berbew | ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007N.exe
Size

163KB
MD5

37664a94acb000504320b1e13046f3f0
SHA1

a6aa928972d15b45bbf27d6eceea6fa0eca53965
SHA256

ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007
SHA512

2c8fd3a6b1bfc51f1853e76f9f54009b6daef42076cdd8791202e7ba33af6e737a0e7f0c317451ba8468ad80d8e14fa2d435c2698455212b1bf695bba152b301
SSDEEP

1536:Ptja1DHK82tfLcQYAFK1AGGGGGGaTnuqrN4lMlProNVU4qNVUrk/9QbfBr+7GwKn:o1bhOfLczLtG2ltOrWKDBr+yJb

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajmkbcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjholemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abkjlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emkcme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koggcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooalga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekbgfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimlqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llbnmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnnfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdmakbie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paoebbol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abcgghde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daeibkpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mddbhfdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cldgkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgonklmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omjfle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojnfei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffihe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aiebhmnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpgjmcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfgdpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adiqjlcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kelokl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkpncb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofpgdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afbmab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Femnbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgmhpbbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdfkkcom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nollbldc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afepahei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aflfag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkfgjamg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkpcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hclacn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldmlgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhmacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aejfhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfnlmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboionhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klikgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llbnmk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflddl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpkjae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lamjpbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljiklonb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnfei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klanlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbqlnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cliafekj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fngbidhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fchdlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nchomqph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbjmggnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpgqgjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddlong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbbmipmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlifja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbhkhgei.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4484	Jlbefm32.exe
3216	Jopabhna.exe
4064	Khifln32.exe
912	Kldblmmk.exe
908	Kocnhhlo.exe
3320	Klgoalkh.exe
1340	Koeknh32.exe
2036	Kikokq32.exe
4656	Klikgl32.exe
1724	Koggcg32.exe
4460	Kimlqp32.exe
1072	Kojdig32.exe
4728	Kahpebej.exe
1368	Kiohfpfl.exe
2700	Klndbkep.exe
4736	Kpiqcj32.exe
2956	Lchmoe32.exe
756	Lajmkbcg.exe
2396	Liaelpdj.exe
1580	Llpahkcm.exe
336	Lplmhj32.exe
4932	Lcjide32.exe
4380	Lamjpbae.exe
2376	Lehfqqjn.exe
1976	Lidbao32.exe
2996	Llbnmk32.exe
4536	Lpnjniid.exe
2336	Lppgciga.exe
4384	Locgof32.exe
4324	Lcocpdfe.exe
2844	Laacka32.exe
2744	Lemolpei.exe
612	Ljiklonb.exe
3764	Lhkkhk32.exe
1668	Llgghjme.exe
3064	Lpbcii32.exe
4452	Lcaped32.exe
2696	Ladpaakm.exe
4552	Lfplap32.exe
1968	Ljkhbnlo.exe
3324	Mcclkd32.exe
3816	Mjmdgn32.exe
3892	Mllaci32.exe
2688	Mpgmdhai.exe
3176	Mcfipcpm.exe
4900	Mfdemopq.exe
844	Mhbaijod.exe
3624	Momjed32.exe
4816	Mfiogn32.exe
3856	Mhgkdj32.exe
2812	Mqnceg32.exe
1016	Mbppmoap.exe
4660	Mhihii32.exe
1744	Nqqpjgio.exe
3752	Nbblbo32.exe
1956	Nhldoifj.exe
2356	Ncailbfp.exe
1424	Nbdiho32.exe
3012	Nmjmeg32.exe
3444	Nohiacld.exe
2244	Nfbanm32.exe
3056	Nqhfkf32.exe
432	Ncfbga32.exe
4652	Nicjph32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Llagcdmo.exe	Longjpoe.exe
File created	C:\Windows\SysWOW64\Lcjide32.exe	Lplmhj32.exe
File created	C:\Windows\SysWOW64\Bjmlme32.exe	Bbedlg32.exe
File created	C:\Windows\SysWOW64\Ennfdbjj.dll	Ekddlo32.exe
File opened for modification	C:\Windows\SysWOW64\Klanlg32.exe	Jbijcaea.exe
File created	C:\Windows\SysWOW64\Jjippjpl.dll	Amlenlkl.exe
File created	C:\Windows\SysWOW64\Oihdkgll.exe	Ockkbqne.exe
File opened for modification	C:\Windows\SysWOW64\Aahhia32.exe	Ajoplgod.exe
File created	C:\Windows\SysWOW64\Pfcnkdee.dll	Cbachf32.exe
File created	C:\Windows\SysWOW64\Llgbnicn.dll	Cpcglj32.exe
File created	C:\Windows\SysWOW64\Fhajia32.dll	Pooanidm.exe
File opened for modification	C:\Windows\SysWOW64\Peljfpbe.exe	Pcjnoh32.exe
File created	C:\Windows\SysWOW64\Bblcbpio.exe	Bdicgc32.exe
File opened for modification	C:\Windows\SysWOW64\Fnioncfg.exe	Fgogai32.exe
File opened for modification	C:\Windows\SysWOW64\Kocnhhlo.exe	Kldblmmk.exe
File opened for modification	C:\Windows\SysWOW64\Kpiqcj32.exe	Klndbkep.exe
File created	C:\Windows\SysWOW64\Ladpaakm.exe	Lcaped32.exe
File opened for modification	C:\Windows\SysWOW64\Qbbged32.exe	Pmeomm32.exe
File created	C:\Windows\SysWOW64\Cmhmqhbl.exe	Ceaeokaj.exe
File created	C:\Windows\SysWOW64\Mhbonq32.dll	Egcgfk32.exe
File created	C:\Windows\SysWOW64\Iebdgklg.dll	Fkpcgn32.exe
File created	C:\Windows\SysWOW64\Bafnoeel.dll	Gdbkfb32.exe
File created	C:\Windows\SysWOW64\Pijbmnhk.exe	Pfkfqcih.exe
File opened for modification	C:\Windows\SysWOW64\Hbhhef32.exe	Gjapdh32.exe
File opened for modification	C:\Windows\SysWOW64\Pmeomm32.exe	Pijbmnhk.exe
File created	C:\Windows\SysWOW64\Hhonal32.dll	Qmjhhlmo.exe
File created	C:\Windows\SysWOW64\Npbiagmb.dll	Khifln32.exe
File opened for modification	C:\Windows\SysWOW64\Mfdemopq.exe	Mcfipcpm.exe
File created	C:\Windows\SysWOW64\Dkkaeq32.exe	Dcdidc32.exe
File created	C:\Windows\SysWOW64\Mllaci32.exe	Mjmdgn32.exe
File opened for modification	C:\Windows\SysWOW64\Cdpigbll.exe	Cliafekj.exe
File created	C:\Windows\SysWOW64\Bijncf32.dll	Cmagpihd.exe
File opened for modification	C:\Windows\SysWOW64\Fepkgfgg.exe	Fdonpnai.exe
File opened for modification	C:\Windows\SysWOW64\Bpnnakmf.exe	Bideda32.exe
File opened for modification	C:\Windows\SysWOW64\Mdikce32.exe	Molckn32.exe
File created	C:\Windows\SysWOW64\Offdof32.exe	Nollbldc.exe
File created	C:\Windows\SysWOW64\Ahnbmm32.dll	Mddbhfdb.exe
File created	C:\Windows\SysWOW64\Qbhpfh32.dll	Nqqpjgio.exe
File created	C:\Windows\SysWOW64\Pajkgc32.exe	Pfegjjck.exe
File created	C:\Windows\SysWOW64\Ajoplgod.exe	Qafkca32.exe
File created	C:\Windows\SysWOW64\Pipehk32.dll	Pcjnoh32.exe
File created	C:\Windows\SysWOW64\Gaqpldng.dll	Peljfpbe.exe
File opened for modification	C:\Windows\SysWOW64\Epioiaak.exe	Emkcme32.exe
File opened for modification	C:\Windows\SysWOW64\Mfiogn32.exe	Momjed32.exe
File created	C:\Windows\SysWOW64\Egdnpa32.exe	Egbaka32.exe
File opened for modification	C:\Windows\SysWOW64\Longjpoe.exe	Llojmdpb.exe
File created	C:\Windows\SysWOW64\Mdikce32.exe	Molckn32.exe
File created	C:\Windows\SysWOW64\Jkiedn32.dll	Kojdig32.exe
File created	C:\Windows\SysWOW64\Ljkhbnlo.exe	Lfplap32.exe
File created	C:\Windows\SysWOW64\Khjlnb32.dll	Qjjfag32.exe
File created	C:\Windows\SysWOW64\Hclacn32.exe	Heiqgaoh.exe
File created	C:\Windows\SysWOW64\Jbpgmbml.exe	Jjholemj.exe
File created	C:\Windows\SysWOW64\Bafdjoja.exe	Bipliajo.exe
File created	C:\Windows\SysWOW64\Djdeeb32.dll	Cpgqgjel.exe
File opened for modification	C:\Windows\SysWOW64\Fkpcgn32.exe	Fgdggonq.exe
File created	C:\Windows\SysWOW64\Pbndekfm.exe	Pamhmb32.exe
File created	C:\Windows\SysWOW64\Jfpipngh.dll	Hbhhef32.exe
File created	C:\Windows\SysWOW64\Dbllin32.exe	Dlbcmdco.exe
File created	C:\Windows\SysWOW64\Aafoajmm.dll	Ijfbfe32.exe
File created	C:\Windows\SysWOW64\Iimchq32.dll	Kelokl32.exe
File created	C:\Windows\SysWOW64\Cldgkf32.exe	Cmagpihd.exe
File created	C:\Windows\SysWOW64\Hadjbb32.dll	Llgghjme.exe
File opened for modification	C:\Windows\SysWOW64\Fggdmo32.exe	Fnopci32.exe
File opened for modification	C:\Windows\SysWOW64\Gedgla32.exe	Gbfkpf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9816	9384	WerFault.exe	491

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpgmdhai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlpcdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fepkgfgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbebihbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peljfpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmjhhlmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocnhhlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplmhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aahhia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgaidd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dghodc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnioncfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhgkdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncailbfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekbgfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkjodj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhkndbcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nchomqph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabkop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdbkfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmhmqhbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cccpnefb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgmhpbbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pooanidm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klikgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbppmoap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhldoifj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ockkbqne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pajkgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbmab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldhblgop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llojmdpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdppdop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laacka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lemolpei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ladpaakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbhhef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijfbfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alabohod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eghaajdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nohiacld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciioopad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kacppmfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeopcmbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pamhmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjjlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbnjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjklaejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oleffo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdedfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbbged32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cemldk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhihii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amaeca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoegi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcbepm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooeohjlh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgonklmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epioiaak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjbmidii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlenlkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdicgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgghjme.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpiqcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckendmcg.dll"	Hclacn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkgaielm.dll"	Hadkgapf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Koimoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcbepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbgfbied.dll"	Pjemfhgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilaeeijd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlopioeh.dll"	Llagcdmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iekeok32.dll"	Mknjep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qkjlniel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pifeookm.dll"	Aeopcmbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mllaci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lknqij32.dll"	Amaeca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hindde32.dll"	Eanlhihd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pabeknmk.dll"	Fgdggonq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnagaffp.dll"	Hbakld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpgqgjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dghodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aiqimm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mloebebk.dll"	Aijlcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglljf32.dll"	Fnlcni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkpncb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Femnbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpjhpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdfkkcom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaqpldng.dll"	Peljfpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glljgajm.dll"	Blkdeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqackl32.dll"	Dekhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pijjgdlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfhnqclo.dll"	Bmikdq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daeibkpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhkkhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjippjpl.dll"	Amlenlkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abkjlb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kikokq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aikbnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpqjfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkgkk32.dll"	Jdempjoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejfno32.dll"	Ohgmpaiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpcglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdclgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Heiqgaoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ophpkbee.dll"	Hbmaqema.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjbmidii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpifbcom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oflddl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opibhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfplpm32.dll"	Ejbklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcgmopbl.dll"	Fngicjke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhkndbcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifnhdo32.dll"	Cmhmqhbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eginhm32.dll"	Lpnjniid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Inhkqe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cldgkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbnphp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fngbidhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amohnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apibhl32.dll"	Aihfhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgaidd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnlcni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbfkpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abpcgbcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leoegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfakcfpe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4484	2964	ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007N.exe	83
PID 2964 wrote to memory of 4484	2964	ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007N.exe	83
PID 2964 wrote to memory of 4484	2964	ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007N.exe	83
PID 4484 wrote to memory of 3216	4484	Jlbefm32.exe	84
PID 4484 wrote to memory of 3216	4484	Jlbefm32.exe	84
PID 4484 wrote to memory of 3216	4484	Jlbefm32.exe	84
PID 3216 wrote to memory of 4064	3216	Jopabhna.exe	85
PID 3216 wrote to memory of 4064	3216	Jopabhna.exe	85
PID 3216 wrote to memory of 4064	3216	Jopabhna.exe	85
PID 4064 wrote to memory of 912	4064	Khifln32.exe	86
PID 4064 wrote to memory of 912	4064	Khifln32.exe	86
PID 4064 wrote to memory of 912	4064	Khifln32.exe	86
PID 912 wrote to memory of 908	912	Kldblmmk.exe	87
PID 912 wrote to memory of 908	912	Kldblmmk.exe	87
PID 912 wrote to memory of 908	912	Kldblmmk.exe	87
PID 908 wrote to memory of 3320	908	Kocnhhlo.exe	88
PID 908 wrote to memory of 3320	908	Kocnhhlo.exe	88
PID 908 wrote to memory of 3320	908	Kocnhhlo.exe	88
PID 3320 wrote to memory of 1340	3320	Klgoalkh.exe	90
PID 3320 wrote to memory of 1340	3320	Klgoalkh.exe	90
PID 3320 wrote to memory of 1340	3320	Klgoalkh.exe	90
PID 1340 wrote to memory of 2036	1340	Koeknh32.exe	92
PID 1340 wrote to memory of 2036	1340	Koeknh32.exe	92
PID 1340 wrote to memory of 2036	1340	Koeknh32.exe	92
PID 2036 wrote to memory of 4656	2036	Kikokq32.exe	93
PID 2036 wrote to memory of 4656	2036	Kikokq32.exe	93
PID 2036 wrote to memory of 4656	2036	Kikokq32.exe	93
PID 4656 wrote to memory of 1724	4656	Klikgl32.exe	94
PID 4656 wrote to memory of 1724	4656	Klikgl32.exe	94
PID 4656 wrote to memory of 1724	4656	Klikgl32.exe	94
PID 1724 wrote to memory of 4460	1724	Koggcg32.exe	95
PID 1724 wrote to memory of 4460	1724	Koggcg32.exe	95
PID 1724 wrote to memory of 4460	1724	Koggcg32.exe	95
PID 4460 wrote to memory of 1072	4460	Kimlqp32.exe	96
PID 4460 wrote to memory of 1072	4460	Kimlqp32.exe	96
PID 4460 wrote to memory of 1072	4460	Kimlqp32.exe	96
PID 1072 wrote to memory of 4728	1072	Kojdig32.exe	97
PID 1072 wrote to memory of 4728	1072	Kojdig32.exe	97
PID 1072 wrote to memory of 4728	1072	Kojdig32.exe	97
PID 4728 wrote to memory of 1368	4728	Kahpebej.exe	98
PID 4728 wrote to memory of 1368	4728	Kahpebej.exe	98
PID 4728 wrote to memory of 1368	4728	Kahpebej.exe	98
PID 1368 wrote to memory of 2700	1368	Kiohfpfl.exe	100
PID 1368 wrote to memory of 2700	1368	Kiohfpfl.exe	100
PID 1368 wrote to memory of 2700	1368	Kiohfpfl.exe	100
PID 2700 wrote to memory of 4736	2700	Klndbkep.exe	101
PID 2700 wrote to memory of 4736	2700	Klndbkep.exe	101
PID 2700 wrote to memory of 4736	2700	Klndbkep.exe	101
PID 4736 wrote to memory of 2956	4736	Kpiqcj32.exe	102
PID 4736 wrote to memory of 2956	4736	Kpiqcj32.exe	102
PID 4736 wrote to memory of 2956	4736	Kpiqcj32.exe	102
PID 2956 wrote to memory of 756	2956	Lchmoe32.exe	103
PID 2956 wrote to memory of 756	2956	Lchmoe32.exe	103
PID 2956 wrote to memory of 756	2956	Lchmoe32.exe	103
PID 756 wrote to memory of 2396	756	Lajmkbcg.exe	104
PID 756 wrote to memory of 2396	756	Lajmkbcg.exe	104
PID 756 wrote to memory of 2396	756	Lajmkbcg.exe	104
PID 2396 wrote to memory of 1580	2396	Liaelpdj.exe	105
PID 2396 wrote to memory of 1580	2396	Liaelpdj.exe	105
PID 2396 wrote to memory of 1580	2396	Liaelpdj.exe	105
PID 1580 wrote to memory of 336	1580	Llpahkcm.exe	106
PID 1580 wrote to memory of 336	1580	Llpahkcm.exe	106
PID 1580 wrote to memory of 336	1580	Llpahkcm.exe	106
PID 336 wrote to memory of 4932	336	Lplmhj32.exe	107

C:\Users\Admin\AppData\Local\Temp\ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007N.exe
"C:\Users\Admin\AppData\Local\Temp\ab420f47d29e9632734616205ee9c6ecfc88dc3630535d6ffc07c7e6b5eee007N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\Jlbefm32.exe
  C:\Windows\system32\Jlbefm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\Jopabhna.exe
    C:\Windows\system32\Jopabhna.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\SysWOW64\Khifln32.exe
      C:\Windows\system32\Khifln32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Windows\SysWOW64\Kldblmmk.exe
        
        C:\Windows\system32\Kldblmmk.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:912
      - C:\Windows\SysWOW64\Kocnhhlo.exe
        
        C:\Windows\system32\Kocnhhlo.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SysWOW64\Klgoalkh.exe
        
        C:\Windows\system32\Klgoalkh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Koeknh32.exe
        
        C:\Windows\system32\Koeknh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Kikokq32.exe
        
        C:\Windows\system32\Kikokq32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Klikgl32.exe
        
        C:\Windows\system32\Klikgl32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Koggcg32.exe
        
        C:\Windows\system32\Koggcg32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Kimlqp32.exe
        
        C:\Windows\system32\Kimlqp32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Kojdig32.exe
        
        C:\Windows\system32\Kojdig32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Kahpebej.exe
        
        C:\Windows\system32\Kahpebej.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Kiohfpfl.exe
        
        C:\Windows\system32\Kiohfpfl.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Klndbkep.exe
        
        C:\Windows\system32\Klndbkep.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Kpiqcj32.exe
        
        C:\Windows\system32\Kpiqcj32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Lchmoe32.exe
        
        C:\Windows\system32\Lchmoe32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Lajmkbcg.exe
        
        C:\Windows\system32\Lajmkbcg.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Liaelpdj.exe
        
        C:\Windows\system32\Liaelpdj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\Llpahkcm.exe
        
        C:\Windows\system32\Llpahkcm.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Lplmhj32.exe
        
        C:\Windows\system32\Lplmhj32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\Lcjide32.exe
        
        C:\Windows\system32\Lcjide32.exe
        23⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Lamjpbae.exe
        
        C:\Windows\system32\Lamjpbae.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Lehfqqjn.exe
        
        C:\Windows\system32\Lehfqqjn.exe
        25⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Lidbao32.exe
        
        C:\Windows\system32\Lidbao32.exe
        26⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Llbnmk32.exe
        
        C:\Windows\system32\Llbnmk32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Lpnjniid.exe
        
        C:\Windows\system32\Lpnjniid.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Lppgciga.exe
        
        C:\Windows\system32\Lppgciga.exe
        29⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Locgof32.exe
        
        C:\Windows\system32\Locgof32.exe
        30⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Lcocpdfe.exe
        
        C:\Windows\system32\Lcocpdfe.exe
        31⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Laacka32.exe
        
        C:\Windows\system32\Laacka32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Windows\SysWOW64\Lemolpei.exe
        
        C:\Windows\system32\Lemolpei.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\Ljiklonb.exe
        
        C:\Windows\system32\Ljiklonb.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:612
        
        C:\Windows\SysWOW64\Lhkkhk32.exe
        
        C:\Windows\system32\Lhkkhk32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3764
        
        C:\Windows\SysWOW64\Llgghjme.exe
        
        C:\Windows\system32\Llgghjme.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Windows\SysWOW64\Lpbcii32.exe
        
        C:\Windows\system32\Lpbcii32.exe
        37⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Lcaped32.exe
        
        C:\Windows\system32\Lcaped32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\SysWOW64\Ladpaakm.exe
        
        C:\Windows\system32\Ladpaakm.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Windows\SysWOW64\Lfplap32.exe
        
        C:\Windows\system32\Lfplap32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Ljkhbnlo.exe
        
        C:\Windows\system32\Ljkhbnlo.exe
        41⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Mcclkd32.exe
        
        C:\Windows\system32\Mcclkd32.exe
        42⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Mjmdgn32.exe
        
        C:\Windows\system32\Mjmdgn32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3816
        
        C:\Windows\SysWOW64\Mllaci32.exe
        
        C:\Windows\system32\Mllaci32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Mpgmdhai.exe
        
        C:\Windows\system32\Mpgmdhai.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Windows\SysWOW64\Mcfipcpm.exe
        
        C:\Windows\system32\Mcfipcpm.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3176
        
        C:\Windows\SysWOW64\Mfdemopq.exe
        
        C:\Windows\system32\Mfdemopq.exe
        47⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Mhbaijod.exe
        
        C:\Windows\system32\Mhbaijod.exe
        48⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Momjed32.exe
        
        C:\Windows\system32\Momjed32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3624
        
        C:\Windows\SysWOW64\Mfiogn32.exe
        
        C:\Windows\system32\Mfiogn32.exe
        50⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Mhgkdj32.exe
        
        C:\Windows\system32\Mhgkdj32.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\Mqnceg32.exe
        
        C:\Windows\system32\Mqnceg32.exe
        52⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Mbppmoap.exe
        
        C:\Windows\system32\Mbppmoap.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1016
        
        C:\Windows\SysWOW64\Mhihii32.exe
        
        C:\Windows\system32\Mhihii32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Windows\SysWOW64\Nqqpjgio.exe
        
        C:\Windows\system32\Nqqpjgio.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Nbblbo32.exe
        
        C:\Windows\system32\Nbblbo32.exe
        56⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Nhldoifj.exe
        
        C:\Windows\system32\Nhldoifj.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\Ncailbfp.exe
        
        C:\Windows\system32\Ncailbfp.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\Nbdiho32.exe
        
        C:\Windows\system32\Nbdiho32.exe
        59⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Nmjmeg32.exe
        
        C:\Windows\system32\Nmjmeg32.exe
        60⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Nohiacld.exe
        
        C:\Windows\system32\Nohiacld.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Windows\SysWOW64\Nfbanm32.exe
        
        C:\Windows\system32\Nfbanm32.exe
        62⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Nqhfkf32.exe
        
        C:\Windows\system32\Nqhfkf32.exe
        63⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Ncfbga32.exe
        
        C:\Windows\system32\Ncfbga32.exe
        64⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Nicjph32.exe
        
        C:\Windows\system32\Nicjph32.exe
        65⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Nqjbqe32.exe
        
        C:\Windows\system32\Nqjbqe32.exe
        66⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Nchomqph.exe
        
        C:\Windows\system32\Nchomqph.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:320
        
        C:\Windows\SysWOW64\Njbgik32.exe
        
        C:\Windows\system32\Njbgik32.exe
        68⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Omacef32.exe
        
        C:\Windows\system32\Omacef32.exe
        69⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Ockkbqne.exe
        
        C:\Windows\system32\Ockkbqne.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Windows\SysWOW64\Oihdkgll.exe
        
        C:\Windows\system32\Oihdkgll.exe
        71⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Ooalga32.exe
        
        C:\Windows\system32\Ooalga32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1044
        
        C:\Windows\SysWOW64\Oflddl32.exe
        
        C:\Windows\system32\Oflddl32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Omemqfbc.exe
        
        C:\Windows\system32\Omemqfbc.exe
        74⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Ocpemp32.exe
        
        C:\Windows\system32\Ocpemp32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4436
        
        C:\Windows\SysWOW64\Ofnajk32.exe
        
        C:\Windows\system32\Ofnajk32.exe
        76⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Oqcegd32.exe
        
        C:\Windows\system32\Oqcegd32.exe
        77⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Omjfle32.exe
        
        C:\Windows\system32\Omjfle32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5032
        
        C:\Windows\SysWOW64\Opibhq32.exe
        
        C:\Windows\system32\Opibhq32.exe
        79⤵
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Ojnfei32.exe
        
        C:\Windows\system32\Ojnfei32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5020
        
        C:\Windows\SysWOW64\Pqhobced.exe
        
        C:\Windows\system32\Pqhobced.exe
        81⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Pfegjjck.exe
        
        C:\Windows\system32\Pfegjjck.exe
        82⤵
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Pajkgc32.exe
        
        C:\Windows\system32\Pajkgc32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Pfgdpj32.exe
        
        C:\Windows\system32\Pfgdpj32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5112
        
        C:\Windows\SysWOW64\Pjcpphib.exe
        
        C:\Windows\system32\Pjcpphib.exe
        85⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Pamhmb32.exe
        
        C:\Windows\system32\Pamhmb32.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Windows\SysWOW64\Pbndekfm.exe
        
        C:\Windows\system32\Pbndekfm.exe
        87⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Pjemfhgo.exe
        
        C:\Windows\system32\Pjemfhgo.exe
        88⤵
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Paoebbol.exe
        
        C:\Windows\system32\Paoebbol.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4308
        
        C:\Windows\SysWOW64\Pflmkimc.exe
        
        C:\Windows\system32\Pflmkimc.exe
        90⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Pijjgdlg.exe
        
        C:\Windows\system32\Pijjgdlg.exe
        91⤵
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Pbbnpj32.exe
        
        C:\Windows\system32\Pbbnpj32.exe
        92⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Qjjfag32.exe
        
        C:\Windows\system32\Qjjfag32.exe
        93⤵
        Drops file in System32 directory
        
        PID:2360
        
        C:\Windows\SysWOW64\Qcbjjm32.exe
        
        C:\Windows\system32\Qcbjjm32.exe
        94⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Qbekejqe.exe
        
        C:\Windows\system32\Qbekejqe.exe
        95⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Qafkca32.exe
        
        C:\Windows\system32\Qafkca32.exe
        96⤵
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Ajoplgod.exe
        
        C:\Windows\system32\Ajoplgod.exe
        97⤵
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\Aahhia32.exe
        
        C:\Windows\system32\Aahhia32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Windows\SysWOW64\Apkhdn32.exe
        
        C:\Windows\system32\Apkhdn32.exe
        99⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Afepahei.exe
        
        C:\Windows\system32\Afepahei.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1056
        
        C:\Windows\SysWOW64\Ajalaf32.exe
        
        C:\Windows\system32\Ajalaf32.exe
        101⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Amohnb32.exe
        
        C:\Windows\system32\Amohnb32.exe
        102⤵
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Aakdnqdo.exe
        
        C:\Windows\system32\Aakdnqdo.exe
        103⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Adiqjlcb.exe
        
        C:\Windows\system32\Adiqjlcb.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1248
        
        C:\Windows\SysWOW64\Afhmggcf.exe
        
        C:\Windows\system32\Afhmggcf.exe
        105⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Aificcbj.exe
        
        C:\Windows\system32\Aificcbj.exe
        106⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Amaeca32.exe
        
        C:\Windows\system32\Amaeca32.exe
        107⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Appapm32.exe
        
        C:\Windows\system32\Appapm32.exe
        108⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Abnnlhhj.exe
        
        C:\Windows\system32\Abnnlhhj.exe
        109⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Afjjlg32.exe
        
        C:\Windows\system32\Afjjlg32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Aihfhb32.exe
        
        C:\Windows\system32\Aihfhb32.exe
        111⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Aapnip32.exe
        
        C:\Windows\system32\Aapnip32.exe
        112⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Adnjek32.exe
        
        C:\Windows\system32\Adnjek32.exe
        113⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Aflfag32.exe
        
        C:\Windows\system32\Aflfag32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Aikbnb32.exe
        
        C:\Windows\system32\Aikbnb32.exe
        115⤵
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Aabkop32.exe
        
        C:\Windows\system32\Aabkop32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\Adpgkk32.exe
        
        C:\Windows\system32\Adpgkk32.exe
        117⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Abcgghde.exe
        
        C:\Windows\system32\Abcgghde.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Bjjohe32.exe
        
        C:\Windows\system32\Bjjohe32.exe
        119⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Bmikdq32.exe
        
        C:\Windows\system32\Bmikdq32.exe
        120⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Badgdold.exe
        
        C:\Windows\system32\Badgdold.exe
        121⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Bpggpl32.exe
        
        C:\Windows\system32\Bpggpl32.exe
        122⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Bbedlg32.exe
        
        C:\Windows\system32\Bbedlg32.exe
        123⤵
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Bjmlme32.exe
        
        C:\Windows\system32\Bjmlme32.exe
        124⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bipliajo.exe
        
        C:\Windows\system32\Bipliajo.exe
        125⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Bafdjoja.exe
        
        C:\Windows\system32\Bafdjoja.exe
        126⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Bdepfjie.exe
        
        C:\Windows\system32\Bdepfjie.exe
        127⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Bbhqbg32.exe
        
        C:\Windows\system32\Bbhqbg32.exe
        128⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Bfclbfii.exe
        
        C:\Windows\system32\Bfclbfii.exe
        129⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Bmmdoppe.exe
        
        C:\Windows\system32\Bmmdoppe.exe
        130⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bplakkoi.exe
        
        C:\Windows\system32\Bplakkoi.exe
        131⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Bbjmggnm.exe
        
        C:\Windows\system32\Bbjmggnm.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Bffihe32.exe
        
        C:\Windows\system32\Bffihe32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Bideda32.exe
        
        C:\Windows\system32\Bideda32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Bpnnakmf.exe
        
        C:\Windows\system32\Bpnnakmf.exe
        135⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Bfhfne32.exe
        
        C:\Windows\system32\Bfhfne32.exe
        136⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Bkcbnd32.exe
        
        C:\Windows\system32\Bkcbnd32.exe
        137⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Bmbnjo32.exe
        
        C:\Windows\system32\Bmbnjo32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Windows\SysWOW64\Bpqjfk32.exe
        
        C:\Windows\system32\Bpqjfk32.exe
        139⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Cgjbcebq.exe
        
        C:\Windows\system32\Cgjbcebq.exe
        140⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Ciioopad.exe
        
        C:\Windows\system32\Ciioopad.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\Cpcglj32.exe
        
        C:\Windows\system32\Cpcglj32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Cdncliaj.exe
        
        C:\Windows\system32\Cdncliaj.exe
        143⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Cbachf32.exe
        
        C:\Windows\system32\Cbachf32.exe
        144⤵
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Ckhkic32.exe
        
        C:\Windows\system32\Ckhkic32.exe
        145⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Cmggeohk.exe
        
        C:\Windows\system32\Cmggeohk.exe
        146⤵
        
        PID:980
        
        C:\Windows\SysWOW64\Cpedajgo.exe
        
        C:\Windows\system32\Cpedajgo.exe
        147⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Cccpnefb.exe
        
        C:\Windows\system32\Cccpnefb.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Cgolnd32.exe
        
        C:\Windows\system32\Cgolnd32.exe
        149⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Cinhjp32.exe
        
        C:\Windows\system32\Cinhjp32.exe
        150⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Cmidknfh.exe
        
        C:\Windows\system32\Cmidknfh.exe
        151⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Cpgqgjel.exe
        
        C:\Windows\system32\Cpgqgjel.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Cdclgh32.exe
        
        C:\Windows\system32\Cdclgh32.exe
        153⤵
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Cgaidd32.exe
        
        C:\Windows\system32\Cgaidd32.exe
        154⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Cmkaqnde.exe
        
        C:\Windows\system32\Cmkaqnde.exe
        155⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Cdeimhkb.exe
        
        C:\Windows\system32\Cdeimhkb.exe
        156⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Cmnnfn32.exe
        
        C:\Windows\system32\Cmnnfn32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Dkanob32.exe
        
        C:\Windows\system32\Dkanob32.exe
        158⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ddjbhg32.exe
        
        C:\Windows\system32\Ddjbhg32.exe
        159⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Dghodc32.exe
        
        C:\Windows\system32\Dghodc32.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Ddlong32.exe
        
        C:\Windows\system32\Ddlong32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Dkfgjamg.exe
        
        C:\Windows\system32\Dkfgjamg.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Dappgk32.exe
        
        C:\Windows\system32\Dappgk32.exe
        163⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Dcaloc32.exe
        
        C:\Windows\system32\Dcaloc32.exe
        164⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Dgmhpbbk.exe
        
        C:\Windows\system32\Dgmhpbbk.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Windows\SysWOW64\Djldlnao.exe
        
        C:\Windows\system32\Djldlnao.exe
        166⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Dpemhh32.exe
        
        C:\Windows\system32\Dpemhh32.exe
        167⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Dcdidc32.exe
        
        C:\Windows\system32\Dcdidc32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Dkkaeq32.exe
        
        C:\Windows\system32\Dkkaeq32.exe
        169⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Djnaamol.exe
        
        C:\Windows\system32\Djnaamol.exe
        170⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Daeibkpo.exe
        
        C:\Windows\system32\Daeibkpo.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Egbaka32.exe
        
        C:\Windows\system32\Egbaka32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Egdnpa32.exe
        
        C:\Windows\system32\Egdnpa32.exe
        173⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Ejbklm32.exe
        
        C:\Windows\system32\Ejbklm32.exe
        174⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Eajbmj32.exe
        
        C:\Windows\system32\Eajbmj32.exe
        175⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Epmcigbd.exe
        
        C:\Windows\system32\Epmcigbd.exe
        176⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Eckoebbg.exe
        
        C:\Windows\system32\Eckoebbg.exe
        177⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ekbgfp32.exe
        
        C:\Windows\system32\Ekbgfp32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7004
        
        C:\Windows\SysWOW64\Ejegblid.exe
        
        C:\Windows\system32\Ejegblid.exe
        179⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ekddlo32.exe
        
        C:\Windows\system32\Ekddlo32.exe
        180⤵
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\Encphk32.exe
        
        C:\Windows\system32\Encphk32.exe
        181⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Eanlhihd.exe
        
        C:\Windows\system32\Eanlhihd.exe
        182⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Edmhdegh.exe
        
        C:\Windows\system32\Edmhdegh.exe
        183⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Enemnjnh.exe
        
        C:\Windows\system32\Enemnjnh.exe
        184⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Fqcijfml.exe
        
        C:\Windows\system32\Fqcijfml.exe
        185⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Fgnafp32.exe
        
        C:\Windows\system32\Fgnafp32.exe
        186⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fjlmbk32.exe
        
        C:\Windows\system32\Fjlmbk32.exe
        187⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Fngicjke.exe
        
        C:\Windows\system32\Fngicjke.exe
        188⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Fqffoeki.exe
        
        C:\Windows\system32\Fqffoeki.exe
        189⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Fcdbkajm.exe
        
        C:\Windows\system32\Fcdbkajm.exe
        190⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Fbebihbl.exe
        
        C:\Windows\system32\Fbebihbl.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Fnlcni32.exe
        
        C:\Windows\system32\Fnlcni32.exe
        192⤵
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Fqkoje32.exe
        
        C:\Windows\system32\Fqkoje32.exe
        193⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Fdfkkcom.exe
        
        C:\Windows\system32\Fdfkkcom.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Fgdggonq.exe
        
        C:\Windows\system32\Fgdggonq.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Fkpcgn32.exe
        
        C:\Windows\system32\Fkpcgn32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Fnopci32.exe
        
        C:\Windows\system32\Fnopci32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Fggdmo32.exe
        
        C:\Windows\system32\Fggdmo32.exe
        198⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fnaliick.exe
        
        C:\Windows\system32\Fnaliick.exe
        199⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Gdkdfc32.exe
        
        C:\Windows\system32\Gdkdfc32.exe
        200⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Ggiqbn32.exe
        
        C:\Windows\system32\Ggiqbn32.exe
        201⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Gkembmbd.exe
        
        C:\Windows\system32\Gkembmbd.exe
        202⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Gdmakbie.exe
        
        C:\Windows\system32\Gdmakbie.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Gjjjdigl.exe
        
        C:\Windows\system32\Gjjjdigl.exe
        204⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Gdpnabgb.exe
        
        C:\Windows\system32\Gdpnabgb.exe
        205⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Gnhbjh32.exe
        
        C:\Windows\system32\Gnhbjh32.exe
        206⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Gdbkfb32.exe
        
        C:\Windows\system32\Gdbkfb32.exe
        207⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Gbfkpf32.exe
        
        C:\Windows\system32\Gbfkpf32.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Gedgla32.exe
        
        C:\Windows\system32\Gedgla32.exe
        209⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Gjapdh32.exe
        
        C:\Windows\system32\Gjapdh32.exe
        210⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Hbhhef32.exe
        
        C:\Windows\system32\Hbhhef32.exe
        211⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Hgepnmpn.exe
        
        C:\Windows\system32\Hgepnmpn.exe
        212⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Heiqgaoh.exe
        
        C:\Windows\system32\Heiqgaoh.exe
        213⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Hclacn32.exe
        
        C:\Windows\system32\Hclacn32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Hbmaqema.exe
        
        C:\Windows\system32\Hbmaqema.exe
        215⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Hncbffce.exe
        
        C:\Windows\system32\Hncbffce.exe
        216⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Henjbp32.exe
        
        C:\Windows\system32\Henjbp32.exe
        217⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Hglfol32.exe
        
        C:\Windows\system32\Hglfol32.exe
        218⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Hjjbkg32.exe
        
        C:\Windows\system32\Hjjbkg32.exe
        219⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Hbakld32.exe
        
        C:\Windows\system32\Hbakld32.exe
        220⤵
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Hadkgapf.exe
        
        C:\Windows\system32\Hadkgapf.exe
        221⤵
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Hkjodj32.exe
        
        C:\Windows\system32\Hkjodj32.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Windows\SysWOW64\Inhkqe32.exe
        
        C:\Windows\system32\Inhkqe32.exe
        223⤵
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Ijolffed.exe
        
        C:\Windows\system32\Ijolffed.exe
        224⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Inmelekk.exe
        
        C:\Windows\system32\Inmelekk.exe
        225⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ilaeeijd.exe
        
        C:\Windows\system32\Ilaeeijd.exe
        226⤵
        Modifies registry class
        
        PID:7296
        
        C:\Windows\SysWOW64\Ijfbfe32.exe
        
        C:\Windows\system32\Ijfbfe32.exe
        227⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7336
        
        C:\Windows\SysWOW64\Jjholemj.exe
        
        C:\Windows\system32\Jjholemj.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Jbpgmbml.exe
        
        C:\Windows\system32\Jbpgmbml.exe
        229⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Jjklaejg.exe
        
        C:\Windows\system32\Jjklaejg.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Windows\SysWOW64\Jholki32.exe
        
        C:\Windows\system32\Jholki32.exe
        231⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Jjmhgd32.exe
        
        C:\Windows\system32\Jjmhgd32.exe
        232⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Jnidhcam.exe
        
        C:\Windows\system32\Jnidhcam.exe
        233⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jdempjoe.exe
        
        C:\Windows\system32\Jdempjoe.exe
        234⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Jbfmna32.exe
        
        C:\Windows\system32\Jbfmna32.exe
        235⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Jomncb32.exe
        
        C:\Windows\system32\Jomncb32.exe
        236⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Jbijcaea.exe
        
        C:\Windows\system32\Jbijcaea.exe
        237⤵
        Drops file in System32 directory
        
        PID:7748
        
        C:\Windows\SysWOW64\Klanlg32.exe
        
        C:\Windows\system32\Klanlg32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Kdmcqi32.exe
        
        C:\Windows\system32\Kdmcqi32.exe
        239⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Kelokl32.exe
        
        C:\Windows\system32\Kelokl32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Koddcagp.exe
        
        C:\Windows\system32\Koddcagp.exe
        241⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Kacppmfd.exe
        
        C:\Windows\system32\Kacppmfd.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\Klhdmf32.exe
        
        C:\Windows\system32\Klhdmf32.exe
        243⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Kbbmipmf.exe
        
        C:\Windows\system32\Kbbmipmf.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8080
        
        C:\Windows\SysWOW64\Kdciah32.exe
        
        C:\Windows\system32\Kdciah32.exe
        245⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Khoebgkn.exe
        
        C:\Windows\system32\Khoebgkn.exe
        246⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Kknanbja.exe
        
        C:\Windows\system32\Kknanbja.exe
        247⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Koimoa32.exe
        
        C:\Windows\system32\Koimoa32.exe
        248⤵
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Kagikl32.exe
        
        C:\Windows\system32\Kagikl32.exe
        249⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Kdffgh32.exe
        
        C:\Windows\system32\Kdffgh32.exe
        250⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Lkpncb32.exe
        
        C:\Windows\system32\Lkpncb32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Ldhblgop.exe
        
        C:\Windows\system32\Ldhblgop.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Windows\SysWOW64\Llojmdpb.exe
        
        C:\Windows\system32\Llojmdpb.exe
        253⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7828
        
        C:\Windows\SysWOW64\Longjpoe.exe
        
        C:\Windows\system32\Longjpoe.exe
        254⤵
        Drops file in System32 directory
        
        PID:7904
        
        C:\Windows\SysWOW64\Llagcdmo.exe
        
        C:\Windows\system32\Llagcdmo.exe
        255⤵
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Ldmlgg32.exe
        
        C:\Windows\system32\Ldmlgg32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8044
        
        C:\Windows\SysWOW64\Lelhajbm.exe
        
        C:\Windows\system32\Lelhajbm.exe
        257⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Leoegi32.exe
        
        C:\Windows\system32\Leoegi32.exe
        258⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Mhmacd32.exe
        
        C:\Windows\system32\Mhmacd32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7284
        
        C:\Windows\SysWOW64\Mcbepm32.exe
        
        C:\Windows\system32\Mcbepm32.exe
        260⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Mddbhfdb.exe
        
        C:\Windows\system32\Mddbhfdb.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Mknjep32.exe
        
        C:\Windows\system32\Mknjep32.exe
        262⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Mahbaj32.exe
        
        C:\Windows\system32\Mahbaj32.exe
        263⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Molckn32.exe
        
        C:\Windows\system32\Molckn32.exe
        264⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Mdikce32.exe
        
        C:\Windows\system32\Mdikce32.exe
        265⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Mlpcdb32.exe
        
        C:\Windows\system32\Mlpcdb32.exe
        266⤵
        System Location Discovery: System Language Discovery
        
        PID:8132
        
        C:\Windows\SysWOW64\Mcjlalil.exe
        
        C:\Windows\system32\Mcjlalil.exe
        267⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Maohbimd.exe
        
        C:\Windows\system32\Maohbimd.exe
        268⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ncnell32.exe
        
        C:\Windows\system32\Ncnell32.exe
        269⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Nemahg32.exe
        
        C:\Windows\system32\Nemahg32.exe
        270⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Nhkndbcn.exe
        
        C:\Windows\system32\Nhkndbcn.exe
        271⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Nkjjqnba.exe
        
        C:\Windows\system32\Nkjjqnba.exe
        272⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Nlifja32.exe
        
        C:\Windows\system32\Nlifja32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Nfakcfpe.exe
        
        C:\Windows\system32\Nfakcfpe.exe
        274⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Nojollfe.exe
        
        C:\Windows\system32\Nojollfe.exe
        275⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Nbhkhgei.exe
        
        C:\Windows\system32\Nbhkhgei.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Nollbldc.exe
        
        C:\Windows\system32\Nollbldc.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Offdof32.exe
        
        C:\Windows\system32\Offdof32.exe
        278⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ofhadeim.exe
        
        C:\Windows\system32\Ofhadeim.exe
        279⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Ohgmpaiq.exe
        
        C:\Windows\system32\Ohgmpaiq.exe
        280⤵
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Okeillhd.exe
        
        C:\Windows\system32\Okeillhd.exe
        281⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Oleffo32.exe
        
        C:\Windows\system32\Oleffo32.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:8320
        
        C:\Windows\SysWOW64\Odpjkalb.exe
        
        C:\Windows\system32\Odpjkalb.exe
        283⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ooeohjlh.exe
        
        C:\Windows\system32\Ooeohjlh.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
        
        C:\Windows\SysWOW64\Ofpgdd32.exe
        
        C:\Windows\system32\Ofpgdd32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Ohncap32.exe
        
        C:\Windows\system32\Ohncap32.exe
        286⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Pdedfa32.exe
        
        C:\Windows\system32\Pdedfa32.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
        
        C:\Windows\SysWOW64\Pojhcj32.exe
        
        C:\Windows\system32\Pojhcj32.exe
        288⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Pfdppdop.exe
        
        C:\Windows\system32\Pfdppdop.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:8592
        
        C:\Windows\SysWOW64\Pibmlooc.exe
        
        C:\Windows\system32\Pibmlooc.exe
        290⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Pchaihni.exe
        
        C:\Windows\system32\Pchaihni.exe
        291⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Peimapdg.exe
        
        C:\Windows\system32\Peimapdg.exe
        292⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Pmqebnej.exe
        
        C:\Windows\system32\Pmqebnej.exe
        293⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Pooanidm.exe
        
        C:\Windows\system32\Pooanidm.exe
        294⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Pcjnoh32.exe
        
        C:\Windows\system32\Pcjnoh32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Peljfpbe.exe
        
        C:\Windows\system32\Peljfpbe.exe
        296⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Pkfbcj32.exe
        
        C:\Windows\system32\Pkfbcj32.exe
        297⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Pcmjdg32.exe
        
        C:\Windows\system32\Pcmjdg32.exe
        298⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Pfkfqcih.exe
        
        C:\Windows\system32\Pfkfqcih.exe
        299⤵
        Drops file in System32 directory
        
        PID:8992
        
        C:\Windows\SysWOW64\Pijbmnhk.exe
        
        C:\Windows\system32\Pijbmnhk.exe
        300⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Pmeomm32.exe
        
        C:\Windows\system32\Pmeomm32.exe
        301⤵
        Drops file in System32 directory
        
        PID:9068
        
        C:\Windows\SysWOW64\Qbbged32.exe
        
        C:\Windows\system32\Qbbged32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Windows\SysWOW64\Qkjlniel.exe
        
        C:\Windows\system32\Qkjlniel.exe
        303⤵
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Qpfhoh32.exe
        
        C:\Windows\system32\Qpfhoh32.exe
        304⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Qbddkc32.exe
        
        C:\Windows\system32\Qbddkc32.exe
        305⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Qmjhhlmo.exe
        
        C:\Windows\system32\Qmjhhlmo.exe
        306⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Windows\SysWOW64\Qkmhdi32.exe
        
        C:\Windows\system32\Qkmhdi32.exe
        307⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Afbmab32.exe
        
        C:\Windows\system32\Afbmab32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Windows\SysWOW64\Aiqimm32.exe
        
        C:\Windows\system32\Aiqimm32.exe
        309⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Amlenlkl.exe
        
        C:\Windows\system32\Amlenlkl.exe
        310⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Apkajgjp.exe
        
        C:\Windows\system32\Apkajgjp.exe
        311⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Aegibnhg.exe
        
        C:\Windows\system32\Aegibnhg.exe
        312⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Aicecm32.exe
        
        C:\Windows\system32\Aicecm32.exe
        313⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Alabohod.exe
        
        C:\Windows\system32\Alabohod.exe
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Windows\SysWOW64\Apmnpg32.exe
        
        C:\Windows\system32\Apmnpg32.exe
        315⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Acijpfpf.exe
        
        C:\Windows\system32\Acijpfpf.exe
        316⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Abkjlb32.exe
        
        C:\Windows\system32\Abkjlb32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2984
        
        C:\Windows\SysWOW64\Aejfhn32.exe
        
        C:\Windows\system32\Aejfhn32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Aiebhmnn.exe
        
        C:\Windows\system32\Aiebhmnn.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Ackfeend.exe
        
        C:\Windows\system32\Ackfeend.exe
        320⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Afibaamh.exe
        
        C:\Windows\system32\Afibaamh.exe
        321⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Aelcmn32.exe
        
        C:\Windows\system32\Aelcmn32.exe
        322⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Alfkjh32.exe
        
        C:\Windows\system32\Alfkjh32.exe
        323⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Acmcke32.exe
        
        C:\Windows\system32\Acmcke32.exe
        324⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Abpcgbcl.exe
        
        C:\Windows\system32\Abpcgbcl.exe
        325⤵
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Aeopcmbp.exe
        
        C:\Windows\system32\Aeopcmbp.exe
        326⤵
        Modifies registry class
        
        PID:8580
        
        C:\Windows\SysWOW64\Aeopcmbp.exe
        
        C:\Windows\system32\Aeopcmbp.exe
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:8508
        
        C:\Windows\SysWOW64\Aijlcl32.exe
        
        C:\Windows\system32\Aijlcl32.exe
        328⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Amehdkbb.exe
        
        C:\Windows\system32\Amehdkbb.exe
        329⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Blhhpg32.exe
        
        C:\Windows\system32\Blhhpg32.exe
        330⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Bcppqe32.exe
        
        C:\Windows\system32\Bcppqe32.exe
        331⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Bfnlmp32.exe
        
        C:\Windows\system32\Bfnlmp32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Blkdeg32.exe
        
        C:\Windows\system32\Blkdeg32.exe
        333⤵
        Modifies registry class
        
        PID:8256
        
        C:\Windows\SysWOW64\Bmjaoj32.exe
        
        C:\Windows\system32\Bmjaoj32.exe
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
        
        C:\Windows\SysWOW64\Bpkjae32.exe
        
        C:\Windows\system32\Bpkjae32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8556
        
        C:\Windows\SysWOW64\Bmojjijg.exe
        
        C:\Windows\system32\Bmojjijg.exe
        336⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Bdicgc32.exe
        
        C:\Windows\system32\Bdicgc32.exe
        337⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\Bblcbpio.exe
        
        C:\Windows\system32\Bblcbpio.exe
        338⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Cmagpihd.exe
        
        C:\Windows\system32\Cmagpihd.exe
        339⤵
        Drops file in System32 directory
        
        PID:8332
        
        C:\Windows\SysWOW64\Cldgkf32.exe
        
        C:\Windows\system32\Cldgkf32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Cbnphp32.exe
        
        C:\Windows\system32\Cbnphp32.exe
        341⤵
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Cemldk32.exe
        
        C:\Windows\system32\Cemldk32.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
        
        C:\Windows\SysWOW64\Cpbpad32.exe
        
        C:\Windows\system32\Cpbpad32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8892
        
        C:\Windows\SysWOW64\Cbqlnp32.exe
        
        C:\Windows\system32\Cbqlnp32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Cijdjjlf.exe
        
        C:\Windows\system32\Cijdjjlf.exe
        345⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Cliafekj.exe
        
        C:\Windows\system32\Cliafekj.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Cdpigbll.exe
        
        C:\Windows\system32\Cdpigbll.exe
        347⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ceaeokaj.exe
        
        C:\Windows\system32\Ceaeokaj.exe
        348⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Cmhmqhbl.exe
        
        C:\Windows\system32\Cmhmqhbl.exe
        349⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9324
        
        C:\Windows\SysWOW64\Cpgjmcap.exe
        
        C:\Windows\system32\Cpgjmcap.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9360
        
        C:\Windows\SysWOW64\Cfqbin32.exe
        
        C:\Windows\system32\Cfqbin32.exe
        351⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Cionei32.exe
        
        C:\Windows\system32\Cionei32.exe
        352⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cpifbcom.exe
        
        C:\Windows\system32\Cpifbcom.exe
        353⤵
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Cfcoom32.exe
        
        C:\Windows\system32\Cfcoom32.exe
        354⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Diakkifn.exe
        
        C:\Windows\system32\Diakkifn.exe
        355⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Dpkchc32.exe
        
        C:\Windows\system32\Dpkchc32.exe
        356⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Dbjodn32.exe
        
        C:\Windows\system32\Dbjodn32.exe
        357⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Dlbcmdco.exe
        
        C:\Windows\system32\Dlbcmdco.exe
        358⤵
        Drops file in System32 directory
        
        PID:9652
        
        C:\Windows\SysWOW64\Dbllin32.exe
        
        C:\Windows\system32\Dbllin32.exe
        359⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Dekhei32.exe
        
        C:\Windows\system32\Dekhei32.exe
        360⤵
        Modifies registry class
        
        PID:9724
        
        C:\Windows\SysWOW64\Dpplcbie.exe
        
        C:\Windows\system32\Dpplcbie.exe
        361⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Dboionhi.exe
        
        C:\Windows\system32\Dboionhi.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9796
        
        C:\Windows\SysWOW64\Dihalh32.exe
        
        C:\Windows\system32\Dihalh32.exe
        363⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Dpbihbgc.exe
        
        C:\Windows\system32\Dpbihbgc.exe
        364⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Dglael32.exe
        
        C:\Windows\system32\Dglael32.exe
        365⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Diknag32.exe
        
        C:\Windows\system32\Diknag32.exe
        366⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Dlijmcmg.exe
        
        C:\Windows\system32\Dlijmcmg.exe
        367⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Dccbjm32.exe
        
        C:\Windows\system32\Dccbjm32.exe
        368⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Dgonklmm.exe
        
        C:\Windows\system32\Dgonklmm.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10048
        
        C:\Windows\SysWOW64\Emifgf32.exe
        
        C:\Windows\system32\Emifgf32.exe
        370⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Edcodpkf.exe
        
        C:\Windows\system32\Edcodpkf.exe
        371⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Egakpkkj.exe
        
        C:\Windows\system32\Egakpkkj.exe
        372⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Emkcme32.exe
        
        C:\Windows\system32\Emkcme32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Epioiaak.exe
        
        C:\Windows\system32\Epioiaak.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:10228
        
        C:\Windows\SysWOW64\Egcgfk32.exe
        
        C:\Windows\system32\Egcgfk32.exe
        375⤵
        Drops file in System32 directory
        
        PID:9260
        
        C:\Windows\SysWOW64\Eibdbf32.exe
        
        C:\Windows\system32\Eibdbf32.exe
        376⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Elppnb32.exe
        
        C:\Windows\system32\Elppnb32.exe
        377⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Edghoo32.exe
        
        C:\Windows\system32\Edghoo32.exe
        378⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Eeidggmp.exe
        
        C:\Windows\system32\Eeidggmp.exe
        379⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Enplhenb.exe
        
        C:\Windows\system32\Enplhenb.exe
        380⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Edjddoeo.exe
        
        C:\Windows\system32\Edjddoeo.exe
        381⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Eghaajdb.exe
        
        C:\Windows\system32\Eghaajdb.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
        
        C:\Windows\SysWOW64\Enbind32.exe
        
        C:\Windows\system32\Enbind32.exe
        383⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Epqejp32.exe
        
        C:\Windows\system32\Epqejp32.exe
        384⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Egjnfjbp.exe
        
        C:\Windows\system32\Egjnfjbp.exe
        385⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Femnbg32.exe
        
        C:\Windows\system32\Femnbg32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Flgfoaqg.exe
        
        C:\Windows\system32\Flgfoaqg.exe
        387⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Fdonpnai.exe
        
        C:\Windows\system32\Fdonpnai.exe
        388⤵
        Drops file in System32 directory
        
        PID:10108
        
        C:\Windows\SysWOW64\Fepkgfgg.exe
        
        C:\Windows\system32\Fepkgfgg.exe
        389⤵
        System Location Discovery: System Language Discovery
        
        PID:10180
        
        C:\Windows\SysWOW64\Fngbidhj.exe
        
        C:\Windows\system32\Fngbidhj.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Fpeoeogm.exe
        
        C:\Windows\system32\Fpeoeogm.exe
        391⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Fgogai32.exe
        
        C:\Windows\system32\Fgogai32.exe
        392⤵
        Drops file in System32 directory
        
        PID:9444
        
        C:\Windows\SysWOW64\Fnioncfg.exe
        
        C:\Windows\system32\Fnioncfg.exe
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Fpgkjoek.exe
        
        C:\Windows\system32\Fpgkjoek.exe
        394⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Fcfhfjdo.exe
        
        C:\Windows\system32\Fcfhfjdo.exe
        395⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Fjppcdkk.exe
        
        C:\Windows\system32\Fjppcdkk.exe
        396⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Fpjhpo32.exe
        
        C:\Windows\system32\Fpjhpo32.exe
        397⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Fchdlj32.exe
        
        C:\Windows\system32\Fchdlj32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10128
        
        C:\Windows\SysWOW64\Fjbmidii.exe
        
        C:\Windows\system32\Fjbmidii.exe
        399⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10224
        
        C:\Windows\SysWOW64\Fpleen32.exe
        
        C:\Windows\system32\Fpleen32.exe
        400⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9384 -s 400
        401⤵
        Program crash
        
        PID:9816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9384 -ip 9384
1⤵
PID:9604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afbmab32.exe

Filesize
163KB

MD5
513783c50db57661d47c350d2b92d9a0

SHA1
a7df05505a768714b8176bf8cb22f952d13ba18c

SHA256
a8593014533b58106082a75a323704a81027fd5340391f68f159703578cfa5f0

SHA512
405fd2fa53b2a6a0a02d9ab3bff8fed437f9b591ac36bdfa40f0535c358102e4053ac96a36d8ded6e01118b1fc874274c47b6f827329fb467ddda61bfa001220

Download Submit
C:\Windows\SysWOW64\Aiebhmnn.exe

Filesize
163KB

MD5
74d1e6d24176609921fa1585547d48fb

SHA1
e20b29e7da4b01c99e1ff149ce23d4570dc7b555

SHA256
d6ce4435183ef0e3f83f968e3cf6d725375b72bf49d48f42da8f47f363b92afd

SHA512
af5e174239b3c2347782e4f86bb3df89e07ed7793ff4c71a926e09b01f82eeb903995df22c7200e94405e10641fe840e9a35f6bc0f47e7badf9f19cc56346ee1

Download Submit
C:\Windows\SysWOW64\Alfkjh32.exe

Filesize
163KB

MD5
85e4d252df2fcbae19c809ea79cd2dbe

SHA1
a2468c0b3ee1db101e83d362e29633c8c1680cf6

SHA256
c50384dd8465d953a4c0276c549cf82d175a97cb438e1308740ddfe2f7f4043b

SHA512
59a53db79ec90f465ef501fae67da626cd365ab4b6e31714228bf492dc7cd16367274109a039cf9195daefc08df45b59945f0908f630d5741be07014f9d42e7f

Download Submit
C:\Windows\SysWOW64\Amlenlkl.exe

Filesize
163KB

MD5
4a82b396fac0144cbdc959979fa24be9

SHA1
76bb0129d4d09aea3de45b7a621b2b8ac15eed9c

SHA256
14e2066e08eb1c6380e809d23738e342a1a9a076e911b1f6f380274324960995

SHA512
cd862c4faaaa882d896425538018007a30b742f69c49336ea811132e0ba7942a939f68659c2a4866ed7254d9f2708b8fac4f152619258669eeb849ca764f7fb7

Download Submit
C:\Windows\SysWOW64\Bcppqe32.exe

Filesize
163KB

MD5
f4d9b6e714f521ccb679240d1a089b5f

SHA1
a01882d4a913b0753b43e149d0607782968c681c

SHA256
e4fbe88127bd447c9c37f5d5dbeeb0c129fe8bb462e0c1fc9c0ed5481289411b

SHA512
7a485a6ef509e4e84f75577734f6f569f63e26de7c6bbf75126d05789435a0bed434c1fabe491b14f6d1575e209f39f64a7ff8818b492756d890910f74cb42b9

Download Submit
C:\Windows\SysWOW64\Bmjaoj32.exe

Filesize
163KB

MD5
82f51973f26d7605d22a59c4615ab2f1

SHA1
934c9f06732bf6807ce07de5b43083df4c3ea906

SHA256
82ea2c40e23cbbc4a29a8d0301570cb642028a8a16dcdb04bf43ca9d75678a17

SHA512
6412af00665241eed635ee0aae356df92de49a8b61b715d3a0bdf7eed6cacc0eaee07016852f3c618a3b2a07b2c4aeffc866be617071a05acfd9f58cbbbc6fbd

Download Submit
C:\Windows\SysWOW64\Bmojjijg.exe

Filesize
163KB

MD5
7400eec18c0426b8ba30b518abbbcc71

SHA1
2f28280041d5b14c4fe4e38dda469d40d24df188

SHA256
b04019054222d7e10c48e2434769fe4839c8c4b2bf744fb27a3a862ab196c32a

SHA512
51e3d4f8f269727a09b9b8ec425c5b28bb12ba29d44888d4f9fa3e8754d611effded06c31362fc702b70c4263a1c4dcb6271ccca4ba1819e16ef4352896eebb1

Download Submit
C:\Windows\SysWOW64\Bpqjfk32.exe

Filesize
163KB

MD5
b5dd049768c0a3ff4080b98f505e9eb8

SHA1
b86cdbb9f0aeed31a336846b5c3ee760587a0d51

SHA256
56d257da5f344c3e79b2012bec843e6bceff9524bcfacac5a94170d8551c7f25

SHA512
9ed278e13ee93f907c7657de9e11631d29b616ed1500acb6239f498a5a4077176ecddc35bb32cc14591dca00941dd8b7e5a2f391e26d0643d654f26ce6baf9c1

Download Submit
C:\Windows\SysWOW64\Cbnphp32.exe

Filesize
163KB

MD5
7c32a4edd805aa9271c6aff6b51baf80

SHA1
05ffb6906014a66013cd50d90a2ddbd6b6a3c8e4

SHA256
d548e029b25d5650629ddbe4ef114ac0a5f9ef7a59c6cf962affb180be8ec06a

SHA512
4aae7a7b87e818014d3b9302a46815cfb696a679eb0cedd437fb239b02dab340df6c9e84bb589ce9c74a67a7090565e4a8780f4a83552bb8153bda36c9429126

Download Submit
C:\Windows\SysWOW64\Cdeimhkb.exe

Filesize
163KB

MD5
d7e033db2d20a4c85bc129fd608b571c

SHA1
2f907cf6fb57f666222960e427f85ebeaabf332f

SHA256
27b03802c95a0dedcd05342129d798e60e5834f1a8bf5a02a9de917aaf901c28

SHA512
2df4fb98e2268af2a86640410109fbbd5357ce6e733408c54e59fd81b5e67a48867ecbf072c2445e32a2f016785aae60a531bceaa4930d13a21fc15ff829fba3

Download Submit
C:\Windows\SysWOW64\Cliafekj.exe

Filesize
128KB

MD5
eae69d263a6bf7a2ad5e3a0b2ce2fd45

SHA1
19efd96f8127cc6d0fdb3ffd29540afd8e95c203

SHA256
bbd379eb068c3f87be6ec9f5f0209d4dd869d8453eddae57038aa2d504f05c60

SHA512
ee7380169e03e6cccc57f1c1b34e96857f56cfd87b0fc6d53767b44b48cae75f6a09a92ebc347128a1012258be0f3052813eefa4993c5a7b4425efcc18b40196

Download Submit
C:\Windows\SysWOW64\Cmhmqhbl.exe

Filesize
163KB

MD5
710fd271aa5b57a38f2a692b787d58a1

SHA1
edd069740177055645c0250d3d6ba7fff936251c

SHA256
a1c48348f7645301227db859bf1412f3da0b70ec8f62f72a71b1bd0431166765

SHA512
8235b72844917dc2d309da8253490f1968caaa5e60dc3a0cdab5422b9a88374178d15af4d4af2c005dc7e17839601792d28c60499e3e07876d193f78eac09e1f

Download Submit
C:\Windows\SysWOW64\Cpifbcom.exe

Filesize
163KB

MD5
e8f218c1efd61199f6fce1433a5f2577

SHA1
db348a4bd1b775af100c44886594887016287a26

SHA256
c7bee70854a86d530d18edd57e0ee9406c512c14f6e35e955b93e8dff702a6dd

SHA512
07035102436724e166aed29e08b2f47de530dd4a6726bbd4b075666a391bfd35888d9125febd4165ffb158655886d0e23dde4731ba03865349c0abdcb21e7218

Download Submit
C:\Windows\SysWOW64\Dbjodn32.exe

Filesize
163KB

MD5
666260e00027920f74b0b1c779e208d7

SHA1
24d3a2110fd51e9268d67036d3acae6c3ef17def

SHA256
88e93662639b67b8b641c0bc5f3d43a6499ad4980b67e04386e39dcaefc98943

SHA512
64ac787e634327a68ad27a06503aa39ee4dc1f98510ec9fe69dd14cb1f917eabcb589a34a684f7f632fcd954063e4f1f6e0fc75deab5cd954cabda359f37e856

Download Submit
C:\Windows\SysWOW64\Dccbjm32.exe

Filesize
163KB

MD5
bdfb693d8d19e032ec3c8b8058dfbfbf

SHA1
9896d051ef823ff3a437c3bdd422e9f32a8a1fa5

SHA256
4a652ff9739188545def29db8ee2a91d7157d6bb5a1cd26bce4c1b921c4f5799

SHA512
7692c1211c26bf45726ac3f40c1ed34d924c4812c137f7589cf0e9a33f720f649fb72a00c7a0d90d0377328f55f9c28e360de7b0e4a7cb7c1e1bc6421e56d5de

Download Submit
C:\Windows\SysWOW64\Dekhei32.exe

Filesize
163KB

MD5
2b2f071bdf7f38f13fb297aa5cdb5794

SHA1
ee40c2db61788af562cf8db79b487e100913b160

SHA256
6b24f4a48536ac328d8077b2eb061023a0e6121fc53e77980994e7fc0ebb708a

SHA512
b2d61ee9802bc92c4cb2474aa6b1274886433585e15802ddf00118f36eeae74842c688b566ddda43594109d27c3ca9f0c4db87c671cd13ba2b25eb11c100e5a2

Download Submit
C:\Windows\SysWOW64\Dihalh32.exe

Filesize
163KB

MD5
b12f38152ae617abaa1090122fc00961

SHA1
2526da9ee46fe01189de0ecec7f1e73d46bf4f53

SHA256
ae794124f2c9ef361f01c236d502eef05ab77953950c621da4b8c747b33d910d

SHA512
5896953e14f46048bf1d0addc1a4c79b78cd0556c3cfae4a1dbecf8d6a7b4a4c712ba490a0b856b179e4760eace01f68737044b9239ff6e39812e79239fe8c42

Download Submit
C:\Windows\SysWOW64\Dlbcmdco.exe

Filesize
163KB

MD5
4588d12446f0dd60093af25e1eee4f69

SHA1
d4ff2e760ac26363b4c05f136d6d0a7871dc02f5

SHA256
3416d60dc18cb22619b070eaedcd6c6334333f316b771d631de61f594e78bd49

SHA512
f0a2458138db37ad3dc0824546ee6f26788081919324eeed18666c5877e58283a1fd0bd474dd005fcd58d5f6808a04e7b734f44295b8a74321a618568a33759c

Download Submit
C:\Windows\SysWOW64\Dpbihbgc.exe

Filesize
128KB

MD5
a75610fcc983202436029563758b1827

SHA1
fbc06befcee63c74a0ac4899ade7ef67b8f06874

SHA256
4cac3c956eb9fe4fb18092128c03cbf03f28ed949295087afac0cdb106841aec

SHA512
6f6e316332aa39a2ece9c9b1e64d9e19a93f5a8fca3e4a78cac84ce171b248b327c2377989ee86b2d74728c40c06306eadfbe00d312480a6abd2746926637235

Download Submit
C:\Windows\SysWOW64\Dpemhh32.exe

Filesize
163KB

MD5
47c1f507974db09c19da5be97a12eb67

SHA1
61417d290d10e3f289832b54680638ba97e059fb

SHA256
7a4c58ed6ee5c16c1e553bb6aef06384a99e0ffb38f7ceef5709121a9cdd1c97

SHA512
aa9ddfc1757fe7a1e30dd180366d42b10b87f8f952a57338c5622aea6ff698d012fb347f9bb55ce97640e8db51318bb2402bb31be486cd1a0e79d86fb7f5ff78

Download Submit
C:\Windows\SysWOW64\Edghoo32.exe

Filesize
163KB

MD5
5e2a66406c38d05cbd89d23e4921440d

SHA1
1130369f94ad8ff2b92c15027ec6d8eef9609393

SHA256
07aa326700d47f8c770857f3eb3aa2ee1fcc0e883d5fc7565bf9f6c80cad03d5

SHA512
6702671f9d4d39183e004fbcc74db3fd9371e2816cd10b1c3089a89125f84e7575ff0973f69afe794b15ac6c60a83c2ed8e8e6eec03af229b2a52cc8ba317e3a

Download Submit
C:\Windows\SysWOW64\Egakpkkj.exe

Filesize
128KB

MD5
662da93b4dad4a9a42011cda5a4ca8ba

SHA1
2d98f7c85f9b0136bbcda6887ac5eae02706b7df

SHA256
b3d49ba8f23e4137cc072c85ae40f76adb6cc9c5018b32dc1f7b7ebbe6dab48c

SHA512
18ef77f826c958eebc104ae35416861e11578096f772bed6f174b20bf58772efafd6cc866d7a3c2f87bea99e5f69749497d1e62c473abce68f1c801c815deb89

Download Submit
C:\Windows\SysWOW64\Ejegblid.exe

Filesize
163KB

MD5
9b049128ed04cc107b75c4745c5d3538

SHA1
840a26414013665f4f1ef20d110322804bdff709

SHA256
ca3196b3e79b8b0aad0939dffb48b66eeecdc04bdcbeb0472f5e4838013d9582

SHA512
04529566c61121eb73cb9b2299d2e786fe46e688045a4357d3ee7986d316cc0e78ab51bbe4dd4640cbcf16955f43fcf2f98df39771e26b5ba1b7c9f38f4d2b52

Download Submit
C:\Windows\SysWOW64\Emifgf32.exe

Filesize
163KB

MD5
31c59fc75c08134e60eaeac1958724e7

SHA1
3d0bdd9ed3094a45c29fb00582d7e112d4e6089a

SHA256
f3f2315180db0808f7b7ff35051c8db537008d908d7023b68dc8b21c283bbfa4

SHA512
fef7e071f09d5225578d719f47dc19e0db03799af43cfeafa76e41b3513b5bebc02f7ed1a30cb9ffdea1680df4ca8eabf9a11f14d0a8514a1b55106a3f4903aa

Download Submit
C:\Windows\SysWOW64\Enbind32.exe

Filesize
163KB

MD5
0e86d34b3b734d90ba85c23f2a0fba77

SHA1
0efec14addbff13e14338b1490f42b667a4009ea

SHA256
df7c55e2c5540fdbb49aa6918e5a61cfcbb1e74d8ec43a34b66ed57420780f6c

SHA512
5211e6021f2b5ea01713bb674bafec21fdd027230028082864d23c0768fe26311383cde477ee45e9d67fdd9612a668ac8cb26a9e6f4d347e0f2a7e73669ea51a

Download Submit
C:\Windows\SysWOW64\Encphk32.exe

Filesize
163KB

MD5
7290b899987f32ef125de1e6bf923d11

SHA1
4b26288bc31b269605414a7699bebae3ab690dc5

SHA256
3496b059b1620646cb05d9c616fca62d8655778c92c50a95379ab48e06f6f803

SHA512
c2b9ac1358bc0aa4d412822f77f0d491bccb0b388eb169236b9bfae636298267c954ad53ba6ba8efa948be5598d2f19ba12dfe2c068bdcbe5581276fcfcf1477

Download Submit
C:\Windows\SysWOW64\Epioiaak.exe

Filesize
163KB

MD5
508266cf5a33841e36e9290791c8d56f

SHA1
b573bf362d16adb9d8f3679ae795ece326ec4043

SHA256
5ca7de682a4a7d41ffd9dd26f4a27763b58f0fe6c4299950966695758724afdb

SHA512
aacadde706f81a4ca5376e17d5f154f157e8783b468152e7e98604aa4d1165d7a02ace953a9e57fcbc47a43de29f01a17fb3f397578884da1d0d71b159059329

Download Submit
C:\Windows\SysWOW64\Epqejp32.exe

Filesize
64KB

MD5
5e494688963fa4257bf5fa773b25a6d5

SHA1
c7b46b288589e20ce7c976b17dbd4bacd96dd976

SHA256
6c17f56d14a5f8b2eac9b93b033594e5e269aab4f7645c12f86b9d1b3794be45

SHA512
667ebb9a430c993dab2c73eb61fe0acef3edd9760337a18732e63de4b159bb6dd3ed6477aa385c86e04ebef3981d5a015374fd1a26f67061dfa8bc813033d453

Download Submit
C:\Windows\SysWOW64\Flgfoaqg.exe

Filesize
163KB

MD5
55887f427270f6b666e8414beab301b1

SHA1
a2c883836b4a10ca4fda6d16c8a8bffd90fd6696

SHA256
bb5ccd64408908769961cd77b0c0fb8e4bafed90e7cac169e52377c999a3627b

SHA512
6839391fe900e91dbebeb92e53167feb79117e411aecb53e8e01efda434f6a76bfeca00270bdc3c50ce92d7f1eedc51e9b6dbc05d08cc027e3cb7ab8061ba052

Download Submit
C:\Windows\SysWOW64\Fnaliick.exe

Filesize
163KB

MD5
3e973e39e8bdf41ca967fcaaaa8b3414

SHA1
8d88d17d29b656ec183382ba29125c4ac898fd9d

SHA256
9c40226cbb448839a5af344e56ae15719ae069ff6cfaf9ee931164f1f69e540f

SHA512
eb430110c62e324d201a08f54ffcfb6796f558121ecac2d327e46d72f003af31a2a0d758668b8fc27171338b46cfc94b011bcbfed1e1677a1e8bbac3fc2189e7

Download Submit
C:\Windows\SysWOW64\Fnlcni32.exe

Filesize
163KB

MD5
cd0fca9837a5b113d5968e850f0bf615

SHA1
c6f3ae6604dec866feb442987d97e2302f94e561

SHA256
28b30a50199f8627c02b895109444bae65963077c0663211a58a4ae0d538238b

SHA512
e208d0404ea5d97ceef2a5bf2f605821dd048a20b0d2d5dde822bc68d7e000ff9dc80cf87a888cc630b0b203e2415b7ee9ff45542ac3851e48b2c67194ffa6c6

Download Submit
C:\Windows\SysWOW64\Fqcijfml.exe

Filesize
163KB

MD5
05218e21bb9b0b8665549a929128c42f

SHA1
aa98023be54f840abb02e870216427a87a6afffd

SHA256
17ca12f4c4641d62dbaacccbf5c97557df5d401eb5818d5b519f5451e05a19df

SHA512
ce459e0ecfd8682452f9822e6093bfb033ba889518e15a1562893a0ec4fc273643c8b59724f1ecbaff97a9cf50d5e24be0e31fa525e69a3b6afd1b341dd899bf

Download Submit
C:\Windows\SysWOW64\Fqffoeki.exe

Filesize
163KB

MD5
65a9ca329dbae9dd6d51b76e6b1f38b8

SHA1
0c44e479f432172963cae19e90430088fad1d1cd

SHA256
bd08f2b49caa6c0bb11e8df47f33db4974791b68be28da27c6e3e9ffacebf5de

SHA512
9ec3a1c6d945932a8dfe98aa6eb3ef985ada2ebae577544e1864086d929a3d2f2db73a11164e4cd97f35222bde3259dd421d376a2fda87620ac56ea82dfbc666

Download Submit
C:\Windows\SysWOW64\Gjapdh32.exe

Filesize
163KB

MD5
62478d33ddf0e8126c247f86dfe12cc2

SHA1
f1e5ff4597f01455009c1aff099b772141f49f09

SHA256
74237ba0ae042f3afca18560ff8bd1049b04f050c1f66b0fe9f93bb3a9663333

SHA512
5c4f6fab90af6ae7be2041cf823ec3bd9943ac1f10a843e78af2971c8ef9abca3285b1b3ea53fac03f223bd569d707c67e97ee64eff74971d9e02067dd0755b1

Download Submit
C:\Windows\SysWOW64\Gjjjdigl.exe

Filesize
163KB

MD5
9ca48aea70bfc9016f1cddaafef3cc55

SHA1
8c3d37514682e7cdb0e1dc0e1b591c43d68140dc

SHA256
0ab02b5d000dd307246862283414a57465b56a8f493fce293980406b2b2da9f7

SHA512
cf943003a27053d05e6d084d8a6395e806a4b40036a1df056932c518b212fa211f1ca5e50762362aeb0b19745d743854ebc9318e507d99e6ce8121050f95a35f

Download Submit
C:\Windows\SysWOW64\Henjbp32.exe

Filesize
163KB

MD5
ded26fe9421f3338ae79bfafbfa4cb83

SHA1
2a88caaee93566771d8373fad88f78a5c3fe01ad

SHA256
4c042f61835e27accee641fd96debae2e39bfe0a7af1bb9a868c94e37ba2db1d

SHA512
04af269bbf87477a96e3bfea4e3d04c11d2c597d007e9882c40378b4eea3d55f28c7dca22bd7f770685d5ef5b854d59849ee103cd637ee324cbec0c6fa8a8f96

Download Submit
C:\Windows\SysWOW64\Ijolffed.exe

Filesize
163KB

MD5
3f909d6425882ac072d7df703d095227

SHA1
fa5cf4fab31e1d2602927847fad6c848f87ef4e2

SHA256
e58ddfb59fab17a682630daa40e37d717df153d2bd4c4a5fe11e102d6dfd9506

SHA512
94e1aa87a85d7248670f264c3eafda4ed0d7aabe142adb2bd3b46b2adffdab94cfaf8ee174dd6d4396d021940965d1cb2c5eb5a06eaa8926957a5d9719ad3f6c

Download Submit
C:\Windows\SysWOW64\Inhkqe32.exe

Filesize
163KB

MD5
e1aac47b260f2d2c2c824c64a0426740

SHA1
40fa4a66ff8cf8f3cd89499cdc453603bee1a2ea

SHA256
a6c3280274efda83362bea35d9f28bf4f11a7273a7dd6fb423b93139161c94f1

SHA512
76aac77d0d298c3c728bc9560501e7e06d65252f9fc236ed80617700d8a1cefbd3b04cf13b972dbc3783e416c7e3a11672b77c9c46217e715b6fb0edd2bf6930

Download Submit
C:\Windows\SysWOW64\Jbfmna32.exe

Filesize
163KB

MD5
ba609f7c64b8a64a540999aa4baf2014

SHA1
79a90ec23b7d8f930b8141d3fea01ff964bb2a7f

SHA256
87418798f9b4b3b5dec00784043dc279bcbacbc78f22dc033ef5a7db2a5d174e

SHA512
ee492a943516004676195fe512a76ff9b81fa36d3dd5f0d42c4d565cf2c40eb8d580d73140a421992daab8394ee8fafa0002424418927a096538e0bdc68fa6ef

Download Submit
C:\Windows\SysWOW64\Jbijcaea.exe

Filesize
163KB

MD5
9d1de2755aec6791784d4f79029ef09a

SHA1
603a32c840bb317936bc3d62ffc41fc817b89c60

SHA256
e5b800710dcb91ab26f2fb9d5a91f49e588dafd423b3686a98f86f3af10f70fb

SHA512
5152e22a6a2aeba1b65ee5415e943782e6a59d03d5daa240fdeedba1a3d0b4056dfa01f407b13af1808055ca7f115d00d02e7bae4d983861e974ad9f3d92328f

Download Submit
C:\Windows\SysWOW64\Jjklaejg.exe

Filesize
163KB

MD5
feaafea7aac38dff758fc8d445f06190

SHA1
fb0cc641bfb7142010a71b3362ec35451e56e0b0

SHA256
4849b8ecb9839b176db1ca0722235959a14e3a1359d83a97dce2d70f91d2c01d

SHA512
2f263acbe269e08d1d7d8413d30cba9184b68483e1ac2fae9edbed99330ebaeb367bf2717aef147ca078c92c8242eb0d33403a686611cf799e3315c89efe5fa9

Download Submit
C:\Windows\SysWOW64\Jlbefm32.exe

Filesize
163KB

MD5
c044c6ee55a2e535a5dd1eceeb37f28c

SHA1
1e77b37569ad686ac391a1f44448541c2552b722

SHA256
38c9f12e51e0b262207c9de7dfdd31ad56166214e1dcb318779f074460891d57

SHA512
0a0ce12ac54a70739c5f9c9ec7aa0243b2d9917cbd65ae1093d86e10346a18668f7bc3bd7e2a990d7bd1a5d47698ca79dc0ead542c5abecd72b00c9f818ff7e5

Download Submit
C:\Windows\SysWOW64\Jopabhna.exe

Filesize
163KB

MD5
89c9cfbf945a081723e65e2242c4ed2c

SHA1
f7622f4da279be7d1773a2fab91cde55b3bc5795

SHA256
55de0d53c08933620a177dfaf68dbdbb89de9370f9febcecea0f6e4950b164af

SHA512
f3e494cc39b1b556b4eb86db065b50788eae6c3bc2b42744ffcb4c3ea22b3c5de0d2284f715b0aad073576ca4ff94b293f656bb1a67f4def50b8f9e8a7b508ec

Download Submit
C:\Windows\SysWOW64\Kahpebej.exe

Filesize
163KB

MD5
d5c2fda0395acbe441653cd70564daac

SHA1
e6dba1c5d144beb7169c964beba1faad39cc138e

SHA256
89d9534e5bd0613cca970eca8407a59e418664620e66e0e3fe2719e132b46cd6

SHA512
0c286893085d6984bb981bcd8adfccafbeb41690238d3e80d418e4bdfd5003407f0242777ef56d9268cd5f421272343550eea3d13e7164ffadb28607f4a23184

Download Submit
C:\Windows\SysWOW64\Khifln32.exe

Filesize
163KB

MD5
064b9f7245b031e3400355bebb4aac11

SHA1
ec2861e8515898f3c3f1c414eba0820e64cecfff

SHA256
3c2d54367b680837904e5a6bfe2590d4fe2914f586db2fe890bc6e36c03127a6

SHA512
56e55d01019f4e161b0eba49cebc8cf8ec0e557281d5c3e6b32ee8adcc930b59262ef93ce334d7883aa59b62d74750d3a9fe6512d628f6bf70ed7df5f9dfeb9b

Download Submit
C:\Windows\SysWOW64\Kikokq32.exe

Filesize
163KB

MD5
61660fb0d365d15d17835d81c2564a18

SHA1
4bbdfcb830778b171b06f951d1d208182188d228

SHA256
ff46a24f5b905cf10b0066621ff051a70c21766e90badf5dda3895603e50b275

SHA512
8211edb34dedcb9cbf0c5b2c64b07fb0fbf3a7cd9fdeebce0175bf5a3a26cd7bed6ab286cb61c0531dce2c5035b6657017947c67e6f94a3fbc39bf0e779d8f80

Download Submit
C:\Windows\SysWOW64\Kimlqp32.exe

Filesize
163KB

MD5
d51ea631844bb9c75014af0ed483edd9

SHA1
6986c547b1c128aaa371c73f596c314a71c17d09

SHA256
da0e9df2daad8a8b1e95ef694b459b1c492d441a0f53541a7ad7cd11ebdb51de

SHA512
3be08cf36d379323489a92276b1b2f2105c0326999bafdaddea768078858723cddf8f81e689e06abd43cf4cf071d8cf1dca9dfa58b36bfcc5f90fb8893be1df7

Download Submit
C:\Windows\SysWOW64\Kiohfpfl.exe

Filesize
163KB

MD5
52f2c0bc3de488e4c3d13d9c446ae3c9

SHA1
735d9b56598a397bf7a8bf9668a42f3091b2925c

SHA256
622244fd97564894ef1e3fb38c7bbceb35354209fd30b96386f8f155a80f7fb4

SHA512
f57127907374e615e618769b4eb259452ab33162efd9d6ce035234cd8555f4debd1cec0c22a8ce42ec189a81fbb0a50a634aa8890a71c031d44860c345970631

Download Submit
C:\Windows\SysWOW64\Kldblmmk.exe

Filesize
163KB

MD5
1ffefed3ae7c52b1a8731e55da0bac3a

SHA1
1abff97f0c42f40dd739e43e8db01560743b0c9c

SHA256
e0ea8b537e30bde7357a2efd4724c63056c6fc88197b27557f15cd3f427043c4

SHA512
76eedaf47a6e7495051d239883aa894e8698bea586fc3cb1aa395b56757a7f8348b6073537d61c7b14d557d53f1de5f74fa39f10a358463e9997738c19e22e70

Download Submit
C:\Windows\SysWOW64\Klgoalkh.exe

Filesize
163KB

MD5
ae4dd236bce2c9daba83e7e77cc4bce2

SHA1
bf1c6a509aafd6dae98fb9eb24c4c28a75639cb9

SHA256
6ce1171bc0ee829c09d47a04266646b65d695ff26cbf249831e9361d6f51a5b7

SHA512
1c7553e1988db3632be788ff5e1c488c5e66a0a1a6c5bea0565acecdf2c113682cf91297046bf26ca605907f3bd9b9af2b4abf01835c0f9b37f69c475e0fd68b

Download Submit
C:\Windows\SysWOW64\Klhdmf32.exe

Filesize
163KB

MD5
6d4cad50ef2a8eb5622db16da7c6cc40

SHA1
97ee3dcdade57a258d152d993bc52e1275af8fdb

SHA256
0fc78b5df78b057ce787f8f61c6fbdbaad7d12c6ef139f7987c3bf52fbbeb306

SHA512
6cd611e6eb31ed8b708ba8c2745c552a9e7cbeaa0fa9513f1af4f5d27fb626ba1a07aeea9aa65d43b3117700e8369dc67ead858c7f1a4167d4f1165560db18c8

Download Submit
C:\Windows\SysWOW64\Klikgl32.exe

Filesize
163KB

MD5
8af8b96ddafab461bf15c6dcffa16fc9

SHA1
0882dbb5a1dbd7be85c7134b4bf7cb926ffb9016

SHA256
7a0ce7a7513a9d9e95465625eb9eb5336a60d23d8323a88b387b247a551f7838

SHA512
0d42f93b8b6fa0fb30e0105ac03dad8b120b69a4f719694e5b5d0e037ada89f218f0ae46c6ca198f568ec203becc2730b060e8119d0540c6697b70a12e15a59a

Download Submit
C:\Windows\SysWOW64\Klndbkep.exe

Filesize
163KB

MD5
0fb73828662d514041e6be0ccc0e9bbb

SHA1
6321c0ac339389333f6fa9c46226c5cc346f8de6

SHA256
161ee2cccfc5fde02ba54e7bd8dc1600aef3b103ef32873e982dd1ef69443d68

SHA512
ce5c3195d9ddaa8bfac68ac76f403b5cca1d97eda0059d328fa04197e646f22a357a5477c886b070dd5e85e3e409d98a8a7697c832faac5a312ba502a6897bfd

Download Submit
C:\Windows\SysWOW64\Kocnhhlo.exe

Filesize
163KB

MD5
c39f09f616c70ae0a60e107db90dd1ab

SHA1
377b129412ac3aa4f7a6966bd671524c233d1c33

SHA256
8c4085bba950ffbe1abc9979fd8b7c09001d75a67352625313db362260d9c228

SHA512
d48233792473505397905b5783622c07fdea107f2d600012bf92aeed67970839fc59952084b0cc482497e4e4fc407d2d5ddc726683b611655cb526f97ed109f3

Download Submit
C:\Windows\SysWOW64\Koeknh32.exe

Filesize
163KB

MD5
04be9901c546308cd0ce9c6b0f6383c4

SHA1
8b262a3f8254d94b0c34c7d1434c0b60c939b52c

SHA256
ef70994905fc24b1bb361e9f23b0dac8a81f5a3de2676f6411d4891c186162bb

SHA512
c689af8f4fdfea3d64a8ae15db6efc84dfe165792de206f9efd3f5ff18068fd2ca459bbdd09ca7cd5301adc7b4fb259ea2bc9889c2a81c1bde14295298495035

Download Submit
C:\Windows\SysWOW64\Koggcg32.exe

Filesize
163KB

MD5
b6742a860ac6686463c2cada85ef2af4

SHA1
366dddbc28a2735eb3ca6ce234382d713874af09

SHA256
9c8100eacd0aeaedb58b89219d9df5ca6c08a7e957b11a34862396a69f00eedf

SHA512
441bcd2fbcea3ef3dc50b973a8b4cc1e63263be5bc30aa59874aa71e3b641cf5c56dd25065dc8ba00e8261d333fa2d711bf95a9f475583ceff8a1586a806ae83

Download Submit
C:\Windows\SysWOW64\Kojdig32.exe

Filesize
163KB

MD5
f13a8b8fb537886810bde0b7e646991f

SHA1
79a1d7d8f96fd755686b4678d59dcdf958092436

SHA256
9d2511e65600dce2a6aed812876a163eec7aab82b035faf43ecbbea8dbe6c80d

SHA512
43941ebbc49aadbfe6988be5816f8f0e0ad5b6a4358dcc79f0f3e3e3e70df90b84f9fd088177c43a80500fded2da3b11581f269eab47f8868a1d9a1d9febc49f

Download Submit
C:\Windows\SysWOW64\Kpiqcj32.exe

Filesize
163KB

MD5
ded5b5568c22863c371de60975829d94

SHA1
bf66681033378d4034f40c7be5bd38de57a0fa35

SHA256
682f724e72c865a000b7c7df8acabf5ddd3ca145879c2b55c6766ee27f4bd588

SHA512
c4123c62cbd6314232cc2932aed434aed7d4a885d8143e09a885ec5a9bef58398b2af8986f143647dac6e067599f89d9845ea5e9dbda1371340fc2288bc866ac

Download Submit
C:\Windows\SysWOW64\Laacka32.exe

Filesize
163KB

MD5
d432b22a41b0cd082f4767f9c215c3e2

SHA1
43b32f896cdc040991e11f7c7f032d1d21a12b43

SHA256
53468e7049ed571a050406c20c4ca60b83a4a1fa5a795c95cf6111ab0fec8c63

SHA512
825c895c544e0abab1d290936ed9b8ebcc20695890da24fa2d3835b507e8a37a19adb2517ba2505e103596118626c638e0e832c9ceb4725e0e68706d35335aa6

Download Submit
C:\Windows\SysWOW64\Lajmkbcg.exe

Filesize
163KB

MD5
7f8f1dae1a90c9c28e32d61ded55e48a

SHA1
ee53b7a9288647d628226cfb151c802694a12142

SHA256
07bd01683bbf8bfd0fd2f85aaa5aa026f93b8f079b0c146cdacba82db23424b5

SHA512
dad3ed0587adc1b577266160e1a958da818fe68244042ff00674c14c77a60c6d635817cce819c33ce75ab9be49992ace47dba103d44e21ffaee7a65cef5416ec

Download Submit
C:\Windows\SysWOW64\Lamjpbae.exe

Filesize
163KB

MD5
4250fbd516cf04978fe1498b835164a9

SHA1
1e6310017bcf9f92e606c5448d9ca74ed6d04cd5

SHA256
b10619a5d237e0c0abe9a599da6ca25e5caa78b1c262fbe0849d2ceabc6ac513

SHA512
ce8034011d1b0cfa79de09ad3232e8beb477139d89aa683b817eb1420c8b41cde6841d04675fbb746b9467cf3001f0a86e6fb9106037dfaea41ba3060d912316

Download Submit
C:\Windows\SysWOW64\Lchmoe32.exe

Filesize
163KB

MD5
ec9f3de2de98cd8e2e866b47e5d28791

SHA1
e64212c4b294b4436fc1bc125d244391c50c4a4b

SHA256
d49b8720411dd4d9bb7e04545e8c0e510e228891f913c2081d6456930ff1df09

SHA512
972936ce2d4d63273111c2f368f30119e4fe3422a6d2a92a648bf89bd1d3267b838a5134c9ed04b1cabb4c9311e44b5955d4b8409c292a4d01a311a603d243f8

Download Submit
C:\Windows\SysWOW64\Lcjide32.exe

Filesize
163KB

MD5
afafc275e4acd4361611e3df07b68fd9

SHA1
e8ec2c4c55fae4c90f81ef84f22e7c5471750533

SHA256
069faf5ea4649548ddac1d5cf12f8b8320a3b6195cecb302d701f31757f0ddbc

SHA512
7b5836762674ac25e086ba1346b24ad8d581a58b1bd0d5a76ad2ebc3561af1093e529e6db8b73fb98ea8b9824f35e2e3df2a560cdaea7d5db85140b1ccac625e

Download Submit
C:\Windows\SysWOW64\Lcocpdfe.exe

Filesize
163KB

MD5
f9814c457efcc8bd7cbc08e7bc6ea300

SHA1
f60b9fb1d2a05388ec867d5cff54598b2364fdc4

SHA256
64d92beb6bfef52270c5419b95e4734b76933507dde9428a49f51a2265483850

SHA512
dedc37e4ed54ac8c4ea80290ba3870d1e349f8db3f0715fc302d462535c515e7720d363f0d50910796275d69757fe393498a22710e836f9fba9c6755bfd4d7d0

Download Submit
C:\Windows\SysWOW64\Lehfqqjn.exe

Filesize
163KB

MD5
15622dfdd79d9a818b053ca52ade9143

SHA1
28476ad483bd79250f66629085f0aa940dba77c4

SHA256
7b8097013a346392370315232628f992f602aec759d4cef64798ee16d6eb4f91

SHA512
9a174b2b7cd0a1f48e6b11a60736ff9a6ed161996efc0e1848bc850c2d003d53950031aeeefbc1592e867f4ff042ddbdb00d3aea6cadad3d6fc6fe9b97ff2c1b

Download Submit
C:\Windows\SysWOW64\Lelhajbm.exe

Filesize
163KB

MD5
35cdd89a1bb1e39ae5aeb6e71a5c025e

SHA1
10250b6c7c8b48fd004b865071df962170522cfe

SHA256
80aa419b8ca94751a7021d711fb396f880ab588003e7021f3e4955b596630b56

SHA512
dc417bf9fc5da9edb36668c268bef8bbf2dfa991da1e8eadb00224553f17b4b3edc387aec7c86e7cfc424baf5010a6ba366ffa1324f2a8a556c13022dc952756

Download Submit
C:\Windows\SysWOW64\Lemolpei.exe

Filesize
163KB

MD5
2a031059e84ec13b0688cec6e2318255

SHA1
db887ecd9b180306f51a001197b9a3c70695a19a

SHA256
042f46ddddf02550c114b238ce5275b1a10b9e94006f6e51119b5b4f8389874e

SHA512
c310a6509144e3abd3d25cdc477d6ccebfbcd137c09dd2df9a5698592131b545723ea11284aa14144c9f1fc01050aaed1127f5faef5b065c36b4002b96764274

Download Submit
C:\Windows\SysWOW64\Liaelpdj.exe

Filesize
163KB

MD5
a7f543b704037ca9a98a43ce85cfde70

SHA1
c035a2a929b2b5c46fb120ab79d50e72a52c0e9f

SHA256
797b278b934da055b091f34f2660e494a59d0b080d2eab3df556cc9ac3408003

SHA512
0f68d6f617874052dc869f4c1861d2b3788ab57ffdc2c2694a8395a1381b67ff1814301c6d1ae3d45a33a7b634d343ea9f0001b54b51b67eb600998964b2f39e

Download Submit
C:\Windows\SysWOW64\Lidbao32.exe

Filesize
163KB

MD5
324e19e689c4e7e80a37df07511dbd83

SHA1
6b4c6a525b3820744e17798c9a063c828d799851

SHA256
64af15d7d58df24f841bc510407515bff8e8a06258afe3faf6944ddb70cc0991

SHA512
43fa0fa597dc80c1f3e06e29425b368d6b5ab846a24a21d8e6f5ca3d087b18c001f9dfeb0960f83f86b15c7a0a14447301fd61f9f33bea0674f59f437f503b52

Download Submit
C:\Windows\SysWOW64\Lkpncb32.exe

Filesize
163KB

MD5
5a50cb7d40eedbb9bc1d6f12e91e830e

SHA1
a731bb59e0adab2cb4a4fd1acb4d0bc5c0e4312e

SHA256
5c67e5923b427d7a32766cfb77f0fe334c49a2da408053e1ed8701496fcd2b51

SHA512
6e606d481449d36fb13e169d7d5b9d83c642b120db5c1b65d4831655fbe4b2553ccdbc1d02205934d1fdb56ee513a253a8d508d6e8706bc02461564c622b421b

Download Submit
C:\Windows\SysWOW64\Llbnmk32.exe

Filesize
163KB

MD5
4e1b9919ce713485725779ca977ec735

SHA1
741be2c1065285837c4f2896eebffdb23a3c36d0

SHA256
4a04710fea6e8f93ac14cffa27e699398633a4dc998587e9cb0af846c64a83ec

SHA512
edf36d9028245d7ab76386451e4318eeb85815f7d4694ef69d59e2145e2c1fd12b97f19473e37ad566b886998c0c51937dad6bb0cb763fd16061a61d4887cff8

Download Submit
C:\Windows\SysWOW64\Llpahkcm.exe

Filesize
163KB

MD5
2e33f1170575b06b301d244726591d48

SHA1
903d52fc43748eaf8587cdf493fec7832c128459

SHA256
3de1ff5f28caca070541168d37f90106084572b5dd659f2bad2c3688913c9b06

SHA512
81a2665ba14aee5da83ee1254e66ff033959440388b2ca8390797900c63a8b5c0866fab2bb79a4710f5c598d346f4c840adb31ac66532921cf63557152cbbc44

Download Submit
C:\Windows\SysWOW64\Locgof32.exe

Filesize
163KB

MD5
69801e58edc0bbece5ad8cba31e769a0

SHA1
b9df7310f0c335a69ea5a25ba58484b0ee554883

SHA256
caf39405d87f20b29c34c100ffc6c374f1dd09c39f0667f90bb5dfd531eadd5e

SHA512
9f9dea0d2a364fcbf1ebf36ab74e4243f6e52eb5cf5a546ce9bbe94f309c001d2de333e736b3cbefebd9cd9ed3053524d96e09e2cf2fd8fa5962ba3830e364ab

Download Submit
C:\Windows\SysWOW64\Lplmhj32.exe

Filesize
163KB

MD5
ed310a82b15e67ead440bc4c272e0de8

SHA1
8dd596590ba0277d01b9d30da835f497e2cc4e46

SHA256
92bff118708d2bd2a6873d3d58d88eccbed0b2e6ab68c942ceb79456fd2de936

SHA512
127cefa750dd99369b34996f6c2e1c41ea12e7d139f71833725cebc7ee26f95ab85a7244fc1fa4ac3e45f34bb36744d949fa1461e78f0044089b715054d8572d

Download Submit
C:\Windows\SysWOW64\Lpnjniid.exe

Filesize
163KB

MD5
9c38783cb43ac263a3571323dfe22261

SHA1
3fbf317a6612af8eac327a9ef91582f7b75618ab

SHA256
581d0a9cdd1ed13078894fe5703b9ecfcfda84ab5380ce84fb6d262fa14ae26e

SHA512
49e26a94e474596a7a830fed64f344b466435d6e51326fe6b06828c64718fac0a93f396c8f2bd0dac8d0cdfdce29793363b6d45322ee1576e3b0170d765aaa0f

Download Submit
C:\Windows\SysWOW64\Lppgciga.exe

Filesize
163KB

MD5
b80102aa9027ecb16f6e9557143a7882

SHA1
2cd977aa09214f9b7fb6082e1ada836320d5af9c

SHA256
58c6ec4f2340a9c4c34ce9187a58f762af68ac4a50d311f57b251d3a9021099f

SHA512
76c3d83f3a23a74cfe2e035a4837839e8814552c71c3f2644a77ecb986e2db18f85c1c93fbc4da51ef22fe0203d53ac72e9ce492f79005694ec17d2dce22af3e

Download Submit
C:\Windows\SysWOW64\Mahbaj32.exe

Filesize
163KB

MD5
2d5633bf1cb00a2ecdea415d1b841be3

SHA1
850d1ea4c4a0f250957223b26af00456d6344d2f

SHA256
71a2ba493da4fbb67b29f7e5951cf1a71416d4bfe4aad7f5dd0fe09be42def6d

SHA512
64a84749503754adad443a21ac79cc62e2cb5cf41956c54cfae2c904ed98841a538448d87ecbb4364d82d571f7a8e33dc2e98c7d8594647255a671eb795e8446

Download Submit
C:\Windows\SysWOW64\Nhldoifj.exe

Filesize
163KB

MD5
9f298726b66a95c83fa597f580b01b2a

SHA1
051422ccdcaa2e1e9adee56397ee590c7ffc8bcc

SHA256
9a16343fa0848505b2b8e25cf78d33efd6f1e0d1c9795bb994f351d63d114730

SHA512
8fc223f205e5a1d2d1771980d8709f5380cc9f815a928a9eda642d4f86630ab464ef051f2416b5f6d5a98244ca40c75fd96c462a7c643b09916cc7e4d751c35a

Download Submit
C:\Windows\SysWOW64\Nlifja32.exe

Filesize
163KB

MD5
2f4ff847c1f4815183948ade5bd78265

SHA1
f310d0ec9566acdf8253dcc403592dc8f35a24ed

SHA256
8e130ed12635f1be421d6df18395c8e338d0c4af421d81835e41ef01e5e35ef6

SHA512
bd8d8d61e9e142e3c886adac7b61df4cfa8971713edf6a753b0340c6cd36a8b0cbec02a800c7286b061d2ea99a1dbcc61a27df86a8846cb8ee7c84ac2b9cfa60

Download Submit
C:\Windows\SysWOW64\Oleffo32.exe

Filesize
163KB

MD5
b48febbe770a777d4059a2d8acc8d4c3

SHA1
dd699a09f83c1b1cc00765d5e5d59533c4b7c484

SHA256
461e68421db04e62d4dcd36287cca7bc42e5360516b4d4b04a6708ea8c9a1df0

SHA512
494ed6fb947f4a13ca11c5d09f047913ca685e340ddac2cdca234781ed2feeb6dbe2dd7c32997eb193838bf98ddfad03e6e1cb9277283c04a723f33a313895bc

Download Submit
C:\Windows\SysWOW64\Ooeohjlh.exe

Filesize
163KB

MD5
54f61abc24a60d2c8bba40bee1f88c78

SHA1
fb4076a766f1cd9e68cff572eb6427694a5c747b

SHA256
2f4d916332d652b4766fcbd1e412789e2e8861b61b8ef6fe35963bc84831171a

SHA512
c49117f664c9ac51d5d610c18c5aeae323f60b295e395d901ef3d74d1c38e43c1a9073a564de4ae8aa3a062187d174a06a14e19f895c5ba6bc6c76fdf3ccc44c

Download Submit
C:\Windows\SysWOW64\Opibhq32.exe

Filesize
163KB

MD5
a692f42482ce039749ba74bd00056360

SHA1
cfc80a8609a4eeeb3788cf29f138d4b9619002fc

SHA256
cd154f2692ee907d9a4dae854eb9b97b34597a3f8a9a76e403e3c38305096469

SHA512
9bf383874703af05f726cd65f69ed171c3d2cecb2a8be0277149c9d6549a6e82fc6107d05a5fa3f8b4cb6d3ff676bed466143a3df617306dd801951716547820

Download Submit
C:\Windows\SysWOW64\Pdedfa32.exe

Filesize
163KB

MD5
f0b3b097412aded7c71c8ca61a1c6707

SHA1
7f67c4ec4e0356db32ebf170f0395bde4ec18e5c

SHA256
bfbcb91b2ef1b0307a53c204d89cac9a001fa27ef4709d275b5ec72ab8d64753

SHA512
d2f34c5483115b74618380c2b8e5a7b19d9f8d25252ab11d6611ae34055b30ef33a84c7e392f598614d094e90f037e6d527da3f09fe125981dc3e4f903b35113

Download Submit
C:\Windows\SysWOW64\Peljfpbe.exe

Filesize
163KB

MD5
f6d88e7421c44095bbce08a991848267

SHA1
289f627e448f58f752ffa07e0223a52110e4ef38

SHA256
481ff3895bc24f1ce270acb2ff8db8c2cab83d3d7ed9bc54ebbc698de866ed73

SHA512
a43d9d014af26b21fb8c79c65ec8f1b11cf2e02d10fa1de339ba402ada7d529b9baca9021dc2651a3bbcb33c83c2f61e98fc972fadb29c7e77912275ce8564c4

Download Submit
C:\Windows\SysWOW64\Qbbged32.exe

Filesize
163KB

MD5
0d7c026585f1845fcb346408f9628a26

SHA1
5a2d9098d85d9b3a07dee7739f1b634732934502

SHA256
ba3009f2a14e4541ace5e40e19fa877981542a9559374137f01ce5c30a18caf5

SHA512
e4902d421ab8ed6b669d847f44dfde23b324a4567811e9943a6164e1e3113d114f01fbb96240a9b4db30e023ca95e726cf010a0592965e4fdfb0f2ce505504e2

Download Submit
C:\Windows\SysWOW64\Qpfhoh32.exe

Filesize
163KB

MD5
0889e64c535407a6cfe3a5ac0e87e72a

SHA1
def0b86912c900d077dbebcb294ec4a62e1851c2

SHA256
9324eb6ab6d14bae037411d0bdee9aa898fb44929a01481341e0edce2e0c1db0

SHA512
743bebb68bc5b526285a506230e4d9667c23750a883f267f075e1e354f4776551cf286b726e937211b03ed60ddf0382d6ef86174f1bdf5d771b4293522e9cd0a

Download Submit
memory/220-639-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/320-456-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/336-168-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/372-581-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/408-492-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/432-438-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/612-298-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/756-149-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/844-3067-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/844-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/908-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/912-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1016-372-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1044-486-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1072-101-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1208-563-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1340-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1368-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1424-408-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1520-498-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1580-165-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1668-301-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1724-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1744-384-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1780-450-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1956-396-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1968-306-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1976-205-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2024-540-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2036-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2104-546-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2244-426-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2260-510-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2336-307-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2356-402-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2360-612-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2376-196-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2396-157-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2680-599-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2688-330-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2696-304-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2700-139-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2744-297-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2812-366-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2844-292-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2964-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2964-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2964-611-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2996-212-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3012-414-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3056-3037-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3056-432-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-302-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-336-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3216-631-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3216-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3320-49-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3324-313-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3444-420-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3612-474-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3752-390-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3764-300-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3816-319-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3844-593-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3856-360-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3988-625-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4028-579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4064-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4064-638-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4252-605-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4308-587-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4324-291-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4344-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4380-189-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4436-504-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4444-468-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4452-303-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-88-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4484-624-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4484-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4548-632-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4552-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4652-444-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4656-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4660-378-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4704-569-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4728-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4736-141-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4752-462-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4816-355-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4852-623-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4900-342-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4908-528-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4932-181-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4972-516-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5004-480-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5020-534-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5032-522-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5160-2910-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5980-2857-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6684-2823-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7280-2626-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7296-2711-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7884-2683-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8580-2526-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8756-2576-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8976-2534-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9108-2559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9688-2493-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10156-2479-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads