256
bc382c9cf5f6eaf4209e4bb84f6a603c0701b9de1275d60a03133c6372a52ac0

SHA512
b4032f35089da5c5c206d73665d1261d6ee601f9b19dcd04d9236426d1c65ab6646053b05000c2549ac4b4e6b13e0ff00e7d78a476298ceac522342822b1b75a

Download Submit
C:\Windows\SysWOW64\Pjpoeb32.exe

Filesize
90KB

MD5
1bf463e2957efbe9afe6e3f2101b3795

SHA1
3379c696a06ccacd8e15d49637904b0be3630aa5

SHA256
a2f6ca95c2a3762a4237b6b1a47b5ad092c2172ea21bf9076b71e92366768889

SHA512
79cbfe3f4347a28d2078d60924abe6f0478ff831ee62ff161c85d6c22f384bed98dbf7d1434e470c8b0856be8feceb51923a38b14be9061f7a2a4ab33acf2c72

Download Submit
C:\Windows\SysWOW64\Pnakkf32.exe

Filesize
90KB

MD5
198cef4a6a70b3a13761d59f6be565ed

SHA1
ce3b0968e232ec453f3ee677d6fb28c4218fb057

SHA256
c0575551c544282f54426eff9d4aebd27e27e996202a3fe667302e22a26511d9

SHA512
0e24bb6d186e8285c3c2170c26727eccb7afdea40ffd7f4a4a5c871a3cff04762207ce16d4c8fa47c67747670cde9358b535d9ea43efd692c2cb15d412d6cd90

Download Submit
C:\Windows\SysWOW64\Pnghdh32.exe

Filesize
90KB

MD5
a45867c696eb1fb7aab78883a60b4279

SHA1
38b284fc00304d953333b23cd7ad6ce334a6e436

SHA256
8b94cc7271120a56c5a1fe606cd81f69052599dd4ccdc050ef6d0f11331c46b2

SHA512
6687df83be2eb9d42a73a5b57558bb591719137a1d8b31bb1c9773cb6f96d6353dde369fb1e0ee3f877be7711b698ba28f0c3bb9e5d403515d0c637ee6db81f1

Download Submit
C:\Windows\SysWOW64\Qdmpmp32.exe

Filesize
90KB

MD5
5072aa39a7c5031d97b2c95a94e44195

SHA1
d8acd73896af91741f621dee4efcaafc4912ec4a

SHA256
87dce98d1a494ef3425de548a245caa68903a7046d4e837e1f912fcc3a25374e

SHA512
59e87de067640992bcadf0f3a80a5d1bfa5e388d0a09494e00b21411c056adbbd79759430b1b9a336175d7e9f465a4d2d9c396c5b44775ecb9925959ca158e52

Download Submit
C:\Windows\SysWOW64\Qgiodlqh.exe

Filesize
90KB

MD5
f23e6e815791fd34f6a637058b514a44

SHA1
0c7c143448dc46aa9ed3299f5e7c3660e2d4f4dc

SHA256
5703bbb9c0b96a56ff9e334a0a7503633be4f1d88f4d2aa4d496b8703f9101f1

SHA512
c7aa661cb41d64498bc2476c7b006f9fe1c9ed58a4dfd855eb6dc1fda87cb334f1968b63cd3b87de2633873a6dcdcbcf5c910d1ecf1079a7dd70a7e545b4b7ae

Download Submit
C:\Windows\SysWOW64\Qqopml32.exe

Filesize
90KB

MD5
110c13b35687af9febef986ae6d29a86

SHA1
3a2058b65e84eb850fd83311e01a289006382201

SHA256
420e3482b4ce9527d01857c858cd10f782bd4e7c6252cecbf3458999a33fe9d8

SHA512
6d63a423efe7514e719437cd9f3ce8521694ad944efd729931667754b9199f241a37fd4f0e3007face77770fcfc72354da1ea283179721c3ca82be0c6b5d20a3

Download Submit
memory/228-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/316-565-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/316-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/448-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/472-594-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/476-579-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/476-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/688-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/876-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/896-484-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/960-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1032-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1120-231-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1132-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1132-558-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1148-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1160-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1168-215-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1188-552-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1260-482-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1368-526-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1400-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1468-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1472-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1504-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1536-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1536-551-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-496-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1552-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1596-520-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1616-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-544-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1792-165-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1832-460-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1872-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2308-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2324-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-466-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2540-586-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2540-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2632-448-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-223-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2724-573-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2752-563-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2772-593-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2772-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2840-532-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2852-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2892-580-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2908-472-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2992-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3096-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3104-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3152-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3236-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3456-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3492-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3532-502-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3540-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3548-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3588-566-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3600-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3616-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3616-572-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3632-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3704-543-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3800-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3848-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3852-514-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3864-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3980-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3984-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4076-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4116-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4176-189-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4184-587-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4304-545-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4332-490-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4340-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4504-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4528-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4568-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4576-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4592-508-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4596-454-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4716-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4744-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4784-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4800-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4912-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4948-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4972-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5104-157-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/8228-2403-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/8364-2386-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/8560-2385-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/8892-2382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/8896-2412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9196-2387-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads