berbew | 713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00.exe
Size

163KB
MD5

f772ad5230e6fcb3ab0be36158265018
SHA1

d4aa823d44e10e09d50ccd18a638441eec4fe341
SHA256

713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00
SHA512

a4456ced0dc212acb256baacaead63c9d891d123fb2eaadb6e66a80aab4d7afde4d8e1867bffe3db120f6f71ca1ff2ba5b70bd7650887f8172d80c6a270cf766
SSDEEP

1536:Pg9IPz56W9JBKCLo1wRPsD8vwQFHlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVUA:I45NJBKPwRP+8vdRltOrWKDBr+yJbA

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phneep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pphjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqakfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgknnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbmcedhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mldfmcfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngmpgjel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olledp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfkieb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmdiamqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eajebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgakeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogkcbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfbkbpjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpdkiajo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjean32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcdkpdph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aichgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqhljhob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehmgne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkqockbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkcdohbq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nekgggpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjcajgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlihoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foiegl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghklfq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mikjfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlngje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndagjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogbploeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqdqbaee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnljgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibdifc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfqgdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olledp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idpilp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nekgggpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Medgan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmkpbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncdgfaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oloidfcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgbij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olfoee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgminggi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpebch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eknppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeqbcmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jecoimci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocjglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amaqmkaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lefkpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofncnkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kldmff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpnehb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aebihpkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkglmlkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocfmajin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgminggi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qodmnhjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojjooilk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkfjoagf.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2852	Lpicgihh.exe
4684	Lfckdcoe.exe
1264	Lefkpq32.exe
1104	Ldgkmhno.exe
2972	Leihep32.exe
2244	Llbpbjlj.exe
4408	Lekekp32.exe
1664	Lmbmlmbl.exe
2548	Ldlehg32.exe
2484	Memapppg.exe
2712	Mmdiamqj.exe
4564	Mpcenhpn.exe
4580	Mdnang32.exe
2660	Mcabjcoa.exe
4964	Mepnfone.exe
3264	Mikjfn32.exe
396	Mmgfgl32.exe
5044	Mljfbiea.exe
1984	Mpebch32.exe
2136	Mdqncffd.exe
4020	Mccooc32.exe
2504	Mgokpbeh.exe
1532	Mebkko32.exe
2816	Minglmdk.exe
4996	Mmicll32.exe
2100	Mpgoig32.exe
4076	Mdckifda.exe
2724	Mcfkec32.exe
2948	Mgageace.exe
2432	Medgan32.exe
2640	Mipcambi.exe
3872	Mmkpbl32.exe
3568	Mlnpnh32.exe
1400	Mpjlngje.exe
2336	Mdehof32.exe
2276	Mchhjbii.exe
2296	Megdfnhm.exe
3596	Mibpgm32.exe
4112	Mnnlgkho.exe
2440	Mplhdghc.exe
4840	Ndhdde32.exe
1720	Nckepbgf.exe
1548	Ngfqqa32.exe
3396	Neialnfj.exe
3504	Nidmml32.exe
2652	Nlciih32.exe
2544	Npoeif32.exe
4352	Ndjajeni.exe
4772	Nghmfqmm.exe
868	Neknam32.exe
4000	Nnbebk32.exe
1148	Nlefngkd.exe
5040	Npabof32.exe
4568	Nconka32.exe
2120	Ngkjlpkj.exe
3772	Njifhljn.exe
5104	Nnebhj32.exe
1696	Nlhbdgia.exe
4700	Npcodf32.exe
4276	Ncakqaqo.exe
3960	Ngmgap32.exe
244	Njlcmk32.exe
2892	Nngonjqd.exe
4752	Npekjeph.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hddiqaml.exe	Hfaied32.exe
File created	C:\Windows\SysWOW64\Necjgcjo.dll	Kbgoba32.exe
File created	C:\Windows\SysWOW64\Igikac32.dll	Medgan32.exe
File created	C:\Windows\SysWOW64\Dnbicmgi.dll	Nngonjqd.exe
File created	C:\Windows\SysWOW64\Olaejfag.exe	Onneoi32.exe
File opened for modification	C:\Windows\SysWOW64\Ofncnkcb.exe	Ogkcbn32.exe
File created	C:\Windows\SysWOW64\Kbnggn32.dll	Chehfhhh.exe
File created	C:\Windows\SysWOW64\Dmpmpm32.exe	Ddhhggdo.exe
File created	C:\Windows\SysWOW64\Pbeafajf.dll	Nohdkl32.exe
File opened for modification	C:\Windows\SysWOW64\Qhghkn32.exe	Qgfldf32.exe
File created	C:\Windows\SysWOW64\Jflkkn32.dll	Bgnkkckd.exe
File created	C:\Windows\SysWOW64\Llfaiaim.dll	Ehmgne32.exe
File created	C:\Windows\SysWOW64\Fgfpqn32.dll	Jkcdohbq.exe
File opened for modification	C:\Windows\SysWOW64\Nidmml32.exe	Neialnfj.exe
File created	C:\Windows\SysWOW64\Pjnjhf32.dll	Nlefngkd.exe
File created	C:\Windows\SysWOW64\Pcdqmo32.exe	Pqfdac32.exe
File created	C:\Windows\SysWOW64\Ieaplbcc.dll	Aqdqbaee.exe
File opened for modification	C:\Windows\SysWOW64\Dkfjoagf.exe	Dgknnb32.exe
File created	C:\Windows\SysWOW64\Mhqlcc32.dll	Dgknnb32.exe
File created	C:\Windows\SysWOW64\Moleonmd.exe	Mhbmbc32.exe
File created	C:\Windows\SysWOW64\Pambekce.dll	Oimihe32.exe
File opened for modification	C:\Windows\SysWOW64\Biadhkop.exe	Bfchlopl.exe
File opened for modification	C:\Windows\SysWOW64\Mljfbiea.exe	Mmgfgl32.exe
File created	C:\Windows\SysWOW64\Nckepbgf.exe	Ndhdde32.exe
File opened for modification	C:\Windows\SysWOW64\Inkjkd32.exe	Ibdifc32.exe
File created	C:\Windows\SysWOW64\Mhbmbc32.exe	Miomggom.exe
File created	C:\Windows\SysWOW64\Ocfmajin.exe	Olledp32.exe
File created	C:\Windows\SysWOW64\Ngfqqa32.exe	Nckepbgf.exe
File created	C:\Windows\SysWOW64\Bacdhldd.dll	Nnbebk32.exe
File opened for modification	C:\Windows\SysWOW64\Odmgfb32.exe	Oqakfdek.exe
File opened for modification	C:\Windows\SysWOW64\Pfjcji32.exe	Pckfnn32.exe
File created	C:\Windows\SysWOW64\Mflhqocp.dll	Nidmml32.exe
File created	C:\Windows\SysWOW64\Ambgha32.exe	Aefbcogf.exe
File opened for modification	C:\Windows\SysWOW64\Hfompd32.exe	Gkjhbl32.exe
File created	C:\Windows\SysWOW64\Jeilbn32.exe	Igekijlj.exe
File created	C:\Windows\SysWOW64\Lpfogcfo.exe	Llkcgenf.exe
File opened for modification	C:\Windows\SysWOW64\Ahonlmoe.exe	Agmbde32.exe
File created	C:\Windows\SysWOW64\Pgnphnke.exe	Pcbdgo32.exe
File created	C:\Windows\SysWOW64\Bljmpb32.dll	Opljpn32.exe
File created	C:\Windows\SysWOW64\Mdgamc32.dll	Ocfmajin.exe
File created	C:\Windows\SysWOW64\Memapppg.exe	Ldlehg32.exe
File created	C:\Windows\SysWOW64\Hiaponbm.dll	Memapppg.exe
File created	C:\Windows\SysWOW64\Pgedglll.dll	Olfoee32.exe
File created	C:\Windows\SysWOW64\Fgijpp32.exe	Emqegkll.exe
File created	C:\Windows\SysWOW64\Fneobj32.exe	Fncblj32.exe
File opened for modification	C:\Windows\SysWOW64\Kpkple32.exe	Klockfhc.exe
File opened for modification	C:\Windows\SysWOW64\Liocpi32.exe	Lfqgdn32.exe
File opened for modification	C:\Windows\SysWOW64\Noehelej.exe	Nlgliaef.exe
File opened for modification	C:\Windows\SysWOW64\Nhnlnb32.exe	Ngmpgjel.exe
File created	C:\Windows\SysWOW64\Plnkan32.exe	Pfdbdcjo.exe
File created	C:\Windows\SysWOW64\Mdnkbgfn.dll	Afboeano.exe
File created	C:\Windows\SysWOW64\Ddpajb32.dll	Lpicgihh.exe
File created	C:\Windows\SysWOW64\Dddkqjen.dll	Pcbdgo32.exe
File created	C:\Windows\SysWOW64\Lmcbjg32.dll	Eajebj32.exe
File created	C:\Windows\SysWOW64\Pcaphnlb.dll	Fhpmjbch.exe
File opened for modification	C:\Windows\SysWOW64\Mikclg32.exe	Mflgpl32.exe
File created	C:\Windows\SysWOW64\Bjgnlo32.exe	Bgiapc32.exe
File opened for modification	C:\Windows\SysWOW64\Kbgoba32.exe	Kphcfe32.exe
File created	C:\Windows\SysWOW64\Mflgpl32.exe	Mpbocblb.exe
File created	C:\Windows\SysWOW64\Oghpbh32.exe	Opngfn32.exe
File opened for modification	C:\Windows\SysWOW64\Aiakammb.exe	Ajnkfp32.exe
File created	C:\Windows\SysWOW64\Mikjfn32.exe	Mepnfone.exe
File opened for modification	C:\Windows\SysWOW64\Oloidfcj.exe	Onlhii32.exe
File created	C:\Windows\SysWOW64\Ojgbij32.exe	Oflfhkee.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10052	9916	WerFault.exe	477

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnbebk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kejeilma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nidfbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mipcambi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngonjqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgknnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpcenhpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabfhjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oocdgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjihdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgijpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnfjfc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhnlnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpgm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofncnkcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dokpoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjemgal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noehelej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfgojchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Biogck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncakqaqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jniflb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lejnpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhiccb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhbmbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjjml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpfcjeja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogfjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmbpoofo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jilndl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkjjpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjean32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahonlmoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajcdapbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mccooc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocfdlqmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpdkiajo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpkple32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llkcgenf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfjjjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miomggom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdnang32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpjlngje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcodf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccjlfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmkpbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onneoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kijjejae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngmpgjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eknppp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gonnblgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfkebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgloc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogkcbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bappnpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbmcedhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agkeoeki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edfdhego.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olbkeoki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgiapc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mepnfone.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeqhl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhkgbdlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phneep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qabdlocn.dll"	Ngfqqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mflhqocp.dll"	Nidmml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojjooilk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgpppo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbmllb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mobbioeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niaimf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqakfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jedhei32.dll"	Chhdlhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jminkf32.dll"	Mpghna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlpeib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pofalj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfiefqhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leihep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iipohm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeqbcmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbgoba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpkple32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aofjch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dokpoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohiljpam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agmbde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mccooc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbfmdfnh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lejnpi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpbocblb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqmfgcnl.dll"	Llbpbjlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhpmjbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efgehhna.dll"	Ibdifc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agmbde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgfldf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgiapc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcabjcoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hadimk32.dll"	Ocfdlqmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qimmdloa.dll"	Gonnblgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhdqaeag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpnehb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pofalj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflkkn32.dll"	Bgnkkckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnnlgkho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oelfff32.dll"	Odmgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddjemgal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liocpi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agkeoeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahbinm32.dll"	Aichgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndhdde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpfboh32.dll"	Gnfhihjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jldadd32.dll"	Iipohm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llkcgenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcbpdj32.dll"	Mldfmcfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdqncffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kojdhh32.dll"	Dokpoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Biogck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfehoi32.dll"	Ngmgap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dabegd32.dll"	Aqffmkpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlaaohoh.dll"	Bqfodh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcdkpdph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhjlkk32.dll"	Leihep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcdqmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbkgpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emfiqoad.dll"	Pcdjbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgokpbeh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2852	1656	713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00.exe	81
PID 1656 wrote to memory of 2852	1656	713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00.exe	81
PID 1656 wrote to memory of 2852	1656	713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00.exe	81
PID 2852 wrote to memory of 4684	2852	Lpicgihh.exe	82
PID 2852 wrote to memory of 4684	2852	Lpicgihh.exe	82
PID 2852 wrote to memory of 4684	2852	Lpicgihh.exe	82
PID 4684 wrote to memory of 1264	4684	Lfckdcoe.exe	83
PID 4684 wrote to memory of 1264	4684	Lfckdcoe.exe	83
PID 4684 wrote to memory of 1264	4684	Lfckdcoe.exe	83
PID 1264 wrote to memory of 1104	1264	Lefkpq32.exe	84
PID 1264 wrote to memory of 1104	1264	Lefkpq32.exe	84
PID 1264 wrote to memory of 1104	1264	Lefkpq32.exe	84
PID 1104 wrote to memory of 2972	1104	Ldgkmhno.exe	85
PID 1104 wrote to memory of 2972	1104	Ldgkmhno.exe	85
PID 1104 wrote to memory of 2972	1104	Ldgkmhno.exe	85
PID 2972 wrote to memory of 2244	2972	Leihep32.exe	86
PID 2972 wrote to memory of 2244	2972	Leihep32.exe	86
PID 2972 wrote to memory of 2244	2972	Leihep32.exe	86
PID 2244 wrote to memory of 4408	2244	Llbpbjlj.exe	87
PID 2244 wrote to memory of 4408	2244	Llbpbjlj.exe	87
PID 2244 wrote to memory of 4408	2244	Llbpbjlj.exe	87
PID 4408 wrote to memory of 1664	4408	Lekekp32.exe	88
PID 4408 wrote to memory of 1664	4408	Lekekp32.exe	88
PID 4408 wrote to memory of 1664	4408	Lekekp32.exe	88
PID 1664 wrote to memory of 2548	1664	Lmbmlmbl.exe	89
PID 1664 wrote to memory of 2548	1664	Lmbmlmbl.exe	89
PID 1664 wrote to memory of 2548	1664	Lmbmlmbl.exe	89
PID 2548 wrote to memory of 2484	2548	Ldlehg32.exe	90
PID 2548 wrote to memory of 2484	2548	Ldlehg32.exe	90
PID 2548 wrote to memory of 2484	2548	Ldlehg32.exe	90
PID 2484 wrote to memory of 2712	2484	Memapppg.exe	91
PID 2484 wrote to memory of 2712	2484	Memapppg.exe	91
PID 2484 wrote to memory of 2712	2484	Memapppg.exe	91
PID 2712 wrote to memory of 4564	2712	Mmdiamqj.exe	92
PID 2712 wrote to memory of 4564	2712	Mmdiamqj.exe	92
PID 2712 wrote to memory of 4564	2712	Mmdiamqj.exe	92
PID 4564 wrote to memory of 4580	4564	Mpcenhpn.exe	93
PID 4564 wrote to memory of 4580	4564	Mpcenhpn.exe	93
PID 4564 wrote to memory of 4580	4564	Mpcenhpn.exe	93
PID 4580 wrote to memory of 2660	4580	Mdnang32.exe	94
PID 4580 wrote to memory of 2660	4580	Mdnang32.exe	94
PID 4580 wrote to memory of 2660	4580	Mdnang32.exe	94
PID 2660 wrote to memory of 4964	2660	Mcabjcoa.exe	95
PID 2660 wrote to memory of 4964	2660	Mcabjcoa.exe	95
PID 2660 wrote to memory of 4964	2660	Mcabjcoa.exe	95
PID 4964 wrote to memory of 3264	4964	Mepnfone.exe	96
PID 4964 wrote to memory of 3264	4964	Mepnfone.exe	96
PID 4964 wrote to memory of 3264	4964	Mepnfone.exe	96
PID 3264 wrote to memory of 396	3264	Mikjfn32.exe	97
PID 3264 wrote to memory of 396	3264	Mikjfn32.exe	97
PID 3264 wrote to memory of 396	3264	Mikjfn32.exe	97
PID 396 wrote to memory of 5044	396	Mmgfgl32.exe	98
PID 396 wrote to memory of 5044	396	Mmgfgl32.exe	98
PID 396 wrote to memory of 5044	396	Mmgfgl32.exe	98
PID 5044 wrote to memory of 1984	5044	Mljfbiea.exe	99
PID 5044 wrote to memory of 1984	5044	Mljfbiea.exe	99
PID 5044 wrote to memory of 1984	5044	Mljfbiea.exe	99
PID 1984 wrote to memory of 2136	1984	Mpebch32.exe	100
PID 1984 wrote to memory of 2136	1984	Mpebch32.exe	100
PID 1984 wrote to memory of 2136	1984	Mpebch32.exe	100
PID 2136 wrote to memory of 4020	2136	Mdqncffd.exe	101
PID 2136 wrote to memory of 4020	2136	Mdqncffd.exe	101
PID 2136 wrote to memory of 4020	2136	Mdqncffd.exe	101
PID 4020 wrote to memory of 2504	4020	Mccooc32.exe	102

C:\Users\Admin\AppData\Local\Temp\713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00.exe
"C:\Users\Admin\AppData\Local\Temp\713a2705788437e7c5fdf46a0b911f3f1f36215ade19188864c9180ed0952c00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\Lpicgihh.exe
  C:\Windows\system32\Lpicgihh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\Lfckdcoe.exe
    C:\Windows\system32\Lfckdcoe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\Lefkpq32.exe
      C:\Windows\system32\Lefkpq32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Windows\SysWOW64\Ldgkmhno.exe
        
        C:\Windows\system32\Ldgkmhno.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1104
      - C:\Windows\SysWOW64\Leihep32.exe
        
        C:\Windows\system32\Leihep32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Llbpbjlj.exe
        
        C:\Windows\system32\Llbpbjlj.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Lekekp32.exe
        
        C:\Windows\system32\Lekekp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Lmbmlmbl.exe
        
        C:\Windows\system32\Lmbmlmbl.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Ldlehg32.exe
        
        C:\Windows\system32\Ldlehg32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Memapppg.exe
        
        C:\Windows\system32\Memapppg.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Mmdiamqj.exe
        
        C:\Windows\system32\Mmdiamqj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\Mpcenhpn.exe
        
        C:\Windows\system32\Mpcenhpn.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Mdnang32.exe
        
        C:\Windows\system32\Mdnang32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Mcabjcoa.exe
        
        C:\Windows\system32\Mcabjcoa.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\Mepnfone.exe
        
        C:\Windows\system32\Mepnfone.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Mikjfn32.exe
        
        C:\Windows\system32\Mikjfn32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Mmgfgl32.exe
        
        C:\Windows\system32\Mmgfgl32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Mljfbiea.exe
        
        C:\Windows\system32\Mljfbiea.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Mpebch32.exe
        
        C:\Windows\system32\Mpebch32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Mdqncffd.exe
        
        C:\Windows\system32\Mdqncffd.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Mccooc32.exe
        
        C:\Windows\system32\Mccooc32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Mgokpbeh.exe
        
        C:\Windows\system32\Mgokpbeh.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Mebkko32.exe
        
        C:\Windows\system32\Mebkko32.exe
        24⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Minglmdk.exe
        
        C:\Windows\system32\Minglmdk.exe
        25⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Mmicll32.exe
        
        C:\Windows\system32\Mmicll32.exe
        26⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Mpgoig32.exe
        
        C:\Windows\system32\Mpgoig32.exe
        27⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Mdckifda.exe
        
        C:\Windows\system32\Mdckifda.exe
        28⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Mcfkec32.exe
        
        C:\Windows\system32\Mcfkec32.exe
        29⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Mgageace.exe
        
        C:\Windows\system32\Mgageace.exe
        30⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Medgan32.exe
        
        C:\Windows\system32\Medgan32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Mipcambi.exe
        
        C:\Windows\system32\Mipcambi.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\SysWOW64\Mmkpbl32.exe
        
        C:\Windows\system32\Mmkpbl32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Mlnpnh32.exe
        
        C:\Windows\system32\Mlnpnh32.exe
        34⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Mpjlngje.exe
        
        C:\Windows\system32\Mpjlngje.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Windows\SysWOW64\Mdehof32.exe
        
        C:\Windows\system32\Mdehof32.exe
        36⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Mchhjbii.exe
        
        C:\Windows\system32\Mchhjbii.exe
        37⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Megdfnhm.exe
        
        C:\Windows\system32\Megdfnhm.exe
        38⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Mibpgm32.exe
        
        C:\Windows\system32\Mibpgm32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3596
        
        C:\Windows\SysWOW64\Mnnlgkho.exe
        
        C:\Windows\system32\Mnnlgkho.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Mplhdghc.exe
        
        C:\Windows\system32\Mplhdghc.exe
        41⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Ndhdde32.exe
        
        C:\Windows\system32\Ndhdde32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Nckepbgf.exe
        
        C:\Windows\system32\Nckepbgf.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Ngfqqa32.exe
        
        C:\Windows\system32\Ngfqqa32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Neialnfj.exe
        
        C:\Windows\system32\Neialnfj.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3396
        
        C:\Windows\SysWOW64\Nidmml32.exe
        
        C:\Windows\system32\Nidmml32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Nlciih32.exe
        
        C:\Windows\system32\Nlciih32.exe
        47⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Npoeif32.exe
        
        C:\Windows\system32\Npoeif32.exe
        48⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Ndjajeni.exe
        
        C:\Windows\system32\Ndjajeni.exe
        49⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Nghmfqmm.exe
        
        C:\Windows\system32\Nghmfqmm.exe
        50⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Neknam32.exe
        
        C:\Windows\system32\Neknam32.exe
        51⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Nnbebk32.exe
        
        C:\Windows\system32\Nnbebk32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Windows\SysWOW64\Nlefngkd.exe
        
        C:\Windows\system32\Nlefngkd.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Npabof32.exe
        
        C:\Windows\system32\Npabof32.exe
        54⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Nconka32.exe
        
        C:\Windows\system32\Nconka32.exe
        55⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Ngkjlpkj.exe
        
        C:\Windows\system32\Ngkjlpkj.exe
        56⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Njifhljn.exe
        
        C:\Windows\system32\Njifhljn.exe
        57⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Nnebhj32.exe
        
        C:\Windows\system32\Nnebhj32.exe
        58⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Nlhbdgia.exe
        
        C:\Windows\system32\Nlhbdgia.exe
        59⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Npcodf32.exe
        
        C:\Windows\system32\Npcodf32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Windows\SysWOW64\Ncakqaqo.exe
        
        C:\Windows\system32\Ncakqaqo.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Ngmgap32.exe
        
        C:\Windows\system32\Ngmgap32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Njlcmk32.exe
        
        C:\Windows\system32\Njlcmk32.exe
        63⤵
        Executes dropped EXE
        
        PID:244
        
        C:\Windows\SysWOW64\Nngonjqd.exe
        
        C:\Windows\system32\Nngonjqd.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\Npekjeph.exe
        
        C:\Windows\system32\Npekjeph.exe
        65⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\Ndagjd32.exe
        
        C:\Windows\system32\Ndagjd32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1832
        
        C:\Windows\SysWOW64\Ncdgfaol.exe
        
        C:\Windows\system32\Ncdgfaol.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1000
        
        C:\Windows\SysWOW64\Nfbdblnp.exe
        
        C:\Windows\system32\Nfbdblnp.exe
        68⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Njnpck32.exe
        
        C:\Windows\system32\Njnpck32.exe
        69⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Nnilcjnb.exe
        
        C:\Windows\system32\Nnilcjnb.exe
        70⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Ophhpene.exe
        
        C:\Windows\system32\Ophhpene.exe
        71⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Ocfdlqmi.exe
        
        C:\Windows\system32\Ocfdlqmi.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Ogbploeb.exe
        
        C:\Windows\system32\Ogbploeb.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Ofeqhl32.exe
        
        C:\Windows\system32\Ofeqhl32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:976
        
        C:\Windows\SysWOW64\Onlhii32.exe
        
        C:\Windows\system32\Onlhii32.exe
        75⤵
        Drops file in System32 directory
        
        PID:4888
        
        C:\Windows\SysWOW64\Oloidfcj.exe
        
        C:\Windows\system32\Oloidfcj.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4216
        
        C:\Windows\SysWOW64\Opjeee32.exe
        
        C:\Windows\system32\Opjeee32.exe
        77⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Ociaap32.exe
        
        C:\Windows\system32\Ociaap32.exe
        78⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Ogdmaocp.exe
        
        C:\Windows\system32\Ogdmaocp.exe
        79⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Ofgmml32.exe
        
        C:\Windows\system32\Ofgmml32.exe
        80⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Onneoi32.exe
        
        C:\Windows\system32\Onneoi32.exe
        81⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Olaejfag.exe
        
        C:\Windows\system32\Olaejfag.exe
        82⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Odhmkcbi.exe
        
        C:\Windows\system32\Odhmkcbi.exe
        83⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Ockngp32.exe
        
        C:\Windows\system32\Ockngp32.exe
        84⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Ogfjgo32.exe
        
        C:\Windows\system32\Ogfjgo32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Windows\SysWOW64\Ojefcj32.exe
        
        C:\Windows\system32\Ojefcj32.exe
        86⤵
        
        PID:420
        
        C:\Windows\SysWOW64\Onqbdihj.exe
        
        C:\Windows\system32\Onqbdihj.exe
        87⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Oqonpdgn.exe
        
        C:\Windows\system32\Oqonpdgn.exe
        88⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Odjjqc32.exe
        
        C:\Windows\system32\Odjjqc32.exe
        89⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Ocmjlpfa.exe
        
        C:\Windows\system32\Ocmjlpfa.exe
        90⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Oflfhkee.exe
        
        C:\Windows\system32\Oflfhkee.exe
        91⤵
        Drops file in System32 directory
        
        PID:3608
        
        C:\Windows\SysWOW64\Ojgbij32.exe
        
        C:\Windows\system32\Ojgbij32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4520
        
        C:\Windows\SysWOW64\Olfoee32.exe
        
        C:\Windows\system32\Olfoee32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4152
        
        C:\Windows\SysWOW64\Oqakfdek.exe
        
        C:\Windows\system32\Oqakfdek.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1368
        
        C:\Windows\SysWOW64\Odmgfb32.exe
        
        C:\Windows\system32\Odmgfb32.exe
        95⤵
        Modifies registry class
        
        PID:3088
        
        C:\Windows\SysWOW64\Ogkcbn32.exe
        
        C:\Windows\system32\Ogkcbn32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\Ofncnkcb.exe
        
        C:\Windows\system32\Ofncnkcb.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Windows\SysWOW64\Ojjooilk.exe
        
        C:\Windows\system32\Ojjooilk.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Omhlkeko.exe
        
        C:\Windows\system32\Omhlkeko.exe
        99⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Pqcgkc32.exe
        
        C:\Windows\system32\Pqcgkc32.exe
        100⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Pcbdgo32.exe
        
        C:\Windows\system32\Pcbdgo32.exe
        101⤵
        Drops file in System32 directory
        
        PID:712
        
        C:\Windows\SysWOW64\Pgnphnke.exe
        
        C:\Windows\system32\Pgnphnke.exe
        102⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Pfqpcj32.exe
        
        C:\Windows\system32\Pfqpcj32.exe
        103⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Pnghdh32.exe
        
        C:\Windows\system32\Pnghdh32.exe
        104⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Pmjhpdil.exe
        
        C:\Windows\system32\Pmjhpdil.exe
        105⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Pqfdac32.exe
        
        C:\Windows\system32\Pqfdac32.exe
        106⤵
        Drops file in System32 directory
        
        PID:1764
        
        C:\Windows\SysWOW64\Pcdqmo32.exe
        
        C:\Windows\system32\Pcdqmo32.exe
        107⤵
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Pgplnmib.exe
        
        C:\Windows\system32\Pgplnmib.exe
        108⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Pgbicm32.exe
        
        C:\Windows\system32\Pgbicm32.exe
        109⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Pjqeoh32.exe
        
        C:\Windows\system32\Pjqeoh32.exe
        110⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Pnlapgnl.exe
        
        C:\Windows\system32\Pnlapgnl.exe
        111⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Pfgfdikg.exe
        
        C:\Windows\system32\Pfgfdikg.exe
        112⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Pqmjab32.exe
        
        C:\Windows\system32\Pqmjab32.exe
        113⤵
        
        PID:984
        
        C:\Windows\SysWOW64\Pckfnn32.exe
        
        C:\Windows\system32\Pckfnn32.exe
        114⤵
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\Pfjcji32.exe
        
        C:\Windows\system32\Pfjcji32.exe
        115⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Pjeojhbn.exe
        
        C:\Windows\system32\Pjeojhbn.exe
        116⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Qmdkfcaa.exe
        
        C:\Windows\system32\Qmdkfcaa.exe
        117⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Qdkcgqad.exe
        
        C:\Windows\system32\Qdkcgqad.exe
        118⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Qcnccm32.exe
        
        C:\Windows\system32\Qcnccm32.exe
        119⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Qcppimfl.exe
        
        C:\Windows\system32\Qcppimfl.exe
        120⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Qgllil32.exe
        
        C:\Windows\system32\Qgllil32.exe
        121⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Anedfffb.exe
        
        C:\Windows\system32\Anedfffb.exe
        122⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Aqdqbaee.exe
        
        C:\Windows\system32\Aqdqbaee.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Agniok32.exe
        
        C:\Windows\system32\Agniok32.exe
        124⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Anhaledo.exe
        
        C:\Windows\system32\Anhaledo.exe
        125⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Amkagb32.exe
        
        C:\Windows\system32\Amkagb32.exe
        126⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Aebihpkl.exe
        
        C:\Windows\system32\Aebihpkl.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Agpedkjp.exe
        
        C:\Windows\system32\Agpedkjp.exe
        128⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Aedfnoii.exe
        
        C:\Windows\system32\Aedfnoii.exe
        129⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Aefbcogf.exe
        
        C:\Windows\system32\Aefbcogf.exe
        130⤵
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Ambgha32.exe
        
        C:\Windows\system32\Ambgha32.exe
        131⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Aamchpmk.exe
        
        C:\Windows\system32\Aamchpmk.exe
        132⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Bappnpkh.exe
        
        C:\Windows\system32\Bappnpkh.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Bgjhkjbe.exe
        
        C:\Windows\system32\Bgjhkjbe.exe
        134⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Babmco32.exe
        
        C:\Windows\system32\Babmco32.exe
        135⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bglepipb.exe
        
        C:\Windows\system32\Bglepipb.exe
        136⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Bnfmmc32.exe
        
        C:\Windows\system32\Bnfmmc32.exe
        137⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Bccfej32.exe
        
        C:\Windows\system32\Bccfej32.exe
        138⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Bmkjnp32.exe
        
        C:\Windows\system32\Bmkjnp32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Windows\SysWOW64\Bfcogecg.exe
        
        C:\Windows\system32\Bfcogecg.exe
        140⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Bnkfhcdj.exe
        
        C:\Windows\system32\Bnkfhcdj.exe
        141⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Bmngcp32.exe
        
        C:\Windows\system32\Bmngcp32.exe
        142⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Bcgopjba.exe
        
        C:\Windows\system32\Bcgopjba.exe
        143⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Cmpcioha.exe
        
        C:\Windows\system32\Cmpcioha.exe
        144⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ccjlfi32.exe
        
        C:\Windows\system32\Ccjlfi32.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\Chehfhhh.exe
        
        C:\Windows\system32\Chehfhhh.exe
        146⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Cmbpoofo.exe
        
        C:\Windows\system32\Cmbpoofo.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Chhdlhfe.exe
        
        C:\Windows\system32\Chhdlhfe.exe
        148⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Cnamib32.exe
        
        C:\Windows\system32\Cnamib32.exe
        149⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Cdoeaili.exe
        
        C:\Windows\system32\Cdoeaili.exe
        150⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Chjaag32.exe
        
        C:\Windows\system32\Chjaag32.exe
        151⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Cndinalo.exe
        
        C:\Windows\system32\Cndinalo.exe
        152⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Cdabfhjf.exe
        
        C:\Windows\system32\Cdabfhjf.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\Cfonbdij.exe
        
        C:\Windows\system32\Cfonbdij.exe
        154⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Dhokmgpm.exe
        
        C:\Windows\system32\Dhokmgpm.exe
        155⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Dagoel32.exe
        
        C:\Windows\system32\Dagoel32.exe
        156⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Dokpoq32.exe
        
        C:\Windows\system32\Dokpoq32.exe
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Ddhhggdo.exe
        
        C:\Windows\system32\Ddhhggdo.exe
        158⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Dmpmpm32.exe
        
        C:\Windows\system32\Dmpmpm32.exe
        159⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Ddjemgal.exe
        
        C:\Windows\system32\Ddjemgal.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Dmbiem32.exe
        
        C:\Windows\system32\Dmbiem32.exe
        161⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ddmabgpi.exe
        
        C:\Windows\system32\Ddmabgpi.exe
        162⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Dgknnb32.exe
        
        C:\Windows\system32\Dgknnb32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Dkfjoagf.exe
        
        C:\Windows\system32\Dkfjoagf.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Dobfpp32.exe
        
        C:\Windows\system32\Dobfpp32.exe
        165⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Daqblk32.exe
        
        C:\Windows\system32\Daqblk32.exe
        166⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Delnljgl.exe
        
        C:\Windows\system32\Delnljgl.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Egmjdb32.exe
        
        C:\Windows\system32\Egmjdb32.exe
        168⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Emgbqldg.exe
        
        C:\Windows\system32\Emgbqldg.exe
        169⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ehmgne32.exe
        
        C:\Windows\system32\Ehmgne32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Eknppp32.exe
        
        C:\Windows\system32\Eknppp32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Emlllk32.exe
        
        C:\Windows\system32\Emlllk32.exe
        172⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Edfdhego.exe
        
        C:\Windows\system32\Edfdhego.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Egdqdagb.exe
        
        C:\Windows\system32\Egdqdagb.exe
        174⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Eajebj32.exe
        
        C:\Windows\system32\Eajebj32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Edhane32.exe
        
        C:\Windows\system32\Edhane32.exe
        176⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ekbikomi.exe
        
        C:\Windows\system32\Ekbikomi.exe
        177⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Emqegkll.exe
        
        C:\Windows\system32\Emqegkll.exe
        178⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Fgijpp32.exe
        
        C:\Windows\system32\Fgijpp32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Fopbqnco.exe
        
        C:\Windows\system32\Fopbqnco.exe
        180⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Fncblj32.exe
        
        C:\Windows\system32\Fncblj32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Fneobj32.exe
        
        C:\Windows\system32\Fneobj32.exe
        182⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Fgpppo32.exe
        
        C:\Windows\system32\Fgpppo32.exe
        183⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Fhpmjbch.exe
        
        C:\Windows\system32\Fhpmjbch.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Foiegl32.exe
        
        C:\Windows\system32\Foiegl32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Fahachjh.exe
        
        C:\Windows\system32\Fahachjh.exe
        186⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Gdfmocil.exe
        
        C:\Windows\system32\Gdfmocil.exe
        187⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Gonnblgo.exe
        
        C:\Windows\system32\Gonnblgo.exe
        188⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Gkglmlkq.exe
        
        C:\Windows\system32\Gkglmlkq.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Gnfhihjd.exe
        
        C:\Windows\system32\Gnfhihjd.exe
        190⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Gaadif32.exe
        
        C:\Windows\system32\Gaadif32.exe
        191⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Gfmpjejf.exe
        
        C:\Windows\system32\Gfmpjejf.exe
        192⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Ghklfq32.exe
        
        C:\Windows\system32\Ghklfq32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Ggnlampe.exe
        
        C:\Windows\system32\Ggnlampe.exe
        194⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Gkjhbl32.exe
        
        C:\Windows\system32\Gkjhbl32.exe
        195⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Hfompd32.exe
        
        C:\Windows\system32\Hfompd32.exe
        196⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Hdbmkaoo.exe
        
        C:\Windows\system32\Hdbmkaoo.exe
        197⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Hhnilp32.exe
        
        C:\Windows\system32\Hhnilp32.exe
        198⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Hklehl32.exe
        
        C:\Windows\system32\Hklehl32.exe
        199⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Hohahjod.exe
        
        C:\Windows\system32\Hohahjod.exe
        200⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Hbfmdfnh.exe
        
        C:\Windows\system32\Hbfmdfnh.exe
        201⤵
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Hfaied32.exe
        
        C:\Windows\system32\Hfaied32.exe
        202⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Hddiqaml.exe
        
        C:\Windows\system32\Hddiqaml.exe
        203⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Hgcfmm32.exe
        
        C:\Windows\system32\Hgcfmm32.exe
        204⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Hknamkdi.exe
        
        C:\Windows\system32\Hknamkdi.exe
        205⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Hojnnj32.exe
        
        C:\Windows\system32\Hojnnj32.exe
        206⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Hbhjje32.exe
        
        C:\Windows\system32\Hbhjje32.exe
        207⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Hkqockbf.exe
        
        C:\Windows\system32\Hkqockbf.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Hbkgpe32.exe
        
        C:\Windows\system32\Hbkgpe32.exe
        209⤵
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Hbmcedhp.exe
        
        C:\Windows\system32\Hbmcedhp.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\Inddje32.exe
        
        C:\Windows\system32\Inddje32.exe
        211⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Idnlgpea.exe
        
        C:\Windows\system32\Idnlgpea.exe
        212⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Idpilp32.exe
        
        C:\Windows\system32\Idpilp32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Ibdifc32.exe
        
        C:\Windows\system32\Ibdifc32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Inkjkd32.exe
        
        C:\Windows\system32\Inkjkd32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Ifbblb32.exe
        
        C:\Windows\system32\Ifbblb32.exe
        216⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Iipohm32.exe
        
        C:\Windows\system32\Iipohm32.exe
        217⤵
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Igekijlj.exe
        
        C:\Windows\system32\Igekijlj.exe
        218⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Jeilbn32.exe
        
        C:\Windows\system32\Jeilbn32.exe
        219⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jkcdohbq.exe
        
        C:\Windows\system32\Jkcdohbq.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Jbmllb32.exe
        
        C:\Windows\system32\Jbmllb32.exe
        221⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Jelihn32.exe
        
        C:\Windows\system32\Jelihn32.exe
        222⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Jgjedi32.exe
        
        C:\Windows\system32\Jgjedi32.exe
        223⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Jndmacoa.exe
        
        C:\Windows\system32\Jndmacoa.exe
        224⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Jbpiab32.exe
        
        C:\Windows\system32\Jbpiab32.exe
        225⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Jfkebq32.exe
        
        C:\Windows\system32\Jfkebq32.exe
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
        
        C:\Windows\SysWOW64\Jgmajifb.exe
        
        C:\Windows\system32\Jgmajifb.exe
        227⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jkhnjg32.exe
        
        C:\Windows\system32\Jkhnjg32.exe
        228⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Jnfjfc32.exe
        
        C:\Windows\system32\Jnfjfc32.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Jeqbcmel.exe
        
        C:\Windows\system32\Jeqbcmel.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Jilndl32.exe
        
        C:\Windows\system32\Jilndl32.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Windows\SysWOW64\Jkjjpg32.exe
        
        C:\Windows\system32\Jkjjpg32.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Jniflb32.exe
        
        C:\Windows\system32\Jniflb32.exe
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Windows\SysWOW64\Jecoimci.exe
        
        C:\Windows\system32\Jecoimci.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Jgakeh32.exe
        
        C:\Windows\system32\Jgakeh32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Kphcfe32.exe
        
        C:\Windows\system32\Kphcfe32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Kbgoba32.exe
        
        C:\Windows\system32\Kbgoba32.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Kfbkbpjl.exe
        
        C:\Windows\system32\Kfbkbpjl.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Klockfhc.exe
        
        C:\Windows\system32\Klockfhc.exe
        239⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Kpkple32.exe
        
        C:\Windows\system32\Kpkple32.exe
        240⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Kbilhq32.exe
        
        C:\Windows\system32\Kbilhq32.exe
        241⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Kicddk32.exe
        
        C:\Windows\system32\Kicddk32.exe
        242⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Kpmlaenj.exe
        
        C:\Windows\system32\Kpmlaenj.exe
        243⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Kfgdno32.exe
        
        C:\Windows\system32\Kfgdno32.exe
        244⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Kejeilma.exe
        
        C:\Windows\system32\Kejeilma.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7660
        
        C:\Windows\SysWOW64\Kldmff32.exe
        
        C:\Windows\system32\Kldmff32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7700
        
        C:\Windows\SysWOW64\Knbiba32.exe
        
        C:\Windows\system32\Knbiba32.exe
        247⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Kfiaco32.exe
        
        C:\Windows\system32\Kfiaco32.exe
        248⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Khknkgjb.exe
        
        C:\Windows\system32\Khknkgjb.exe
        249⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Klfjlebk.exe
        
        C:\Windows\system32\Klfjlebk.exe
        250⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Kpbfld32.exe
        
        C:\Windows\system32\Kpbfld32.exe
        251⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Kflninba.exe
        
        C:\Windows\system32\Kflninba.exe
        252⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Kijjejae.exe
        
        C:\Windows\system32\Kijjejae.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7972
        
        C:\Windows\SysWOW64\Lpdbbd32.exe
        
        C:\Windows\system32\Lpdbbd32.exe
        254⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Lngcmqol.exe
        
        C:\Windows\system32\Lngcmqol.exe
        255⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Leakjk32.exe
        
        C:\Windows\system32\Leakjk32.exe
        256⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Llkcgenf.exe
        
        C:\Windows\system32\Llkcgenf.exe
        257⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8132
        
        C:\Windows\SysWOW64\Lpfogcfo.exe
        
        C:\Windows\system32\Lpfogcfo.exe
        258⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Lfqgdn32.exe
        
        C:\Windows\system32\Lfqgdn32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7192
        
        C:\Windows\SysWOW64\Liocpi32.exe
        
        C:\Windows\system32\Liocpi32.exe
        260⤵
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Llmpld32.exe
        
        C:\Windows\system32\Llmpld32.exe
        261⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Lnllhp32.exe
        
        C:\Windows\system32\Lnllhp32.exe
        262⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Lfcdjm32.exe
        
        C:\Windows\system32\Lfcdjm32.exe
        263⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Lhdqaeag.exe
        
        C:\Windows\system32\Lhdqaeag.exe
        264⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Lpkibcbj.exe
        
        C:\Windows\system32\Lpkibcbj.exe
        265⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Lbieon32.exe
        
        C:\Windows\system32\Lbieon32.exe
        266⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Lehakj32.exe
        
        C:\Windows\system32\Lehakj32.exe
        267⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Lhfmge32.exe
        
        C:\Windows\system32\Lhfmge32.exe
        268⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Llbigdhn.exe
        
        C:\Windows\system32\Llbigdhn.exe
        269⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Lpnehb32.exe
        
        C:\Windows\system32\Lpnehb32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Lejnpi32.exe
        
        C:\Windows\system32\Lejnpi32.exe
        271⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Mldfmcfk.exe
        
        C:\Windows\system32\Mldfmcfk.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Mobbioeo.exe
        
        C:\Windows\system32\Mobbioeo.exe
        273⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Mfjjjl32.exe
        
        C:\Windows\system32\Mfjjjl32.exe
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
        
        C:\Windows\SysWOW64\Mhkgbdlp.exe
        
        C:\Windows\system32\Mhkgbdlp.exe
        275⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Mpbocblb.exe
        
        C:\Windows\system32\Mpbocblb.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Mflgpl32.exe
        
        C:\Windows\system32\Mflgpl32.exe
        277⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Mikclg32.exe
        
        C:\Windows\system32\Mikclg32.exe
        278⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Mpdkiajo.exe
        
        C:\Windows\system32\Mpdkiajo.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8100
        
        C:\Windows\SysWOW64\Mogldn32.exe
        
        C:\Windows\system32\Mogldn32.exe
        280⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Meadah32.exe
        
        C:\Windows\system32\Meadah32.exe
        281⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Mhppmd32.exe
        
        C:\Windows\system32\Mhppmd32.exe
        282⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Mpghna32.exe
        
        C:\Windows\system32\Mpghna32.exe
        283⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Mfapkkpi.exe
        
        C:\Windows\system32\Mfapkkpi.exe
        284⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Miomggom.exe
        
        C:\Windows\system32\Miomggom.exe
        285⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Windows\SysWOW64\Mhbmbc32.exe
        
        C:\Windows\system32\Mhbmbc32.exe
        286⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7396
        
        C:\Windows\SysWOW64\Moleonmd.exe
        
        C:\Windows\system32\Moleonmd.exe
        287⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Mefmlh32.exe
        
        C:\Windows\system32\Mefmlh32.exe
        288⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Niaimf32.exe
        
        C:\Windows\system32\Niaimf32.exe
        289⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Nlpeib32.exe
        
        C:\Windows\system32\Nlpeib32.exe
        290⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Nonbem32.exe
        
        C:\Windows\system32\Nonbem32.exe
        291⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Nehjagbo.exe
        
        C:\Windows\system32\Nehjagbo.exe
        292⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Nidfbf32.exe
        
        C:\Windows\system32\Nidfbf32.exe
        293⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\Npnnopbd.exe
        
        C:\Windows\system32\Npnnopbd.exe
        294⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Nbljklah.exe
        
        C:\Windows\system32\Nbljklah.exe
        295⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Nekgggpl.exe
        
        C:\Windows\system32\Nekgggpl.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8244
        
        C:\Windows\SysWOW64\Nhiccb32.exe
        
        C:\Windows\system32\Nhiccb32.exe
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:8288
        
        C:\Windows\SysWOW64\Nppkdp32.exe
        
        C:\Windows\system32\Nppkdp32.exe
        298⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Ngjcajgo.exe
        
        C:\Windows\system32\Ngjcajgo.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Niipmefb.exe
        
        C:\Windows\system32\Niipmefb.exe
        300⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Nlgliaef.exe
        
        C:\Windows\system32\Nlgliaef.exe
        301⤵
        Drops file in System32 directory
        
        PID:8444
        
        C:\Windows\SysWOW64\Noehelej.exe
        
        C:\Windows\system32\Noehelej.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8484
        
        C:\Windows\SysWOW64\Ngmpgjel.exe
        
        C:\Windows\system32\Ngmpgjel.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8516
        
        C:\Windows\SysWOW64\Nhnlnb32.exe
        
        C:\Windows\system32\Nhnlnb32.exe
        304⤵
        System Location Discovery: System Language Discovery
        
        PID:8560
        
        C:\Windows\SysWOW64\Nlihoq32.exe
        
        C:\Windows\system32\Nlihoq32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Nohdkl32.exe
        
        C:\Windows\system32\Nohdkl32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Neamhfjd.exe
        
        C:\Windows\system32\Neamhfjd.exe
        307⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Oimihe32.exe
        
        C:\Windows\system32\Oimihe32.exe
        308⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Olledp32.exe
        
        C:\Windows\system32\Olledp32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8748
        
        C:\Windows\SysWOW64\Ocfmajin.exe
        
        C:\Windows\system32\Ocfmajin.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8792
        
        C:\Windows\SysWOW64\Oedjmfha.exe
        
        C:\Windows\system32\Oedjmfha.exe
        311⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Oipend32.exe
        
        C:\Windows\system32\Oipend32.exe
        312⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Opjnko32.exe
        
        C:\Windows\system32\Opjnko32.exe
        313⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Ochjgj32.exe
        
        C:\Windows\system32\Ochjgj32.exe
        314⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Oeffce32.exe
        
        C:\Windows\system32\Oeffce32.exe
        315⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Oheboa32.exe
        
        C:\Windows\system32\Oheboa32.exe
        316⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Opljpn32.exe
        
        C:\Windows\system32\Opljpn32.exe
        317⤵
        Drops file in System32 directory
        
        PID:9056
        
        C:\Windows\SysWOW64\Ocjglj32.exe
        
        C:\Windows\system32\Ocjglj32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Oeiche32.exe
        
        C:\Windows\system32\Oeiche32.exe
        319⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Olbkeoki.exe
        
        C:\Windows\system32\Olbkeoki.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:9164
        
        C:\Windows\SysWOW64\Opngfn32.exe
        
        C:\Windows\system32\Opngfn32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Oghpbh32.exe
        
        C:\Windows\system32\Oghpbh32.exe
        322⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ojgloc32.exe
        
        C:\Windows\system32\Ojgloc32.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
        
        C:\Windows\SysWOW64\Ohiljpam.exe
        
        C:\Windows\system32\Ohiljpam.exe
        324⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Oocdgj32.exe
        
        C:\Windows\system32\Oocdgj32.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
        
        C:\Windows\SysWOW64\Ogklhh32.exe
        
        C:\Windows\system32\Ogklhh32.exe
        326⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Pjihdc32.exe
        
        C:\Windows\system32\Pjihdc32.exe
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
        
        C:\Windows\SysWOW64\Plgdpo32.exe
        
        C:\Windows\system32\Plgdpo32.exe
        328⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Pofalj32.exe
        
        C:\Windows\system32\Pofalj32.exe
        329⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Pgminggi.exe
        
        C:\Windows\system32\Pgminggi.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8708
        
        C:\Windows\SysWOW64\Phneep32.exe
        
        C:\Windows\system32\Phneep32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Ppemfm32.exe
        
        C:\Windows\system32\Ppemfm32.exe
        332⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Pcdjbh32.exe
        
        C:\Windows\system32\Pcdjbh32.exe
        333⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Pfbfod32.exe
        
        C:\Windows\system32\Pfbfod32.exe
        334⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Phqbko32.exe
        
        C:\Windows\system32\Phqbko32.exe
        335⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Pphjlm32.exe
        
        C:\Windows\system32\Pphjlm32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Pcffhh32.exe
        
        C:\Windows\system32\Pcffhh32.exe
        337⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Pfdbdcjo.exe
        
        C:\Windows\system32\Pfdbdcjo.exe
        338⤵
        Drops file in System32 directory
        
        PID:8220
        
        C:\Windows\SysWOW64\Plnkan32.exe
        
        C:\Windows\system32\Plnkan32.exe
        339⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Pomgmi32.exe
        
        C:\Windows\system32\Pomgmi32.exe
        340⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Pgdonf32.exe
        
        C:\Windows\system32\Pgdonf32.exe
        341⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Pfgojchl.exe
        
        C:\Windows\system32\Pfgojchl.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:8660
        
        C:\Windows\SysWOW64\Plagfm32.exe
        
        C:\Windows\system32\Plagfm32.exe
        343⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Pckpcgge.exe
        
        C:\Windows\system32\Pckpcgge.exe
        344⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Qgfldf32.exe
        
        C:\Windows\system32\Qgfldf32.exe
        345⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Qhghkn32.exe
        
        C:\Windows\system32\Qhghkn32.exe
        346⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Qqopml32.exe
        
        C:\Windows\system32\Qqopml32.exe
        347⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Qcmlig32.exe
        
        C:\Windows\system32\Qcmlig32.exe
        348⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Qfkieb32.exe
        
        C:\Windows\system32\Qfkieb32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Qhjean32.exe
        
        C:\Windows\system32\Qhjean32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8828
        
        C:\Windows\SysWOW64\Qodmnhjg.exe
        
        C:\Windows\system32\Qodmnhjg.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Agkeoeki.exe
        
        C:\Windows\system32\Agkeoeki.exe
        352⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Afnejb32.exe
        
        C:\Windows\system32\Afnejb32.exe
        353⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ahlafnag.exe
        
        C:\Windows\system32\Ahlafnag.exe
        354⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Aofjch32.exe
        
        C:\Windows\system32\Aofjch32.exe
        355⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Agmbde32.exe
        
        C:\Windows\system32\Agmbde32.exe
        356⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Ahonlmoe.exe
        
        C:\Windows\system32\Ahonlmoe.exe
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:9224
        
        C:\Windows\SysWOW64\Amjjml32.exe
        
        C:\Windows\system32\Amjjml32.exe
        358⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
        
        C:\Windows\SysWOW64\Aqffmkpg.exe
        
        C:\Windows\system32\Aqffmkpg.exe
        359⤵
        Modifies registry class
        
        PID:9352
        
        C:\Windows\SysWOW64\Agpoje32.exe
        
        C:\Windows\system32\Agpoje32.exe
        360⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Afboeano.exe
        
        C:\Windows\system32\Afboeano.exe
        361⤵
        Drops file in System32 directory
        
        PID:9460
        
        C:\Windows\SysWOW64\Ajnkfp32.exe
        
        C:\Windows\system32\Ajnkfp32.exe
        362⤵
        Drops file in System32 directory
        
        PID:9504
        
        C:\Windows\SysWOW64\Aiakammb.exe
        
        C:\Windows\system32\Aiakammb.exe
        363⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Aqhccj32.exe
        
        C:\Windows\system32\Aqhccj32.exe
        364⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Agbkpdea.exe
        
        C:\Windows\system32\Agbkpdea.exe
        365⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Aichgm32.exe
        
        C:\Windows\system32\Aichgm32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9672
        
        C:\Windows\SysWOW64\Ajcdapbb.exe
        
        C:\Windows\system32\Ajcdapbb.exe
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:9708
        
        C:\Windows\SysWOW64\Amaqmkaf.exe
        
        C:\Windows\system32\Amaqmkaf.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9744
        
        C:\Windows\SysWOW64\Bckijehc.exe
        
        C:\Windows\system32\Bckijehc.exe
        369⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Bfiefqhf.exe
        
        C:\Windows\system32\Bfiefqhf.exe
        370⤵
        Modifies registry class
        
        PID:9816
        
        C:\Windows\SysWOW64\Bihablgj.exe
        
        C:\Windows\system32\Bihablgj.exe
        371⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Bqoicigl.exe
        
        C:\Windows\system32\Bqoicigl.exe
        372⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Bgiapc32.exe
        
        C:\Windows\system32\Bgiapc32.exe
        373⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9924
        
        C:\Windows\SysWOW64\Bjgnlo32.exe
        
        C:\Windows\system32\Bjgnlo32.exe
        374⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bmfjhj32.exe
        
        C:\Windows\system32\Bmfjhj32.exe
        375⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Bodfdfld.exe
        
        C:\Windows\system32\Bodfdfld.exe
        376⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Bgknfcmf.exe
        
        C:\Windows\system32\Bgknfcmf.exe
        377⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Bjjjbolj.exe
        
        C:\Windows\system32\Bjjjbolj.exe
        378⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Bmhfnjkn.exe
        
        C:\Windows\system32\Bmhfnjkn.exe
        379⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Bpfcjeja.exe
        
        C:\Windows\system32\Bpfcjeja.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
        
        C:\Windows\SysWOW64\Bgnkkckd.exe
        
        C:\Windows\system32\Bgnkkckd.exe
        381⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10212
        
        C:\Windows\SysWOW64\Biogck32.exe
        
        C:\Windows\system32\Biogck32.exe
        382⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Bqfodh32.exe
        
        C:\Windows\system32\Bqfodh32.exe
        383⤵
        Modifies registry class
        
        PID:9332
        
        C:\Windows\SysWOW64\Bcdkpdph.exe
        
        C:\Windows\system32\Bcdkpdph.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Bfchlopl.exe
        
        C:\Windows\system32\Bfchlopl.exe
        385⤵
        Drops file in System32 directory
        
        PID:9492
        
        C:\Windows\SysWOW64\Biadhkop.exe
        
        C:\Windows\system32\Biadhkop.exe
        386⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Cqhljhob.exe
        
        C:\Windows\system32\Cqhljhob.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Ccghfcne.exe
        
        C:\Windows\system32\Ccghfcne.exe
        388⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Cfedbomi.exe
        
        C:\Windows\system32\Cfedbomi.exe
        389⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Cicqnjmm.exe
        
        C:\Windows\system32\Cicqnjmm.exe
        390⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Cakiohmo.exe
        
        C:\Windows\system32\Cakiohmo.exe
        391⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9916 -s 408
        392⤵
        Program crash
        
        PID:10052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 9916 -ip 9916
1⤵
PID:9992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aamchpmk.exe

Filesize
163KB

MD5
d9db6856392215a2ddd2333f8ed55217

SHA1
c3bd44323fc96addc291df07fe354dcbc3e4f5ed

SHA256
0738aee0de95e984428652a74c65e83c9c0b30712b86f7adc53ebad6fdfa7f1e

SHA512
296fcfca002edd4b9e61efd2abf13f7a5e0baa8ad1a7af069f983ccfe420c24f1c154a991a25b99dce8af7cc4dcf5e472703f73b49f45c8fe50f305ea61bb064

Download Submit
C:\Windows\SysWOW64\Aefbcogf.exe

Filesize
163KB

MD5
f23b2609b9e3c8bb9386873ea63f5247

SHA1
5d19a1b47470e058e4df9e24c89cdedb8a67bd8f

SHA256
6138d6e3aa2fbdf81d1dfc0ebc8dfa07d277a46cb98e647fafc174475af15d2e

SHA512
62f00189d6fde9169fdb44d5589df4fa9182a96daf8267e33eac610c2b5ce352381b4f7bce834fddc3278aea5565bc9cac3f8eb18d573e3fa34d8a29093e83d6

Download Submit
C:\Windows\SysWOW64\Agmbde32.exe

Filesize
163KB

MD5
72ce893119cd05aaad50775cb4f55fcd

SHA1
6e7346bd101069ddbd7b7b2578968d243b32fe8d

SHA256
c351041391e3855f7327afddd47b767e558cb81c91c633a288d98450e38f3690

SHA512
6394f198d101d58cc1322091890c778a9186f76ec4d072cf1bea9cf3c9a4817ad5fecb45982d97ac2a06038d62950680ebafc66492433ffbcf4e47358f72b054

Download Submit
C:\Windows\SysWOW64\Agniok32.exe

Filesize
163KB

MD5
d0065ca4f9490e4db56cfbf55f852009

SHA1
0845996fdf8fa42aa6ddd5e62c3e43c366e03fba

SHA256
35bf2cc9b5ec71982018c707b04d034cf66ecee1a4220168feac3325abad07ce

SHA512
00eda7ec460277beb8475ee5fe8c07d2262996304cf4498a0b448237c408badf851d4aa1c7e0150d712f3385d3fd741c629bbe84b5240385f0bd47270f67c4e2

Download Submit
C:\Windows\SysWOW64\Ajcdapbb.exe

Filesize
163KB

MD5
8338ceff8481ce3a170f19db3899cce9

SHA1
8ee439c45151923ed911c5e8851ee759c1b896cf

SHA256
e43aba2b83b3129b2ecc298c9a4102bba0c995382f4cd86573b631b342e26e35

SHA512
d262e4287f6d66d18be02f18cb8b726746b8ed6ffc694a8cba9621624ae27ff5db0b0547314fe7a95d896f0c4f968d0b8f9d8e327a21e2237987856281d6386d

Download Submit
C:\Windows\SysWOW64\Aqffmkpg.exe

Filesize
128KB

MD5
35f85915c04dde9a083fbb2ba77ac66a

SHA1
c6e06ad3f44d5bc9ff2c71d3f522ba342a492d62

SHA256
553b2d72fb8002f4e2dd08a7d4d5756088a92ba87b04dfb1b0bbe2a52b521fbd

SHA512
c76a32493aef8cb2d6b38a13fcdbe686b0474fbfc119a7eb552a82cce0878ead3a1284435b69e5328229df531759f9e11de026c1bd4af81f16f569289a2203bf

Download Submit
C:\Windows\SysWOW64\Bccfej32.exe

Filesize
163KB

MD5
01daf09c4ab96f04dd4f93caa6137220

SHA1
b1968149010fc11820fbc1ade7d89a5c1bfc5ddf

SHA256
b7d3a5ff7bc5839e3a9e517a68f79cbad4dd0aef37d409075be93ecf0acf46c2

SHA512
f9bb1e2dc4cb564e52574158440d2b456d8fa7d8821e0630630eeea6a56c900ed920ba668935c0dda65d4d0c1bed7b798fdd952323a3e3c1ca5982dbd60ab31b

Download Submit
C:\Windows\SysWOW64\Bglepipb.exe

Filesize
163KB

MD5
546fd4947accf919be3afe06cb97a9c3

SHA1
6c420b1a846e607efac2bfba9c20ab089c387344

SHA256
99b27979872f22af23e78d66e8a62c48540ffdd5a982e6d1d80f502f32e92810

SHA512
bb802bb0a9b8d044abecc62751988e7db3ef6d2d524d4ff187148655e2f1b977a38f759e315650311675512a6c5f345b31225001349498191c315626510f1067

Download Submit
C:\Windows\SysWOW64\Bgnkkckd.exe

Filesize
163KB

MD5
9a9347ecc12528ff2f138df3501799ef

SHA1
cf8f11fb0e97fe9da516df900826e170c93db4b5

SHA256
f5565165d263a48842321e8344956b4f2db8aebd87621daafe48ed6c4042d078

SHA512
92a641152ff5a4542e92a9f73451673568685c97e1b1f53c6ea11c41c0c734e1b62b92d115af80f763ac92a62f639d1bd06f7cf0b20c00fdd2e35eabd1e5a9c9

Download Submit
C:\Windows\SysWOW64\Bihablgj.exe

Filesize
163KB

MD5
4522b4aa8e74250ae433863d14232c76

SHA1
1f9585c7d0dc02d130520aa87372ee54e81acec0

SHA256
55078c7d4e48932790e5731f99be8a394be09312b6126acb8a8e36168767bdc9

SHA512
08d0465a2a1599d77a54ee11e2a9c6b369a3b1f4640a5ff5eb0a0e3a17e43dc18e70a5c366b611be0f7011147731ae900d1dba50b31087df76d0a1385eeb902e

Download Submit
C:\Windows\SysWOW64\Bjgnlo32.exe

Filesize
163KB

MD5
8069b3e0754da74bac6489b5f7bef6cd

SHA1
0c59e84680eeabb1a435e8382751585c722e105a

SHA256
301e43752ff8950d4bc2acb51819621a93d63cf8a0057bacfecd8de523093c22

SHA512
613789bf792f71e95bcc1655f1140c79b064b3e4f55e0bea58ce86f747fb8378d87ab85291206f95e9021e000b9144fb4c5ddce4661f98bfd077a56910f6ca7e

Download Submit
C:\Windows\SysWOW64\Bmhfnjkn.exe

Filesize
163KB

MD5
b391c9203ec73174035d34e87e882e0e

SHA1
44e9ddc526108da31f1394870582650876cfa2c3

SHA256
a491784da3fffa94165bedd332f6d17f0ed1850a52353ff50895619d54ac508a

SHA512
dee8a1957e16b64a5f5bc50f202fc0e4cc23eba8e12393320d9d7c8897ec4963d880c7a6ed61bed3fe4ca8a8efdd8d1d417fa74791e1cf0d165ac07217590310

Download Submit
C:\Windows\SysWOW64\Chjaag32.exe

Filesize
163KB

MD5
e78a5c686d994b9c7607ddc9ad086bd8

SHA1
2220a10d2a7d38d2b4700efade47fd4bee2c2577

SHA256
563aee9a876173035d34e26ffe85b6b648ea0f5a6ba3e6bb4a39d5477dc4331e

SHA512
de0a7fae3b29b5fb394b26f3b136a1c762af53e98d903c421f82fb41a2bf91fab4d4a642416f07199cb3f80608844760d2e0c1973e8968ea1230eb3b52eb7a30

Download Submit
C:\Windows\SysWOW64\Cicqnjmm.exe

Filesize
163KB

MD5
5e8cc253a8079c5a9c4ecce5f62a28a4

SHA1
c5d3d7cfa4bd43856d90865c6acda71b9ac4be28

SHA256
c01f4af3e69a66078d717ec34ea35598dd5b1bfb4faf3e1a25d79c23bfa0fdf0

SHA512
4eb0579f85f607d1206d7f4fc44455a33258bb974811e7ee8fad1672b86558c6c8913b436cacbe6fbdb10dd4296c1e626415fa999621e3390b560c36061b0bd9

Download Submit
C:\Windows\SysWOW64\Cmpcioha.exe

Filesize
163KB

MD5
e5b0083fb1eb8fb1ba23bec92808934a

SHA1
bb0be2fea9a58ba001f1e6e8e2e0324d6a5130e7

SHA256
e71e73cb26e8f219ac94af291ce40ccda2b6c91b2f51a34e66009b1347c6c1be

SHA512
d39b298080e527cdde3cedfe2ea057327daefbe4fceedb7ec137bd85912b3305cecb470e3e4c4369ca47696d10566fdb9f1cb7fb7ed0c946a6fec84c7282204c

Download Submit
C:\Windows\SysWOW64\Cnamib32.exe

Filesize
163KB

MD5
d9e4598e7617a006d4086049d6885d75

SHA1
1093c33b9add89531c427b1e5e7cd27846020f38

SHA256
19ad2dd61f44a849c2f2687e755d9f5d69098d6d5ef93c0b180197b7c3fede63

SHA512
951ec339b29b13a9d9a1f26a4f8d27d0b43d901548c7ecd9ae2c0252b6b9b7b92d175efb7029035b338c1784b647bd1a03992b8400d3055b23b1fb5df9057c87

Download Submit
C:\Windows\SysWOW64\Cqhljhob.exe

Filesize
163KB

MD5
81e2107c1aa53862b37965e5f99ee010

SHA1
14164f3f608e3c173b17b1f54b6133d356b4507a

SHA256
f8996cadc4616b68808dc44ec683e3b6af5b5b906a9ef6ba7e184ea8b1aabcaf

SHA512
e8e8791744f0134e8a2e08a25c4b0289831d1e099d291a1b037e564315ff1e63218fd8d2e59b682315e03345e4d5d753a8be3d693f68a4578bf414b760a8b433

Download Submit
C:\Windows\SysWOW64\Ddhhggdo.exe

Filesize
163KB

MD5
279ddb9d943da505a7666f69cefc0af5

SHA1
938c26b4dc4de4c79efeea0b295ff28007ea88a2

SHA256
6292b79de182c7e8cfcedcccacae5b2df86c2c6f2c5b592aab006042f3f4cdd2

SHA512
e7f884d9439c2336ad86955c820d73bbbe9439985904f84df82015c16c2fd710f79aaf33ba88dd476db43b9232ee518934a981b7014b74046c251e4764d6d47d

Download Submit
C:\Windows\SysWOW64\Dmpmpm32.exe

Filesize
163KB

MD5
95bbe3f9d7b55b6887e7bd50a870fd06

SHA1
fcd07a6829358cbe4007e7cac6449b6f6ce15701

SHA256
0e5077e29c6b88d88e8d75e5bdb01f0c28a1dd21ff2d3d0a232ff2cc06f42dab

SHA512
96a86e09413088813c79c7061d357da64ab3dce14f0a761f6a5f89c5250745162d16f3ae1789015d5737981461d6c3935538ec443e62de3cee3ebfe83f554192

Download Submit
C:\Windows\SysWOW64\Fgijpp32.exe

Filesize
163KB

MD5
9cd8e34524d7753dd8e0bdb485935705

SHA1
98cdf6589885aa425b681da655a9533c582dc912

SHA256
4d22c9ee5d17a32ae75eb39794336f1e91de06ccc1ae5102b5e6e960d4ad205d

SHA512
5a4f5866297b9ebaf9108e7994f8c4a2089259b369cecfbae42ee499e22fe56a0e12f6e2350ae24fba3901b3486a6f31a45540c5610c585e445c158dde6056c1

Download Submit
C:\Windows\SysWOW64\Fneobj32.exe

Filesize
163KB

MD5
81c8c5d900d4c9510f27275500218a0c

SHA1
643cf2dd8a565d890352f4a3882f7f0148539549

SHA256
676837850204a89203b9457a0390eb26070bd7df244d2d262f8c969ccef29630

SHA512
56b6528ae1c740e1416687048cdacde620d5742ed4b291b20d977884b811ba19a22fe356ed8b7fd61ab1e78a59f58bc6a8f6d73dc04d31c0f7c8f19debaafc28

Download Submit
C:\Windows\SysWOW64\Jbmllb32.exe

Filesize
163KB

MD5
633646feb020485a561f37b69e2116c7

SHA1
dfd6b3f93d9a7ba1e49ad47dcb474b4a21f77c22

SHA256
b46f4c57eef8d859f0b5b5da6fee4fdce30a728849260266c03c6d0e155d6a9a

SHA512
3b1e8bfc3075c7229c2d0793942496458eb9caa4075d49a928cbbd49ec90e6451072bf6e8680e98deaf35ca50bd4e8e318c5bd187712eae8adea0b3e26c6ae67

Download Submit
C:\Windows\SysWOW64\Jecoimci.exe

Filesize
163KB

MD5
9ba6022a1b43155bc1692baf87d52d41

SHA1
37d4fa35c22e364e15de9aadeee8fa0d96d1ee8d

SHA256
a61040104af2f4e250bc4b22edbd854005a90d5bdc0c61aaf3528fee2ce6682c

SHA512
2d0151312750530f3d04601674b6f7d8d2af8cab381d9f6ae8a8a3fa2e7edf1a339db00fa69c217dba29f4c2318d8b30999464218cfca35be1e245f1c82e4a23

Download Submit
C:\Windows\SysWOW64\Jeilbn32.exe

Filesize
163KB

MD5
a2e8ebe518384077aa6892cd9a0cab2a

SHA1
74b936f208c3eaf0324137564dbf360b408faa21

SHA256
a0988bd1cd7957329ecec375397210c5c040fe64d39ff79bdbb0871fd266090f

SHA512
fcb2fa4a0140b8afd928ae4fc5f51e8ec94d11fe922a1280ecb3ef0a9e88f41a316a46a39a4affbb97939dcb32f20c5adb10dc55473cc2ec114841e18a685abb

Download Submit
C:\Windows\SysWOW64\Jgjedi32.exe

Filesize
163KB

MD5
500a7f2b9353e69fa1c694243d2838d9

SHA1
4d6be22f20e7b159838f8fe3acb9ca844b21ee78

SHA256
4386b7ff734e0e0f9ee86fb90174a22d4e66fbddd55e89c36d3920628c765260

SHA512
d1796e6d1519dcb97179e73c3e46dd189af4449b791c637c9a79b666bf218323e8414e996335c63e9c130a81e6f70794dfdbde52fda9ba387a75fcce78b651ec

Download Submit
C:\Windows\SysWOW64\Jilndl32.exe

Filesize
163KB

MD5
27feec4d22219d5f052c3cace4b7aac1

SHA1
c8360eaba4541d18565651bd86666695ac955884

SHA256
dde11fba4e28cf29cecbd12f4852cc7105b672b3adda7ff204d08f33a91e035a

SHA512
f9a4298ef7275980cb8c9d6c33c62cc17421413214291ea3f37d261b4c40fc59a9e742d0bf7452239c13f1bc29d032d189d94824d3fcb405d28d92c90487bfac

Download Submit
C:\Windows\SysWOW64\Kfbkbpjl.exe

Filesize
163KB

MD5
993d4528d40c3f02b97d2c570d6030d9

SHA1
13a2604cb642b48a5cd6eb22266dc2f6c20799e1

SHA256
7332e1ae14781e5a91082b54c6916953413da4ac68944de7d969a17451f66116

SHA512
ac80870ec5fd8e4a3f4e1629ff1c353bf8c938571ceb8175ad6e7249c1aedbcf821b377a87bbccddbd8bdadc6496eecdecb30b3cbb44673801906afd24fad86b

Download Submit
C:\Windows\SysWOW64\Kfgdno32.exe

Filesize
163KB

MD5
6b59de131a8158657444aa69812d1d4c

SHA1
a9a78ed90bf22e265d41e157a568837f061ed7c5

SHA256
5afcd3946d9713855cbe80622e0b7bd64e8ed012f2de3e3079fa22bbaf0e8e7b

SHA512
d9220428af69f10e13a0b0403d66a412afec72f60b7b97dbbf3b7bea655001df9382d23db80e2e671daf12558d8756e00c6f92d31d6fdca7f7a2e6e4fc62c301

Download Submit
C:\Windows\SysWOW64\Kfiaco32.exe

Filesize
163KB

MD5
a02ed6869bf91dfd8fcfd620ee4665ac

SHA1
ae818756bf4dcca5f84d481a4ee9938370db6a06

SHA256
51eb3bb7b51104dd0c5d5efe253f2b064c0303dfe814304afc7d3bfb12480361

SHA512
bce68ab31987ac3fedaef0f00b75e9492141ae18caa4aaa01631d862dba5645cf052d4277b3c0165eed899a1496c8494c2730f9bbb0d7d49dd87b2f1b1037f19

Download Submit
C:\Windows\SysWOW64\Kicddk32.exe

Filesize
163KB

MD5
299847046179dbbba8f52bfac1704458

SHA1
867aaf3214e3a9e24001fc92fd2995a07b192e2f

SHA256
7a61196269063e279b38c1ece6cbbd972eb738fba6d1e3e69490e822ebca504d

SHA512
4b8cc43a83123589e8d7e5660789e3e003103e4dbcd520656de40fbbb28f02c94997aa6cfbf0938a134f2bfd21a8b342c058f02b5c446411c827cdc6d98a948d

Download Submit
C:\Windows\SysWOW64\Kldmff32.exe

Filesize
163KB

MD5
5ce989b8653e7ecafd6ff4e695da53b2

SHA1
6be7744c2853712da8d32a792808496470579d2f

SHA256
755a058dfe417e82dacc915b252fb82769238e16575ceeb1c12155a8b5e0beab

SHA512
e867bc30a59f6b828e5c8aea3b1a92d4f9b58092581c75a42fecdeab2955c5190736b0e1231d5a76a845b9f109614bde801f06699a7b94b2c5ce520d5aaaa5ac

Download Submit
C:\Windows\SysWOW64\Kpbfld32.exe

Filesize
163KB

MD5
d89c89149f55fdf9d65184449773373f

SHA1
f0706aede4828a81936e25ff2a0470dd37985aa6

SHA256
4e3399dd20ea765a4ac9eee6184460446db78eea7fc261e9f1b00bd0b5d2dcd6

SHA512
1e0c2bfc5f977be666a454d01a2711074087eabe8ebff376be945fdb9126f4fd4043343d336177eaa775b410b8bf1ea9195148a16f90244073352d1930c8a95f

Download Submit
C:\Windows\SysWOW64\Ldgkmhno.exe

Filesize
163KB

MD5
19c7260381f4779d7540823da5bc16db

SHA1
e5de777a2556398ff1cf5b065bcb92e4b85858fa

SHA256
68d3510b6b7b40200a8e59d0eab4bf97f63053fdb1947d7dabeceb1447575ee9

SHA512
112ffdf982b22bd6a551f60cdcd9158cfda9d773fae216408027f07d833b9cecb7cff84c00b1e666e1b5c212639867fc2dc3014b805e7f882c9f46133bfce905

Download Submit
C:\Windows\SysWOW64\Ldlehg32.exe

Filesize
163KB

MD5
aa40e92e576ade75ad4194cbde37c9f8

SHA1
c583f35c3452e9e0bcd068baf9bc8f1a32c794a0

SHA256
1548e6c03567c0b97b758a12db8e0da27925060463660bf6a9ea58ac2a3c98b7

SHA512
043cff26966e090fc5f45982f3172edb938360772c98cf13470450c5617df80f7e2ae2bd447884bb3ad25acdaee29f589957852347edfa778b7aeb344faebe3d

Download Submit
C:\Windows\SysWOW64\Leakjk32.exe

Filesize
163KB

MD5
aeb1a57bee62addd7cebfa9e23f212f4

SHA1
548e6157e38bab5eaa24dd7f1ee4607478271520

SHA256
1a865b15e5e1b43845436b32d954874a16585d1595fe8ab955b0bbeda50665d1

SHA512
d907d6a9c100fcc054638bd716362828c699984b32f480cd90b06391cbefd215fc6917eb76374e9193abbda5be90ddd2f5292afa5fb7c776e43c8c4183e8a69e

Download Submit
C:\Windows\SysWOW64\Lefkpq32.exe

Filesize
163KB

MD5
263a459b99b6bf0ba52ab5984f4023c2

SHA1
8e9e77e37501b75be34cfb6fb78fc563fc4bea4e

SHA256
2501c91442e3f578a0cad7e5ef0cbddd6ecb556edf961b943298367474637e52

SHA512
50dbc16755fdb0a1bc847a1401ef62c6c1e99f0c4d3c1572475c89d2cb247e4aa4e0a317913680dc7381e68500378fb5884d022cee085b36fc6ebe144d98234b

Download Submit
C:\Windows\SysWOW64\Leihep32.exe

Filesize
163KB

MD5
1b72aba82ea8e3b5e9ade3601c397a32

SHA1
0611357a6fa2d45d38263b8db9cd4ed9f7f3edb8

SHA256
ddb1a629182ea2339720659ff390e233f70355250d310bf82d9acaf7908c3948

SHA512
0c876f98563aca3620c23e1cf1ba3f10cb3bb4a3aac84c53fcd7f4e0e533b55f7288844795e8da2abcf1e59a1de44bafd8ad073f4dc069835b4157dac1427cc8

Download Submit
C:\Windows\SysWOW64\Lejnpi32.exe

Filesize
163KB

MD5
2bf9e905f87566db8b23554f3579900f

SHA1
06c6c62c4ac1c3b1cf1ad4039243390bea0df6d8

SHA256
5ab969ad645c254f0ce6a69e3c196f12be2701b0934a35e9287df9d44d41e819

SHA512
8aa9d4d807f12d3469b4c31ea38304bb914a3bb35880fd601b3903ffbe0b49fad2a332fee811120094b5198922bfcd2b89cfaed154a01c5782fb29f626696529

Download Submit
C:\Windows\SysWOW64\Lekekp32.exe

Filesize
163KB

MD5
4039fdb08f31d472d356337807a4c177

SHA1
c415f098bb1aa646d740dd7b5a9a16bde4426e89

SHA256
15997dace47a2ee7c28bb4dc6e49caadb392a2115843a2c0e9e044cc0e8dbc94

SHA512
f329313fa726f2e6337a26bdd6ccc4cf241e3b3539a89db80207847fa83eda1abb2c56f90f054ac1c027393b789cd09500356433bfa478a5b7d2a0960611ce50

Download Submit
C:\Windows\SysWOW64\Lfckdcoe.exe

Filesize
163KB

MD5
8eb9b0fe0bd1c9cee1cc5d58c6b21cf5

SHA1
ad907934efc3842045bd2bca9f04c1fad3e3a544

SHA256
c1261c3a62e2840035f8afe14cb1adef726d43e04c58b32124c905b882613782

SHA512
6e80a7f1cb0807e8b332464000487d41b995823a077773e87da6e6324120e8267b1590f89852f1c7aa4ecb39eb9680c2efbe3207c9e06e10ce60e1c8d1672b00

Download Submit
C:\Windows\SysWOW64\Lfqgdn32.exe

Filesize
163KB

MD5
4c38c2995b4a9811150d4e5a9418d1ff

SHA1
49f770d7fd9c267dda8c223c2e6cfc2a4cf1c829

SHA256
b24a4e4b1e95a9462236c2e4dd9f25723ca7e24375931cf668df3a0d0194b707

SHA512
af0fd1236f3b9b42e815f64374cef57cf586966f828c481797a7f8e4f53922c933d61eee31a5aa900f7cb76089b501268deb6cda931fd6580313353671ce62b2

Download Submit
C:\Windows\SysWOW64\Lhdqaeag.exe

Filesize
163KB

MD5
2fea15b289ab7bda7d71129dd9734a38

SHA1
fedf5ce4ff78306308a951b6cb1d8f2812d83979

SHA256
e17f502091418c1e1ab32913534058a83658116cd675cbeff4ec80212e81458b

SHA512
c5ba17e918edf4ec7963e242baac4768b515dc020d0f33cefcd9c6e6df7fd55a4dfb84fac661f1723e7859e41e2bdd1813d07f0ce3a530823343f46c788a78ba

Download Submit
C:\Windows\SysWOW64\Llbpbjlj.exe

Filesize
163KB

MD5
ca9308a8099e01dae9442503366cbd86

SHA1
90501ede3c6d0ca17f419e3e85303f5fe3672c2d

SHA256
59a236c5b12785742f68417f514e894bbf3de945a958275056e79dff2fc6b708

SHA512
e92ac90761d493d0df37fe8313fe7faa20e3d40a5b13d0582c24433893740e6a4c30387e46a85b82020a17d84295e743a2893a5442a8fd845e954656462d95ba

Download Submit
C:\Windows\SysWOW64\Llmpld32.exe

Filesize
163KB

MD5
beae5464142b8165d4794ef0bc8ff0d2

SHA1
ff320097f8c16c0dd14b97b3cf567ea374e34654

SHA256
7d76615be8f10c25f0dc9ccabd55c9b0420538014c12bc51ec96970dd8552196

SHA512
1e26b3b3ee53a1bb2f49f73d84a61f66fc4c7459c028f711374f55cf46e3cf558af80b10c01d9b2dedf475e7e5af285d4974f0a9fae1043eb539e5f442041fef

Download Submit
C:\Windows\SysWOW64\Lmbmlmbl.exe

Filesize
163KB

MD5
8a030eb9771e5cd2c5247a738a9d8f8a

SHA1
6a5c0fed427fa77dcc9784c6485c958a476c8266

SHA256
3d7aecffe2b41c7b40a9c68fe58cd0ec91cdf278c8901338f8ac65794b19dad7

SHA512
23f3b31dfcd6479d0600b675f9f58b37fe5989436e0bd4af25b960138025c31a8cccdf930a1736bb6cc3b32ea37f74adb68d482406ed20298a66677ed6b5a45e

Download Submit
C:\Windows\SysWOW64\Lpdbbd32.exe

Filesize
163KB

MD5
b78c7997b50955fc6944ded906ec75c6

SHA1
c2aee7d944b385073faeaf110f334ce60cdbef35

SHA256
ad379dd6d4f64d47f868c4bf2cab46a7d228436a211222bdba9b4741f30848c6

SHA512
660d839db9ccd4873d287c744d76ff4200cc7ee77ad58354864dea3ca086a19367d7910d4bfc297b75b6ef90d75b3be59bed3586795278fded083458df25f44d

Download Submit
C:\Windows\SysWOW64\Lpicgihh.exe

Filesize
163KB

MD5
9dbe9aa35a26d4903a48df1ab88c4abe

SHA1
996e4ba98b9f12ddcc46a039e73bac6e9d1e8b9b

SHA256
f580ab81c3c8386a373f4b45cd9c0497be581cf047f6933d20002091a9c64f6c

SHA512
4247312f72563e4e9f589ac74924581ba4d12a38c14784b48ad99889da119151290d0993b2ad7bc5b3ec7d5750babe7e031794b6e0271dd623a2ff8ee3507ed7

Download Submit
C:\Windows\SysWOW64\Mcabjcoa.exe

Filesize
163KB

MD5
d835d21e68962021c808d03daf90b67a

SHA1
d953ca115241a7a97b881ac6b3ccc9f0a5ec1f91

SHA256
8e0fc040d71b7830ae94fd5f9467c6a11469458ebe139438feea211e123dda58

SHA512
b7eda79f6bffcc41ce62d70c1663d732988944c4a8a19035a581da2f87bcd97b0fcdad818137f6187656d31b7a20ef289372a9d09f7fb324af348872525d197b

Download Submit
C:\Windows\SysWOW64\Mccooc32.exe

Filesize
163KB

MD5
16531908080b72d8f296544f83348abc

SHA1
ada725026201428db66a86a2d0be8e51cb940e20

SHA256
f579c3e5e1eaa082450325c4249d4f1f834174c2b96f1ef40ddf8706e4b47cea

SHA512
b2d0493f63dff738031d21efce4c376861fb66dfdb99ed09f11437134f26ba51cc60681a0556c0d9f942cfdf1847d3c8d7915a76a1e5b29cade2274b49ab8e05

Download Submit
C:\Windows\SysWOW64\Mcfkec32.exe

Filesize
163KB

MD5
262cf1a8b7ec18ad36206aa374097805

SHA1
ca4e3f8d7d364c069e6a936ddee86f75ee1189fd

SHA256
4bdaa11a0413092e9b48e6c69e40cb2395e660768d17ae6416f5a3102806f5c5

SHA512
c9720f9dfb5bd4d115600eec57d1dfb78ada4fa91a4c6351812012a7d64c3404367b9934d5907d0e0337e7a04dcdc150fb03ddf1cde4e6cdcb49446b6dae11a3

Download Submit
C:\Windows\SysWOW64\Mdckifda.exe

Filesize
163KB

MD5
e323e7fdaf904b7137522997c3dbfaad

SHA1
bd12a361087b831615ff0142f5a0b32058701493

SHA256
78f0dadf0cf3fbe6b3f1303cd48c53ade3371dd41face5ceb41c49062a8e25fa

SHA512
ae63afbc581025f761856b42bb6e0deece82615361e2437564fdfdc09e264e01733e0e7891d98d669afec563e86ef72c8759dc60de017f62e831c3fdb818fd80

Download Submit
C:\Windows\SysWOW64\Mdnang32.exe

Filesize
163KB

MD5
53da23518ae90f1825a0f2e7b7951a68

SHA1
9a65c46aa2478511c66b64a62a9b1b4fb7d08adc

SHA256
9bbfd5c44694036275c3eee4754a2de01ea00a392ca78a09aad1bacc666e79a9

SHA512
5d747696eda59033893bc5d6aa8640b8c5ecb2651abc39db82725bb001b03ba1b8aef635f0d992cea6da74283f4ab9f72ea0639427ff4b355b6a6acb276d8ff4

Download Submit
C:\Windows\SysWOW64\Mdqncffd.exe

Filesize
163KB

MD5
78a5837cb6f804737c6b22416cce14a7

SHA1
195dad94d257b0a29c5ddeaa30a0b34072f5d1f2

SHA256
d5ca5517129911b792db4d599bf622b9603a745e3f250b5f9038b93588b8a894

SHA512
048fcc290be78e91d5d106321ab3b367aa99729ace26e68b3873e7a7a4957612ab379dc9216ee47e4c0a8035029ce6cf1154d1274abd94d7badc280f1cebe3a6

Download Submit
C:\Windows\SysWOW64\Meadah32.exe

Filesize
163KB

MD5
f32708d097faa95604ceacc5c1feca51

SHA1
fd3c95cc5d651cf391ec9b866cf8a19e85b64904

SHA256
7751adbf6dbf233cff754f9ef52d6aae14a041433329f939e913ce3894e0bbd9

SHA512
e5caf9a81d63824af1017a5182a1df4293185b2b885a53d42a4937288ab20a8e30eaee0236b473e455e58fcea80a8d779c73ddb573fd841509317b44d40f4efa

Download Submit
C:\Windows\SysWOW64\Mebkko32.exe

Filesize
163KB

MD5
a7d3a4b4491551b27100a2a7e0fb6efd

SHA1
db80a1f026c10525e94315d382c3fcd613e0a987

SHA256
dd85e9ca416992229e907f01d5f8f2c3f1075db2254a874c0d15d3c9d3fe8d89

SHA512
5d9c30bd217da5602f912089f384c7a42b4d1bfe2cdb3a82edfd7c2a8a1df227ca4f334fbcb2596517a8780425fae0dc8520c9c4e212bf07b0dfd4286ab36406

Download Submit
C:\Windows\SysWOW64\Medgan32.exe

Filesize
163KB

MD5
83b914958676b0a2f469dc2c1c99ead3

SHA1
b236bf650821dfadb73b2d2b53d359de8d4c2ae7

SHA256
f415ee5f1fa9b81001c11ba6b8ff8d31f11bde7b402fadbfe3ec2f8129db4226

SHA512
80a9b88a1dabf776b7b04c9da5f22860c68050b1bf4c353b7a60c83076c3787ef47a3fe9774a6285f5ecce8bc6bb45d27954bd207c17efcc23b02e47fdb9f539

Download Submit
C:\Windows\SysWOW64\Memapppg.exe

Filesize
163KB

MD5
f0295d375a9c07167254ea29cb254286

SHA1
b97161e51e7a9ed11c05486e29fff027044d6fe4

SHA256
46f9432d1152af81dfc558ea78a7957459f3e74084704f5ee5cc786562047a7c

SHA512
908fd7294ca6038710cf095ac6adfc146294aa95ee1f3098f5e05c5ff83cf3cc4fbb04a3f2daca8f541de9b8a391c0010835099c16733f5d768ddf6247b6bb19

Download Submit
C:\Windows\SysWOW64\Mepnfone.exe

Filesize
163KB

MD5
4bc0011b2984362cebaefbb03efa816d

SHA1
00ee3e48f703c7689b28d0d48857cdf29c1797d7

SHA256
20fa98cb29d657adee9f59b65510b2c23c45e327290467f42315538f4b9d6502

SHA512
1ba1d6a181c3353a9f4919d1fe0f7a3f8b5e349c3158963a8230f143aec17888230849de72a58ae92e56bf1b28f5f6852c122d322c5716f2ccb98b9ed09bd271

Download Submit
C:\Windows\SysWOW64\Mfapkkpi.exe

Filesize
163KB

MD5
dbebc69c96a65d7778c2f39f086b12e7

SHA1
b2ac6759bc0d791b37bf8789c635bef9593ac150

SHA256
9668ede95e4a85b645cb4fa3237e75ab4374a2649837c24e29d713852de068dc

SHA512
ef15dc3e350f5c56f321c8619ecb1a47be6e586bed3055868931d6944dc18e9a35874cdf6a6d84f6edb088f14118c816c9a9907b6baa95d3d7efa9e3252c7911

Download Submit
C:\Windows\SysWOW64\Mflgpl32.exe

Filesize
163KB

MD5
7e75230780c1b4ebc477ddbab222be89

SHA1
53400f1b53feee392307f9f03fa885b2a3c712db

SHA256
cefb2f502f164ef2156ea958476d30a195eef5df61e8cdb471d38e2edf83258d

SHA512
550ef29ee83e6bc613718f6d642beca29c969fffedbaeee2df570ede1842bb7b8c9d1666b382522be3a9825aa8797f8296ab6205c5ebce50b92c286af5c62246

Download Submit
C:\Windows\SysWOW64\Mgageace.exe

Filesize
163KB

MD5
f6288166a85c18f436e1dec7334b9bbc

SHA1
decc0c810baa56b2e054af1777fcf812353808b3

SHA256
1942f9adaf363f86b83da973511a850ae6fa2c2637d50d5d15f44cb110203502

SHA512
a1e18e3c52e6ed8e125f587a3fb848d4914bfaa2cbbac5d68e6c8cb40c595b61b2a0f27064b80755df8e4e583957c3f4b3165254b6e6dbff88bac000fd994a66

Download Submit
C:\Windows\SysWOW64\Mgokpbeh.exe

Filesize
163KB

MD5
c5414ed2b4214b90aed0b8ab26beb9be

SHA1
975d18e99736fc4070a8e86f1f6594c27df92eae

SHA256
2b8092ca474376240a1cdcf61bb3f05bfcba3d797697602f540898aed381fc8a

SHA512
9f3ce3d80c0c92b4d8eb5ab52b26bf94bab3c06d343ee356beaf0c57595fea2b7b84852a37fbce58c45a3ac36df580c134fc8f83cb9c204702dccd5da517baaa

Download Submit
C:\Windows\SysWOW64\Mhkgbdlp.exe

Filesize
163KB

MD5
dba246ebf7391aa3278f71cebf3069d1

SHA1
18b1a03cea90aabed19589fe5b2b6292cdb52a06

SHA256
d33306a185bcaca1bbece102aca9759d2632440d24d8374c4e471afe75dcedd5

SHA512
f495f24ae212ee38d9c7559c9518153b12fb95e3300dfa30da069af0528a8991a97717145a680d9113f99563f8e7249944780c531d6e0387d2159319019c25f6

Download Submit
C:\Windows\SysWOW64\Mikjfn32.exe

Filesize
163KB

MD5
7fb80f08cc704b7f9763ea055b00eaae

SHA1
af23df40fddb7c589b0a7465a8127aed6ab28908

SHA256
6e4d102df1c543414355e41486d510116aa61e5f76e4d55529b2fb6d680d1f1b

SHA512
f57291140bb41a1aa0dcfc22ac28909ed3dc91ee41ad1c0e5950b722d860b5c65abaad643dc5221a7e864fbee37aa5e8c1b68e3853a76511b5a24e2745491e78

Download Submit
C:\Windows\SysWOW64\Minglmdk.exe

Filesize
163KB

MD5
62ddf0fa83d13a6167bd9c7849f1eee9

SHA1
23368f23b835d21870e672f2069997b28c2c754a

SHA256
22d285eddc9c3b1d37a5bf56b7f97852e839884de1ef17cb828067f07ba27b1e

SHA512
9d952cb899cb8055ca41c69d4b55bea5313e95c6d445c7127c01a3da5558243eceee943a3332ea35b6b0455f21c058bd31fdf6ae6eb1dd7ac0ddcc437fa485a3

Download Submit
C:\Windows\SysWOW64\Mipcambi.exe

Filesize
163KB

MD5
64ffdba61ced59ee0193947e1a197dc6

SHA1
64ff5a0c0b016a5c7738009c1384a06999007225

SHA256
3195cb6c0fd2d441f9f8d66791a31a0cf1804d4b606b58cc960bf2ddac1ddf82

SHA512
e4cffa2b02ee92a8ab3c7bdfd58b96fdb055c35739b69351951aa765d844a41829533ea43c15cd91c16a8014656bd432dd0bcaedcdb0e550f82b943abc1b0977

Download Submit
C:\Windows\SysWOW64\Mljfbiea.exe

Filesize
163KB

MD5
6717a495e93d989bcc6cdc6c468cb1c1

SHA1
94985018197b0f435e2a712b9bf3e70b9dffbc3c

SHA256
e2078b8fbce2a34d8c46848ffac706c521693134efeb010f408f38592b380a3a

SHA512
55eb8f6fd23ca07d10d55042b9ff723ac15ad152c15f30e2934a8cd6b948e1beb60128635276fb1910aa1b8656df010ee69d59a5a511480e1e1f3b0275c915f2

Download Submit
C:\Windows\SysWOW64\Mmdiamqj.exe

Filesize
163KB

MD5
0c90f7c167aa4cdae163d62abc589685

SHA1
2002a17ce68f84990bf070c3f197686cf740d755

SHA256
9178a6dc72344df359cd27762d8c1aed8c84959431761c96aec1e733d3668ded

SHA512
799132c455e74a5ead256700fcfca9d5f5c35030e7e9584356e592b5c82c629625accb5924d463d086c1c88c1a7626edf6627b257342ac19138fc7c2af0a36ed

Download Submit
C:\Windows\SysWOW64\Mmgfgl32.exe

Filesize
163KB

MD5
344eb796323ded5c52ffe6ded9cf62ac

SHA1
c09c4491197c36cc4ec51b87baa79487b56aeb98

SHA256
8024a92cc174a1481c938e443261724f752b6b3be0c9d22a52724a486a52810e

SHA512
2174a26cd6257ebcbae5d4decf67fc39bdbdfde2ad8bbdf99e27c2826d220158867f3d72a44fc0d5c34148024840cf452c245002718b463c88ac95cea965c302

Download Submit
C:\Windows\SysWOW64\Mmicll32.exe

Filesize
163KB

MD5
b976fd5e8f83f18ae141f5bea070549b

SHA1
8ab962ba921bb7c9b5d57990a8ae11602d062960

SHA256
7cdd1320fa1401693370d35ebcf5864c3c713e65d3fd256312cb1ee412d2fd6a

SHA512
058c8f61866b13d983969e7cc6b146f51f5a0557ea3d17dbf3455b0e5ef627bc3e1e4b5300a810c3de1066024c7c5699cc71e9eabe49d74762cd1cea7fa634b2

Download Submit
C:\Windows\SysWOW64\Mmkpbl32.exe

Filesize
163KB

MD5
30e2f4f6c484f8828f30d742cf0494bc

SHA1
bb3b3aa711eba6d66d2150580cd14e345aed1167

SHA256
5c17ac30b58dc48a4990b0d6ecc4f9e45bdaa473a14227aa68cb155ce8aefb41

SHA512
2e442171c0b679642adee8890bdb666031096201551472fd36af93b275804dd2f194ba71cf1594b64d8a06de7ac73d1a3bdcc4e0897c237c0469a597609a96b0

Download Submit
C:\Windows\SysWOW64\Moleonmd.exe

Filesize
163KB

MD5
91e174f459cfecd9f87bf1c56697df08

SHA1
431741188044b9cfc5ec946d9981d474c25b3d71

SHA256
e74b80d27a79f46f0be6c4bec26db6dc739aa8d85fa240e2a13875a224ba666a

SHA512
f1e29dacc48ac12051febbaa9cb6d0f933a5de54d423300702f66bff35e1ffe3b49a52c4b8fa36b4de9544982b2a04ac7f0737964200fc716f662d48b270cd39

Download Submit
C:\Windows\SysWOW64\Mpcenhpn.exe

Filesize
163KB

MD5
c32149398050ba39903f4152811e3967

SHA1
b1ba8aedd7ed61a43e1301200bd217a686d13d6b

SHA256
58191dccdc80aa38011a7494d0d995005a0b7c5d15ca7cdb46b2867eab390de6

SHA512
ee0e4aeeb627c07beed1b2a954de735ffcadac0b0551768bce29aebf4c33c276ff0ea7b8f21575d9e6bde8f0bfe758e47d91aa7742c854c31c24f749004882d9

Download Submit
C:\Windows\SysWOW64\Mpdkiajo.exe

Filesize
163KB

MD5
7c4ca3c113b021adc2e5976f7f643beb

SHA1
97a2d382bbf0aacb43c1d03f3b0109d4c6b6caa8

SHA256
fde8f600a25fabbff05c3224896ed57ad64ecb26a94092536e57deb00d1b7dae

SHA512
a6629c29b682bd83e57ef3bd0858191762bbeb48b268043881cf985775dec144367e6675846dec3847e15c6e6512b45eec41a08ddcc3c1f4af79d55569727f50

Download Submit
C:\Windows\SysWOW64\Mpebch32.exe

Filesize
163KB

MD5
8ffc768c07440a789bef7d3c1ee88fb9

SHA1
e396f53f88c761fb7cc4a9fc8067b7c8b76ac3fc

SHA256
5cf33a27ade90ba18585c864b389b1aed85f34a99f0d0cdb65c8ee2b9cd02013

SHA512
06cfaafa340e6095111d6c4f6334d0f0ff5de9c23972c6ddc5faf6975388cc04520f22d3a0c279ae10538e4d2e2b3a2d021f3c7596e2dfd8c4b1f1f76fe8f097

Download Submit
C:\Windows\SysWOW64\Mpgoig32.exe

Filesize
163KB

MD5
a30470511a3551938ceef7b8c397f036

SHA1
441fbfdfecf3e029ce822d63760549826e1a3179

SHA256
a756197bce61c66e38d49986bcd4e55ceba811e6b71a8f78e95ef7e248365a01

SHA512
4b249ae70fc96d69d03dd79471589c55405a930064b45f699d12acbcd5b1dfbe99568c84b7e1c8272a9391c5005eb6b006f981e6291fcc58367c8ddea616a3c8

Download Submit
C:\Windows\SysWOW64\Neamhfjd.exe

Filesize
163KB

MD5
1aace2cce2892865e9c882d046386dd8

SHA1
1be7c2026657b41a804d2489fedf090e020bf4db

SHA256
592e487ae72fd6f5172fc3aad0b09b1a3b40f309c217162089abae2a571ca0c3

SHA512
6b5046ea0b212a975687a7990a84cb996e10f41f5c3a364e86be94c30a7f572f5babd1b51332eed88baab10261dce26c22604b00d1aa70207b2b28e71aa9ca46

Download Submit
C:\Windows\SysWOW64\Nehjagbo.exe

Filesize
163KB

MD5
761a7e853e48e29df9cfb4ecfe26065b

SHA1
67722a9e4f6ab55db306e96de922bb1fb920de68

SHA256
814272c2abbfec2f4d95d3823603415ada092431b6c76aa8eb5abf658b2510b8

SHA512
7b57444517a483d1699106fe60bca5a3c26dd656fd5ad4086839595de351ee8a043012cfd621ffab927a9a30d29fa9ae91d7d4f4c2775cc869472f71c5a62cf1

Download Submit
C:\Windows\SysWOW64\Ngjcajgo.exe

Filesize
163KB

MD5
227010955bf113d7cc41560ec75670d0

SHA1
d16af2b159b872138b806a8a12fdf4b05d18c730

SHA256
ab17b8686678decbfdcf3185437aedaafb8fdcbfe8b8b7e18c26397bfec42b63

SHA512
4e4e75bd8d5ae9f6d6394415d2e31eed15e074ef9d257f3c95aab9e12b0394a15fd3ce45008d606a7bf5332ccdf574ca48f6b128722a7c56cb4dbbd5da29c319

Download Submit
C:\Windows\SysWOW64\Nhiccb32.exe

Filesize
163KB

MD5
7cef8e54d89a23ff95220a670cf26407

SHA1
438f7ec64116ec717d0025dd5c9b2ba56f45442e

SHA256
eaa4307349818ea7acfd95e7b8a1054e7792885f266da73fbd678df901024ec4

SHA512
e73d3a6620c04fbc0de6391a7bfda1f3304e815b0db2b704cddcb17658ed7c0b19021e3f34c51299f50105a17203ea538d7d9e56fc04bfa0fe03c5d9af0ee576

Download Submit
C:\Windows\SysWOW64\Nhnlnb32.exe

Filesize
163KB

MD5
a019ef9459ba8d71d7c20b4797104560

SHA1
489ba5f374618498f52984c575c1aa9e80ece445

SHA256
9a3fef6b56ceb747e56b8b6dd31d06f995a6a53738860a69281aa5354af16b16

SHA512
1b9b041302e5c0007d9ca37d32f01d021de84702ad164dc115bf642eb32ec55e2961666a959513764e0ba84bc9a85fca35083174e8fb5250bb28b1510b7f3063

Download Submit
C:\Windows\SysWOW64\Nlpeib32.exe

Filesize
163KB

MD5
ee085363e359d120fd369980b040ebba

SHA1
969243ac1787479076e8259be2fa2d28cd9b0d02

SHA256
0360b097746c3176ecea52ca8a19d7e37068876a018e0e7991dcc6f9dae52b13

SHA512
9f2a0d215482b8e213b7b2f52dcb3a4a22a16b2ed5ac4638c208fe05cdfbb18d2751424ec5c3892617bc7921673ceaa0b006828b659187ed4a297a0f46fb54a8

Download Submit
C:\Windows\SysWOW64\Npnnopbd.exe

Filesize
163KB

MD5
1d5ae918899082cfef3fe7207582d276

SHA1
7081501410353e59c345831b34d5bb78e323d686

SHA256
dffefecb98a6c8ea557570b40a3136a51c222a2de2de2b03272ead798816a6d3

SHA512
c7795a60c5635a328db163eb04f87fd701d8a5371a6051eb11a22bc7c3661e6c0faab963712767bb5d2254ffaa3ff7e674c1a4011457775a1ced24af8ae99a1a

Download Submit
C:\Windows\SysWOW64\Ocfmajin.exe

Filesize
163KB

MD5
015ab21ea9c05a748008d6af18c33269

SHA1
7bb9e8cc2454c257ebdf6c6889de2765c813066f

SHA256
88aa92beeb1fed088a1b97d2f22bcc48e4dbe0462a44458af85645419cd0a81e

SHA512
a3c6c7346eb5962624c75fdaba3c900db2a51954466e13cdad38e58700504928b24a31b2009d9749b1dfb3803e2ceca7b0fc977e14775fe5d8e3619d2e0c3dfb

Download Submit
C:\Windows\SysWOW64\Oheboa32.exe

Filesize
163KB

MD5
7684eb069be1215d1dd3c7eba2c12630

SHA1
e02e9550845358e9eb09ba0349401d1647e2aa1d

SHA256
cd45a4dbc372aca1f38e4f749fd89f6b2741d17ac21ba2c4eab68db50fcfab26

SHA512
5f6b0d8fb6c815ac778a590035875fd7d00b9e21f074c98432dc4afe72cbd981c9131740fcbb7bef4cb4deb74e406432c5b40f1dd83b995d5cb4055b6696b463

Download Submit
C:\Windows\SysWOW64\Ohiljpam.exe

Filesize
163KB

MD5
09b007e00c1a92e4442fa0fac89bb564

SHA1
cadc339fbddf11178efdd2e37a368f5b0167f464

SHA256
d2968d20f1ee9d56bbdc54412a8319f9e26054d7e84dff739c1e99fc2509c9ba

SHA512
73a5ce3f2732a6169e41a5a3be473f861ea535c5c63a0279128ec57a0f2bb7f42056c45e33a079934a683e694ca5ff41628556aef4b2cf44c346dae6a8ad6ad8

Download Submit
C:\Windows\SysWOW64\Opjnko32.exe

Filesize
163KB

MD5
6ac63d649478afa2ec4917086381c732

SHA1
fc39ceb8779c4309035816dab402cfa2e4cfc5e5

SHA256
f6946d7077a0b8a2424b62aab30b21c38a161f11904cf89b2fefc95c822a848e

SHA512
75f313504b023265cdc3996ee109a6a6bb3c1eebd37df77b994dfef0aeea1e0d67e6d341ca0b958899fc1456676d4858b8d544d6031a78a904e3381ed10634e9

Download Submit
C:\Windows\SysWOW64\Phneep32.exe

Filesize
163KB

MD5
ec3f5555fa2884d4da6677890259dcd9

SHA1
bb4f4ab60c3599e8a50767f089040cc1f0b662ab

SHA256
51322959cc0da9d4267107c550fdc9456f296212ad8152ae8bd0b4c8adf0bbff

SHA512
b3400ec50c408f1e84ce047e5ee19d6614b33e4fa85d49a87ecb4f85709de2292dbe3cf756ee2088b570301ee8711bf31e6b007d19d646d5b053507e3e73b7b7

Download Submit
C:\Windows\SysWOW64\Plagfm32.exe

Filesize
163KB

MD5
8a51c2e18888e1c08f4f2a64e78d6948

SHA1
26ab61ab10774a4abfde503c205ea12a599912f3

SHA256
866f6409f5fec911aaf01fbb1b39079230fce5a1414e5fd1fdc4394fdaf31e44

SHA512
19c604a41a4b2ed1fbd43108d4ea737ae587f1196a19d00ed471a1a7862e9d1a8ff24d23898295c87802b9f4475d9737eb0d1592aae4d63797781b4accdbb175

Download Submit
C:\Windows\SysWOW64\Qqopml32.exe

Filesize
163KB

MD5
da2b00f3d51db5c32eed0b431eafc9ba

SHA1
d72d201c53e2da0b3736e627114226f596aaee4b

SHA256
bce0a77e9fe4d1b58b87b142f799d9c3608f8b8ac3843f2f67a3cda189bf7f36

SHA512
bc63eea9ed216c393fe688cbf70869b49ec587339d256cc79186404686cdfa40f41dea1d87baa614ed2ae26139e82115047a5ed93650d862dc112c30c8c4f464

Download Submit
memory/396-633-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/396-141-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/868-363-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/976-492-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1000-456-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-3041-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1104-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1148-376-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1264-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1264-547-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1400-271-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1532-670-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1532-188-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1548-323-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1656-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/1656-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1656-524-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1656-3048-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1664-578-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1664-3033-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1664-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1696-411-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1720-317-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1772-702-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1860-573-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1984-157-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1984-646-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2100-211-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2100-687-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2136-651-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2244-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2244-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2276-284-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2336-277-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2432-243-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2432-713-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2440-306-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2484-590-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2484-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2484-3029-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2504-663-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2504-179-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2544-348-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2548-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2548-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2640-251-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2652-342-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2660-615-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2660-117-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2712-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2712-596-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2724-227-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2724-701-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2724-2995-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2816-676-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2816-196-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2852-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2852-535-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2852-3046-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2948-235-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2948-708-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2972-3038-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2972-41-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2972-560-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3264-628-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3264-133-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3396-330-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3504-335-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3568-265-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3596-294-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3772-399-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3872-259-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3960-429-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3960-2928-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4000-369-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4020-658-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4076-694-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4076-219-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-300-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4216-504-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4276-423-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4408-571-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4408-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4520-598-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4564-603-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4564-3023-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4564-101-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4568-387-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4580-609-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4580-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4684-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4684-541-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4700-417-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4736-695-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4752-445-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4888-498-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4964-125-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4964-621-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4996-681-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4996-203-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4996-3000-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5040-381-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-639-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-149-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5104-405-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6472-2676-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7776-2556-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9040-2390-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9092-2423-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9580-2377-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9780-2371-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9860-2351-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads