berbew | fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b

Analysis

max time kernel
97s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b.exe
Size

96KB
MD5

d765e800d7273fd83a35a3ede1e7f807
SHA1

080b824b7eea7130fcc8700bb7f4bcc91b418510
SHA256

fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b
SHA512

02debd04cf5c962da2af1e86bbe405a4392a6d2646cd01d830f0cd8e7774de86136cc2e5ea358c7857eb144dd97dcc8102c0cd0a5d953058f7166211b8af4d05
SSDEEP

1536:YOdjqY9h2CERIZUETDC15RQQjnmpLUFiVSDWMh2tT74S7V+5pUMv84WMRw8Dkqq:YOdPhHWIZUakQQypoF76sif4Sp+7H7wd

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oidhlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dheibpje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjmmepfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oondnini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jknfcofa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenicahg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coadnlnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnpofnhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oohgdhfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Poomegpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfefkkqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbqqkkbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megljppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lggejg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmgelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lelchgne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fllkqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igigla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjdebfnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Madjhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmgelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqmidndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgjgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nknobkje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpfepf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcgnbaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elbhjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipflihfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnfcia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Knflpoqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlphbnoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohnohn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfendmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckilmcgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbeejp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqpoakco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahjgjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlkbjqgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dheibpje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dcpmen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Neccpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ccdnjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecbjkngo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kglmio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Manmoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkfadkgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dojqjdbl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2340	Iafonaao.exe
840	Iddljmpc.exe
844	Iahlcaol.exe
4720	Idghpmnp.exe
2976	Iqmidndd.exe
4420	Ijfnmc32.exe
1636	Idkbkl32.exe
1792	Igjngh32.exe
1204	Jdnoplhh.exe
1500	Jnfcia32.exe
640	Jkjcbe32.exe
1960	Jqglkmlj.exe
3936	Jnkldqkc.exe
2388	Jhpqaiji.exe
3684	Jbiejoaj.exe
4600	Jkaicd32.exe
2964	Jbkbpoog.exe
2936	Kiejmi32.exe
4128	Kbmoen32.exe
1924	Kqpoakco.exe
2440	Kiggbhda.exe
1532	Kgjgne32.exe
5072	Kjhcjq32.exe
2944	Kbpkkn32.exe
2124	Kqbkfkal.exe
3944	Kijchhbo.exe
1012	Kgmcce32.exe
1876	Kjkpoq32.exe
4492	Knflpoqf.exe
1692	Kaehljpj.exe
4344	Keqdmihc.exe
4044	Kilpmh32.exe
1092	Kkjlic32.exe
4232	Kjmmepfj.exe
4464	Kniieo32.exe
4432	Kageaj32.exe
1028	Kecabifp.exe
3196	Kgamnded.exe
4472	Kkmioc32.exe
4904	Kjpijpdg.exe
4500	Lbgalmej.exe
4652	Lajagj32.exe
4820	Liqihglg.exe
4608	Lgcjdd32.exe
688	Ljbfpo32.exe
1988	Lbinam32.exe
1592	Lalnmiia.exe
1068	Licfngjd.exe
1632	Lkabjbih.exe
4012	Lnpofnhk.exe
996	Lbkkgl32.exe
4400	Lejgch32.exe
3016	Lghcocol.exe
3320	Ljgpkonp.exe
1464	Lbngllob.exe
3656	Lelchgne.exe
1372	Lihpif32.exe
2724	Llflea32.exe
2516	Lndham32.exe
1096	Lbpdblmo.exe
4288	Leopnglc.exe
4240	Lhmmjbkf.exe
3280	Ljkifn32.exe
4848	Mbbagk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njghbl32.exe	Mhilfa32.exe
File created	C:\Windows\SysWOW64\Jofabneq.dll	Naaqofgj.exe
File created	C:\Windows\SysWOW64\Igliicdk.dll	Afinioip.exe
File created	C:\Windows\SysWOW64\Gbdoof32.exe	Gfmojenc.exe
File created	C:\Windows\SysWOW64\Hmkjpibb.dll	Ohkbbn32.exe
File created	C:\Windows\SysWOW64\Ljclki32.exe	Lnmkfh32.exe
File created	C:\Windows\SysWOW64\Dbbffdlq.exe	Dodjjimm.exe
File opened for modification	C:\Windows\SysWOW64\Dafppp32.exe	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Olealnbk.dll	Dihlbf32.exe
File created	C:\Windows\SysWOW64\Iooogokm.dll	Kjjbjd32.exe
File created	C:\Windows\SysWOW64\Gcgplk32.dll	Afbgkl32.exe
File opened for modification	C:\Windows\SysWOW64\Apmhiq32.exe	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Oipckj32.dll	Noeahkfc.exe
File created	C:\Windows\SysWOW64\Jnchkf32.dll	Iahlcaol.exe
File created	C:\Windows\SysWOW64\Kiejmi32.exe	Jbkbpoog.exe
File opened for modification	C:\Windows\SysWOW64\Lghcocol.exe	Lejgch32.exe
File created	C:\Windows\SysWOW64\Pekbga32.exe	Plbmokop.exe
File created	C:\Windows\SysWOW64\Bklomh32.exe	Bacjdbch.exe
File created	C:\Windows\SysWOW64\Jdnoplhh.exe	Igjngh32.exe
File created	C:\Windows\SysWOW64\Hijeeipc.dll	Kkmioc32.exe
File created	C:\Windows\SysWOW64\Cffpglpg.dll	Lnpofnhk.exe
File created	C:\Windows\SysWOW64\Jknfcofa.exe	Jcgnbaeo.exe
File opened for modification	C:\Windows\SysWOW64\Ebimgcfi.exe	Enkdaepb.exe
File opened for modification	C:\Windows\SysWOW64\Oldamm32.exe	Oifeab32.exe
File created	C:\Windows\SysWOW64\Ohnohn32.exe	Ohkbbn32.exe
File created	C:\Windows\SysWOW64\Akcjkfij.exe	Ajbmdn32.exe
File created	C:\Windows\SysWOW64\Dmennnni.exe	Ddnfmqng.exe
File created	C:\Windows\SysWOW64\Fijkdmhn.exe	Flfkkhid.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Afbgkl32.exe
File opened for modification	C:\Windows\SysWOW64\Dlghoa32.exe	Dihlbf32.exe
File opened for modification	C:\Windows\SysWOW64\Ingpmmgm.exe	Hkfglb32.exe
File created	C:\Windows\SysWOW64\Kbpkkn32.exe	Kjhcjq32.exe
File created	C:\Windows\SysWOW64\Eadpldgf.dll	Kgamnded.exe
File created	C:\Windows\SysWOW64\Meamcg32.exe	Mbbagk32.exe
File created	C:\Windows\SysWOW64\Jcigfeaf.dll	Mbighjdd.exe
File opened for modification	C:\Windows\SysWOW64\Bjicdmmd.exe	Ahjgjj32.exe
File opened for modification	C:\Windows\SysWOW64\Bljlfh32.exe	Bfpdin32.exe
File opened for modification	C:\Windows\SysWOW64\Lenicahg.exe	Lndagg32.exe
File created	C:\Windows\SysWOW64\Gfqnichl.dll	Blqllqqa.exe
File opened for modification	C:\Windows\SysWOW64\Glgcbf32.exe	Gncchb32.exe
File created	C:\Windows\SysWOW64\Flbfjl32.dll	Oakbehfe.exe
File created	C:\Windows\SysWOW64\Ofmdio32.exe	Oghghb32.exe
File created	C:\Windows\SysWOW64\Fgibng32.dll	Lhmmjbkf.exe
File created	C:\Windows\SysWOW64\Pojcjh32.exe	Oeaoab32.exe
File created	C:\Windows\SysWOW64\Pigqjdgo.dll	Aojlaeei.exe
File created	C:\Windows\SysWOW64\Bohibc32.exe	Bljlfh32.exe
File created	C:\Windows\SysWOW64\Npbblbdb.dll	Difpmfna.exe
File created	C:\Windows\SysWOW64\Ojmcpd32.dll	Plkpcfal.exe
File created	C:\Windows\SysWOW64\Gpbkpm32.dll	Dcigeooj.exe
File created	C:\Windows\SysWOW64\Bljlpjaf.dll	Bacjdbch.exe
File created	C:\Windows\SysWOW64\Eegiklal.dll	Mjmoag32.exe
File opened for modification	C:\Windows\SysWOW64\Keqdmihc.exe	Kaehljpj.exe
File opened for modification	C:\Windows\SysWOW64\Mjbogmdb.exe	Mhdckaeo.exe
File created	C:\Windows\SysWOW64\Oflpld32.dll	Oifeab32.exe
File created	C:\Windows\SysWOW64\Bhocin32.dll	Ajndioga.exe
File opened for modification	C:\Windows\SysWOW64\Dmoohe32.exe	Diccgfpd.exe
File created	C:\Windows\SysWOW64\Gaocia32.dll	Ikbfgppo.exe
File created	C:\Windows\SysWOW64\Hnlonj32.dll	Jkjcbe32.exe
File created	C:\Windows\SysWOW64\Mjbogmdb.exe	Mhdckaeo.exe
File opened for modification	C:\Windows\SysWOW64\Nlfnaicd.exe	Nelfeo32.exe
File created	C:\Windows\SysWOW64\Bllbaa32.exe	Bddjpd32.exe
File created	C:\Windows\SysWOW64\Clnedaem.dll	Neoieenp.exe
File created	C:\Windows\SysWOW64\Dbndfl32.exe	Dpphjp32.exe
File created	C:\Windows\SysWOW64\Jejechjg.dll	Fcniglmb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10108	10204	WerFault.exe	498

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lggejg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kilpmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lihpif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgnbaeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lndagg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iebngial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoaojp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pekbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efccmidp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpcfmkff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aefjii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedgjgkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clgbmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijfnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkaicd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbpkkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lelchgne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Allpejfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmkbfeab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieidhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgdpni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbgalmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lejgch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oohgdhfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbhpch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flqdlnde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmoohe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebimgcfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emanjldl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljbfpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mehcdfch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njghbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nihipdhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oampjeml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahdged32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cohkokgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oondnini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pamiaboj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abponp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfkbde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmfhkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgiimng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iikmbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pibdmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaflgago.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajndioga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idkbkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lghcocol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmmjbkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mahnhhod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neoieenp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aojlaeei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocacl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cimmggfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncabfkqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgkfnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjcngpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnhmnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjknfnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Licfngjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaompd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eadpldgf.dll"	Kgamnded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljkifn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfqnichl.dll"	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omfajq32.dll"	Mbgjbkfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadenp32.dll"	Nolgijpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pibdmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldipha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjdebfnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gncchb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Plbmokop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cimmggfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hemqgjog.dll"	Kglmio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljclki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Angdnk32.dll"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmlmhc32.dll"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnfcia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kageaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhhpnaf.dll"	Gmbmkpie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmigpf32.dll"	Phigif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgmcce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fllkqn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kilpmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lalnmiia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oohgdhfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Noeahkfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbnnbmfj.dll"	Oaompd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ikbfgppo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjfngdm.dll"	Ldipha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hicpnnio.dll"	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhpopokm.dll"	Fngcmcfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Neoieenp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Embddb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occgpjdk.dll"	Hpabni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igigla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dempqa32.dll"	Nnhmnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbngllob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngjkfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emhkdmlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljbfpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Meefofek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abponp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmkbfeab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhghaf32.dll"	Oobfob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahdged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjkpoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajjjof32.dll"	Oocmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmbmkpie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmnoab32.dll"	Kiggbhda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgddbm32.dll"	Akcjkfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmphblgf.dll"	Dheibpje.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2340	4816	fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b.exe	82
PID 4816 wrote to memory of 2340	4816	fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b.exe	82
PID 4816 wrote to memory of 2340	4816	fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b.exe	82
PID 2340 wrote to memory of 840	2340	Iafonaao.exe	83
PID 2340 wrote to memory of 840	2340	Iafonaao.exe	83
PID 2340 wrote to memory of 840	2340	Iafonaao.exe	83
PID 840 wrote to memory of 844	840	Iddljmpc.exe	84
PID 840 wrote to memory of 844	840	Iddljmpc.exe	84
PID 840 wrote to memory of 844	840	Iddljmpc.exe	84
PID 844 wrote to memory of 4720	844	Iahlcaol.exe	85
PID 844 wrote to memory of 4720	844	Iahlcaol.exe	85
PID 844 wrote to memory of 4720	844	Iahlcaol.exe	85
PID 4720 wrote to memory of 2976	4720	Idghpmnp.exe	86
PID 4720 wrote to memory of 2976	4720	Idghpmnp.exe	86
PID 4720 wrote to memory of 2976	4720	Idghpmnp.exe	86
PID 2976 wrote to memory of 4420	2976	Iqmidndd.exe	87
PID 2976 wrote to memory of 4420	2976	Iqmidndd.exe	87
PID 2976 wrote to memory of 4420	2976	Iqmidndd.exe	87
PID 4420 wrote to memory of 1636	4420	Ijfnmc32.exe	88
PID 4420 wrote to memory of 1636	4420	Ijfnmc32.exe	88
PID 4420 wrote to memory of 1636	4420	Ijfnmc32.exe	88
PID 1636 wrote to memory of 1792	1636	Idkbkl32.exe	89
PID 1636 wrote to memory of 1792	1636	Idkbkl32.exe	89
PID 1636 wrote to memory of 1792	1636	Idkbkl32.exe	89
PID 1792 wrote to memory of 1204	1792	Igjngh32.exe	90
PID 1792 wrote to memory of 1204	1792	Igjngh32.exe	90
PID 1792 wrote to memory of 1204	1792	Igjngh32.exe	90
PID 1204 wrote to memory of 1500	1204	Jdnoplhh.exe	91
PID 1204 wrote to memory of 1500	1204	Jdnoplhh.exe	91
PID 1204 wrote to memory of 1500	1204	Jdnoplhh.exe	91
PID 1500 wrote to memory of 640	1500	Jnfcia32.exe	92
PID 1500 wrote to memory of 640	1500	Jnfcia32.exe	92
PID 1500 wrote to memory of 640	1500	Jnfcia32.exe	92
PID 640 wrote to memory of 1960	640	Jkjcbe32.exe	93
PID 640 wrote to memory of 1960	640	Jkjcbe32.exe	93
PID 640 wrote to memory of 1960	640	Jkjcbe32.exe	93
PID 1960 wrote to memory of 3936	1960	Jqglkmlj.exe	94
PID 1960 wrote to memory of 3936	1960	Jqglkmlj.exe	94
PID 1960 wrote to memory of 3936	1960	Jqglkmlj.exe	94
PID 3936 wrote to memory of 2388	3936	Jnkldqkc.exe	95
PID 3936 wrote to memory of 2388	3936	Jnkldqkc.exe	95
PID 3936 wrote to memory of 2388	3936	Jnkldqkc.exe	95
PID 2388 wrote to memory of 3684	2388	Jhpqaiji.exe	96
PID 2388 wrote to memory of 3684	2388	Jhpqaiji.exe	96
PID 2388 wrote to memory of 3684	2388	Jhpqaiji.exe	96
PID 3684 wrote to memory of 4600	3684	Jbiejoaj.exe	97
PID 3684 wrote to memory of 4600	3684	Jbiejoaj.exe	97
PID 3684 wrote to memory of 4600	3684	Jbiejoaj.exe	97
PID 4600 wrote to memory of 2964	4600	Jkaicd32.exe	98
PID 4600 wrote to memory of 2964	4600	Jkaicd32.exe	98
PID 4600 wrote to memory of 2964	4600	Jkaicd32.exe	98
PID 2964 wrote to memory of 2936	2964	Jbkbpoog.exe	99
PID 2964 wrote to memory of 2936	2964	Jbkbpoog.exe	99
PID 2964 wrote to memory of 2936	2964	Jbkbpoog.exe	99
PID 2936 wrote to memory of 4128	2936	Kiejmi32.exe	100
PID 2936 wrote to memory of 4128	2936	Kiejmi32.exe	100
PID 2936 wrote to memory of 4128	2936	Kiejmi32.exe	100
PID 4128 wrote to memory of 1924	4128	Kbmoen32.exe	101
PID 4128 wrote to memory of 1924	4128	Kbmoen32.exe	101
PID 4128 wrote to memory of 1924	4128	Kbmoen32.exe	101
PID 1924 wrote to memory of 2440	1924	Kqpoakco.exe	102
PID 1924 wrote to memory of 2440	1924	Kqpoakco.exe	102
PID 1924 wrote to memory of 2440	1924	Kqpoakco.exe	102
PID 2440 wrote to memory of 1532	2440	Kiggbhda.exe	103

C:\Users\Admin\AppData\Local\Temp\fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b.exe
"C:\Users\Admin\AppData\Local\Temp\fccac2012f1689366b14843ef4b8dd4c309fb9e2303c04aeea12499ded9d582b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\Iafonaao.exe
  C:\Windows\system32\Iafonaao.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\Iddljmpc.exe
    C:\Windows\system32\Iddljmpc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\SysWOW64\Iahlcaol.exe
      C:\Windows\system32\Iahlcaol.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
      - C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        26⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1876
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1692
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        32⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        34⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        36⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        38⤵
        Executes dropped EXE
        
        PID:1028
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        41⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        43⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        44⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        45⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:688
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        47⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        50⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4012
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        52⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3656
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        59⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        60⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        61⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        62⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        66⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        67⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        68⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        69⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        71⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        72⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        73⤵
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        74⤵
        Modifies registry class
        
        PID:1152
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        75⤵
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        76⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        77⤵
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:4996
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        79⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        80⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        81⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        82⤵
        Drops file in System32 directory
        
        PID:816
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        84⤵
        Drops file in System32 directory
        
        PID:2904
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        86⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        89⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        90⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        91⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        92⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1540
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        94⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4304
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        96⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        97⤵
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        98⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        99⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3416
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1224
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        104⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        105⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        106⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        108⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        109⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        110⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5400
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        115⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        116⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        117⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        118⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        121⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        123⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        124⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        125⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        126⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        128⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        131⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        132⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        133⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        134⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        136⤵
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        137⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        138⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        140⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        141⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        144⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        145⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        146⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5984
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        148⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        149⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1844
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        151⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1888
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        153⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        154⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        155⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        156⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        158⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        160⤵
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        161⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        162⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        164⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        165⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        166⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        168⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        169⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6200
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        173⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        176⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        177⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        178⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        179⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        180⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        181⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        183⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        186⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        187⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        190⤵
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        191⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        192⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        193⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        194⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        195⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        196⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        197⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        198⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        200⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        201⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        202⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        203⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        204⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        206⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        207⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        209⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        212⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        214⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        215⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        217⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        220⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        221⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        222⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        223⤵
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        224⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        225⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        226⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        228⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        231⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        235⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        236⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        237⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        238⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        239⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        240⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        242⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        243⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        244⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        245⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        246⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        247⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        248⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        249⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        250⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        251⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        252⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        253⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        254⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        255⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        256⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        257⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        258⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        260⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        261⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        262⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        263⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        264⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        265⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        266⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        267⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        268⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        269⤵
        Drops file in System32 directory
        
        PID:7940
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        270⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        271⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        273⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        274⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        275⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        277⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        278⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        280⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        281⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        282⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        285⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:8044
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        287⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        288⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        289⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:8224
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        291⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        292⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        293⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        294⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        295⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        296⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        297⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        298⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        300⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        301⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        302⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        304⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        305⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        306⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        307⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        308⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        309⤵
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        310⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        311⤵
        Drops file in System32 directory
        
        PID:9164
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        312⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9208
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        313⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:8344
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        315⤵
        Drops file in System32 directory
        
        PID:8416
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        316⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        317⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        318⤵
        Modifies registry class
        
        PID:8608
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        319⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        320⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        321⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        322⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8972
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        324⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        326⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        327⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8408
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        329⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        330⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:8732
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        332⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        333⤵
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        335⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        337⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        338⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:8872
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        340⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        341⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        342⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        344⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        345⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        346⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        347⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8664
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        349⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        350⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        351⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        352⤵
        System Location Discovery: System Language Discovery
        
        PID:9244
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        354⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        355⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        356⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        358⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9552
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        360⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        361⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        362⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        363⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        364⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        365⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        366⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:9900
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        368⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        369⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        370⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        371⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        372⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10124
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        373⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        374⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        375⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        376⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        377⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        378⤵
        Drops file in System32 directory
        
        PID:9432
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        379⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        381⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        382⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        383⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        384⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9924
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        386⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10120
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        389⤵
        Drops file in System32 directory
        
        PID:10196
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        390⤵
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        391⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        392⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        393⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        394⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9764
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        397⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10112
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        399⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        400⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        401⤵
        Modifies registry class
        
        PID:9564
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:9340
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        403⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        404⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:10232
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        406⤵
        Drops file in System32 directory
        
        PID:9472
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        407⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10000
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9328
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        410⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        411⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10204 -s 412
        412⤵
        Program crash
        
        PID:10108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10204 -ip 10204
1⤵
PID:10028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
96KB

MD5
b80685b4cc6dd41d9fb489c99d5c5fb2

SHA1
0e08a2e1ff5ed946a478630f0b50ed880f96fbf1

SHA256
ae6a3bc6cd3d1e9eb584480190fbd9112f7f8da85ab2db8cef55382e24d0109a

SHA512
b40369c4fd2453b4f9fd61464ac2d8d1ca47c0c38b35cd14a82e2dd5c087b8e9e3f57f423c5c2fdca08772bd17b83ed893d7aa5420c5fa6d5ce479c501a0a2a6

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
96KB

MD5
4386b2530ec6771e0bf981873512b43c

SHA1
5c12ef732cf2957e577613a65bd3b76d73406408

SHA256
70717634008a208a48219796269335d935370379f9e159b1f52314a15bbaa2c5

SHA512
d13c753745b1436bebac6cb58e19977f02b91ffcb89d1d3eaf5384925af0fbab153759c1f894e6692506523d094f4aeee1fce4d80e532f29e8d4890eb67a0e85

Download Submit
C:\Windows\SysWOW64\Bgkiaj32.exe

Filesize
96KB

MD5
c869acce43ff3a2cfc98c379d4c3775b

SHA1
42219898a17aee945c4214a16aaf164673dd22b0

SHA256
e6201f16caedc4ea5624a80cd8b6bdf67a55aaf1c29373c17a9527a04cabf3d0

SHA512
b5d0f55b82c25066063eb12b6851dd122ef7e7f54a35990627ba429ec0c3c6d579ecd704cb6efe1902db8f08af00d1d8d9fa05713b6edf812c3273b90d780e6d

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
96KB

MD5
c7d8eff5eccde2771987282b731c7e02

SHA1
b015ab8fb65668b98f83201bc0568e2cfb29608f

SHA256
bd8d82d4672d2733fefaf1d59a8a0b60fa78b7bae6b7468b368b4d9daf805de4

SHA512
93e81660c8a9c50bbeb019f1afe57cd58d48df22d1f64700b3bbb40593447c5fdf844cb83fab3c8dc6ca2d58f04c27a5789ada8e1b9962a8b845d101b51efdf4

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
96KB

MD5
9a14aa2a1458334563498f9450c2a20f

SHA1
d065f46514e3dd39baba31b2fd8dd21d198e513d

SHA256
8e1f2153d9d96556dbeaec3b9637e890763d51b6bec31f2dcb42ea688e0e4bf1

SHA512
09e270797f9d77eebe2c5b53b041115cbfdfb2635329fd0f4c677550b8852731507f51792d193e5859d6de037ed552d7bbff8b8166f00c167fb49492853da97f

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
96KB

MD5
a98576054e06904e3aec47691b40ef1b

SHA1
ff86d039962c65647a523e6a137d1649b17d9f64

SHA256
69c8bdb4a01de265ccd5165c27d20addd0411464daf2b53620f7bb4ab0a80fe9

SHA512
270617de7c5bbfb645530ad52de33e5bd70940a4f0cf99e1d1a228997fe7eea1ce867b4b2604f3d888767b3c6970287733dc07f44404797eb0e972c98f04c7c5

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
96KB

MD5
1338eac32c00e68b4999a39d90e39b6e

SHA1
e646c420998716cd1ecd0c8215418c7297e0c950

SHA256
03a6f1fbe01b757592fdb07b7eb9ce97ea463777471f721da1073c907998419f

SHA512
4a578d4f6c9a1b624ace446b48e0a03599d61e0d18038199f9f773ee093acc48d53219e29924384da4d9e7ca93fbb7af34a55a598142b7221c29fe8ff51a2c0f

Download Submit
C:\Windows\SysWOW64\Cofnik32.exe

Filesize
96KB

MD5
0021d16eb32feb12a14a71bfaf1fca57

SHA1
12ecfc16e8bb66aecc980bb031695d332fe93249

SHA256
cda2718b287d75eb31a5ba12acdc95836f1334edcea4237447e44d77bea6a566

SHA512
8560804f5a7b390158b6c62c44ccd5ea484766897c65eeea0fd445680c24c998f544162017ed289c2b6b75c269058f493236ca2b5e02b5505eb7acf8ba1990ea

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
96KB

MD5
cd1443b170cfd894b5b4e4468ed14cc5

SHA1
48a33f282e3fa0856e7d762ba7a6d2f3c3a59732

SHA256
865043455e7e4e912ae230d05ac796229adddcbbe54baa99a84c53e82593402b

SHA512
4f42d1d8a1264947605f2c179b89abc81fc1ef4eda9567c97ab01fce3b19309e55292cd11f33314a30b092b0c2311cdcda740ca35a1dc870be4252f81a3a1e2e

Download Submit
C:\Windows\SysWOW64\Dbicpfdk.exe

Filesize
96KB

MD5
52039e6d27c608bb2b1c592239dc1808

SHA1
ad09203fbcd303a3788eb3d1682fb97345e46e9d

SHA256
3df86491a8bd6a977325ba94dce59687d1cec69969658156949e38b9d2ae857f

SHA512
a1504797f025659594a1a21243733a3e79a3aeff5bf69b1ca7bc12b32414d0e38c25a5d75bcf6dbdc87c981aa74ef6696de3bc45142b7b3599616f49e4650deb

Download Submit
C:\Windows\SysWOW64\Dgcihgaj.exe

Filesize
96KB

MD5
03ae3965a0bef954224d9968fb0b55d8

SHA1
00a464594ca437534675c9393b5fd7b296c32782

SHA256
9dea4f74a30303024c266a52570bd5a27ab95953a6db3dc8c901e023da4484d7

SHA512
b0df16d39a177a9ccc7f30d740adc7bcd696e778fcf47ebd10d12f9d601ccb56f5385824be166da9167c65daefa59af887acc46b32f0eb8dd2d0fc6dd7a0bf13

Download Submit
C:\Windows\SysWOW64\Elbhjp32.exe

Filesize
96KB

MD5
dd5cd28840e50cac1225cd45171d0c50

SHA1
647a32f8df75ef6891bb6f8879a1b6b6f4700ef5

SHA256
79b013700339f1735c8f50faf573a1e693aa20fd33a99e3615ef037e25343766

SHA512
8d8d66742199513a13cf1e031f759ad0faed97a407b1d321ec75f3d487d0bbbcb29b125bb057868a8f170fbf2b1599c2cfdecf01e2ce53fd5abc2c26f0fe040b

Download Submit
C:\Windows\SysWOW64\Emanjldl.exe

Filesize
96KB

MD5
af07ccb7d2806d3a4eee8db75923657a

SHA1
28a960cc74a60efdd8a8265a3778732f07b929fd

SHA256
2ceb00633ecc9cdffef71ac28b120f244ed326d38db604da319a7dfc0456058f

SHA512
7396850648446bb9899701fafa7ee9ab5d02a1a469db9ca98349706ff5101d49827937ec88332bd7a11473675552abe86a9eebb935f997926d406c82f6a4cda8

Download Submit
C:\Windows\SysWOW64\Enkdaepb.exe

Filesize
96KB

MD5
deeaf74588a37a59169e27433fe8fdc0

SHA1
2c09f40ff976625caddb9df82a17dce15464f7fd

SHA256
4001df85bb5dada5c10079d16ec3bdbd7c3340ce3d747e56eb8f22b00119b386

SHA512
f97b933bd4c8fb06503b892dfad845a971c9e43f5a3868e1f64144fcc520fe481aaf04e196b73993aa2ee036b34f629a95aba95e4407d1b0213fff947fd8a1fd

Download Submit
C:\Windows\SysWOW64\Fdccbl32.exe

Filesize
96KB

MD5
8a0a9fda7fe0a28a09c926c6a4f12665

SHA1
03da051012958139839882c034985cf2e534397d

SHA256
d4d8f44d71b56e6061a1678d1cff3c67b52c343ed7defeca4e2a16d57892d0db

SHA512
8d549757bdb9dbfaa09f7ac863e2bc183b6137e171db8462cfbc636b0cd36a00aafb6cf6bb10fc892db4121f0e7857b4823d10561ff51e1ca52e34b550ec1594

Download Submit
C:\Windows\SysWOW64\Flqdlnde.exe

Filesize
96KB

MD5
01106c36967a680114e892cf87d089c4

SHA1
12784f5f5934108d6d0233b1ca71b116d9524671

SHA256
4315a061548f69a7ae39775c54f6928e2457883963822daaecb34de938ab9431

SHA512
09ab53245996b1d2f097476addcd7ae6c1d7860a53a3adba89c878352ed01b677944e5ca071b8a2a4f50245d188aa85756e83d4b2a80705f9aa53c4a3423a49c

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
96KB

MD5
4403ea23ada1b81057dc2acdf83bbe6c

SHA1
baad0799fb0cf5cdba007e2cb813c977691550b2

SHA256
fb9ddaa1ae81a4d5fbd5b25cde8977eea4576201cc13a1f9c7c014cc08b9b5b9

SHA512
911b27584e175fb4e463db20f553670e9f285799f5c3397ea0f66a7ec0e9bac85bfe28f89fed35f5e89576d6d430ae9338639bd496079c3251b85d393281ff5f

Download Submit
C:\Windows\SysWOW64\Gkkgpc32.exe

Filesize
96KB

MD5
84c2397f37b07aa7a222b9d5ec224e47

SHA1
69a783f880bcfac3e2e0fe73d85a8982c1dc8c60

SHA256
0c08c4b8633f5208c05d23f2bcc0a2bcd835a1b2132d30b6a0613d39245a0623

SHA512
a923ce5781d838736dfa1612d8c82b91bf05cb0701860fc79cd7c6a9711610399cf8a5fb39260bf5d05483581305713302d1ba815e8063e31873c754d779a32c

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
96KB

MD5
955b6c301f5ed93754c484cd2b6e3e40

SHA1
2690f9d71ec83376384fbd10541e04479fc77161

SHA256
e8fb4d4a95b438f64ccc6f5b8bbc52507a6d81d7d0782074556ea4dab01ef36d

SHA512
19834be0d18dc141184178d749723e1cd281d16e3614a82f917c0a674cac49eff447ce505a4683f032fba3e8690fbb29876bfb9bf25efb8d4144980510c43186

Download Submit
C:\Windows\SysWOW64\Gpnmbl32.exe

Filesize
96KB

MD5
b9f0e9523ee8add7ae22b94bf1aff21c

SHA1
66372bc54059e0650bf179ff663d7c9473529cb7

SHA256
bd50be8d6219d7f56dcc6929e844438bb6b17536fd17e6985e315fea67784039

SHA512
d94157717c4960d5bb92cfb200a2700ed71ad9604068198bd41a3780163783b152f829f08ad3e097b0fb46a8898760604c9009ea2d2de9654cf9006ec7bd47ec

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
96KB

MD5
7583248d4f7793bacc508b7631b6484f

SHA1
4ff92b4e0f92272c35199fa755de27212ff28460

SHA256
da6b4b1322908415802937191e90e15d6cb0ff5f138cd3bdd4f3450e4a0b52b4

SHA512
7d8e33f9c589c9b20aa8ad78842298db4abee77e82d1bb5096def88dd05d1cdf1f5280e941ac6810a221539d6e7121817f23bb93992fcf26bc3421029a2c18fc

Download Submit
C:\Windows\SysWOW64\Hpabni32.exe

Filesize
96KB

MD5
063c8a9c44176bd47dcf2d7b0342f761

SHA1
db63034cfed3582ad502e71b6e70fd7beb52b01f

SHA256
8ad71cde64930c452e0cf07da4c9c6d31f4a008cd6c8fd1754f727942ec4eb3e

SHA512
dd039ab0f4f97ad7a94999a7d589cbf1be0f8980a214a6455dd8558d11a77ef2123878cdd66e928eddfcd35a3e3c1bb50a752cea831fcb98852bdd1eb573633d

Download Submit
C:\Windows\SysWOW64\Iafonaao.exe

Filesize
96KB

MD5
670f484b80c15008f8712161d65208ad

SHA1
c95f53116314a1a1eb7af4344cc58e69e400343a

SHA256
953f6bbf27da0b56d4d5ce689eeb5964c9d11f69d01d22d5507f083d0d0086bd

SHA512
8249f39b5d3210a2cb4ea4d22c132b64b0a8a44fef867bad667908a477c62016142b5bd54b366564ccc21ffc14fc4628a27ba990e7234644638c043ea0f5ed62

Download Submit
C:\Windows\SysWOW64\Iahlcaol.exe

Filesize
96KB

MD5
6741f0db9b93f842c59ff597e0e2ed6b

SHA1
0f7e599b67bb8770e60857341cb0ebd24ca678b5

SHA256
30bb16590250b2621ab54f11a8d3f6c3ce7cd657c25fecf323363bd52ef09ccc

SHA512
9645eee50e51b3edc4970e26e819596f03ff29c38c173d09f05d24a4b3646777c8070a57668c4793175cff776778a34a31ab93b0a59900c0cb9b1a7b14b51e78

Download Submit
C:\Windows\SysWOW64\Iangld32.dll

Filesize
7KB

MD5
3a5c061ccb1c28bb03d7ab1517534b02

SHA1
617e9b84046edf2a0373adabbeb5c569f92eef4d

SHA256
04726e47a70b1b5a3c4c9619bf651cbbd92943422d9bbdafa11ba1ffed60075c

SHA512
b0a4ff731c9359c1f66b3eec8899583aa247ec3b2dae44061028304086c989a6ca3dacfb198ab9e0f67e4e391a09b31803494f5c2a226cb122f3c1eaf4a99fa0

Download Submit
C:\Windows\SysWOW64\Iddljmpc.exe

Filesize
96KB

MD5
8fe451dd4f16570025df074650398c6a

SHA1
f7638ee3e8549c8159cd13f77511d5fc73c53e81

SHA256
c5777dcbab19872f3167c8d6face7b5666f5d836a85df18653ab6d88565cfa39

SHA512
b05b792d437a28ede989c7ce6c3426422eb52c42735367412b761650c5f174c40c7759268e1487b95842a3476d77de22186e8d3e168474a427f4f9d2c476d8d2

Download Submit
C:\Windows\SysWOW64\Idghpmnp.exe

Filesize
96KB

MD5
27be05a562428ad521772f66d9e2b793

SHA1
33a4d2e098bc26f934daf6a0b96af0a9771b45d8

SHA256
9fb307030e5fa03bac71203f6e0118129bd170ed4564e7b966fb810e5e7db7d7

SHA512
24713fc4792dbd0151a3c9cfa4753438bf16746b5ee8fa187f8581fb76ba3a58561422131937a1f7ef87943abab506f095a7a58e5ebc4b28a3d3b3d89ce1a441

Download Submit
C:\Windows\SysWOW64\Idkbkl32.exe

Filesize
96KB

MD5
dcb4fab1558c5f016688fb8ad6d9f6c3

SHA1
afe875beafa5b0eb26b3fb8dade9b1dd0aa3107d

SHA256
ea8b6008217832e1195cfbfb7957c5e5bb6dc6fab9b417c44846642ee210a1e1

SHA512
bc24d4c1e2a4823a3729e05eda36cb5d8ef1cd4afd5338ab7c546163857ef1edc761c87015947fc8e44fa3df1fd7c120e2809209605ef4157719b46a406784c6

Download Submit
C:\Windows\SysWOW64\Igigla32.exe

Filesize
96KB

MD5
1a82b273d97fa3838cff7804848a923d

SHA1
f835cd3b81c9be6fb03b2d69a065d9c7ff57f4a5

SHA256
82406b47a7bce9c889f97235f5e66094f7a645cc56a82cf9e22b46d9dc17e51b

SHA512
fa9bdc7e2fd9f2ccb1163b84e7d490569ce596a50ba002c7127171f70ef1b4b8c7bea8843bfa92edbbef83d129038a1575ba29833455514b06125ea11c36cae1

Download Submit
C:\Windows\SysWOW64\Igjngh32.exe

Filesize
96KB

MD5
dc0d35a05da36eba7e8b980d34ce607a

SHA1
c6ba76fe768be02af2071d170ba3a3aab7d0135b

SHA256
bee9bdd2e1ec1844af43ecea0b943fce238b5140118f317d4043ad9b97d0498e

SHA512
812c2722263be6ab09543a2aac1538e8f5f1b690a256366adee43463f7310587145c5cc40d85ca0788d0814220b1b6e809f912abd08c8954ab1bfbbbb113c850

Download Submit
C:\Windows\SysWOW64\Ijfnmc32.exe

Filesize
96KB

MD5
b8f72df5c6d4cf7a793dfa0be24b8746

SHA1
6a5df9a66b241f081a857e6c6c858d1e1e9fd7c9

SHA256
b57b8e6b5bb8462f81b84ff62f5b8bffbd3c7a97f66bff106b7ff3ef39ddf38f

SHA512
8d888b4d83223653760021d12ca9831bbc4ac91c207c311453c7142c553dc6be9b696338187d9dc374b7fea9953796861a221d50c3dcf2107f6eb6d50dbf8c0c

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
96KB

MD5
4225e8ac207bb4717c2ac12b841b9885

SHA1
f50f65cbdf60be65ae9917fd513e74ba09d93228

SHA256
0f60d7448c268bdbc0258fb52e57e9871ee83b4d70ae65c9e38284da5b2369ed

SHA512
798f7a25ed1036e86dbae18242a972d1072d64aa9ca9f962cbc31f6482515184be52e70f759ac48459a5f872c7c43f0c2d5d28849cd0ffe99a12a8919a069794

Download Submit
C:\Windows\SysWOW64\Iqmidndd.exe

Filesize
96KB

MD5
92edb944d6bbcc0b7d49fbfccf432eae

SHA1
7f31d7c58678d07c0ad1990884e5e658418bd8b1

SHA256
a88acfb73380de2d097c8ba86f8e5450d79e40cabcd55142a2fee775138547ff

SHA512
717485bf1a791e615256e9fc86aa023e99e548d9671d01994ecb634d088ee83bcddaff1497d12246ec68fa11c4f298e238025cd4978491276011fff993a013bc

Download Submit
C:\Windows\SysWOW64\Jbiejoaj.exe

Filesize
96KB

MD5
96ed45cd97d1bf650999176ae6b256ec

SHA1
26d12c819ea3e72a3cc05d615461e48a13994f3f

SHA256
ceaf5070e06937f19247a6ea28cc9abcd0a7f638935fef701239111f03e4ab07

SHA512
f22b9d107f66a74bc1dbce76efd6160cb14f568b31b5182023b38171cb0ee8e1b0f8bf0f28f6969317734e7298d0d9c15e94bf3dc2122914ca25e87d91ba0b08

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
96KB

MD5
ca3e68d2a70a466299e5c5d3a02d6e63

SHA1
07581645f22adf7ef77eeeb04498e154e219fc98

SHA256
9700175f751effd6401e96af85db479cc183ae7d2ed239a651331111a0913af3

SHA512
3de6e2984828d855e98b9f67da49b697642bbe8e75de34efbd7bfc9197cc61611fd45743f1211228141e06a8e85b6f47cfbac51357554dc3ce1cf3b3585c33e3

Download Submit
C:\Windows\SysWOW64\Jdnoplhh.exe

Filesize
96KB

MD5
318109b11a72de0e63a6bbe847346139

SHA1
fb147ed9fdc3f31456d12be47cea34bf6776d377

SHA256
a8965bd5c00f834cdf7aa9a2cc4d10c2302076edf599ea29f10668567e174eb0

SHA512
73d4cbef594b614f21ca569e3f9f36f56ff0cd3f2b6efd604f1e309079b1ec33c1e34485420e13a32e2acf86fc599fb2c8ff8c477ba0057dd03e1a79882ec600

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
96KB

MD5
4413502c997be9173d29183158ee19da

SHA1
e1e416c4e2a22e2aec84cb67b707b008d49b773f

SHA256
fddf2a108bc9b5a510cefd0290b98b6758dd1d3994ca0fa599116fccaf79eb49

SHA512
2396c36b114dbe91869b253c679a3cf145b496889235579b65f63dcbd741d01b5d486395acf4cf47e2a320c5dca12557c7e33133e2addda67d223f28cf001de0

Download Submit
C:\Windows\SysWOW64\Jhpqaiji.exe

Filesize
96KB

MD5
2d3966afd5ce9ede30f08c5b198477a0

SHA1
3a10c4f9556041fd8aec8b5f312d6beab7d8169b

SHA256
b53f3543ac0bd39eaac9d05d29890e72e2b371c06a8670b30fcd3d265ef688cb

SHA512
6c8693db6f41d4bf1d49f2d935706e438e73b292368243ae6b7170e573fd84bb83d338fb8364df35b43e363cfff979c4100f7737e2cefe52caece454a84fede9

Download Submit
C:\Windows\SysWOW64\Jinboekc.exe

Filesize
96KB

MD5
be19ad369b761036a9a9d4489bf7dd55

SHA1
858d0d02b572e8a29295469ebdb787119c726ad2

SHA256
fac1ccaa52b4c2a8a77229a0601ebf8a867c096f058f7cc82ef1cdbae3a6c8a0

SHA512
73ef6a2b65022ea107710256534d1ada76fdd9557374ac013efa6fa1d29cf5447d58c0b899f5cbee480df052b101531260f8fd89ef56cb635b4c5cd093a9b9d3

Download Submit
C:\Windows\SysWOW64\Jkaicd32.exe

Filesize
96KB

MD5
b897b8ddf6cf7c8f7601a6985be921b9

SHA1
249a4904e2bb7b8d44b9a940f69ebf42d01430f4

SHA256
78977aa1834899a19bae8834bcc7f90971072e5a28dbf8cc25888909cdd03701

SHA512
dce15b420b478291de6e171762642b8c5ea00edf929f81ae4894798bc1634b5d3fef77931010d3d840eb9c6170fc21551119334d68080e67d937c7c10bfc57b9

Download Submit
C:\Windows\SysWOW64\Jkjcbe32.exe

Filesize
96KB

MD5
cb2f187b4fcae1b05ff4ec72d35a2987

SHA1
cd7b0417ee1eac721d65ee36912feb618a46b02f

SHA256
50b83b6ebede1674730455d9bf547b770d051b06ef992f27231a75c7ea6b2aca

SHA512
92d93544b86e8977275da35fff3455194da78f939055bc96d415d34be860bbfec97d4e4a5c5943f7eee88b835bcf0cd3e3e76c35c1b7c3d52e3903ae8798ea9e

Download Submit
C:\Windows\SysWOW64\Jnfcia32.exe

Filesize
96KB

MD5
01c206362425818aac2dd146d657b522

SHA1
4a64fc494cc2ec72eb9f341738b482e46fd6ba85

SHA256
a1afc7d77439fc5374a5e8bee3d0f44c0deda99a8d1a0a9ebc8010ea5ea22186

SHA512
5fab96c5177351472822a7e9bf71e3131c2ceaa0b4bd6e9b42e485b138a5ffcd4e5fc54da4a379cca34a32a8fe1d990520eda11798f831b43a131ffa87606b1c

Download Submit
C:\Windows\SysWOW64\Jnkldqkc.exe

Filesize
96KB

MD5
2a3303c494ef2021250c203eee5d3066

SHA1
f447636e35feb8faebfcf69080496304885162e4

SHA256
798b4fd9c74cf37370b7f46dd9b376232516df94941643d1bbdbddab3dbebc54

SHA512
8666478e2f32438f9547bbf95309f0633fa7d6ac50e2f9f6532b5f6b0d7c67399f7f718b5744d61abb236cb6386dba62c5a3493b7740c92605b9f64d4ef7f33c

Download Submit
C:\Windows\SysWOW64\Jpfepf32.exe

Filesize
96KB

MD5
776beab42ebfcc955c06f69adbad3f22

SHA1
bc33127b40cf01f0b2dc85a774ded44afe01dea5

SHA256
30f2c0543810196174ca31ac361903deead1a1a64962a8aca2b9a8407b7e51fb

SHA512
e5f7aa93ff0e0529c0fb9c84bb6f71c6335444583b8c8d68c34da34b3d62f682a4e199362edaaa1178d11122d7cd5a8c569872cb00bc03811ef9e2d96fd727c3

Download Submit
C:\Windows\SysWOW64\Jqglkmlj.exe

Filesize
96KB

MD5
7f61bb9f206b0a509bd39aa4c634fdac

SHA1
2cf6b132d000753737fe85ad65e267b178e33257

SHA256
431bbfb76660fde2ec1e5c8b8080556704b09ec072d6effc19e0a348d1827c71

SHA512
acd7cbfc63995b68f9f9135e40036afed8e3bdfe31298f4d3017763c9d8df88c59fdab04722616bee1a24758596475eb960c4540028272e7c6ad8fac6df11636

Download Submit
C:\Windows\SysWOW64\Kaehljpj.exe

Filesize
96KB

MD5
fd233e886912dbdd7ae759dc79a0189c

SHA1
de621c20e8beaae2d66d41f8215efa550bd7dcc3

SHA256
b9a8ac915012a063fd1d1af743ca91f64c9831b92fe532c879b3b4d67aadacb7

SHA512
de5edc6684ff61df47c056b7bc0f3e91d2059c6aabfd0675bb0b6917552d90a3f4895a6c6e537a2d02d8afc969d1500a82e2041c8030553c49da83af3399c6cc

Download Submit
C:\Windows\SysWOW64\Kbmoen32.exe

Filesize
96KB

MD5
d43c16dd6e1324908d8478080ba39bed

SHA1
5b5c81707a7453925c7c2efe24336fb323c1c5b2

SHA256
8997b768ba6d9592946429da9d4a8622507da0b65783bd8db512cf5b7c2dfd7a

SHA512
d7602f1660a0f17f401ea606ea42367c8d69b23e101a1c2f4b39921314a531b689c5fd41bf80ec8e97a7be5309d73e8cc80efe147c84447ff0da7729a453c4a2

Download Submit
C:\Windows\SysWOW64\Kbpkkn32.exe

Filesize
96KB

MD5
e63627098227885f6951a11e41216964

SHA1
aa39ea307cb0d538b3f1241d41bda78328872b2b

SHA256
4f58c7ec845d9810c2501ee570c6a4a0ea5f75b215f26b1e32a5cb007b68ea5d

SHA512
8b19d289987513afc3154caa7e28b13abdca75a29f861346b4e3a6d956aaf019132a730854318dc9fb12f08a056ce4ec0d19b2e865db6a13fb70301e18aa0f8a

Download Submit
C:\Windows\SysWOW64\Keqdmihc.exe

Filesize
96KB

MD5
04a0c2fb2625caab0f423fcf7ae7ae30

SHA1
3600713102cdb6beaf6c574b65ca4a7ccfa1ffd2

SHA256
199e85ad8f0c8555d0f0cc0c48bc44edb7e2a890896b788a4c25be04dce7d54f

SHA512
0f5272da8b0f43428c163ef81a277896c977413af83496f4c95cf19384fd84fe090cbef1438e35285af6ab8fc7cab1e612931f9c1c433966a35d86d362e8c896

Download Submit
C:\Windows\SysWOW64\Kgjgne32.exe

Filesize
96KB

MD5
c6067b4ec40cb32f098d80bac6641cf3

SHA1
732ce4bbd9e31cda85cd8b5ca3a954fde534c7de

SHA256
e05e48ab2467456ad15e753de3304780fe320a588461b05451bad58f969e2dac

SHA512
719cd4d4e4314a7588e6a4106712e8ce5175b1c80c262fad96d2f2bf99fcb92a36c4afe361b0c288a777432a3581252ae22887d87436ec34f30302c126594c18

Download Submit
C:\Windows\SysWOW64\Kgmcce32.exe

Filesize
96KB

MD5
e51c50e5b1974f50a7f98527c6554443

SHA1
948d1bfc776611e6aa2b172c3350ffae43e412ab

SHA256
21ca33fdf904204c569de101f1799fa25b5c425bff7507ffed143f3180a04f6e

SHA512
a703d2928461bc7a225314475c518c8a5ab8eba2026728c4f74417ad25105251602901a415e76ac05effee0c1eaec81dddcc547a25c82122e9296b86767fff38

Download Submit
C:\Windows\SysWOW64\Kiejmi32.exe

Filesize
96KB

MD5
374366ea58f3a0467b64700c094b35a1

SHA1
46d77d153b9503c21578a5b9da10ab249f45ee72

SHA256
ca078fe5901c68f039ad4f5591abf1bc65fb5d79102381213d1e0ec69835cfb6

SHA512
7654eeee17592528d1e47ed43199892822ee4c3c7e9e28349622a21cb636aa0bcf0e65b7be67f4635b4a545750ae556edc210d54d3d598b74f4d6c9831ca61c1

Download Submit
C:\Windows\SysWOW64\Kiggbhda.exe

Filesize
96KB

MD5
023505e5d16b4bb8f7c084226a669889

SHA1
26440f55f16bda4f9078d68e84839d72efa2a540

SHA256
77781a72f5ac01a99af36d01c7b6a3f1636bc2031457895564cd1265ce242c95

SHA512
c8d2a45eecb201c0c4bcd40347e651ceddac8a71f04ffccce0d21d97d0e15e7d255d578efed0aee2f8b64112b8fc209d2bd8e292181db3d854c4a0aaf65b63b4

Download Submit
C:\Windows\SysWOW64\Kijchhbo.exe

Filesize
96KB

MD5
b09ffece8e50d6852479747c9e2d93bb

SHA1
8800b5522cead405841b9fcdf3f748a87ef2dbf0

SHA256
ffaa9247bfa1d5f8792e1dd7da3032169687a6fafab975a232f3fec9b510183a

SHA512
136b4265158806a7648b72d9f379dd8d8083b6095d1b1714eb1c30ad22e1ce970fb8e24dca1c5a2f5cead1ccca3e42a6b217ea588727f52a149211728372b795

Download Submit
C:\Windows\SysWOW64\Kilpmh32.exe

Filesize
96KB

MD5
e161c7caa1c0931451c0baa50001ee0d

SHA1
d7ff795bfa592c4eb690247d0a8cb60529bd8579

SHA256
adcc3468a017714da05c20531124f25741dbcfde444791d32b1fc58240586e07

SHA512
bd862099a9c131b99e0180244c9cdc071c36624a95a32a47a38fede2bd36f4f12112f20eb8d25a934ee08dd389c608594305e2ad22103787fe1bfd1fda8ce5ea

Download Submit
C:\Windows\SysWOW64\Kjhcjq32.exe

Filesize
96KB

MD5
11dc42a0b8d2730d3562432bebfe5857

SHA1
5758fec2cd3e27b399fe2e420fdbb1a039151b21

SHA256
33f158cf2dd8f7a6f65f5e3005d7754de8c8fd33a5bf994f849f5bf16718898b

SHA512
3fc218c9595ed2fd357dde59fcb06e2f6bf1f9360733d24a7566c2274efe474e43d31d7375528377236516bd6dbd321aae200740013332556e31733f6ad68d3f

Download Submit
C:\Windows\SysWOW64\Kjkpoq32.exe

Filesize
96KB

MD5
522e2f2bd761e55b19799ff76f96fb9f

SHA1
2794ecd07f3c33ad9096b4e448bdc707ba447c2f

SHA256
586ba9fe19d8182e10a3b97cb62d0d7a6b8c108a47f22c8141ef51021acdf9f3

SHA512
9124c496493faaaab78718ae3291693bd61676f843a0cec673288618eeaf330e9ea7c691660d6812eac76b2e85db39c9b20b17a3017b94639627f2ab96e3cf68

Download Submit
C:\Windows\SysWOW64\Kmkbfeab.exe

Filesize
96KB

MD5
944745975bb7c571c5c87ec178ccf2ce

SHA1
eff8ab84d0cec30117745158e079d6370278f70c

SHA256
39b3fc929515ce48868d0afe6df0dfbf5c60b1f521df9a014d2f867531c40883

SHA512
47f133b0746d2c28d1be36e0d1d1b00f00b66c1bc9866208edb20bd925fa30f41cab1826d79c28fea5544bc441520d7145db6ce3ec449c9f4c7b29b2ae677584

Download Submit
C:\Windows\SysWOW64\Knalji32.exe

Filesize
96KB

MD5
f7b484a93a5f092177e8d941f6a305e8

SHA1
f4654585d83b8ce8f4df425f527ea715aa0d610e

SHA256
cae360766aabc2ddbfdeb9ed111f5bf9050db66fc0f3ce41f50868427b034585

SHA512
95df7ff90cc4f5e76e2e14264d20ee9394627879ecd8b3d55816cfa453f141192da1fd7d488ce5848da9a8bafba51dc163389420372021dc09ae63730cce6051

Download Submit
C:\Windows\SysWOW64\Knflpoqf.exe

Filesize
96KB

MD5
25ff8806eb7a4f01fe55f943ba47d189

SHA1
d235a67619b93a1fab264054dbbc11d1a8899a68

SHA256
f723ce5817df1540930e64ee01c24299573411cacab8460ff90fc32f98b5ab80

SHA512
c7ffcb82d71e4daaea46d44e3bce53a56685ad34c9fec830c083e1b878c52e1b3b3ff674d90139cc01fcbc2a47fc73d97be06889016b1bd56dffee71f1663047

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
96KB

MD5
3e08d5bb27da3c9044da1390b207febb

SHA1
17b3a219e5eb90641e4b10d537361632cd1aa48a

SHA256
71baced56787d2aa8515b36b67f43fb9f85afc663a84e7d8b708b0b801df2f04

SHA512
7abc90751a5c81c16674ead8cdb62fcc4244cdf01f43c5f284483959852e3f2df9f65cdb40698becb3960e70cc703c220a08ccf1f744c3a143105c8b666a1808

Download Submit
C:\Windows\SysWOW64\Kqbkfkal.exe

Filesize
96KB

MD5
c09d25e922c9aac51002eef3efe63330

SHA1
8095a59c4a521a11cc24f25603c025e9a9c95a0f

SHA256
893528f7e4bca34f5e935523c82898bca2be1988a5fec0baff6d824656b5758a

SHA512
e12a3fabcb8fcbad103f6b9994180a5952a2d610b0a6e666e83e7f9c178e821cd37c832b909d073eb3f18671b61e00cdf867c010784d9f97c57eedfa2342246d

Download Submit
C:\Windows\SysWOW64\Kqpoakco.exe

Filesize
96KB

MD5
09f610f62225c741d801f8eda6e61795

SHA1
dc3dcafc3c31504bf534a0569159dba2a2bb4e00

SHA256
10f227d83ad6494c65d0b291e564d80e5a37fe7b61dc6c221720aeafacfe68f8

SHA512
c1b1fdea4e0e1aa179f51a44ab1668a07691f5699040bf1fe41ad572d793089431b2d37764dc7680258a1091e18bb2eeb122a7839edac01bceef23fb82a586e0

Download Submit
C:\Windows\SysWOW64\Lgdidgjg.exe

Filesize
96KB

MD5
9cca49210ea5a88a00beae0d37db548e

SHA1
63343378b38ad4b04fd9de55010a8692beb52759

SHA256
e8a30c98fed7d2ac28347ee76b9a7177a48f567707f6f8e85da35cdf50960640

SHA512
4904edce9c0829d35dee9936097cbd5290c35e129420c90433a79f567da2cc35ec7cd0c85d3dbcaba964d18c2a780cab484c04e180d8a8c9feb6122857443e40

Download Submit
C:\Windows\SysWOW64\Lqpamb32.exe

Filesize
96KB

MD5
889a2282807428603f720d7bb3d13596

SHA1
293cd119aaa6875165adf6f692dc1198bef9583f

SHA256
980784853014f10a5605b43218d3546851f75b532c18865bc414b3487a7e34c2

SHA512
e7916c7c6b71b81c65882521464239d0762a603de3f9f3ec64b10919680f3c738be8dc1625ddc9308609319c1868dc5cab3369c5211c61def012d0a53f1d87d1

Download Submit
C:\Windows\SysWOW64\Megljppl.exe

Filesize
96KB

MD5
34960498dc7b7578c4390f0f0448d209

SHA1
85d76855c1ad0402b18b76dc1c4cc3bbafa647a0

SHA256
44b1cbc7641b8012dd44a7b72fc64acfa8d05ebd8a8e1e580db389725841a68c

SHA512
6c324852acb111a6906e3ec6820dc7278578f6277060c825fb1d25c29d5b4402f18b7c0c2156f2132f4fbfe1aa582735253eb0d9da071b179b563ee71eee7d8b

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
96KB

MD5
68581f3f78c701dbf3cacbb45cba51e3

SHA1
c7798d3c534dca3fe02576b685cdad40214ffb07

SHA256
b3d213d4987e4149c4b461a4a35e7c4a1c443e0474824df54d32ee010e7126e5

SHA512
e7cb7fbe85768dbcbe3819507745875673596b0ad339ec8cc0f39b62fe9b9d62339605b317ff31365f3b5e5f6de50a2da067d0e4016367d782bfe74cd3379659

Download Submit
C:\Windows\SysWOW64\Mqkiok32.exe

Filesize
96KB

MD5
9f21ae1eb1ee6384e2ed28b83df2dac9

SHA1
b2310daf71d4e9af13e4b534c7e3a8a52690b3d4

SHA256
3a7555e85657dccb5d6656c16d882dba7f2b58be641239084065de2eb535f8ae

SHA512
565db3fcd17f02de6dd02afdc3cb3960f6495fcc45ef166b4ce98f44fd11675dbf0fa888efb244fc9df66433f0afbb96e1b4c0484bc11025bead655a79e509f0

Download Submit
C:\Windows\SysWOW64\Npgmpf32.exe

Filesize
96KB

MD5
7d617cbbec60229fd5894605bc839c04

SHA1
7acad394df373db8e60073c142fbd91a318acde3

SHA256
ed3857f5ab16b9e65714d8429c5146fdb80fda0c8947ef79862dcdfee8ed143f

SHA512
6b5c373fd1965fc9847839e5dba46afb06d42666dfe3b6db890822fed83f3e7e52b3f441a662601633c7002eaeb5cce79cd0440fa39cd293057dbe2f2928e7dc

Download Submit
C:\Windows\SysWOW64\Ogekbb32.exe

Filesize
96KB

MD5
70b35412202d83226dd65b9b09d72c51

SHA1
fb916c7a0ed71e1cc4cbeddbc11b4ab75a05ae92

SHA256
a9a2cd826bedc47b03d71acf51c9c8f6682476448bebdb64a145cff872a7921e

SHA512
a4e0532d668d8800b49d3ac3c939a62f9b3eccab38eb3a35a0934cea5fd5791f2c10690f6f84a5bd3c2ef54f437649b733a384bb9c1443360361de8be3e5412e

Download Submit
C:\Windows\SysWOW64\Oobfob32.exe

Filesize
96KB

MD5
98309cc2102bda485cabeb86548bbf77

SHA1
56fb4a9d2684849b9f339e30b2403e982783ea62

SHA256
e4345987b7c862d46a7392c403de2fcda51ed9f9d58baa2d9ee8e052ccfc390d

SHA512
601b122da9ad54bcb77f2080ffc5c85a01144348a3e8d853b2fc733ecc3669a7d269477014661ff00bde02d23deab1829f9b6ee0b0f2f5cb94f41fedfe93fdb1

Download Submit
C:\Windows\SysWOW64\Pdhbmh32.exe

Filesize
96KB

MD5
a409915d884b3365ce9542d8c394d50a

SHA1
56634e4c7c2eee81e4e966feae5a4d95d421fa2f

SHA256
d35a885cbc040975f3570f511246d3cf5ef3fcaee82a7b145e245d165eb2676f

SHA512
87b037bd1e8a73654ea6affb45b45122bfb8541c90d79069eecbc5308860f1c9a1cbf27903570618914aadd9a0164d9884f22f1242d2354e214461111d076d6a

Download Submit
C:\Windows\SysWOW64\Qdbdcg32.exe

Filesize
96KB

MD5
f6608e8239d1f741a46042e35c870a09

SHA1
2e605258658e86e68e84d8b57d32ecfcb55c0fcd

SHA256
bd3b7a1143c701af1d39810ecb45ab199779c7cabbdb64ac282ea3911d473405

SHA512
f3409db6aad41fec5b594b8d904a320e5ded2bbf4c49f50b406f7c231445d6e85f2639043fafd9c5d67edc6e2f42c8e4dcd963c4357e359b45114c9f10c59f31

Download Submit
C:\Windows\SysWOW64\Qoelkp32.exe

Filesize
96KB

MD5
b0d0db747f32e26de1f31f7c2dbd8b01

SHA1
f3c4cdf71aa3591dd061692c9765febbea1de53f

SHA256
a37a9beaca27f8221b5f17c36b958fd074fe193203e2a8a2cc0ce3a83450b881

SHA512
d2dd79cd384e8a097207dab36080340e5efb595869affbef6f59c0446bb499f54005082e12f08925d81b7752a5a224fdfedcaf8eb470a20ff13068579edf3249

Download Submit
memory/320-542-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/640-87-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/688-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/816-556-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/840-15-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/840-562-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/844-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/844-569-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/996-374-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1000-500-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1012-220-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1028-290-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1048-483-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1068-356-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1092-266-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1096-428-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1152-506-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1204-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1372-410-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1464-398-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1500-79-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1532-181-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1592-350-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1632-362-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1636-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1636-597-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1692-244-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1760-464-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1792-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1876-229-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1924-164-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1960-96-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1988-345-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2032-518-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2124-204-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2180-584-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2268-488-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2340-8-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2340-555-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2384-564-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2388-111-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2440-172-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2452-476-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2460-577-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2516-422-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2724-416-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2904-570-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2936-144-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2944-196-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2964-140-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2976-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2976-583-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2984-494-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3016-386-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3080-458-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3196-296-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3280-446-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3320-392-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3488-549-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3564-591-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3656-404-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3668-598-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3684-119-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3936-103-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3944-212-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3968-512-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4012-368-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4044-260-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4048-536-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4128-156-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4232-272-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4240-440-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4288-434-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4344-252-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4400-380-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4420-590-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4420-47-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4432-284-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4464-278-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4472-302-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4476-470-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4492-236-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4500-314-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4600-127-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4608-332-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4652-320-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4720-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4720-576-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4816-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4816-548-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4820-326-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4848-452-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4904-308-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4996-530-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5072-188-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5108-524-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads