berbew | 8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592

Analysis

max time kernel
110s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592N.exe
Size

163KB
MD5

b802547d023de946e5ac9695ff4ae290
SHA1

78cb6cf89fcfa6ef6696b1a4700d5bf98f1f8a8f
SHA256

8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592
SHA512

afe11a410001d5c8713bf6a934f1360321eec64375bcc4ebbc2b86df514a15d87e80f28a6948296e4abb32d4d501eb4b323c11de48d45aa3bb51161feae7c819
SSDEEP

1536:PDfbQxdA+RuVTuLH1sTV4Df61NylProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:AdA+VyTV4DSyltOrWKDBr+yJb

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqpamb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oogpjbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnbklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcmbee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqknkedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbpjaeoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbjkkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpbmfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pekbga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaflgago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bckkca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpjcgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdoihpbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oondnini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckfphc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbajbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgjlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpabni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naecop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkgeoklj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnbklm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlggjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Illfdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bemqih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjellmbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dihlbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmhand32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmqmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adkgje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmeede32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nobdbkhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejalcgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqfngd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnfgcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emphocjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igigla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajbmdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naecop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igbalblk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeehkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmkigh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjjbjd32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1832	Gkgeoklj.exe
4300	Gdoihpbk.exe
3200	Ggnedlao.exe
1824	Gpfjma32.exe
5032	Ghmbno32.exe
1096	Gnlgleef.exe
2688	Hkpheidp.exe
412	Hajpbckl.exe
4688	Hkbdki32.exe
4736	Hpomcp32.exe
2248	Hdkidohn.exe
1476	Hkgnfhnh.exe
4552	Hnfjbdmk.exe
1584	Hnhghcki.exe
4104	Iklgah32.exe
1444	Iddljmpc.exe
2980	Ijadbdoj.exe
3056	Igedlh32.exe
3628	Ijcahd32.exe
4904	Idieem32.exe
4644	Inainbcn.exe
2160	Iqpfjnba.exe
2764	Igjngh32.exe
3604	Ikejgf32.exe
3196	Indfca32.exe
4848	Jdnoplhh.exe
1008	Jglklggl.exe
408	Jkhgmf32.exe
4588	Jnfcia32.exe
4280	Jqdoem32.exe
3848	Jhlgfj32.exe
2756	Jkjcbe32.exe
1496	Jjmcnbdm.exe
740	Jbdlop32.exe
2084	Jdbhkk32.exe
2948	Jgadgf32.exe
3180	Jklphekp.exe
4428	Jnkldqkc.exe
4452	Jbfheo32.exe
1080	Jdedak32.exe
4444	Jgcamf32.exe
4852	Jnmijq32.exe
3992	Jqlefl32.exe
3752	Jibmgi32.exe
1524	Kbmoen32.exe
2960	Kgjgne32.exe
4032	Kqbkfkal.exe
4996	Kkhpdcab.exe
2276	Kaehljpj.exe
3580	Kgopidgf.exe
4664	Kbddfmgl.exe
3324	Kgamnded.exe
3464	Lbgalmej.exe
2164	Lgcjdd32.exe
4136	Lnnbqnjn.exe
876	Lgffic32.exe
4472	Lankbigo.exe
4376	Lldopb32.exe
4844	Lnbklm32.exe
4744	Llflea32.exe
912	Lndham32.exe
3988	Leopnglc.exe
2920	Ljkifn32.exe
4008	Mlkepaam.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hajpbckl.exe	Hkpheidp.exe
File created	C:\Windows\SysWOW64\Ocaegbjb.dll	Idieem32.exe
File created	C:\Windows\SysWOW64\Gpaoobkd.dll	Cimmggfl.exe
File created	C:\Windows\SysWOW64\Icpkgc32.dll	Hiiggoaf.exe
File created	C:\Windows\SysWOW64\Alelqb32.exe	Adndoe32.exe
File created	C:\Windows\SysWOW64\Indfca32.exe	Ikejgf32.exe
File created	C:\Windows\SysWOW64\Mhaimehd.dll	Bckkca32.exe
File opened for modification	C:\Windows\SysWOW64\Djhimica.exe	Dbqqkkbo.exe
File opened for modification	C:\Windows\SysWOW64\Cimmggfl.exe	Cbbdjm32.exe
File opened for modification	C:\Windows\SysWOW64\Jdnoplhh.exe	Indfca32.exe
File created	C:\Windows\SysWOW64\Gefklj32.dll	Hehkajig.exe
File created	C:\Windows\SysWOW64\Kjjbjd32.exe	Kjgeedch.exe
File created	C:\Windows\SysWOW64\Dnkdmlfj.dll	Ahofoogd.exe
File created	C:\Windows\SysWOW64\Jdbhkk32.exe	Jbdlop32.exe
File created	C:\Windows\SysWOW64\Pjajmpkj.dll	Iggjga32.exe
File opened for modification	C:\Windows\SysWOW64\Oacoqnci.exe	Omgcpokp.exe
File opened for modification	C:\Windows\SysWOW64\Pkegpb32.exe	Pefabkej.exe
File opened for modification	C:\Windows\SysWOW64\Ebnfbcbc.exe	Efgemb32.exe
File created	C:\Windows\SysWOW64\Acmobchj.exe	Akffafgg.exe
File opened for modification	C:\Windows\SysWOW64\Ijcjmmil.exe	Igdnabjh.exe
File created	C:\Windows\SysWOW64\Doogdl32.dll	Nelfeo32.exe
File opened for modification	C:\Windows\SysWOW64\Deqcbpld.exe	Dngjff32.exe
File created	C:\Windows\SysWOW64\Koaagkcb.exe	Kjeiodek.exe
File created	C:\Windows\SysWOW64\Ijcahd32.exe	Igedlh32.exe
File opened for modification	C:\Windows\SysWOW64\Iqpfjnba.exe	Inainbcn.exe
File created	C:\Windows\SysWOW64\Nknobkje.exe	Nafjjf32.exe
File created	C:\Windows\SysWOW64\Fpbmfn32.exe	Ejfeng32.exe
File created	C:\Windows\SysWOW64\Pddhbipj.exe	Paelfmaf.exe
File created	C:\Windows\SysWOW64\Gkbofaoj.dll	Eiaoid32.exe
File created	C:\Windows\SysWOW64\Gaigbkko.dll	Fmndpq32.exe
File created	C:\Windows\SysWOW64\Oloahhki.exe	Oeehkn32.exe
File created	C:\Windows\SysWOW64\Iddljmpc.exe	Iklgah32.exe
File created	C:\Windows\SysWOW64\Iqpfjnba.exe	Inainbcn.exe
File created	C:\Windows\SysWOW64\Pkenjh32.exe	Phganm32.exe
File created	C:\Windows\SysWOW64\Jebqacjl.dll	Nemmoe32.exe
File created	C:\Windows\SysWOW64\Oondnini.exe	Nhdlao32.exe
File opened for modification	C:\Windows\SysWOW64\Lklbdm32.exe	Kqfngd32.exe
File created	C:\Windows\SysWOW64\Phaahggp.exe	Poimpapp.exe
File created	C:\Windows\SysWOW64\Fofdocoe.dll	Dbpjaeoc.exe
File created	C:\Windows\SysWOW64\Efpomccg.exe	Deqcbpld.exe
File created	C:\Windows\SysWOW64\Nobdbkhf.exe	Mldhfpib.exe
File created	C:\Windows\SysWOW64\Pekbga32.exe	Papfgbmg.exe
File created	C:\Windows\SysWOW64\Fdflahpe.dll	Bljlfh32.exe
File created	C:\Windows\SysWOW64\Idcepgmg.exe	Iinqbn32.exe
File created	C:\Windows\SysWOW64\Bfllfd32.dll	Kkgiimng.exe
File created	C:\Windows\SysWOW64\Pfabjq32.dll	Gejopl32.exe
File created	C:\Windows\SysWOW64\Gkjcgjio.dll	Jcoaglhk.exe
File opened for modification	C:\Windows\SysWOW64\Nbqmiinl.exe	Nemmoe32.exe
File created	C:\Windows\SysWOW64\Dpgnjo32.exe	Dmhand32.exe
File created	C:\Windows\SysWOW64\Jqknkedi.exe	Jknfcofa.exe
File created	C:\Windows\SysWOW64\Qkicbhla.dll	Coqncejg.exe
File opened for modification	C:\Windows\SysWOW64\Codhnb32.exe	Cbphdn32.exe
File created	C:\Windows\SysWOW64\Fnoimo32.dll	Fpggamqc.exe
File opened for modification	C:\Windows\SysWOW64\Nccokk32.exe	Naecop32.exe
File created	C:\Windows\SysWOW64\Cdlqqcnl.exe	Cnahdi32.exe
File opened for modification	C:\Windows\SysWOW64\Koaagkcb.exe	Kjeiodek.exe
File created	C:\Windows\SysWOW64\Lnnbqnjn.exe	Lgcjdd32.exe
File created	C:\Windows\SysWOW64\Okjnnj32.exe	Oemefcap.exe
File opened for modification	C:\Windows\SysWOW64\Efpomccg.exe	Deqcbpld.exe
File created	C:\Windows\SysWOW64\Lnmodnoo.dll	Npepkf32.exe
File created	C:\Windows\SysWOW64\Jkjcbe32.exe	Jhlgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Llflea32.exe	Lnbklm32.exe
File created	C:\Windows\SysWOW64\Hnoigi32.dll	Oimkbaed.exe
File created	C:\Windows\SysWOW64\Ioqgiibk.dll	Hdokdg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10904	10824	WerFault.exe	506

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiaoid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkalplel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjeiodek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfjfecno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdjinjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcecjmkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oondnini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahjgjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbajbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmfnpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giinpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcdala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nelfeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oobfob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onnmdcjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hehkajig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Malgcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Polppg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djqblj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkicaahi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlmdbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jddnfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqknkedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkphhgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbdlop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbfheo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bombmcec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbqqkkbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlieda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iklgah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdbhkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meefofek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnahdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbphg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpggamqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfghg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alelqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeheqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmeede32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jljbeali.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qohpkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Codhnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbeapmll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkmdecbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kclgmq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eokqkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elnoopdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdjibj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igbalblk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnkpnclp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbpjaeoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndflak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdgged32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgdpni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcahmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igpdfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iggjga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmieae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lggldm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqafhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogjdmbil.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdkidohn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgpqgeo.dll"	Mminhceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpomcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llflea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pefabkej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhal32.dll"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nobdbkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncndec32.dll"	Papfgbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfpfngma.dll"	Gigaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fopjdidn.dll"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfkjii32.dll"	Jhlgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oipckj32.dll"	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gghocf32.dll"	Nhbolp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjebhadm.dll"	Qohpkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkdliame.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkbofaoj.dll"	Eiaoid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhcmlj32.dll"	Ijcjmmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfllfd32.dll"	Kkgiimng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maiccajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggamph32.dll"	Djhimica.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fideeaco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgdojhec.dll"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jncoikmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehighp32.dll"	Igedlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nknobkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfigpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlmcka32.dll"	Hmpjmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfifmo32.dll"	Dfjpfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqehjpfj.dll"	Deqcbpld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpchib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpbkpm32.dll"	Dcigeooj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekgliip.dll"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qadoba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lndagg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnkldqkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdidcm32.dll"	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofhjkmkl.dll"	Maiccajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcbfe32.dll"	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmoijje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpdcag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hijjli32.dll"	Kbddfmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjnafk32.dll"	Mnnkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olijhmgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcecjmkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgopidgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfnoiid.dll"	Jddnfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmmolepp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcncmnn.dll"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mknjbg32.dll"	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkgiimng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfcabp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1832	2616	8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592N.exe	84
PID 2616 wrote to memory of 1832	2616	8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592N.exe	84
PID 2616 wrote to memory of 1832	2616	8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592N.exe	84
PID 1832 wrote to memory of 4300	1832	Gkgeoklj.exe	85
PID 1832 wrote to memory of 4300	1832	Gkgeoklj.exe	85
PID 1832 wrote to memory of 4300	1832	Gkgeoklj.exe	85
PID 4300 wrote to memory of 3200	4300	Gdoihpbk.exe	86
PID 4300 wrote to memory of 3200	4300	Gdoihpbk.exe	86
PID 4300 wrote to memory of 3200	4300	Gdoihpbk.exe	86
PID 3200 wrote to memory of 1824	3200	Ggnedlao.exe	87
PID 3200 wrote to memory of 1824	3200	Ggnedlao.exe	87
PID 3200 wrote to memory of 1824	3200	Ggnedlao.exe	87
PID 1824 wrote to memory of 5032	1824	Gpfjma32.exe	88
PID 1824 wrote to memory of 5032	1824	Gpfjma32.exe	88
PID 1824 wrote to memory of 5032	1824	Gpfjma32.exe	88
PID 5032 wrote to memory of 1096	5032	Ghmbno32.exe	89
PID 5032 wrote to memory of 1096	5032	Ghmbno32.exe	89
PID 5032 wrote to memory of 1096	5032	Ghmbno32.exe	89
PID 1096 wrote to memory of 2688	1096	Gnlgleef.exe	91
PID 1096 wrote to memory of 2688	1096	Gnlgleef.exe	91
PID 1096 wrote to memory of 2688	1096	Gnlgleef.exe	91
PID 2688 wrote to memory of 412	2688	Hkpheidp.exe	93
PID 2688 wrote to memory of 412	2688	Hkpheidp.exe	93
PID 2688 wrote to memory of 412	2688	Hkpheidp.exe	93
PID 412 wrote to memory of 4688	412	Hajpbckl.exe	94
PID 412 wrote to memory of 4688	412	Hajpbckl.exe	94
PID 412 wrote to memory of 4688	412	Hajpbckl.exe	94
PID 4688 wrote to memory of 4736	4688	Hkbdki32.exe	95
PID 4688 wrote to memory of 4736	4688	Hkbdki32.exe	95
PID 4688 wrote to memory of 4736	4688	Hkbdki32.exe	95
PID 4736 wrote to memory of 2248	4736	Hpomcp32.exe	96
PID 4736 wrote to memory of 2248	4736	Hpomcp32.exe	96
PID 4736 wrote to memory of 2248	4736	Hpomcp32.exe	96
PID 2248 wrote to memory of 1476	2248	Hdkidohn.exe	97
PID 2248 wrote to memory of 1476	2248	Hdkidohn.exe	97
PID 2248 wrote to memory of 1476	2248	Hdkidohn.exe	97
PID 1476 wrote to memory of 4552	1476	Hkgnfhnh.exe	98
PID 1476 wrote to memory of 4552	1476	Hkgnfhnh.exe	98
PID 1476 wrote to memory of 4552	1476	Hkgnfhnh.exe	98
PID 4552 wrote to memory of 1584	4552	Hnfjbdmk.exe	99
PID 4552 wrote to memory of 1584	4552	Hnfjbdmk.exe	99
PID 4552 wrote to memory of 1584	4552	Hnfjbdmk.exe	99
PID 1584 wrote to memory of 4104	1584	Hnhghcki.exe	100
PID 1584 wrote to memory of 4104	1584	Hnhghcki.exe	100
PID 1584 wrote to memory of 4104	1584	Hnhghcki.exe	100
PID 4104 wrote to memory of 1444	4104	Iklgah32.exe	101
PID 4104 wrote to memory of 1444	4104	Iklgah32.exe	101
PID 4104 wrote to memory of 1444	4104	Iklgah32.exe	101
PID 1444 wrote to memory of 2980	1444	Iddljmpc.exe	102
PID 1444 wrote to memory of 2980	1444	Iddljmpc.exe	102
PID 1444 wrote to memory of 2980	1444	Iddljmpc.exe	102
PID 2980 wrote to memory of 3056	2980	Ijadbdoj.exe	103
PID 2980 wrote to memory of 3056	2980	Ijadbdoj.exe	103
PID 2980 wrote to memory of 3056	2980	Ijadbdoj.exe	103
PID 3056 wrote to memory of 3628	3056	Igedlh32.exe	104
PID 3056 wrote to memory of 3628	3056	Igedlh32.exe	104
PID 3056 wrote to memory of 3628	3056	Igedlh32.exe	104
PID 3628 wrote to memory of 4904	3628	Ijcahd32.exe	106
PID 3628 wrote to memory of 4904	3628	Ijcahd32.exe	106
PID 3628 wrote to memory of 4904	3628	Ijcahd32.exe	106
PID 4904 wrote to memory of 4644	4904	Idieem32.exe	107
PID 4904 wrote to memory of 4644	4904	Idieem32.exe	107
PID 4904 wrote to memory of 4644	4904	Idieem32.exe	107
PID 4644 wrote to memory of 2160	4644	Inainbcn.exe	108

C:\Users\Admin\AppData\Local\Temp\8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592N.exe
"C:\Users\Admin\AppData\Local\Temp\8ea954e3bf56d8454d05ae6cb48b9274044fd44856c0696110a28e0f11c50592N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\Gkgeoklj.exe
  C:\Windows\system32\Gkgeoklj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\Gdoihpbk.exe
    C:\Windows\system32\Gdoihpbk.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\SysWOW64\Ggnedlao.exe
      C:\Windows\system32\Ggnedlao.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
      - C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        23⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        24⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3604
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        27⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        28⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        29⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        30⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        31⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        33⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        34⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:740
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        37⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        38⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        41⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        42⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        43⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        44⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        45⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        46⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        47⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        48⤵
        Executes dropped EXE
        
        PID:4032
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        49⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        50⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        53⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        56⤵
        Executes dropped EXE
        
        PID:4136
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        57⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        58⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        59⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4844
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        62⤵
        Executes dropped EXE
        
        PID:912
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        63⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        64⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        65⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        66⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        67⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        68⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        70⤵
        Modifies registry class
        
        PID:380
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2336
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        73⤵
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        75⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        76⤵
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        77⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        78⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        79⤵
        Drops file in System32 directory
        
        PID:804
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        80⤵
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        81⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        82⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        83⤵
        Drops file in System32 directory
        
        PID:2388
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:208
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        86⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        87⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        88⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3704
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        90⤵
        Modifies registry class
        
        PID:376
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        91⤵
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        92⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        93⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        95⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        96⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        97⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        98⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        99⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        101⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        104⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        105⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        106⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        107⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        109⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        110⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        111⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        112⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        114⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        115⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        116⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        117⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        118⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        119⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        121⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        122⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        124⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        125⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        126⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        128⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        129⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        130⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        131⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        133⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        135⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        138⤵
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        143⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        145⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        146⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        149⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        150⤵
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        151⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        152⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        153⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        154⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        155⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        157⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        159⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        161⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        164⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        165⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        167⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        168⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        169⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        170⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        173⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        174⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        175⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6700
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        180⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        181⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        182⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        183⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        186⤵
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        188⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        189⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        190⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        191⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        194⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6840
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        196⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        197⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        198⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        199⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        200⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        202⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        203⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        204⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        205⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        206⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        207⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        208⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7396
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        210⤵
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7476
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        212⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        213⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7600
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        215⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        216⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        219⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7852
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        221⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7940
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        223⤵
        Drops file in System32 directory
        
        PID:7980
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        224⤵
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        225⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        226⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        227⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        228⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        229⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        231⤵
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        232⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        233⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        234⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        235⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        236⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        237⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        239⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        240⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        241⤵
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7444
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        243⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        245⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        246⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        247⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7184
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        249⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        251⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        252⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        254⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        255⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        256⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        258⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:7696
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        260⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8236
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        262⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        263⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        264⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        265⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        266⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        267⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        268⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        269⤵
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        270⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        271⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        272⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8684
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        273⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        274⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        277⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        278⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        279⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:9012
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:9052
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:9100
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9140
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        284⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        287⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        288⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        289⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        290⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        291⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        292⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        293⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        294⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        296⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        297⤵
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        298⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        299⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9020
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        301⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        302⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        303⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        304⤵
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        305⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        306⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8380
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        307⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        308⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        309⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        310⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        311⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        312⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1336
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9128
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        315⤵
        Drops file in System32 directory
        
        PID:9196
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1512
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        319⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        320⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        321⤵
        Modifies registry class
        
        PID:8996
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        322⤵
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:9168
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        324⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        325⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        326⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        327⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        328⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        329⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        330⤵
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        333⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        334⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:9224
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        336⤵
        Drops file in System32 directory
        
        PID:9268
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        337⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        338⤵
        Modifies registry class
        
        PID:9352
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        339⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        340⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        341⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9496
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        343⤵
        System Location Discovery: System Language Discovery
        
        PID:9532
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        344⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        345⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        346⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        347⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9744
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        349⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9784
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:9820
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        351⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        352⤵
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9928
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9964
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        355⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        356⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        357⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        358⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        359⤵
        Drops file in System32 directory
        
        PID:10208
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        361⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        362⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9348
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        363⤵
        Modifies registry class
        
        PID:9420
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        364⤵
        System Location Discovery: System Language Discovery
        
        PID:9484
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        365⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9560
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        366⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        367⤵
        Drops file in System32 directory
        
        PID:9712
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        369⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        370⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        371⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        372⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        373⤵
        System Location Discovery: System Language Discovery
        
        PID:10080
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        374⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        375⤵
        System Location Discovery: System Language Discovery
        
        PID:3236
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        376⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        377⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        378⤵
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        379⤵
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        380⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        381⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        382⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9844
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        383⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        384⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        385⤵
        Modifies registry class
        
        PID:10116
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        386⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        387⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        388⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        389⤵
        System Location Discovery: System Language Discovery
        
        PID:9736
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        390⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        391⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        393⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10020
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        395⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        396⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9780
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        397⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        398⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        399⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        400⤵
        Modifies registry class
        
        PID:10316
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        401⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10388
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        404⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        405⤵
        Modifies registry class
        
        PID:10496
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:10532
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        408⤵
        Drops file in System32 directory
        
        PID:10604
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        409⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        410⤵
        Modifies registry class
        
        PID:10676
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10712
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        412⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10788
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        414⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10824 -s 224
        415⤵
        Program crash
        
        PID:10904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 10824 -ip 10824
1⤵
PID:10880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajbmdn32.exe

Filesize
163KB

MD5
ad18cdeddb0723349deecca7229f6718

SHA1
4c955253b030bd86d45632d76035cc4c47cf95f3

SHA256
d106c9b6d23cabba5af2b6c343d05cde9884c0a5de6dbaf141e7eba75fef7f4b

SHA512
d92dbc303191cbec2d7b62730d31999e9e9e2f4d79c80194094118b870ba1dad8de0a8d268c62356fa6a780de7ec370b597f7b942cf65dfb4d77e63b60ad7cc1

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
163KB

MD5
06066bffb0b6926c541883c5582c1703

SHA1
099a3513591a46784d740859793dc16170d5554a

SHA256
7f57f2791c9ec93ebcf3400fc0873accb0b3dd14e390d1d66b24ac83e7327de4

SHA512
1f5e125768f4e5f7430727ecbbadda333f677c3140b1ea42c97b13642b00413604551fa4df73f6cc6a5a27db9d656d83d84a2e61a348cbf8781dfd346bf3b393

Download Submit
C:\Windows\SysWOW64\Bhkmec32.exe

Filesize
163KB

MD5
377b5f30c286af813d3f0cf19bd6ae24

SHA1
d26e5eb402adadd4b66bf7de9676c966f7663901

SHA256
e7721a5e6fe211abcdde3411a07f1179dba79e34306dfa78461670a1a9ef50ba

SHA512
a100efa834aac1d6e1242d7e0b84cd3d0a131959818cb1832187b98ec11c129e102b04681a25a2600cac4b6694baa69f651ed8899ba5cdc47db8cce65683ce97

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
163KB

MD5
7971b70b8c49ff4a9d908294051da89a

SHA1
082a0d5aa55e72e5fa38ae5502f98ae2cd6ddd4e

SHA256
ea44a54b447d3ef09ac33211d05936736475a387e55c47bba37b955e4a3e4cee

SHA512
54d6f509627f76820dcc02639fef2628e6d444fa17072f2aefce2a434ea60e56b222157c9100b294785087eb843628dfbccb1b053b9f238d64ccca070a992494

Download Submit
C:\Windows\SysWOW64\Bljlfh32.exe

Filesize
163KB

MD5
f06fdad82202bb81556ae9e3f40fcc31

SHA1
dc04621aa4f73fafb35c83d026338dd006c4e2d8

SHA256
8a44347083a55d1a3804a7ff6fe35721d695af78b8484608d2fd5db75e46b38e

SHA512
361feaa379f630de31af62e8cf0c666fcecf5d8d47bde734a5ed523f9492e0e9e0079a71901ebd8133f95ec3c61672f5d5257f01aa34837b439069f3a78f3a89

Download Submit
C:\Windows\SysWOW64\Bnoknihb.exe

Filesize
163KB

MD5
7f91cc221f231fa78a98e870e780addc

SHA1
720bede29ccbd3fba2da8db6a8c89bb87d6cbcc6

SHA256
fc19ae4fd4cdb56df18532c81ea69b8875c6aabbb22ca01d24b8b023c41ff30a

SHA512
f67b538f93312310b995608c9cc72b4a35f6d3a366f30d9963c073b9e6db15c26a8a7a4724b19a6594e38cac3712c5e3ec6da5f99a2ccda1c76dc49d2769868d

Download Submit
C:\Windows\SysWOW64\Bombmcec.exe

Filesize
163KB

MD5
2064dca3947718313dc59b2ab6afc715

SHA1
272624f5ba924055269e86586e8b3773a31c9521

SHA256
570252fb74c969dc7e0c3bfd966cea9d36daa7a4b33f6bc264ba84f50f90ac9c

SHA512
05438702a99a8ce29edd7620699e63d963cacbd3b7e16572e220c635dfd63749949ff84be01880f0452ca0d0cbbe31dbdbf21467910d4bc09722c17d029feded

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
163KB

MD5
14eb7f3369668cb5c5e152dd9c662557

SHA1
1976f7939ffbdd7bdccdf99022e8a1aa972cecbe

SHA256
201f8b2c0737f987549360937892f7053fda3bed586023eb41584cb21045ac5e

SHA512
c7f1d9e8f774f4b9c86f70e848a9f5a716c552765ede176a94a8aa01217041c4062d2108889fbf42cbedbc5b1ce4a15e052a136ea35013a9d0ca010a24646954

Download Submit
C:\Windows\SysWOW64\Cdlqqcnl.exe

Filesize
163KB

MD5
76d76db02b4b0ebe2a00aa2090f67c16

SHA1
85e708a3f7a4cadd0185bd62a5cb91b5a1bb4e95

SHA256
648b8e7875adcf96dd0900c90cc599b681177bce0088469b081d41617917699f

SHA512
7c623a4af57982f792bdea785cba24f28528cbe1c1aef8f708e86d3b5f8bfc2d787aaaac3857965d0f71e96070b5d98317d7b1dfb1fd0024a791cd5da5b288d2

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
163KB

MD5
aa46a7702f60c91d278eb7613a41a0f8

SHA1
c56a465d18e9c78cb2ab1647db691e1f8bf7d5ed

SHA256
74917db0f1489f061323f400d69faf7f4df2fc82e42eb5ca6247a3f2bcbc9948

SHA512
967b0f3f00adbdc86c00ed1229f0ca81403b47630eee892024aa01318797a3b892ec29b81219bd25bba88775f375d7a4f71592dde1a812bc83bce6eb98bd44c7

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
163KB

MD5
324994ec74bb12a02b65584e640adb4a

SHA1
86326a48ec12294954eb3f264ffa45c38e77112c

SHA256
5eb6fa4e1e98d1a8ed4b4ebd523a713c3e6f9fcab7ff1cad39c0325d997ff302

SHA512
a2bfe096ae441624b79651cc5ef869604e1bade0f1222759066a65bfffa9515d2dba0d5e96797d246181fb260ca18c1273181a8d11c375133a699341eac5e2ca

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
163KB

MD5
d0d6d26d17d135f722207063a51fb26e

SHA1
9fd6adf12826faccc08cc16f1993476eb699dd2d

SHA256
727cbbb8b9c7b4a3b6041319969c1c20e0543fff1ee1174908e3e646b8c977a5

SHA512
9ccb07d964a5a3393bcb3c3ee81bfdfab976b6a2046be7e0168f6bb337d1994b538d3513a264d35367e4a99b2f450140dbea388bbe880e6a06a0593829485f33

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
163KB

MD5
60ebd14e723cb390e87cd30b572b98bf

SHA1
35f425c341fe23ec32113b9c80a02f2a8adc0c24

SHA256
9af5a9a9051853d0887d7508d0f771f61bccac81069041a854b31d86f1bb3cbc

SHA512
63b57c607a858d83f4171237ec63954b1c90707b2873eeeadbaeabee6507bf263819d815c2562fe54478ca596f0cf20e6fefcfb8b8a932ecfa2cd0b67d65435c

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
163KB

MD5
6ca219f602d0322fefa2f76aea325588

SHA1
855d8fe1c9f033fb219d48ea3fdc3b9655de3506

SHA256
14c04801e6fc7269f8cf2cbb7572b008cff34ff3fc38989b1fb9f9253be590d2

SHA512
cc652073d56a2218d569fffaac79f3e7a2912fd5f2b3ce0619e4f81953cf47ca22f7458c2045abde02b6fecaf19bbfca11b7af0e87cc53942afbc99b2f622248

Download Submit
C:\Windows\SysWOW64\Ebejfk32.exe

Filesize
163KB

MD5
3b442faa1a8c2e7e76451cda045f3046

SHA1
64f958710f41c7c4a48bb664485fd76095014675

SHA256
1ca69abcb1303653966e7a78968d3689cfa24d5f5e738de97ea82c3b673b1f9f

SHA512
fa696741e95d455fa9f983120d9fda07617ee13f3047164529d6dcbad26d12f017079c2ef25fab0a076c8acc79fd31f2d9d776c5057301c04068e5c048a8d77c

Download Submit
C:\Windows\SysWOW64\Eifhdd32.exe

Filesize
163KB

MD5
66bba0826feeb7265a14bc041d40e12c

SHA1
8b183e8816dfc74d5e619b522a8064241d59713a

SHA256
bc192ae17650ad07d9d3af5fd543a673040543c2a241767ebed0b62552c12ba1

SHA512
aebc243b79dbcb98033860b7fc30c56173da371197836367fc063fbb9b5379e68569b32a31b9cb9db35e349406411bf45148a1976d10f223b1775876d8f10cda

Download Submit
C:\Windows\SysWOW64\Elpkep32.exe

Filesize
163KB

MD5
d8f14049ec81756262f7d1e3b7c806cd

SHA1
84b4958ef8ff2098f3ddad9bc70b859b24540484

SHA256
30c9bffa10283be738813510626cfdce29d97296d41bab1abd3d898522a6c2d7

SHA512
84e97f7f15130ac8de6732b3ef6cdcadae8290a5e3f5c432b4d7b6652daad4972c174c854bdd74fb6c335d959deeef005c1be96d02cdbbb5cd6ec558304aff55

Download Submit
C:\Windows\SysWOW64\Eokqkh32.exe

Filesize
163KB

MD5
ffa8c168fe9a5428bf2c010db7ff27a8

SHA1
2b6ef933a9e46fc02280eb8195c5bd4e1a4ef01e

SHA256
7d6e0c2d095842fb846bb0acbdfa38d019ecadf2cc6f9721d27555839e1b002e

SHA512
0555b6cf0895f90b399e75126387800995c84e1fc83fc8ac51c581840cc30eaf2d7c42b06c6a2d92d512493ce12d0c90bac4cacde0a496cfb4496587e088515d

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
163KB

MD5
34dcfa260bf05d259c7f709970506a1d

SHA1
e213ef6de698869c7b0fbfbed7b61468bf4a9287

SHA256
3faa08f1795214d50d03f217f5110b3a5581ee526f0f9bdec5cfb4badd7bc541

SHA512
e02d413c4680bd1075429197a899b3f98bf5352c9f6b8432e10be10537dfa3c0b4d21cb8056666b6673f6c10fca9c53ad4d727925ea5a463e2f4af761852bc31

Download Submit
C:\Windows\SysWOW64\Fimodc32.exe

Filesize
163KB

MD5
68c15063814142c24341b3831c682e09

SHA1
f6fce12a156a828cd356a30155babb17861dbfcf

SHA256
4578cef4228a1d8c0eb426e85f1111268887fef036178c0324edaa03e5ca0f03

SHA512
16302684896995241b041853f5fdba5037b1dc19085eeb6da8be89d53db22845188647658e0c372e5b026f6b076e9d6719a2d7738b73c5472f4bff647eca68c4

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
163KB

MD5
f27fce5bc80d78d636d4fb17cdbf1f5e

SHA1
0e2a083442d571277e4e86300a66111f4e22e929

SHA256
ac0ddd6bfe0f91ca7c7a1649d615a7d4297c5c2cbe648c40035101a199f55c9a

SHA512
f891c5e4cbf4f9f68d2a3733dc4a4ad6a303825a0358467defc12524c22f220e975e895c967178635670a319f0e405c75359fd5e23af59c1fb3fda567892ee9d

Download Submit
C:\Windows\SysWOW64\Fpdcag32.exe

Filesize
163KB

MD5
2e6acb2a91005ef7de72a44b68bf3985

SHA1
4c98a1e16456b52959410874d39d6a39836fc638

SHA256
8be35c74de7c4b557be8c65d7ebc48e60c0db5cadded53c7289fdd88b464caf9

SHA512
f0314f31dea1b1cfd93b600f1701a9cff85efdbcb590649cad63ef1b8cbe20343ef894484d572961b125bbe7d127ef40a12d984ca92c300c342394c965f49bdc

Download Submit
C:\Windows\SysWOW64\Gbeejp32.exe

Filesize
163KB

MD5
a62cfa7d7b9aa456babf5eece0912683

SHA1
8c40a121abb45f8dc4f3b31f442f97ff1caa1e7b

SHA256
61c5ceb1b2a0b8cf3062869e2521d3a3657d3be2e8489e3e249e2bc9d6f6ab0c

SHA512
57f7aab1c2ae1d66dc664bd32903cc78f81391beba0f339d36251d89e5d7c305a8f02c816ae4bee61ce29ab64e5e1d0a9fdcc646fcecc4816fe92c11601ead6b

Download Submit
C:\Windows\SysWOW64\Gdoihpbk.exe

Filesize
163KB

MD5
a6b6f165922c21c429ffed739928868e

SHA1
c74073787c142823043de2c0621b5ea721ec2825

SHA256
b7df365c2b5cc966c6bbc0c226fe6afa6a5c32ad71a2b1706dd2c7785373c7ea

SHA512
5c6b7f83df5681ee21131da25c77b1bd79e1b1150e734cee8fb2e144097e777fbbdf154c25b5d0454915c0e91ba04aa507e37abcbcdfa87da96fc06ca80a04f8

Download Submit
C:\Windows\SysWOW64\Ggnedlao.exe

Filesize
163KB

MD5
a705be91891b394339506e058bc6969c

SHA1
1acd8976abe5c57d5bd8b4764950fd61019a1b53

SHA256
3f2db5bf572acb44163c5263602a04243b980d51b46cfdf661d56a68d22a9c8a

SHA512
31e703825419366c40a4648c0dffd1a126ea0e31e55e091d6e7690a862adce9df1c9ed7a9e76d6c543f25a5200d1192dbb8662f75ee4949478c0c562f7e1b74c

Download Submit
C:\Windows\SysWOW64\Ghmbno32.exe

Filesize
163KB

MD5
7cc803745a5b6c000276c2c7f442bb0c

SHA1
3a0bc254cae4417845d73912ade6309fca16b64a

SHA256
a11130de7a9d151786686b4ac31485fd1d59065c24b472e96aed4ecd55e5d1df

SHA512
c9d143e459960564f2e4a83a81c5692f0e6c84039b5942b0d246b24ed4a21fdb22253d73b56719e2d4a4f27c256f4b53832f58db81fc3edbd373053f4f2d25bb

Download Submit
C:\Windows\SysWOW64\Gkgeoklj.exe

Filesize
163KB

MD5
ff6aca10fcea6bc4db02eb8bccd736f8

SHA1
d269fb5eeb4dedeeab7ee5b887ede3bff2ab1959

SHA256
bce1730b42b1bc046260aacb5d3b7892bc7327b0226ab817751dfb6f064f62e8

SHA512
114ecded99dc4bde3ca6e631c06f7aa45b3747bec24172f24351d92b4446bd546053e439536d78f03515ffd7e7a7f0370be0c218951da043f20f0dad6fbc9e40

Download Submit
C:\Windows\SysWOW64\Gnlgleef.exe

Filesize
163KB

MD5
ee975cf1259f014ae0013a7ae8e750cf

SHA1
01bb09b23f4b10e507baf3db192d077d78d105f5

SHA256
a6e3d8cae10532a7d56b45e63a5fb25657dff8d0a64567c0ef7afa0827693b5e

SHA512
91811c05699b5435045f0161fbf9703e0a004750de5fb02acc86a39e82039a2bf170723f71b2509d310fe7c91c1e233b695f6eb6130239f15357428fab3557b1

Download Submit
C:\Windows\SysWOW64\Gpfjma32.exe

Filesize
163KB

MD5
c7ed2ffa164578cb1606af146ff4b9e6

SHA1
6fac7cc909946a131c06161adf734e9e09a83e60

SHA256
29a51e413cf8038cb8b53600389214670c2e2810b004d59712c72a4954be59e5

SHA512
dbae6740173e8de9ab93ae9d5abce0f1ba82b61ad816097617508e99b4562a7d5d73333f9ad6f4e24be61f8b3fa19ca1bb857ab36190313cb45b8762f3e440e9

Download Submit
C:\Windows\SysWOW64\Hajpbckl.exe

Filesize
163KB

MD5
599b1027b85f9a6fa01f2760916a58c2

SHA1
6cc2a117bc91eb3ee989b6377801f0df668bbd5b

SHA256
f36ef48e9891911b2f5507fe4a9a006aaa386b1d035d54858946740318e80785

SHA512
0466e8cb82a3f482571e5449fdf166f713cb97d64278a5ca72faaf9cf97459a463706c8bbfb81e8974c1efbf22e04ebdd9c0f12f6bbda0a32b1db31d97e1a348

Download Submit
C:\Windows\SysWOW64\Hdkidohn.exe

Filesize
163KB

MD5
7ef5c30a6ca0f1e95249621a6cb88671

SHA1
a4b20c723975f52456ee5d822e9fb5869daf52be

SHA256
9d801cd2d62497ffe70d9bf1ba554b7ea5abdf0e7ed5ed6eec649f33d6df4e20

SHA512
be60a91f94b1c9ec8c3da84b0371384ac4d022cfb20edf4d949c70b828e2c79d34b9b069b3e220aecd8461b40dde15d16b09077817fbdbe0ffe41d9280601b4a

Download Submit
C:\Windows\SysWOW64\Hdokdg32.exe

Filesize
163KB

MD5
bc860734ad62354caa10528f8936849f

SHA1
623f01127a6869fa9ea4cd38f9c54d2c8acb5557

SHA256
0ba72181233a604fb6715134db21bd684236b1285c97532f3299ce3a25f7dbd6

SHA512
20231f1dfc70c7e99cf675ad2feadc62d7c78934135340c7ed3b4afeb259aa72fe3d64a7929794c431af14b25cf067e0eedb683bf1d653f80934ff81c0ddc6a3

Download Submit
C:\Windows\SysWOW64\Hehkajig.exe

Filesize
163KB

MD5
dd81c8e02aa8055d9d0d6d91b1ad1920

SHA1
d5fa12db1e82a18f5cc0beb86ae63d103b9a877e

SHA256
f8b433bf6267a36156008d7489fcc21036676e9490f4b6883fbcf23e0355fc08

SHA512
deab2ead391400f584cadc52cf1cc5cbdb4388a5850492264017c96e194feb5eebf11a9fceba1937431684c5028795dfe92b2013e4ab7fc9be58b35b1c536b58

Download Submit
C:\Windows\SysWOW64\Hgfapd32.exe

Filesize
163KB

MD5
09249f14900c667643f1225289668132

SHA1
549796b54e2b7ed645c51a58064e7ba8c06d31b2

SHA256
3246ccdd8244e75e5c9879fdb4a484ea5feedcaa8124af275b74d6b4397d6fc5

SHA512
31d4efda2304b5295d57258e9348d1067b26cd536ad81096f5890f04113612c5579d8357b100c1ff27f70ffa08d186f861c53745600389e75691efb5808169cc

Download Submit
C:\Windows\SysWOW64\Hkbdki32.exe

Filesize
163KB

MD5
7d5586395c5eddc3aada00998db452bd

SHA1
eb10bceca6a49aaaea3618022e162772baa81762

SHA256
87e4499ff37ad729bdd723f127a9b00b480ed80d9350f3ec9d1f3c87aea2336b

SHA512
9e4d185dba32475c992c89b6f4a9c61694feb105111b854250caa0b5cc472e862a2cbb4101d57aeeb40239d5c677b91c38a8f38a1a38235e61cc08fa878df0e4

Download Submit
C:\Windows\SysWOW64\Hkgnfhnh.exe

Filesize
163KB

MD5
c230672f6d0986488768573a085860aa

SHA1
c07c0b7b72028ae5402f5bdf00d098a661077953

SHA256
5fbf42534e2587f3fb6f16a06df6cd3d5a3a0e0d65b3baeb3f504a5abcac3619

SHA512
58d77eac7db4f4503206b279ab22021d8fe9d82cdc1cc11ed2e3fabdcca0e6594a5edceec5dfcd2082bc259c7ffec42df77a7b072f6b3a9ec805fc8639c53c6f

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
163KB

MD5
25b85e6a16773d961986c5f9bd09a415

SHA1
5d04a5feaef26af7e22f34c4c9cf01e72a31ee95

SHA256
55784676edc6df2661753af2b85847135c2c9108b57342be53c5ce726ccc59d1

SHA512
24134eedf0a76d396f6abc80bccb62564a84884aff84baadb7372b9d497c8e47512cbdd4a2c9f751c71482cf1f4f8685a16bb922c5c2633015c60eeb84ca89d6

Download Submit
C:\Windows\SysWOW64\Hkpheidp.exe

Filesize
163KB

MD5
3d7365531f969eca516557cf6f49e75e

SHA1
d25a0b1f74bd7ed01c58f6ee519b2693b6ef793d

SHA256
0379878f4720d8c0a370175a75ce501d8a432d8af0a0ca2a4a8f5837cd6d939d

SHA512
7b1c432b3255f546aeae9a394f4182776adf8cde55a410f25c7f38bc6cc71844f933120642bfffe0591ba03ea0802aa5678892e3d9fdcb7ecce3cf614b8afa03

Download Submit
C:\Windows\SysWOW64\Hnfjbdmk.exe

Filesize
163KB

MD5
67e5a712dea17e06a46f0b359f59c526

SHA1
968c17e882cab3faabdcaefc964fedefcb4e0df8

SHA256
b616dc9a1af07ef537043280f8f66095274d398518fb9763fa2d24d5fd178b70

SHA512
7efc53c13903094688e54b7f871c4996956ada975435c9c9339752e3fe009e0a4eb4022fac8c92da1543d173f292f27f626aef85dca82e140aca49f0168ffba9

Download Submit
C:\Windows\SysWOW64\Hnhghcki.exe

Filesize
163KB

MD5
64a33521f15d19b4ff1a67f6d356cb9f

SHA1
2f6ed430bc3eb1233b379c2de105f10b1b5c308e

SHA256
0be6832dc21a2bc59fe0b0ca70b4ae330a98a92e4b6e7324587f6a6272976dc1

SHA512
f7c4f87a87f2ea801632fffcab5059c1a14f1c103f3c9f142dfedc83e8f1c7c048e2c4903a74d018530c056f44c901151b3e83a99e282d217f813f760f69d157

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
163KB

MD5
04825964ba31f6f4beb9728943db42cb

SHA1
52acd3b6fd29f9fba22825644285dc3b6aec314e

SHA256
0cca7a9154bb1aff1299f17e0afdb97e8b835a9b86179088be5e2d396693e805

SHA512
38e58194d6aae56657e8687d11c5c17dbbe1726ccde13067cd8bcc69fc7564ffd819a6f74e4782faa42aea1316f1cb3371835277bcda5325abd25cc73eb03d8b

Download Submit
C:\Windows\SysWOW64\Hpomcp32.exe

Filesize
163KB

MD5
65bb7bafdbb7997426de091d6862893d

SHA1
ef8a2e5ab882873beca84caa08ceb543adcf6b38

SHA256
415950b352f0e692c59a01effa0884ab07dbf0a47a9763851f731b514684eead

SHA512
eebce7d896f68be4e3b70417a15ec95621a13a3d5c6cb64ea01e7bcfcffcca72d5a8c226dd7f5f2e2de5d51df2cdee629c744ea022dd3e6a089ad4c6b67e8a7c

Download Submit
C:\Windows\SysWOW64\Iddljmpc.exe

Filesize
163KB

MD5
7089a954fe4aaa9baf9a25571feceaf1

SHA1
e7290d204baaf09c7b10afd291cd772c35962deb

SHA256
4b2b4a2796cd2e4ffad405d9fe9c88ef5ee74bb35586c7803099007bc0b0c441

SHA512
07dedf2ffc063aad42bda357d888e0667d367888392a24b25f7c222a16e8a2a793e3f95bef7910f325bcbacd4368ed93ea5c105b5094e19f405050f3cb13b800

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
163KB

MD5
c0d137246f6c75b1a68dbb23b65ff50a

SHA1
4564c5d76c33067d19318b7da31cff55391e5054

SHA256
ff986a294a8722ca84ac532571020359bf46fb0ed1e0b22d0e0a8bc94ff4bc0f

SHA512
668cc2581001ec28d1848b836cf7bfc7a5ee648d3fc556c6430ed39c37851a0d6726e66b0dd94720dd979f87ad54ddfb5ec0ba105862f50eabab8a448b8092ab

Download Submit
C:\Windows\SysWOW64\Igedlh32.exe

Filesize
163KB

MD5
68e77456beae1763a80f10ab3e0bf146

SHA1
d0e93eda298761c71985939841228dd4dfe70332

SHA256
61cae2521fe932a3c7cdc933c9f41de0067426e9039eaa470355101d83786c4f

SHA512
58b177d118be8c2f28ecb1fad303c8038299e218e41657fdac22e70dff5865aa4715b4c4ab6aefc3b935cfee2fc5ddc59bbf84341d350c04d8de8d9c9a62d87a

Download Submit
C:\Windows\SysWOW64\Igjngh32.exe

Filesize
163KB

MD5
4f51311f6501050521edcb8af26c0c13

SHA1
803c31a9bff9147388dd7ce53d8b88a6c7980041

SHA256
fb642bd4bb04b434147ad6499ac026e3c8602de3d1b855bdad35614bded398f4

SHA512
21bbe72c21b135a4f62555e1f2b3398ffa9dc746c4c7de4dd0dbba9035899eeb2abef61b230cadf2cbee7a9030202f57213bf746efab45a212329728051193d7

Download Submit
C:\Windows\SysWOW64\Ijadbdoj.exe

Filesize
163KB

MD5
67a41b44d1f11d6cb8da5d986cfe697b

SHA1
875187779ed6a1470098f2c07fc6072a75254da6

SHA256
d583f0597f3c83cf473bb37b096d04f417f6ad592fcd2fb703c21a9c14878711

SHA512
16b33c18ecc98995921ed4aae88ff13e96e00442a98bc6ea64a94604707f72bb01f183414373a2023e49ea48e4d713e822d7f96c076d5fbf22dac11638c04935

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
163KB

MD5
491e8542b23a163d978b0a09f156ba56

SHA1
7314c40483eadf00ea8cacf88242992e7e7377b0

SHA256
6ef463a1678ce23e59876abf0bcfcbfa8dfe12251da9be1cb62059986ff4e0fe

SHA512
f58fb1a6e53f3990fd676c4d77a74a6717d1e8f1e59c355fa4ed9900ed4b2c78f97d665f7fa6c78e72bc61c27e0b973e192273d7938cc9c66ff19ca470015fa3

Download Submit
C:\Windows\SysWOW64\Ijqmhnko.exe

Filesize
163KB

MD5
82b69a8bf9b944e19d3302418b0c0f3f

SHA1
3d46233719e7a62339bead9bce50f030a10498b2

SHA256
b8e7c10b3a0cd818f867e9793e20cf1ccb03ec265a6febbfc4378a43b4494595

SHA512
d84ffd004caf8ef37fa91bcacb9f60d329851d4e8bdc47b9e29ef9f5defac0831f14391ada2671b042c9a55b5098364428976cc89d15cf94c7466766cfe9fa7c

Download Submit
C:\Windows\SysWOW64\Ikejgf32.exe

Filesize
163KB

MD5
f061b8daac7b5d63269033fb6669fcdf

SHA1
2de752cfdb473c4ac34efeb279b224be91605ccd

SHA256
08eb1129e6ea964c8462c5d10f1395451c3a2a2221d8b15f22c2917bf84ca19f

SHA512
61bfd928c08670adbbd075198e0c30b0852de751865fbfcfb2106c2c9c825b80ab47a3679e3e7a286d91bfc9742896d5f05faea34f971c2247396858f9b77e2a

Download Submit
C:\Windows\SysWOW64\Iklgah32.exe

Filesize
163KB

MD5
fc276ee65ca3b35676fa205e503e628d

SHA1
b46336434ea0e7438bfb72dc41f36e3189df1d32

SHA256
36302acf80f5b75b4432577885bcc575d4120dc285af52ad67737bdf3850ace2

SHA512
aa8390ff0d83f1b141837fd3daaf5ef00a2725f74efd90f9d46a7aae34d0819f5ec4096044dcc325d8b133270629cfeaa9a8bfc019c821af16a4c880486432cf

Download Submit
C:\Windows\SysWOW64\Illfdc32.exe

Filesize
163KB

MD5
d64477b172a02a8e9454f84f5264fad2

SHA1
f0a08b48c2b2e36686f88fa90f21861568a2e34e

SHA256
f81173e6867a363c73a810afb654b6b52b9296cd2cd2f557dc52eaad9dda5088

SHA512
34fa98abf21624cb558392e04bbd6624b93e6a7787edd27afbceb747f04813f38b4fcf4925f559b0207c5a2f0185e40d5608c22ccc99f3657c00a07af46090fd

Download Submit
C:\Windows\SysWOW64\Inainbcn.exe

Filesize
163KB

MD5
722e9614040390d28e853d1295db1ec1

SHA1
e2aadbcccecaf86ac9386cc8d186d82a05257ef5

SHA256
81a3579fc45f70569d98dbf816ba2c8cec5b51e4aea0faa231ebb7c49a8552fb

SHA512
463571cafab65650c2adc9a80bdcce224f8452a1266f617b6a466409d37f093b0f408276d8d4b1d4ae4551d2b2bbf9bbad6fe7cc1698299f5b080e0ea4fe752b

Download Submit
C:\Windows\SysWOW64\Indfca32.exe

Filesize
163KB

MD5
d43f57e2e1fbb1523e1bb00d1ceab6d7

SHA1
cbeac7418a02f8989a400d2b81baf016f47f6b26

SHA256
c03d21f9226aedcaf5fe8642e8d83237e7be20138153df72f89650d267c785e3

SHA512
2a1158e94813f31d744cc94f87de97e214e0972dc8e6b07cfedafa8d06402160b572c742cbea455db8f3f07a5fb0369b99a373b0c3b54001343a4a6ed37cf0ed

Download Submit
C:\Windows\SysWOW64\Iqpfjnba.exe

Filesize
163KB

MD5
066b8f9c1bd3d64fc1c417fbd79905c3

SHA1
902c7914bac230b4161479ac4343f92780187ee5

SHA256
60358b131e8442e9b0e56cc29986d35be10bc2be73a6c75237d54a8c5d8c33f1

SHA512
a90ee605a0a1e92162b9b5e94d2af29ccae9a6f0a3ae8a48643cbbad6acc0160c3ce0b00688306134decb791b6ec53ae091395667de2252aed1f48fe627c7c16

Download Submit
C:\Windows\SysWOW64\Jdnoplhh.exe

Filesize
163KB

MD5
a80878d8bf906ed90fb195c24576903c

SHA1
05d90868efee91bcab4b47355a6eaea75a4c9b7a

SHA256
17f8f938c6fdbcbd570ee5a5c926b19df85df828ecddc4877ac32f08b26c9bb3

SHA512
ed8c628c3f959032a5833923a536f514271278c782830357c56e23b923bb91e893e33570560f48bbc28638b0ff4138d633cacc857f410b6cc84ff23d1e8c84c1

Download Submit
C:\Windows\SysWOW64\Jgeghp32.exe

Filesize
163KB

MD5
7d7bb4e02d9f0952b40e47915e31a852

SHA1
a610aff45519ce35a00fb1f6a213ba54d04471db

SHA256
d28f20de4b09319ff6ddb553af8f3769bbe25459078eecf94aa4c2e2fca31835

SHA512
233191fc70af6f36ed9fec80584e12f57e9819cb56b75fde94f7a3f808eb112bef717adbff250adb933984530c9da10ddeb244a496085b681b748363819cc79e

Download Submit
C:\Windows\SysWOW64\Jglklggl.exe

Filesize
163KB

MD5
70e8a41e9aa87bdd0e4dcd1f522107a7

SHA1
5304f1c3edcb9400e6f912bd639a03d6b8d1affb

SHA256
8f5ab674d17f7645ac6326c73a887163147e366d051bdc9b214ae8133457ee39

SHA512
9253dc6e04e93529905451c5a9db6163d1ffa1bf5c378f856f86176ab6552d461e045d4b20e6ab93b4c960e8af2a4bb086d24ab4bcb25a27016500eacaf09fac

Download Submit
C:\Windows\SysWOW64\Jhlgfj32.exe

Filesize
163KB

MD5
6bb1900cc1a9c5ef61af0cda51c8cd6d

SHA1
e6feff7a3634c934228e2fdad6cd221b5b74d58c

SHA256
8f07dbac76151107fd5ee117e8e75f04e620e7474d7a2d7c8aaef3dd55b0fd96

SHA512
a3407adc310d0d93c601b5ba322c047226a5f62c1a4988194b91a721ea39b4f34cd07404a18edf34afb2961b98d82c7a1798b2fb74b47755c884eea943adfe54

Download Submit
C:\Windows\SysWOW64\Jjlmclqa.exe

Filesize
163KB

MD5
33e9abeea1a9ef53c1a90bd9ff15d768

SHA1
9449568da4d18b64666ca77a1d29495eaee7eeec

SHA256
d9f4f44049605e61855ff76a0481f0963371f2bce684cebca6cb1f45ba00ba39

SHA512
c27ca235976328026aeeb4e24b5f21b25a2c958676af07e49ea61a215d80fb46b679aeb648b8c6a28a0d4827e5e57298386661bcf96f09a9b5c60758c9f80819

Download Submit
C:\Windows\SysWOW64\Jkhgmf32.exe

Filesize
163KB

MD5
cd6dafb52603ba78ab231c57a3e32261

SHA1
32244d55e39096cbba0f420f0092f7f7ef4a3300

SHA256
4a12a4965fb6f42e1f6f8d9d729f002913703aa40a9f0f14a8d51888693eb5a9

SHA512
c366db1f8dc96152f8375279e63df4a582bff393efd04d8599df74b4ae4d420e577f6c81a4f213f415e98f740134ab173fc44a189471cada17922c2dddc3eec0

Download Submit
C:\Windows\SysWOW64\Jkjcbe32.exe

Filesize
163KB

MD5
5ff3d432a6b7f7018fcc8fdad0f69fa0

SHA1
6124813d0d1d591cfca9f93aadb2d8f260fb22b4

SHA256
75f1bf17b5584b528ce98a9577e2eda431bd1c198cfcd5894447c3f69ea4b88f

SHA512
2dbdea019d7cef1de9aa09a979339614d4a74d78655aa04f486e706ae9a136f60dabc81a1e4dbadd189d76c631d077d84c4f051e633ba02887999056e1ceca15

Download Submit
C:\Windows\SysWOW64\Jklinohd.exe

Filesize
163KB

MD5
18ae2c346c8c3f252c0efe2eb7637d2a

SHA1
748c4915497318ad337f584e725a6b72787ab2f7

SHA256
ec55a047ec770bd2f894cb4d5838b27ea9733e370c23cc65b7d025a9aced2bd7

SHA512
4aed9c58bcf7599b476be30a0ba2ffbacc161d455112f0ee88d08142814faf346f3a2bbddc1dbcd0ec54ab3c90b3978d3c29f7bb3e257b3d0f68a043f45d8541

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
163KB

MD5
4617ca29ed9f667adb52ae848e3cf9e9

SHA1
ce57e7b4d30dad28c4b4c923d1752c123b46b9cf

SHA256
d31641255118e4e316df9fb64f7eece724911017ea9306be0b764980292e3055

SHA512
c0629690e44dab6e0518e389538f961a095fd1dca5d39c3849658a50dc60fd823166d96bb9968607f353839cc46b03367f9f621f1e63e37c19117ca2c034d528

Download Submit
C:\Windows\SysWOW64\Jnfcia32.exe

Filesize
163KB

MD5
508ca0f226556c557abced3f55a0f64d

SHA1
d65b0fc5fa4be7da6c0e810fa85d0787391352af

SHA256
075070f93a905f3dcd299ae2688a4a3976c265aef7d900a21b7ae79fda4c81c3

SHA512
23ceb21fc048d36edeb2f3edd18f014d295da7a5e8380c9c784cba9cc6d3f32efcc5da4bf0d461a3e72b903a75ab50d9f638977bcce6f832adc6cdf8567421ad

Download Submit
C:\Windows\SysWOW64\Jqdoem32.exe

Filesize
163KB

MD5
e73e9e2ce8b21b16a5b261a37b984532

SHA1
ed58c28c1b5d32c13ae1d2c04c66a9b358d05780

SHA256
77cc46bf9773df03b29e845bb3d1abecd005416c09ff4c59f05ae91488cdc797

SHA512
d686b5a1c69682aa0db2e95703907305ab1dbf8d7f2975830780f7f688fef727b77fc522d5233412e25ffb36859fe39cf7b1881353739aad6bd7f0ad299f2d49

Download Submit
C:\Windows\SysWOW64\Kjeiodek.exe

Filesize
163KB

MD5
2cbbde654f85254cd7da4412ea1c6f3f

SHA1
d49576479bd18f310926e859787a68818c0d42df

SHA256
573576ebff5fca17b76ad8a9ec4dd3a5ac2ab998626ec7adf96b210659cb5941

SHA512
80d4d72289c5e656e5746b9c1d0d041d391712591c507ab259a951ec4f06ccc9f783da74048fa94661684a404c54c7a1bb2f016893c1e31e50a7d5704e4ae626

Download Submit
C:\Windows\SysWOW64\Kkeldnpi.exe

Filesize
163KB

MD5
e0a07e0a6c08807b92d79b2a6b5fff32

SHA1
5ea13f55905e3e9c8e5886134c22fc80dbdf3bd1

SHA256
33e60e56d4dd22dca286ebc0d619d4f23dec91cd67f18554fd3fcdfbb2e619b3

SHA512
3b788effa98df4f8ecd0e17fe69681abb49657da4a046337f4509c2210c20566cb377a75a48a11a07ed0d12f113362cae49c59b0aa42497c590138bef93e56a8

Download Submit
C:\Windows\SysWOW64\Kkjeomld.exe

Filesize
163KB

MD5
e9763bd183b0b49a85d720dc9a3d6d96

SHA1
002f157241d31e0bae5813309d9c936ff456caa3

SHA256
df198f91ea319480d01c91eeb19af8a49f64b844c6b927a29af348e4eb571e61

SHA512
94959b313e47e2aa1a35f14b08d5150952393aa83ce19d4968d021edf23cbe5289635691d5ed9f8bd11e65a6318dad1b0e306a85ba4e40f4a8c1e36d78bda197

Download Submit
C:\Windows\SysWOW64\Kpcjgnhb.exe

Filesize
163KB

MD5
9a37ed8e4d13997b206e5ced0286a113

SHA1
b52bc94b829bcb0ec43e294bc964b4bf13e54818

SHA256
9bcb876cafaa94f2643bda2149cd5277247ab2e0788ad7686f475b4dcf61e813

SHA512
e601c4282f6c8c8bc15a8056b3184ef23c6d01941e79cedabb42719f0e29a4bc5d56129c9aaef89c74e504462a2308166740e93991c7680d222c12a42361580c

Download Submit
C:\Windows\SysWOW64\Lfjfecno.exe

Filesize
163KB

MD5
17da9c503c8118fca04d97e94dbb12e7

SHA1
f9ab59282055ed77d2d3a47002443abdeab1c41c

SHA256
222792f189261921fab643c6d3b58dee0c00f2fc7f00c2d70656d9ac776b5678

SHA512
b6ccbb939d9383ffb61b551700373276bd106ebfd679fdc051d20f16eedaf277580baa0c5f160121c8b0a102952b2f10aece26ba354980fb3bea5282e977ff5d

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
163KB

MD5
e683079fe5a04854ef3f7000ea677333

SHA1
a420785ef7c881b6cdae937654e2d828e47d1f05

SHA256
e7c3554744a6ee7a13ffd27231c29fa0459efac39cfdf5bbcbefc126346dfc0c

SHA512
057d80e654d38bde5a849094f0c1d7eaba077f5a47e09776763411153df3440f84a64455f71ba7559aac8b276d624831ca2bb3c2b5de39676c303121f0b9c3af

Download Submit
C:\Windows\SysWOW64\Lnmkfh32.exe

Filesize
163KB

MD5
3eb122b11598067cb3bc958ff5541c5e

SHA1
57a6604e48909e6121ead63a36c9c437c93e6b20

SHA256
7780497be11e3f4e5a6404050cad6c9854b551a28702077497aa279d3bfa4cec

SHA512
b89a26cb829d834ebdcbbf6d4fb39b49bdb90d662afeff68d2524856cf88c79e32ca7f664ba5757f5b894069f3da195a88541bdceb28689ca4a9fe06819c0211

Download Submit
C:\Windows\SysWOW64\Malgcg32.exe

Filesize
163KB

MD5
8731f1264c2d53ffc4236ae7cec6e395

SHA1
9fb42b3c4d1dd7e4c801fb6fd57c1051dfee374f

SHA256
06f09a2e77cfe49fef743d11ee9de9c6cf90b364d54147fd31d4a920f0da61df

SHA512
b961b18d69aefbba95a069bbf59f833ef542b7ea2ab9c8e927cdc0a27693cdcf3aeddb94f207da9e03716b3c03f156552e013ef8903bddb8b845bee9ac7cf49f

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
163KB

MD5
d316950b0810a4203a2316cd01af04fd

SHA1
f78f7ac7d59850fa0e467cdfef62c316456642b4

SHA256
b57f843c2f4f98d47612d7af15dcd56535bdf8c01c19f8742c8eaa733fd0cfa5

SHA512
cec5bd42763d0d4139215118ed551d9285bb4e79e9d508e44a1811226ecbdd4df55b073482ba3663f010edebf0f0e82cc86b1c669a32a3f9fb23eb199f53b061

Download Submit
C:\Windows\SysWOW64\Mqafhl32.exe

Filesize
128KB

MD5
e2b089ac5bbecff04ce0642c1eeb16e0

SHA1
4ccc0e43b681635ef64d50245706dcdb5f8966e6

SHA256
ce530b3be3c9811c80c94d8c3e3d6f136be949be88b5b363676c3d0f468ee9fb

SHA512
ca7ac732336b13fa31f7ad3c0027fbaf52ae963d7b766b76bb1b42f731300ad553c2d4a1660f15d47cd19be2df0f700026f780d6ca7822bc3a238f94b8f5a646

Download Submit
C:\Windows\SysWOW64\Nclikl32.exe

Filesize
163KB

MD5
85dd48059b919afd22cd9289b07c2500

SHA1
560d634d3868b30763d920addc47fe61c7e8f380

SHA256
da7248926132c2c7f3e58d83a49e490205fd5ff902d43a0c3ba95ce433f6f2af

SHA512
1f5a04ac24094fdfcdef8bc3c81a478c1965a0066dba08230c60f1f77c339523be6f89e71b7e7947b79307db5e8d456bac2059e9567a9bfd23ad0c68f7b52596

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
163KB

MD5
55b14d78480551c78ea3ac95da0a1904

SHA1
f02aadfd5e8fbe0241e7316a9637726af2dae98e

SHA256
882fa4ccb03e2f14890f40c05571b3d544e39003c8288d09d04925913fff180d

SHA512
ea011c8b169ad169e40c5751f696368096dcc6e5bbdb74db76200356ec7e0a74f0b606ffe31a369cdf94b5b536c57e306cff85c0431a7599a5ea47e1108d00ba

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
163KB

MD5
00266f9fef2e7b5a731a5e30b95b2e21

SHA1
c894f80dfaa0f24f5a7b29f62cd9a15ff0b8535a

SHA256
6bcf5aea35c3adf5705673f32d4c7b3d11c7c3f5868a1d2a26e1b804d61196a9

SHA512
445837dd8c85b0c4b119ee424bc4ebefcd54dbd99a36675d362024b98e7e23fdb1e56d316180dfd720513bc831398afc15e0685edff385e679492d20bb964ad0

Download Submit
C:\Windows\SysWOW64\Pcjiff32.exe

Filesize
163KB

MD5
c539de9a58867df2fa6142a56faf6cd9

SHA1
105562c1517be05acce3ff79c5e7c8c2dcf397ce

SHA256
a52688aa618bbd061054edb669ea34111282032ce2f4d42f47db9932541694ed

SHA512
818e5117a31e78c671cee3c39308f953b11d612e5290240a554ef0c29eed1e3247125abd519d393a75ca149eeee32ff5e6e24b5c8a093323ec792752c6339602

Download Submit
C:\Windows\SysWOW64\Pcobaedj.exe

Filesize
163KB

MD5
365c174d577c30b6cdcd4419a10b6360

SHA1
28c7acfe19fb9b89f39cad54543a17dc218c5fa0

SHA256
181dd2b345b471aa0a1cd198f7defb05e9e8310a3de4b3ec0ff48d8d11ada733

SHA512
5fc05681c82d8bcdcb2f5b60f77fd3bd58fd1337ac3cb3a9cca8273d003c13d546409fb3a547570b2dc0d87d848cc499a73f6fde818f691fde6c7dd07528954c

Download Submit
C:\Windows\SysWOW64\Pmblagmf.exe

Filesize
163KB

MD5
abf8a2c64e6129780a6a365f4acd61e8

SHA1
c13d7b3a5765cdafb0939308332847e9e66e6dfe

SHA256
29865893cce5b6876ccf3a42675fe942db45d2e403a7a451aa4cb2204665c367

SHA512
2efe0207754eec77a800656d92e2fa7619465af733a512bf98cdaa25e386a5255f16bef0494fd626a4b5d00414d05b30bc1deaf4910fbc9f8312c762b6d7b669

Download Submit
C:\Windows\SysWOW64\Qadoba32.exe

Filesize
163KB

MD5
3bdc2cbd442e82a2731c00ed5cb49c9c

SHA1
72afce357c60a0e5446b4cdbfa74b92bc1e98ccf

SHA256
2d455b7a3793760c54eb942e36857999108bc4398b6e57daf4cbf1f8a4b1f737

SHA512
7ecd12e2f64e0bb348bd47a32718c9aa5e89b150641c2d871291cb78ee90929c2cae36355d193a847e6f7f0451b432d7495e933f914657e89b861fc9c0f85b75

Download Submit
memory/376-593-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/380-467-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/408-229-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/412-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/412-585-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/772-573-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/804-520-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/876-394-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/912-424-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1008-221-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1080-306-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1096-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1096-572-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1444-129-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-613-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-97-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1496-266-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1524-328-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1584-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-571-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1824-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1824-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1832-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1832-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2084-277-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2132-437-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2160-182-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2164-382-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2192-461-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2248-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2248-606-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2276-352-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2308-507-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2336-479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2616-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2616-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2616-526-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2688-579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2688-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2688-3278-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2756-260-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2764-189-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2920-436-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2948-283-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2960-334-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2980-137-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3056-145-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3180-289-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3196-206-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3200-29-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3200-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3324-370-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3464-376-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3492-540-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3580-358-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3604-198-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3628-152-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3704-586-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3716-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3848-252-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3904-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3964-508-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3988-430-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4008-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4032-340-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4052-496-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4104-121-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-527-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4136-388-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4172-473-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4300-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4300-546-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4376-410-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4428-295-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4472-400-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4484-490-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4540-455-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4552-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4588-237-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4624-514-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4644-173-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-364-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4688-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4688-592-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4736-85-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4736-599-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4744-418-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4840-600-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-412-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4852-317-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4904-160-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4996-346-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5032-565-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5032-41-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5040-533-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5132-607-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5216-614-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6408-2902-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7980-2825-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8320-2746-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8468-2629-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8628-2642-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8684-2727-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9224-2626-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9520-2568-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads