berbew | d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51c

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe
Size

465KB
MD5

df5de584f840f1eec5dd0686dfd52300
SHA1

1745cf56e6b8e91aee82031568d62da4d3459891
SHA256

d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51c
SHA512

8cad4bea5bfb2b75f0c91cf5c3dd9386acaf00fe364e8455ffe3235bd660884cb6f23771f482172a2fc230c5251ed28a3515c4afa82dcf42a8a16522b85d6feb
SSDEEP

6144:PxiM5AEhwqOOVF5V4lKjIbvBhRJfzSf9x7N/I7b9M:PMM5AErO8LKlUmpRe94a

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hppeim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joekag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpgdai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mledmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hioflcbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooibkpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiqjke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbldphde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnibokbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbekii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kifojnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmeigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbgkei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jimldogg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocgbend.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmbegqjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oanokhdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaclqkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmdblp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmeigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgohf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joekag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocgbend.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbekii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haaaaeim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgkan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cienon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondljl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekonpckp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eghkjdoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apjkcadp.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
740	Nclbpf32.exe
1176	Ncnofeof.exe
2424	Nqbpojnp.exe
4364	Nadleilm.exe
2148	Njmqnobn.exe
2696	Nceefd32.exe
2160	Ocgbld32.exe
4772	Offnhpfo.exe
2156	Onocomdo.exe
4948	Oanokhdb.exe
2648	Ofkgcobj.exe
3000	Opclldhj.exe
2720	Ojhpimhp.exe
1864	Ondljl32.exe
3964	Omgmeigd.exe
4848	Oabhfg32.exe
4980	Ocaebc32.exe
5036	Ohlqcagj.exe
3456	Pfoann32.exe
224	Pnfiplog.exe
1028	Pmiikh32.exe
3864	Paeelgnj.exe
1268	Ppgegd32.exe
2820	Pccahbmn.exe
4660	Phonha32.exe
4776	Pfandnla.exe
4968	Pjmjdm32.exe
4124	Pmlfqh32.exe
3480	Pagbaglh.exe
3684	Ppjbmc32.exe
452	Phajna32.exe
1232	Pfdjinjo.exe
4252	Pjpfjl32.exe
3068	Pnkbkk32.exe
4244	Pmnbfhal.exe
2880	Pplobcpp.exe
2176	Pdhkcb32.exe
4508	Phcgcqab.exe
3904	Pjbcplpe.exe
4528	Pmpolgoi.exe
4464	Palklf32.exe
3364	Pdjgha32.exe
3388	Phfcipoo.exe
2252	Pjdpelnc.exe
2256	Pmblagmf.exe
4640	Ppahmb32.exe
3580	Pdmdnadc.exe
4856	Qfkqjmdg.exe
4752	Qjfmkk32.exe
1396	Qmeigg32.exe
3640	Qaqegecm.exe
4128	Qpcecb32.exe
1072	Qhjmdp32.exe
732	Qfmmplad.exe
2124	Qodeajbg.exe
3428	Qmgelf32.exe
3176	Qpeahb32.exe
1292	Qdaniq32.exe
3820	Afpjel32.exe
4912	Akkffkhk.exe
4492	Amjbbfgo.exe
4512	Aaenbd32.exe
3500	Aphnnafb.exe
2184	Ahofoogd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nqbpojnp.exe	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Palklf32.exe	Pmpolgoi.exe
File opened for modification	C:\Windows\SysWOW64\Aoioli32.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Gaebef32.exe	Gbbajjlp.exe
File created	C:\Windows\SysWOW64\Nceefd32.exe	Njmqnobn.exe
File created	C:\Windows\SysWOW64\Hpioin32.exe	Hioflcbj.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Phonha32.exe
File created	C:\Windows\SysWOW64\Fgmdec32.exe	Fdnhih32.exe
File created	C:\Windows\SysWOW64\Iialhaad.exe	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Dgbanq32.exe	Ddcebe32.exe
File created	C:\Windows\SysWOW64\Qfoaecol.dll	Cncnob32.exe
File created	C:\Windows\SysWOW64\Qkicbhla.dll	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Pjpfjl32.exe	Pfdjinjo.exe
File created	C:\Windows\SysWOW64\Pjdpelnc.exe	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Dbmdml32.dll	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Dkbnla32.dll	Bdfpkm32.exe
File opened for modification	C:\Windows\SysWOW64\Finnef32.exe	Fofilp32.exe
File opened for modification	C:\Windows\SysWOW64\Fkmjaa32.exe	Finnef32.exe
File created	C:\Windows\SysWOW64\Adppeapp.dll	Bdcmkgmm.exe
File created	C:\Windows\SysWOW64\Hnmanm32.dll	Cmnnimak.exe
File created	C:\Windows\SysWOW64\Cgpfqchb.dll	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Cancekeo.exe	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Ijikdfig.dll	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Plikcm32.dll	Baannc32.exe
File opened for modification	C:\Windows\SysWOW64\Cocjiehd.exe	Ckgohf32.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Cacckp32.exe
File opened for modification	C:\Windows\SysWOW64\Ddkbmj32.exe	Dggbcf32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Bdmmeo32.exe
File created	C:\Windows\SysWOW64\Ihkjno32.exe	Haaaaeim.exe
File opened for modification	C:\Windows\SysWOW64\Oonlfo32.exe	Omopjcjp.exe
File opened for modification	C:\Windows\SysWOW64\Eqdpgk32.exe	Doccpcja.exe
File created	C:\Windows\SysWOW64\Qahlom32.dll	Dgbanq32.exe
File created	C:\Windows\SysWOW64\Cgkeml32.dll	Fnfmbmbi.exe
File opened for modification	C:\Windows\SysWOW64\Jekjcaef.exe	Jaonbc32.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Cdkifmjq.exe
File created	C:\Windows\SysWOW64\Gkdinefi.dll	Eqdpgk32.exe
File opened for modification	C:\Windows\SysWOW64\Fndpmndl.exe	Fgjhpcmo.exe
File opened for modification	C:\Windows\SysWOW64\Fnfmbmbi.exe	Fkhpfbce.exe
File created	C:\Windows\SysWOW64\Afockelf.exe	Acqgojmb.exe
File created	C:\Windows\SysWOW64\Dgeenfog.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Ipaooi32.dll	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Fjohgj32.dll	Kapfiqoj.exe
File opened for modification	C:\Windows\SysWOW64\Diqnjl32.exe	Dgbanq32.exe
File created	C:\Windows\SysWOW64\Edbiniff.exe	Eoepebho.exe
File created	C:\Windows\SysWOW64\Pkbcikkp.dll	Mapppn32.exe
File created	C:\Windows\SysWOW64\Fbcolk32.dll	Cienon32.exe
File created	C:\Windows\SysWOW64\Ccdihbgg.exe	Cpfmlghd.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Ofkgcobj.exe
File opened for modification	C:\Windows\SysWOW64\Qaqegecm.exe	Qmeigg32.exe
File created	C:\Windows\SysWOW64\Kdebopdl.dll	Aokkahlo.exe
File created	C:\Windows\SysWOW64\Ojehbail.dll	Fiqjke32.exe
File created	C:\Windows\SysWOW64\Pakdbp32.exe	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Bgpcliao.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Eiekog32.exe
File created	C:\Windows\SysWOW64\Fndpmndl.exe	Fgjhpcmo.exe
File created	C:\Windows\SysWOW64\Bfolacnc.exe	Bjhkmbho.exe
File created	C:\Windows\SysWOW64\Lphdhn32.dll	Jpegkj32.exe
File opened for modification	C:\Windows\SysWOW64\Qhjmdp32.exe	Qpcecb32.exe
File opened for modification	C:\Windows\SysWOW64\Amnlme32.exe	Aokkahlo.exe
File created	C:\Windows\SysWOW64\Ieoigp32.dll	Akblfj32.exe
File opened for modification	C:\Windows\SysWOW64\Dnonkq32.exe	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Eecgicmp.dll	Fnkfmm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8920	8632	WerFault.exe	407

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihpkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpbjfjci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpjjmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekonpckp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqppci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iojkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mapppn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfnamjhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkkhbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfmlghd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnnljj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oonlfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opclldhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojemig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaleemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doccpcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaonbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkmjaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koonge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgkan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqgojmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmpolgoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddifgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eghkjdoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Haaaaeim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepleocn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbanq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbocfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edeeci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daeifj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmfllhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiekog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paeelgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pccahbmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jimldogg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lancko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cildom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohlqcagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmblagmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nblolm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdcmkgmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifmmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpegkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnabm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnonkq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feenjgfq.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbjqfjb.dll"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phonha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Haaaaeim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coppbe32.dll"	Hnibokbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijikdfig.dll"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjnlmph.dll"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmocfo32.dll"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eghkjdoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddkbmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpgdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egopbhnc.dll"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gggikgqe.dll"	Njljch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpfmlghd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdjofbi.dll"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faoiogei.dll"	Mledmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adjjeieh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnpkdp32.dll"	Ocaebc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gillppii.dll"	Hioflcbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebfign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laiimcij.dll"	Llcghg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aibibp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnonkq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbmohmoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fndpmndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahfmpnql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjhkmbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfedh32.dll"	Fgoakc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kifojnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjohgj32.dll"	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eohmkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iafkld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohlemeao.dll"	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Legben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgkeml32.dll"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bhpofl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 740	3024	d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe	85
PID 3024 wrote to memory of 740	3024	d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe	85
PID 3024 wrote to memory of 740	3024	d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe	85
PID 740 wrote to memory of 1176	740	Nclbpf32.exe	86
PID 740 wrote to memory of 1176	740	Nclbpf32.exe	86
PID 740 wrote to memory of 1176	740	Nclbpf32.exe	86
PID 1176 wrote to memory of 2424	1176	Ncnofeof.exe	87
PID 1176 wrote to memory of 2424	1176	Ncnofeof.exe	87
PID 1176 wrote to memory of 2424	1176	Ncnofeof.exe	87
PID 2424 wrote to memory of 4364	2424	Nqbpojnp.exe	88
PID 2424 wrote to memory of 4364	2424	Nqbpojnp.exe	88
PID 2424 wrote to memory of 4364	2424	Nqbpojnp.exe	88
PID 4364 wrote to memory of 2148	4364	Nadleilm.exe	89
PID 4364 wrote to memory of 2148	4364	Nadleilm.exe	89
PID 4364 wrote to memory of 2148	4364	Nadleilm.exe	89
PID 2148 wrote to memory of 2696	2148	Njmqnobn.exe	90
PID 2148 wrote to memory of 2696	2148	Njmqnobn.exe	90
PID 2148 wrote to memory of 2696	2148	Njmqnobn.exe	90
PID 2696 wrote to memory of 2160	2696	Nceefd32.exe	91
PID 2696 wrote to memory of 2160	2696	Nceefd32.exe	91
PID 2696 wrote to memory of 2160	2696	Nceefd32.exe	91
PID 2160 wrote to memory of 4772	2160	Ocgbld32.exe	92
PID 2160 wrote to memory of 4772	2160	Ocgbld32.exe	92
PID 2160 wrote to memory of 4772	2160	Ocgbld32.exe	92
PID 4772 wrote to memory of 2156	4772	Offnhpfo.exe	93
PID 4772 wrote to memory of 2156	4772	Offnhpfo.exe	93
PID 4772 wrote to memory of 2156	4772	Offnhpfo.exe	93
PID 2156 wrote to memory of 4948	2156	Onocomdo.exe	94
PID 2156 wrote to memory of 4948	2156	Onocomdo.exe	94
PID 2156 wrote to memory of 4948	2156	Onocomdo.exe	94
PID 4948 wrote to memory of 2648	4948	Oanokhdb.exe	95
PID 4948 wrote to memory of 2648	4948	Oanokhdb.exe	95
PID 4948 wrote to memory of 2648	4948	Oanokhdb.exe	95
PID 2648 wrote to memory of 3000	2648	Ofkgcobj.exe	96
PID 2648 wrote to memory of 3000	2648	Ofkgcobj.exe	96
PID 2648 wrote to memory of 3000	2648	Ofkgcobj.exe	96
PID 3000 wrote to memory of 2720	3000	Opclldhj.exe	97
PID 3000 wrote to memory of 2720	3000	Opclldhj.exe	97
PID 3000 wrote to memory of 2720	3000	Opclldhj.exe	97
PID 2720 wrote to memory of 1864	2720	Ojhpimhp.exe	98
PID 2720 wrote to memory of 1864	2720	Ojhpimhp.exe	98
PID 2720 wrote to memory of 1864	2720	Ojhpimhp.exe	98
PID 1864 wrote to memory of 3964	1864	Ondljl32.exe	99
PID 1864 wrote to memory of 3964	1864	Ondljl32.exe	99
PID 1864 wrote to memory of 3964	1864	Ondljl32.exe	99
PID 3964 wrote to memory of 4848	3964	Omgmeigd.exe	100
PID 3964 wrote to memory of 4848	3964	Omgmeigd.exe	100
PID 3964 wrote to memory of 4848	3964	Omgmeigd.exe	100
PID 4848 wrote to memory of 4980	4848	Oabhfg32.exe	101
PID 4848 wrote to memory of 4980	4848	Oabhfg32.exe	101
PID 4848 wrote to memory of 4980	4848	Oabhfg32.exe	101
PID 4980 wrote to memory of 5036	4980	Ocaebc32.exe	102
PID 4980 wrote to memory of 5036	4980	Ocaebc32.exe	102
PID 4980 wrote to memory of 5036	4980	Ocaebc32.exe	102
PID 5036 wrote to memory of 3456	5036	Ohlqcagj.exe	103
PID 5036 wrote to memory of 3456	5036	Ohlqcagj.exe	103
PID 5036 wrote to memory of 3456	5036	Ohlqcagj.exe	103
PID 3456 wrote to memory of 224	3456	Pfoann32.exe	104
PID 3456 wrote to memory of 224	3456	Pfoann32.exe	104
PID 3456 wrote to memory of 224	3456	Pfoann32.exe	104
PID 224 wrote to memory of 1028	224	Pnfiplog.exe	105
PID 224 wrote to memory of 1028	224	Pnfiplog.exe	105
PID 224 wrote to memory of 1028	224	Pnfiplog.exe	105
PID 1028 wrote to memory of 3864	1028	Pmiikh32.exe	106

C:\Users\Admin\AppData\Local\Temp\d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe
"C:\Users\Admin\AppData\Local\Temp\d482f26415d025caf65baa88207b2de1d184bdaf0c100b824975677586ddc51cN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\Nclbpf32.exe
  C:\Windows\system32\Nclbpf32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\SysWOW64\Ncnofeof.exe
    C:\Windows\system32\Ncnofeof.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\Nqbpojnp.exe
      C:\Windows\system32\Nqbpojnp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1268
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        27⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        28⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        29⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:452
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        35⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        36⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        37⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2176
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        39⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3904
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        42⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        43⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        45⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2256
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        47⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1396
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        52⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4128
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        54⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:732
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        57⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        58⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        59⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        60⤵
        Executes dropped EXE
        
        PID:3820
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        63⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        64⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:208
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        67⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        68⤵
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2540
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:2284
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        73⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        77⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        78⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        79⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        80⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        81⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        82⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        83⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        84⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        86⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        93⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        94⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4932
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        98⤵
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4872
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        100⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        101⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:1324
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        106⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        107⤵
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        109⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        110⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        111⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        112⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        113⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        114⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        115⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        117⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        118⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        119⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        120⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        122⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        124⤵
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        125⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        126⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        128⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        129⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        130⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        132⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        133⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        134⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        135⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        136⤵
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1060
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        138⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        139⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        141⤵
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        147⤵
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        148⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        149⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        150⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        151⤵
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        153⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1724
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        155⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        157⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        159⤵
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        160⤵
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        161⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        162⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        163⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        164⤵
        Drops file in System32 directory
        
        PID:3424
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        165⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        166⤵
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        167⤵
        Drops file in System32 directory
        
        PID:5012
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        168⤵
        Drops file in System32 directory
        
        PID:3632
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        170⤵
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6184
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        173⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        174⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        175⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        177⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        178⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        179⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6548
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        182⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        183⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        184⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        185⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        186⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        187⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6828
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        190⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        192⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        194⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        195⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        196⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        200⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        202⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        203⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:64
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        205⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        206⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        209⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        210⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        211⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        212⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        213⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        214⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        215⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        217⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6644
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        224⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        225⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        226⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        227⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        228⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7420
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        233⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        235⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        236⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        237⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7960
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        241⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:8056
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        243⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        244⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        245⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        246⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        247⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        248⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        249⤵
        System Location Discovery: System Language Discovery
        
        PID:7544
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        250⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        251⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        253⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        254⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        255⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        258⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:7384
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        262⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        264⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        265⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7952
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        267⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        268⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        269⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        271⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        272⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7716
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        275⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8164
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        277⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        278⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        279⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7760
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        280⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        281⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        284⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        285⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8248
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        286⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        287⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        288⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        289⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        290⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        291⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8556
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        293⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        294⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8684
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        296⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8736
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        297⤵
        Drops file in System32 directory
        
        PID:8784
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        299⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        300⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        301⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        302⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        303⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        304⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        305⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        306⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        307⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8440
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        310⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8568
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        311⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8632 -s 400
        312⤵
        Program crash
        
        PID:8920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8632 -ip 8632
1⤵
PID:8820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acccdj32.exe

Filesize
465KB

MD5
8f6193af870985e39f72b356a6c684f2

SHA1
abfd23a18746e93680a44c21298457f5a50f0192

SHA256
78869bd5238befecaa5763a4804cfa9c0f9aa121225ce5612dc228e56a9c119c

SHA512
aff9d48544d0050dcd582a513d8eca91765f9175fb4b20e3825cbdf268a8de3e6d3253e0d258c3d2133b2374967027f02ad007e9c934d4a7ca94fa9c4ab9ea2e

Download Submit
C:\Windows\SysWOW64\Banjnm32.exe

Filesize
465KB

MD5
f2f851002bf2887e0a2dc12a375a6842

SHA1
4024353ea4760ac0c2c5db9358aef37e57c40755

SHA256
95dd2bfc82d7e75cbb94bf4be24383bc910a66b7b89f6ab41c646f680a60baaa

SHA512
29b4b83bfa5c4d277fc6e3eb2fbf56dd827cec8f3aedfd383720a0af929090c6fe1d361bb99ab7f043ce334116438c127813e4fe458a7a3c990d7f5b2f688acf

Download Submit
C:\Windows\SysWOW64\Bdcmkgmm.exe

Filesize
465KB

MD5
be79fea2f2e464cce773d3056e8078a5

SHA1
438c4c7f497f589d0d72d8813a10889cdfffbbe5

SHA256
56bcb9f640601db9fd8c094abc0c35ed61ce1913a0854133083330c8c4cbef65

SHA512
830ead4805c345a15bb2b9c8fcb516533e36606a0befebb6ceef5f4b3293701976f50fa7b7dceb74f43dd30bafef88dac2ee35879c69528fa1fc415fab051967

Download Submit
C:\Windows\SysWOW64\Ccdihbgg.exe

Filesize
465KB

MD5
695b4f8e22cb075ed0b9c7e0a3ccb896

SHA1
5212dea16bca0a625bab4930560aae0985ef4574

SHA256
2edf0da3cc908826e7d0a4052ef9dcf7b5c36bc9751ee6f9fdf87f4d5e2b61c4

SHA512
d91eaf5f9d2b2b9ce45818031a07d8bb11cf4939448efcd8256614969bd66f234a3f4c9afa2de047021078bd6b004f9e0ea2163ccb2b7788029e5b0ecf86b5ff

Download Submit
C:\Windows\SysWOW64\Cmedjl32.exe

Filesize
465KB

MD5
3d97833bf1b3f92c05d885c9a02bc474

SHA1
a49d91c20f2daecea2a5958a279214dfa2fd9a04

SHA256
988314781b4d6b6165f5dced6f2ac38cc601633190fb20620da2d8c8b2b83220

SHA512
596ecc77fb55c60b9e7f2e9f559446dfcd8f1dbbcce23e1c251bd81f1222f51655176136cb5df4497bf09a040d825d05fcfcbe708b97e7f1431598d154b44012

Download Submit
C:\Windows\SysWOW64\Dggbcf32.exe

Filesize
465KB

MD5
7104556ba1505803a0c8f607d4d3e878

SHA1
bc9efbb9348cdcca1b6be5243271fe0b0ab92270

SHA256
08ac96f9745f17a57f089a0c133c498a620cb5ddd64a78d3236c69c4528b21dd

SHA512
0e37144bc2a7100a4e206a9353d4819b5a1d0cc8a9bcffb66c86846127608748899ceeee7456f1ade23f68d48b8cfb70587267b3996a428369f3d1e1a4376e13

Download Submit
C:\Windows\SysWOW64\Eoepebho.exe

Filesize
465KB

MD5
955e15f7f236bbab8130fa0862cb3374

SHA1
18205a5c63e7f4edc143f312b9265688fbff9df9

SHA256
0c4d7711e556ef600468672ffab619e9e36c711eacb670126f64ae916e2a0494

SHA512
96aadf09ab7667a81316ae7a545181f43c7f5e921c37170f14865763b064743545ea19d43969cfcb46d5f9c2540206b384a1a88102ad03e7b86617268d560296

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
465KB

MD5
489f8457301f0262f607acf67499f1b0

SHA1
e8e1ef03fba2e456fc61cf8ec39ba0ada5e1921b

SHA256
32bc24374874f2e27993940b92c02b58193c44f2b44f279c7cb0ab4f7e5c9958

SHA512
8e55cf21a0f15d86ee8a0eda29a19f90e44e01892491d6b0ba04794d789ce210b0917bb6d4f75b3a5ffa5541c2bce47faa32fcfa92031a9c018b2f3c06b777c1

Download Submit
C:\Windows\SysWOW64\Gacepg32.exe

Filesize
465KB

MD5
92a5f3d48d91652725dc7fcb527d9da0

SHA1
9d9efdf72e8cbe174fdeeebed17429910e94533e

SHA256
12b8c074cbc95a1724ef62a648142f33127ba9311d38903c51187dd0353cc1c8

SHA512
fcb1998ab0941f317b7c6db729eee1f75c413dce5e00d22f21e23b3f11ede2e60df87e360c1d10b7b406225427c41324f79bb92a3b164c1994d53e0f1bac91f0

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
465KB

MD5
61e929a3617f191e36a919a2dba7a92e

SHA1
e97a9552b0454930c7dd0914c3fbf4d0c5fdf0b1

SHA256
f75619a1cc828ff5cda06c291a64581a3f71c4313ca793f5ced1efdd2c8da930

SHA512
920c2da7ba4a5f2bc06f851a4497f8dc10e726f773d227806d2bbf99175902f8ca65685e2da3d04d8bbf23e0cd4728b40a703e2ec7dad2b126b321b7280b5528

Download Submit
C:\Windows\SysWOW64\Gnblnlhl.exe

Filesize
465KB

MD5
540ea5d9b4e890f4293db0decd6269e7

SHA1
f7a0eb827b0093a20ffca56a6ef85f8b45dbc5b2

SHA256
64d86876ed90e8a8ecaf149b35d85378e6aa1fa89406a688c08bb3011746d03c

SHA512
d1c3ebbb0c8f22bfd5676cf52137df685357d66b388395d776ca7f1820282014f8686b2b7425e0fd6187a1a2f2a81fde9aedeae0cdd9f96444625ef3f02d87bc

Download Submit
C:\Windows\SysWOW64\Hnnljj32.exe

Filesize
465KB

MD5
639481f126f199c39ea6ecffc3772b84

SHA1
1099b74f565aa819fc57d6cd52dedaef1b29edba

SHA256
5e9fe7f0ea5276e59f778091ec90e382f0d5caba429fad4972b0288c455b2a92

SHA512
6fe9724f738290892df172dc72236651a95ac7c5d228e88eb97ca528fbdb7ecab49f4623101aa3b8365b124c593cc38ddfc74640f4e2c4e6453bef473e22b3df

Download Submit
C:\Windows\SysWOW64\Iamamcop.exe

Filesize
465KB

MD5
6ad965854b100d86de5dad7cb69eaeb3

SHA1
d5b7fc2016645c32df01db7dde423412bbd0dc0b

SHA256
50fe50b2dfdf310fa7d8746542bb9036764ca13fd237f7b3daddaa9b3cf6a6db

SHA512
12653bd9a405026c4eddcd0740264656ef92d17d01302e0f3471bee66efe3d2cbac5d1cfdba3319833c3da3e317dadb445e71e4d909b62339b79dc09c09261f3

Download Submit
C:\Windows\SysWOW64\Iojkeh32.exe

Filesize
465KB

MD5
0ee9132ecfcf52efb131fb86ba7da110

SHA1
ca112176aa673e9a0643399d5eed1f19e0d324c6

SHA256
39bfe37eee780340edc68e5939bce3bf33cc2f54901d872e43e77a7e7d5315ba

SHA512
4cacd6221e895d078efed3c3ca9044ac852820ec59f5e50a4e3a053f3508015237656b50ae6da1d8bfa860522a2287bed02023480f1be0d0430eed8a5b965ab1

Download Submit
C:\Windows\SysWOW64\Jpgdai32.exe

Filesize
465KB

MD5
035213270a22da4f461457758a0a3dcb

SHA1
c57f39210d98355182d8c28bc4a5aa8c2a2685a5

SHA256
a0334b84c906f66b58715b16402283b194ee47e85d0bc9cf2d297af13c44f536

SHA512
e137384a25a84f1bd854cefd27e9c0acbe6595ce00fb43484990b77448023dac43074b64ae6ff82ac0ee6d7f3a26f52d7cdf85bcc266aaded67bd4176e50800b

Download Submit
C:\Windows\SysWOW64\Kpiqfima.exe

Filesize
465KB

MD5
d804255022a2038d4c9fb86998bfaed0

SHA1
d4be66a5b78df6407882878c596d827189c6e2a6

SHA256
d75b74530c14a0549169afac5c7e40d50eed7d5ff4f2469d6566626137cf5615

SHA512
6c58200dd358178abc215dba5891f9be1d2cfc0bcf8059e5d8e4a61ef2b60a58471b1e7bd00e81fc5ce6ca396eb1b5e4bc148b55a943a7400d5ecf5c020a4fdc

Download Submit
C:\Windows\SysWOW64\Lancko32.exe

Filesize
465KB

MD5
faa28cf07c6b314c2fdb3abf24cd4c7a

SHA1
2b50bbdb6d670b9ebce7b8e156b1a79ad12a6272

SHA256
15579641691e82e8f79ef99880dc8c4445dcc67707f63ea7dff89fd267eab807

SHA512
acffa5ecfb7078ef41860b733be897f4818a14c83f503a9ee2a9c1614cd9afea5d08bb9027870e8582aea645f975c878210cbe123f20d9273a95232fe5a058bb

Download Submit
C:\Windows\SysWOW64\Lojmcdgl.exe

Filesize
465KB

MD5
024f179e68bb066514e239a5bd1d42d5

SHA1
8e369a276828e23bd49f1ac3773346475da53fa4

SHA256
500b31076e7f2cd3798a1aad025d077417ed450ebb4603183cbe2b02e7d01dcf

SHA512
6ce4268a32f5001d53bd43ccf4f1ec486867131f233a7aa076df2ed08f893f13e98846b4e37f3ccb8ad208a9fc4ad340cd70303e63a3e967dde03349d3a5fe34

Download Submit
C:\Windows\SysWOW64\Mapppn32.exe

Filesize
465KB

MD5
1a7e095125e6ee385aff5e13ced7d9ce

SHA1
e3f1cf9274b421fd56a7ca7d895be828bc5b1f9e

SHA256
37173440042959e92acc02a5295c500789e0ae98e8ff73393f53a8ec7e3698e2

SHA512
1cf0ca226580ab708bc6985e76ebb182cea76f89dbe7025f11f9ab258f465a14ba003213fe195b1818f2edefb797c5e103bf36c3610064116ea37b95277a2ab0

Download Submit
C:\Windows\SysWOW64\Mlhqcgnk.exe

Filesize
465KB

MD5
88b39a617375acbd6e41c93204e9a751

SHA1
a35e2ce0bf945dad64463855dbe388704d537562

SHA256
e26c14a196ce8639e58c13c27fae9ac76132b53401253d22ecbf0c70a7ef0f49

SHA512
a285949c7ab60f186af8e6bd3dca7f009fb33df64b5303a0a18d07aae4366b2449e81cb90a9c4ed13a87005dae50da73b0c7724c3aa829e357bb29b797a5e8e3

Download Submit
C:\Windows\SysWOW64\Mqjbddpl.exe

Filesize
465KB

MD5
9f7c0e682098a67d4ffab594cdc4e25c

SHA1
a6e8a4aca95af0e811d1244c18cf72733495386e

SHA256
fbeecfcc8853885f07dec6217f1479d3068dd27a5b795a5c29de119bf9da1d7f

SHA512
0db6651561161bcbd54d730639eb25da42c5fa70cb6b21eb879c044e8316bff0f31d5ca3f6f9e6d5d3ac207c057f07da286529a7e2708beaa06b95ed5d22d768

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
465KB

MD5
bac0841f41054108884df3cbfc16c6e5

SHA1
8d270a83b10944f9737924c4d65f4bb8d76db0a3

SHA256
33894990fcb617acd5ed57c7a853029a0437f2933ffc9b4b461d879627116791

SHA512
e4e9845b663af98ce2d74e7add49f83b61f9645d4414f84bf6e2c20803396e19214455a68abe8d6129e5c671a0f0bccfe97d38b8b82583e8016b00be1a4c3ede

Download Submit
C:\Windows\SysWOW64\Nceefd32.exe

Filesize
465KB

MD5
d05913026eca7ba67072b4997cbf6b3c

SHA1
aff21a0ba2866be94a5cabb648489a5877030f3b

SHA256
7e038826e560b662eafdd56776b3b09acb4ea776fb4c2ba57a2fdb96b3d34c42

SHA512
82554325e22ce486c9cc865e089e29ccc10b77e951fafdfa4fbf3105f4b6a38dd29e0b5af2c2aa45adea46881c529b12364930a7b8d23f6a930e6b44bb100d13

Download Submit
C:\Windows\SysWOW64\Nclbpf32.exe

Filesize
465KB

MD5
558b537a3d239e362fdaf791cccde9b7

SHA1
28eadb207d208ebdb56812908ce4cb438281caff

SHA256
3aca4c7ef9536e945c46099dfb92f357e7fbe75e06c4df1305a133f909c782d8

SHA512
5699a631d0f01be4e28eb846f912a2b76464ca67e17c53e55c7dce215555a974540b9dbb7aac9d32b78b011edd4d29ae894f3896e15c47f344440108f09e3f25

Download Submit
C:\Windows\SysWOW64\Ncnofeof.exe

Filesize
465KB

MD5
62b4ce26c3ea3c0c3dc44a2e0b44b996

SHA1
dc2090ac8bd54c5084b7122e98581be76a56b5a7

SHA256
4fe48ae6c073251ed51010ac324adf57b50719f1d56f933e463a2f0d523d9c0b

SHA512
68442b137797fa0b1685c0c33c8ba262b7973b804d9e50472ceda3a6b6c1408d22e123bb4b1d3c4d67ad371aacd4e1674494b9647544919697461eb53d6afd33

Download Submit
C:\Windows\SysWOW64\Njedbjej.exe

Filesize
465KB

MD5
cfbe0ba345109f85e6c260433a0a3b1d

SHA1
85576c2e108594ba1ef051c9e37fec2666db1741

SHA256
c29ca9a241cb42ab9b181fa6694cadb43f798fa88d718bfad17036b9518d370a

SHA512
b5ab509568c52f2b4766e9c6c811fe731f01c87f13e9ee08d9f53ccd66f5d1144a8a3f5dba0882c430506b8add7d6f28bfc1c472481dbab1b7bcb779b3f6cd13

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
465KB

MD5
6da54c528215b328823fb58288bd767a

SHA1
3801fb4aee608b179dcc06379875636726687f31

SHA256
09def9b90b32f0d9c7d083d427072e52b81b2116382b596889de42e3d474e0da

SHA512
5e7369432ef0ef8d086ca7d4e7da16c4d26c515c18fab7323aeb2d7d630a0caa86930a18178e6b1a8bf072423cf9e00da98ef076d6e584175ea9db0d987a1722

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
465KB

MD5
ff1c5d46c27b61bc743af9ed73a3d99e

SHA1
3fa054f31b2aefd081a4f4fd4867e82fb702c5a5

SHA256
6819580e9c9cdb8d4da0bad183e93b804d779596caf28b794d784f4f9f0f9fcf

SHA512
62d52c59e4a5d2104f8a69992f7a2b247b3f1d5c9d13a2b06a5e681132c3adb5a5072562197c1479cfefd1b674ffe06167633498ab7acbf2a0a7419fc5dddeac

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
465KB

MD5
4afec3bf07ebdd1076e8facf1bd3f518

SHA1
0250bca42f77d9941a924c5864b914531edfde8e

SHA256
7280b712dd733890b5b112e6b1dbb35f82aef885fcadb6d3b62efd1965f088a6

SHA512
1f0fc75fe316534463e5878942aee07ab3965e9d63e7c86bd5c5b4e482aeb2438ddfd11c6d0ce2eefa15915adb7b73fbf6d9e43cb75a211eaecb84c22980ca43

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
465KB

MD5
aa403e3d00e861066e5f286654a00a6a

SHA1
1495c6cabd4127b3ffd56a7efd41464ce8b80199

SHA256
4359d9358e1d6b1e1e1424c3332ae5db46c935b47195dae8d59f08979e06914b

SHA512
2f921c443983e8605615513c831d9361d1194f995a5e5146338a71782a1d2b76380196421ecb048899024c3ea61be543bf71ebae81feef13178924e5456e8c7d

Download Submit
C:\Windows\SysWOW64\Ocaebc32.exe

Filesize
465KB

MD5
d608da4a68c25c05f11edb3c927636cb

SHA1
e2a26e1d734d667115675954085fcb8e2bfabd13

SHA256
2cb34e875f77d69a3a7c88c9ddc1f6655f1b9737a6abd1c6ff0363881f1b053c

SHA512
e4cb5e3f40ad4056052cf0709572ad10418c3cccb53cac587984cf2fdc13d8661fe4e485b950d46df0cb05b792aadee0d90b9096e8ad3c08e6647498bdbee456

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
465KB

MD5
19dd8e8b93f0db8d4137af372e91767e

SHA1
8e826ede1fcf43b010c4a511a11cedc95dff3515

SHA256
da068361e7a03fd79ac8eab4657de6ed396f2f8749ce443eb22f329db00ee647

SHA512
3d088652ce861ffefe4d4705525797feb9ca72596e00ad23cde1ccbefd079a4f715f5c62b42b0724def67fd0d77ecb7efc3a079e327ac20afe59a0ae2ef5ef47

Download Submit
C:\Windows\SysWOW64\Ocnabm32.exe

Filesize
465KB

MD5
3410d7c45f1d2d50438937b5069e77d5

SHA1
d005706369bc240131f9f8d831d1585aa83caed1

SHA256
e6992b6fd09b33e49b7242d97b9829aaa9b0954f3e48d159a555b1f793b19876

SHA512
f3bb0437b010368c275342f479d6d66d609915be376fefc5ffb0841bc6df46323acbcf4f98cb4df84804304e53a26d7f518be1de1a0cf3f1ffb558573090a384

Download Submit
C:\Windows\SysWOW64\Offnhpfo.exe

Filesize
465KB

MD5
df84558fc506c0aa830ff3091db74fd5

SHA1
3a5d725cbd4acbb3afd27516e0680aff4820d5f5

SHA256
9881d969f099394ebae2530e84b42eee0f02aca60f3bcacf25ff0cd651b01fa5

SHA512
659ec45cda05c7611c4603fa79d5a540d98681c74320dc2d4881b6db6490bbfbe55a0a6182dd576b1c54f84c76c8cf683cd4df78b52441b0b075388ffa76e1bc

Download Submit
C:\Windows\SysWOW64\Ofkgcobj.exe

Filesize
465KB

MD5
61b5d9c470edb9336a2036f42e6706c9

SHA1
b99b60cac64c4552840f12e70008ffe5521ef9d8

SHA256
e4c1f5d08040fc6ef1d91e4e025f7796b1b8de752af0b2a7b0ea1e786db42c76

SHA512
b6f363dcd9e6991c79c5cf70dda5d394455565cbc08fe05e43580eb85aa4621d73b8e5fc2ee4c94c95faf21c294ff592539eae2cedf43650398cea22d4c35998

Download Submit
C:\Windows\SysWOW64\Ohlqcagj.exe

Filesize
465KB

MD5
76bb27298f67aa7954e347ac15d38969

SHA1
503d51ca8d0341322efc8f97f33573cc73b4a2ef

SHA256
404966494396fd32d67de70ade1e7b500172c51787210db5e94e2fc22dd013f5

SHA512
3cd8d61c688c9b2955b93dc495ce4c0c8541073880aa149387e313eddbe520cb454bb17712869db82cf85d88630550d6bcbb6eabd7c00d87365a1e5a13f0b892

Download Submit
C:\Windows\SysWOW64\Oifppdpd.exe

Filesize
465KB

MD5
48caf27ceac3b21cfd8a696dd0f4f804

SHA1
73e154286e878783e0f6e1ccae6d33ac6bcc2515

SHA256
314f563975ae7446a165dece7a30c8a604a0d6825a8fc86c4b03c672c240b29e

SHA512
ae1d70b069ab46369bfd4a0724a6fd9ce5413d829aaa106d63f108d8ba7cb5220d6f27e4f0cdab82df16c521ab907855920f98b089cc7d7aae05cafe4b6cadc8

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
465KB

MD5
d8e4ee6874f3cf6410d06a7d7cd77028

SHA1
00d02c18de4a85db09f5d830fd82b5e925b7d3b0

SHA256
ef67a76663a1280a2540f8511f4626eb2fa1e695d1bfbf8bd0f3971b7463c1ec

SHA512
438ff0bf397d9040c6c6a7c3e2b66438092b83519c6c4f752e4e0b8c132be6fe8367f248327bfce1bf714dfcc1eca92df6ddf165a78e0df4ff5fe57e36d8767f

Download Submit
C:\Windows\SysWOW64\Omgmeigd.exe

Filesize
465KB

MD5
fe06a93dbf5d3eac7058c2eae4870c25

SHA1
5feb3b3996e56eefdca00f4a3afed75e7471ffd4

SHA256
b875955d00712837c436021c5dafa5daa6eb11bd8f3402531d2a5c471c2b3bea

SHA512
34fca880af84636250e5f374806ee614a146ef1b3f2f4e8ad22f7099bc2d53d7ac267778864971ccf924941b7bc7434902f0bb25df3eeb41edd6a8bea45aa404

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
465KB

MD5
f83d3b7999f78d29fc2d4882b433ee3d

SHA1
dc9fc7949c9a4ab88e55ac784bcc620bfad9f5dd

SHA256
121a337303f8a336b5e5117dc17c4c02bcf353a0c95783e848872c0ee46dab1f

SHA512
d52636c76a7d46bd92f2a5254d81dd124317242bd53f39ca9b3d5adb7dc0ae16d92c4d762c2bc12bac52c57a892e279cc82935458a25740093072b401e98ff0a

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
465KB

MD5
062e2ff686f07b3295c9ab4ac067c5d4

SHA1
39b8fd100eab6246a8428dbcae81d32e7f003fe2

SHA256
deae6317146d95c5b580c65e1b0ae1a1e1ac73e638d3add2aa55a7b1cc24db13

SHA512
ab3235b56c96297e56bdc5c0418a66a193cbf61137b0ac12078716ea23eecc164d4f3f24de4760a8275befa8caf2a510c067f14d64180a509d622f65f7827c1f

Download Submit
C:\Windows\SysWOW64\Ooibkpmi.exe

Filesize
465KB

MD5
d7e51291625125590a37ef45763aabf1

SHA1
86029b6c119295bda138d706f8e538614308fa47

SHA256
719c62927a78fa91269bcef97eb8c8e15173e98deafb5c09e1602c85cfabd173

SHA512
293eb03a73cf72c2242b2525f8dd710fc29c6f3570864c02fbee7ebc2c12efb720d425e61cef57f16e2a215a3b7a0cd856395a67f159ea5bc76c254020c5f201

Download Submit
C:\Windows\SysWOW64\Oonlfo32.exe

Filesize
465KB

MD5
6235a80097fa77a15c53682540669ae8

SHA1
e7c0f004585298d582407a487c4cf8c3b73dd360

SHA256
77de7cd68540de751b7e98e423592771c21d1be5c1a31acfbf0b00f8086b4b94

SHA512
644b99dafe5b75a5ff7d04563fa2f22c7d0f8922df456461aa5a6a9fd00b3941b82e7ced30d8481e62ff825b7472fd7de4fc4d9eb5d9e088110e49b809cbf9c5

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
465KB

MD5
75e6669afcec39e9ea6d77b5c42b1a76

SHA1
7c85ea25c65c97a110688326356dd5588edc8f69

SHA256
a33dd66c722ad6f0696f5407d5187444a0d81703589adcb00614f3b47ee0c793

SHA512
324745091004c2d086fe61363177152d07d9ef5f19ed16351ee54ee332dbae810c4f1fb3dbedc2a7ce966bd7ae4b9db33478f23ecc693c60604b3e767b3f20ef

Download Submit
C:\Windows\SysWOW64\Paeelgnj.exe

Filesize
465KB

MD5
fd85444b9b86b0e9274274a083fa1a8a

SHA1
b5da32e189ed174e9d36ec5d42989e9aa1b05290

SHA256
3da0604645cbb10eed43d11cb0f8c80d7434c857f57def1a0f3115ada8eba482

SHA512
178f3deb5c99e69cba16c089a33ff97e2056d37616e36e8a4c62f5c16f8c2423b0de8b1f9762b95e17b739018d56a79f9cda73db10c39a19df4c6db225c760d8

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
465KB

MD5
9fa0a25dbaad49ffb9c6b89df4c657fa

SHA1
8cf3d38bee861806bea6cf7cacf0e1be478d8f84

SHA256
d4022fb0137b7c08ff54f745b18fa7124d505468067a9080c1e68b37147b1c59

SHA512
40262efee0036e4d0571183e0a08560f82d322dbff5ef3d2f458b846344418526db597da11e5d704f4b16bcfb0ecc7b93a0698b1b25bc3fee1a4a9936c26d33c

Download Submit
C:\Windows\SysWOW64\Pbekii32.exe

Filesize
465KB

MD5
5f7aded29ccf86addf151aaaae24b838

SHA1
65526050b754ccce54d9ebcbb993a60f207e7ef7

SHA256
ad0941a9c1d5f153d6f433637c787ef993298eb345d8977d2cb4367411c23b50

SHA512
f390809a189c047d151b6dc7d47533bcf53240e528e1c19f77fd7ac04c27effccc3841b145ea6efb008bd75bbaa2446bc012abe4fae04848fb174ce6a45a4f16

Download Submit
C:\Windows\SysWOW64\Pccahbmn.exe

Filesize
465KB

MD5
2300953a066f654550808b1d3fa18766

SHA1
72ac28eca750077a57ba0ba04e896a91ed9d0b38

SHA256
1a3a013fe06300663fae3075843b5c5aae67454a8725d2d21699e33fe86a2b9a

SHA512
20b6a8a30d20d5e03a838c3d774e2324027b84356e0676ac3622c694dea7a2eb8a297b54dcc235a2611e9ca8c2e83317915894c9c472d90ef03713e597f21949

Download Submit
C:\Windows\SysWOW64\Pfandnla.exe

Filesize
465KB

MD5
c1315b18926bd0003e56370303b00382

SHA1
a8f2aca1944222188f55fa40d8541563ce98c8f3

SHA256
e28d20c8c79b1cbf38efa66c4e3a84299c69725f1074a58004dc0ae804145d91

SHA512
48185157a6cded1b770ccae85bac54c800c6295b1e2a08c4fb860f6daad4e64a46bad9c626ee7f9a6b2bac7da1450c2d6c46b812e7cd1b4888ba170bfd7605b0

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
465KB

MD5
0f0af468f5c0b920040d1e1f362ef631

SHA1
dd9dc77ef1fd848ee75ad1743aa0981bb11e447b

SHA256
509d9d52dc76f46126b18acb3f57f335616c290d5ca0f5d9ef39e407f31c06a1

SHA512
19d77df877878734d77c214612959a50157f5f57aa51b7872404fa19c6dd0e35db5d24f51994a6460c5a5df8a786494f9fe924b59a8b8140dbb1402f71106874

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
465KB

MD5
84af384ce44613bd332fda470c5b3615

SHA1
0e710f09edc0746c9aca75fffb00618839262c86

SHA256
ae35211e01e06e501ddd2d3a617735d38fa512562f349d7b8c1f298f800fca69

SHA512
663eb72cda7bd971b062fcfa802ec8b036a92bbfe80fb6a4b1615cbf51d42e6f4a564bf92a6af913696e07c8707b0fb3bf1b6edf6867d14f3e6cb9de70103809

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
465KB

MD5
370fd5a88f22173f8ab02fbfe74cd639

SHA1
df27d54abb05e50d8d8f07ac8e44041c780a58d0

SHA256
cf20b8e6023fbb96d464019670593499198200228fca70b098f5696663ede8aa

SHA512
bb53553324580c688d1566f336a54b8bfe4cd88154d50c09fc4a859b1d134ec4d72cc08311c82901e14360e77415e9a9b8db8c86ef6b66f2aef93e89302e8833

Download Submit
C:\Windows\SysWOW64\Phonha32.exe

Filesize
465KB

MD5
7fe20e581c4daebf25217174ea5808d8

SHA1
b88896945f561907ee18aae744a45b1d23708a53

SHA256
1ee81f871d353b7918430700e5a1815290f23bec34e98193661655ce7ee913e1

SHA512
757feba1e368ddd254ef8c0112ce6c14095c2a22acf77635300b3e4a086644ecda4c6a461c58a4760eef4ef033acb56bf59301efbce5c02743a1665345052f45

Download Submit
C:\Windows\SysWOW64\Pjmjdm32.exe

Filesize
465KB

MD5
92da1f8b740205172db4615814a3407b

SHA1
0ab659bc76f3233c6433646e233c1549838c8c77

SHA256
b48d3eb88ee97155d04a2ead0116a30cac4e40ebbca49865a7c0ac0ff4d8e01d

SHA512
0140a6b555493d2ae05219c1cb8fe4854d992e25974884f04d47660c0246e667cdcea6121c467376f08a00de45f927e37fb2db4388a43dc26a65c8a64a35452f

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
465KB

MD5
6704600a59530e50cd0ca1456bf8c0e0

SHA1
54af22f5ee602943c06f34eb450ed23deeb1b122

SHA256
2cf35c2708971618f93b4fd4fa95a83860ae48289bcd68cca6639cf627ecd14b

SHA512
5aeb513f5164266d10acf54def0d5ee92b11658880c33b9e1677eefd312f4222d7ad613e59ac9ddbc6f2db38abf2d9c3dce4184496e81f68d9b71dc4329285a2

Download Submit
C:\Windows\SysWOW64\Pmlfqh32.exe

Filesize
465KB

MD5
d624742c9681c9c762afd38f1d716d9e

SHA1
692740666469f1437a279572f7b27c287fb72c3e

SHA256
f739843d32379780a94f95edc17a6b2348b4100651a83544a951dfabc09f4081

SHA512
64c42a464e83a7bafe49266f03e18038b9af1298e811a8d845e210df21aa49664f9e4994cee76563caa2d501a1695a0d80c2931c839dc5087228fc1ae3ffb0ae

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
465KB

MD5
edfe363339d56e42fd811fa26b5be7f7

SHA1
5c25acd857ec175bff55a706e533af7ac5a329f7

SHA256
28578b15c3357762a3b4aaf4b142d47b4800ce689be893133d618eedee2c97cb

SHA512
6bf5f84e79d4aa176326937ed361d890963688d79da2c1cac3c6ce1daf250883f36a090eb0c367be3dd538317736fb685e4e6c4d953a8ab68d0802aeae8d7220

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
465KB

MD5
cc131ff0b5ae05890fa49219d29b35f4

SHA1
4ac74c0bcdcb398931119c1c5265e8ad823a2615

SHA256
038488854df87c9361e4fcd14623be9dbac047a1b76ae54729b21575ae0e7879

SHA512
ed9915bdda9749753d0392cdb9483e530a2b83034a3106ed6ad974d8a40cc703b4c750db5a947b0bfca857ddc8404a152e66fdef52cdd866768ba85335b9832f

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
465KB

MD5
a4080722af943641906b9c58148bec80

SHA1
0d48e2af6b1f9a5c8c200271e001b7d7f0c80cf1

SHA256
700df962348a300c0822de777ba3c1738902afa929ab4966f393053825bbd636

SHA512
5b578ad2e2381a02a4358fa2f7e4fb8a4403f9ad72cd1753667fcedb390fe177e526ec5e9cebfa8baf7a70e53c1bb585639fdfa0e309163108da688b0e8794f5

Download Submit
memory/208-458-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/224-164-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/428-470-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/452-251-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/732-391-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/740-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/740-554-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1028-172-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1072-385-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1176-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1176-561-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1232-260-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1268-187-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1292-416-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1396-368-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1864-116-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2124-398-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2148-40-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2148-582-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2156-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2160-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2160-596-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2176-289-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-452-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2252-332-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2256-337-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2284-482-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-569-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2540-476-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-590-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2720-107-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2820-196-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2880-283-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3000-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3024-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3024-548-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3068-271-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3176-409-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3364-319-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3388-326-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3428-404-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3456-155-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3480-235-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3500-446-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3580-350-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3640-374-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3684-243-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3820-422-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3864-179-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3904-302-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3964-123-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4000-464-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4124-227-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4128-380-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4244-278-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4252-266-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4364-575-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4364-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-314-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4492-434-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4508-295-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4512-440-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4528-308-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4640-344-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4660-204-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4752-362-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4772-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4776-211-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4848-131-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4856-356-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4912-428-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4948-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4968-220-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4980-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5036-148-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5148-488-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5188-494-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5228-500-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5268-506-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5308-512-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5348-518-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5388-524-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5428-530-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5468-536-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5508-542-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5548-549-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5588-556-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5636-563-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5680-570-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5720-577-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5768-584-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5812-591-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5852-598-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/8632-2068-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads