berbew | 3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbd

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe
Size

92KB
MD5

e2c94558a29a008c8262a970d85f9470
SHA1

e450479d1ef4e375de519b718a8ff1b32820e3c2
SHA256

3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbd
SHA512

b7828dc19ef4672a555b2f8f5a0364d3a61838a53c14ac252eb1dbe6855f7266260ac307df114f003fa69bc66045c1f196ab48bc65442fe6add55cdbbc30033f
SSDEEP

1536:Al3flim6pdhY16+0L8Afq6VEfFLQ+b95O7urzLeyfESWXeTvKIaN3imnunGP+2:cdgbhY1d0QJgEfFLQ+bzO7urzLeyboGI

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bakgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Camddhoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkgpbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oejbfmpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbfgkffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flfkkhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkndie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glldgljg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jdfjld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbanbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iphioh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqmkae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekdnei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jekqmhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lokdnjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lddgmbpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oogpjbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bllbaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chlflabp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hibjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjgchm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmieae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clchbqoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkahilkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bobabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikkfqmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pefabkej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahbjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpoalo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iphioh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dooaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpgind32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Paeelgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknmla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aednci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knqepc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Injmcmej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jniood32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3892	Gdjibj32.exe
3532	Gjdaodja.exe
4900	Gigaka32.exe
3916	Gbofcghl.exe
1456	Giinpa32.exe
4832	Gdobnj32.exe
2712	Gikkfqmf.exe
3660	Gpecbk32.exe
3564	Gfokoelp.exe
428	Glldgljg.exe
3152	Gdcliikj.exe
2092	Gipdap32.exe
3704	Hpjmnjqn.exe
3156	Hkpqkcpd.exe
1592	Hlambk32.exe
4016	Hckeoeno.exe
4892	Hienlpel.exe
3644	Hlcjhkdp.exe
1360	Hginecde.exe
2080	Hmbfbn32.exe
4088	Hpabni32.exe
2360	Hkfglb32.exe
1104	Hiiggoaf.exe
944	Hdokdg32.exe
2124	Hgmgqc32.exe
2100	Hkicaahi.exe
1424	Ipflihfq.exe
3256	Icdheded.exe
3956	Injmcmej.exe
4292	Iphioh32.exe
412	Iknmla32.exe
1036	Ijqmhnko.exe
3452	Iciaqc32.exe
1716	Ijcjmmil.exe
1372	Ilafiihp.exe
5052	Ijegcm32.exe
4444	Idkkpf32.exe
4312	Jjgchm32.exe
2240	Jkgpbp32.exe
4988	Jlhljhbg.exe
2316	Jjlmclqa.exe
3424	Jpfepf32.exe
3988	Jnjejjgh.exe
2108	Jknfcofa.exe
4368	Jdfjld32.exe
3596	Kjccdkki.exe
4252	Kqmkae32.exe
2496	Kggcnoic.exe
1748	Kdkdgchl.exe
3684	Knchpiom.exe
4880	Kjjiej32.exe
4224	Kmieae32.exe
4576	Kkjeomld.exe
2752	Kmkbfeab.exe
2156	Lgqfdnah.exe
2060	Lmmolepp.exe
2784	Lddgmbpb.exe
908	Ljaoeini.exe
1100	Lmpkadnm.exe
1052	Lgepom32.exe
3588	Ldipha32.exe
4124	Lekmnajj.exe
4232	Ljhefhha.exe
1248	Mcqjon32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Flkdfh32.exe	Fimhjl32.exe
File created	C:\Windows\SysWOW64\Qmeigg32.exe	Pfiddm32.exe
File created	C:\Windows\SysWOW64\Bhqndghj.dll	Bajqda32.exe
File opened for modification	C:\Windows\SysWOW64\Bakgoh32.exe	Bomkcm32.exe
File created	C:\Windows\SysWOW64\Ijegcm32.exe	Ilafiihp.exe
File opened for modification	C:\Windows\SysWOW64\Megljppl.exe	Meepdp32.exe
File opened for modification	C:\Windows\SysWOW64\Coadnlnb.exe	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Nohffe32.dll	Cbfgkffn.exe
File created	C:\Windows\SysWOW64\Aolece32.dll	Fefedmil.exe
File created	C:\Windows\SysWOW64\Cpabibmg.dll	Hpnoncim.exe
File opened for modification	C:\Windows\SysWOW64\Kofkbk32.exe	Klhnfo32.exe
File created	C:\Windows\SysWOW64\Hckeoeno.exe	Hlambk32.exe
File opened for modification	C:\Windows\SysWOW64\Njjdho32.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Ifomef32.dll	Opnbae32.exe
File created	C:\Windows\SysWOW64\Bcjfln32.dll	Mjlhgaqp.exe
File created	C:\Windows\SysWOW64\Fligqhga.exe	Feoodn32.exe
File created	C:\Windows\SysWOW64\Dmcnoekk.dll	Ickglm32.exe
File created	C:\Windows\SysWOW64\Pjpfjl32.exe	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Pocpfphe.exe	Pldcjeia.exe
File opened for modification	C:\Windows\SysWOW64\Ahmjjoig.exe	Qpeahb32.exe
File created	C:\Windows\SysWOW64\Blciboie.dll	Pldcjeia.exe
File created	C:\Windows\SysWOW64\Bmjkic32.exe	Bogkmgba.exe
File created	C:\Windows\SysWOW64\Kpjgaoqm.exe	Jcfggkac.exe
File created	C:\Windows\SysWOW64\Cpkhqmjb.dll	Cncnob32.exe
File opened for modification	C:\Windows\SysWOW64\Nqbpojnp.exe	Nflkbanj.exe
File opened for modification	C:\Windows\SysWOW64\Mqafhl32.exe	Lncjlq32.exe
File created	C:\Windows\SysWOW64\Jdfjld32.exe	Jknfcofa.exe
File opened for modification	C:\Windows\SysWOW64\Iedjmioj.exe	Iojbpo32.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Fihgkk32.dll	Lqojclne.exe
File created	C:\Windows\SysWOW64\Ijdabh32.dll	Kmieae32.exe
File created	C:\Windows\SysWOW64\Ambfbo32.dll	Fnnjmbpm.exe
File created	C:\Windows\SysWOW64\Ofmdio32.exe	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Cedckdaj.dll	Pfoann32.exe
File created	C:\Windows\SysWOW64\Cnjdpaki.exe	Cogddd32.exe
File opened for modification	C:\Windows\SysWOW64\Cbpajgmf.exe	Coadnlnb.exe
File opened for modification	C:\Windows\SysWOW64\Jgkmgk32.exe	Jmbhoeid.exe
File created	C:\Windows\SysWOW64\Mmacdg32.dll	Kegpifod.exe
File opened for modification	C:\Windows\SysWOW64\Camddhoi.exe	Cnahdi32.exe
File created	C:\Windows\SysWOW64\Lokdnjkg.exe	Llmhaold.exe
File created	C:\Windows\SysWOW64\Jleiba32.dll	Jniood32.exe
File created	C:\Windows\SysWOW64\Lccahg32.dll	Jjlmclqa.exe
File created	C:\Windows\SysWOW64\Jkiocibf.dll	Lmpkadnm.exe
File opened for modification	C:\Windows\SysWOW64\Idkkpf32.exe	Ijegcm32.exe
File created	C:\Windows\SysWOW64\Gicaifkq.dll	Iphioh32.exe
File created	C:\Windows\SysWOW64\Cjelhg32.dll	Gpecbk32.exe
File created	C:\Windows\SysWOW64\Ememkjeq.dll	Kjccdkki.exe
File created	C:\Windows\SysWOW64\Mdgmickl.dll	Poliea32.exe
File created	C:\Windows\SysWOW64\Ckhecmcf.exe	Chiigadc.exe
File created	C:\Windows\SysWOW64\Kjjbjd32.exe	Kpanan32.exe
File created	C:\Windows\SysWOW64\Bogkmgba.exe	Bklomh32.exe
File created	C:\Windows\SysWOW64\Hgmgqc32.exe	Hdokdg32.exe
File created	C:\Windows\SysWOW64\Glmoga32.dll	Kdkdgchl.exe
File opened for modification	C:\Windows\SysWOW64\Lgqfdnah.exe	Kmkbfeab.exe
File created	C:\Windows\SysWOW64\Eoaedogc.dll	Pmcclm32.exe
File created	C:\Windows\SysWOW64\Ihbjebjh.dll	Phigif32.exe
File created	C:\Windows\SysWOW64\Fhgcme32.dll	Blgifbil.exe
File opened for modification	C:\Windows\SysWOW64\Gehbjm32.exe	Fnnjmbpm.exe
File created	C:\Windows\SysWOW64\Mjcngpjh.exe	Mfhbga32.exe
File created	C:\Windows\SysWOW64\Mpggodfg.dll	Gjdaodja.exe
File created	C:\Windows\SysWOW64\Cdnmfclj.exe	Cbpajgmf.exe
File opened for modification	C:\Windows\SysWOW64\Gldglf32.exe	Gmafajfi.exe
File opened for modification	C:\Windows\SysWOW64\Geaepk32.exe	Gpelhd32.exe
File created	C:\Windows\SysWOW64\Lfmmaj32.dll	Geaepk32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9596	9472	WerFault.exe	446

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlcjhkdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkjeomld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpgind32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibcaknbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbohpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgmgqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkgpbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljaoeini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omgcpokp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaalblgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgbpaipl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chdialdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldipha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bafndi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dooaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbjoeojc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lopmii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijqmhnko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkijdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imgicgca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kncaec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modgdicm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmkdcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfhbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnkggfkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odoogi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbpajgmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekaapi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoeieolb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chlflabp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibjli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bepmoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flfkkhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmkigh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iedjmioj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdickcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdcfidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiiicf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mokmdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlambk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpabni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlhljhbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pldcjeia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgbloglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpfepf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aednci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckclhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfcnpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgifbil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnegbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpelhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imkbnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hdokdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Injmcmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cocopa32.dll"	Ekdnei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igdgglfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abakhdbk.dll"	Ijqmhnko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcokoohi.dll"	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iemlnm32.dll"	Gdcliikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gicaifkq.dll"	Iphioh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjecbd32.dll"	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikemehi.dll"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iojmqe32.dll"	Cbdjeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmkdcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdahdiml.dll"	Iedjmioj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmmcnn32.dll"	Lgqfdnah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oejbfmpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Paoollik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mebcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdabnm32.dll"	Oalipoiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omgcpokp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figmglee.dll"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnidao32.dll"	Injmcmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhpofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mmpmnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Omgcpokp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jdfjld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogjembbd.dll"	Lomqcjie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aamebb32.dll"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eadhip32.dll"	Ckhecmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkegpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pldcjeia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmdml32.dll"	Qmeigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhdbgapf.dll"	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkjeomld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hflkamml.dll"	Mnfnlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljnlecmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hffpdd32.dll"	Pkegpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdaklmfn.dll"	Feoodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlgaff32.dll"	Aonoao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bldqfd32.dll"	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ackekpfe.dll"	Aehgnied.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Modgdicm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3892	2804	3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe	85
PID 2804 wrote to memory of 3892	2804	3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe	85
PID 2804 wrote to memory of 3892	2804	3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe	85
PID 3892 wrote to memory of 3532	3892	Gdjibj32.exe	86
PID 3892 wrote to memory of 3532	3892	Gdjibj32.exe	86
PID 3892 wrote to memory of 3532	3892	Gdjibj32.exe	86
PID 3532 wrote to memory of 4900	3532	Gjdaodja.exe	87
PID 3532 wrote to memory of 4900	3532	Gjdaodja.exe	87
PID 3532 wrote to memory of 4900	3532	Gjdaodja.exe	87
PID 4900 wrote to memory of 3916	4900	Gigaka32.exe	88
PID 4900 wrote to memory of 3916	4900	Gigaka32.exe	88
PID 4900 wrote to memory of 3916	4900	Gigaka32.exe	88
PID 3916 wrote to memory of 1456	3916	Gbofcghl.exe	89
PID 3916 wrote to memory of 1456	3916	Gbofcghl.exe	89
PID 3916 wrote to memory of 1456	3916	Gbofcghl.exe	89
PID 1456 wrote to memory of 4832	1456	Giinpa32.exe	90
PID 1456 wrote to memory of 4832	1456	Giinpa32.exe	90
PID 1456 wrote to memory of 4832	1456	Giinpa32.exe	90
PID 4832 wrote to memory of 2712	4832	Gdobnj32.exe	91
PID 4832 wrote to memory of 2712	4832	Gdobnj32.exe	91
PID 4832 wrote to memory of 2712	4832	Gdobnj32.exe	91
PID 2712 wrote to memory of 3660	2712	Gikkfqmf.exe	92
PID 2712 wrote to memory of 3660	2712	Gikkfqmf.exe	92
PID 2712 wrote to memory of 3660	2712	Gikkfqmf.exe	92
PID 3660 wrote to memory of 3564	3660	Gpecbk32.exe	93
PID 3660 wrote to memory of 3564	3660	Gpecbk32.exe	93
PID 3660 wrote to memory of 3564	3660	Gpecbk32.exe	93
PID 3564 wrote to memory of 428	3564	Gfokoelp.exe	94
PID 3564 wrote to memory of 428	3564	Gfokoelp.exe	94
PID 3564 wrote to memory of 428	3564	Gfokoelp.exe	94
PID 428 wrote to memory of 3152	428	Glldgljg.exe	95
PID 428 wrote to memory of 3152	428	Glldgljg.exe	95
PID 428 wrote to memory of 3152	428	Glldgljg.exe	95
PID 3152 wrote to memory of 2092	3152	Gdcliikj.exe	96
PID 3152 wrote to memory of 2092	3152	Gdcliikj.exe	96
PID 3152 wrote to memory of 2092	3152	Gdcliikj.exe	96
PID 2092 wrote to memory of 3704	2092	Gipdap32.exe	97
PID 2092 wrote to memory of 3704	2092	Gipdap32.exe	97
PID 2092 wrote to memory of 3704	2092	Gipdap32.exe	97
PID 3704 wrote to memory of 3156	3704	Hpjmnjqn.exe	98
PID 3704 wrote to memory of 3156	3704	Hpjmnjqn.exe	98
PID 3704 wrote to memory of 3156	3704	Hpjmnjqn.exe	98
PID 3156 wrote to memory of 1592	3156	Hkpqkcpd.exe	99
PID 3156 wrote to memory of 1592	3156	Hkpqkcpd.exe	99
PID 3156 wrote to memory of 1592	3156	Hkpqkcpd.exe	99
PID 1592 wrote to memory of 4016	1592	Hlambk32.exe	100
PID 1592 wrote to memory of 4016	1592	Hlambk32.exe	100
PID 1592 wrote to memory of 4016	1592	Hlambk32.exe	100
PID 4016 wrote to memory of 4892	4016	Hckeoeno.exe	101
PID 4016 wrote to memory of 4892	4016	Hckeoeno.exe	101
PID 4016 wrote to memory of 4892	4016	Hckeoeno.exe	101
PID 4892 wrote to memory of 3644	4892	Hienlpel.exe	102
PID 4892 wrote to memory of 3644	4892	Hienlpel.exe	102
PID 4892 wrote to memory of 3644	4892	Hienlpel.exe	102
PID 3644 wrote to memory of 1360	3644	Hlcjhkdp.exe	103
PID 3644 wrote to memory of 1360	3644	Hlcjhkdp.exe	103
PID 3644 wrote to memory of 1360	3644	Hlcjhkdp.exe	103
PID 1360 wrote to memory of 2080	1360	Hginecde.exe	104
PID 1360 wrote to memory of 2080	1360	Hginecde.exe	104
PID 1360 wrote to memory of 2080	1360	Hginecde.exe	104
PID 2080 wrote to memory of 4088	2080	Hmbfbn32.exe	105
PID 2080 wrote to memory of 4088	2080	Hmbfbn32.exe	105
PID 2080 wrote to memory of 4088	2080	Hmbfbn32.exe	105
PID 4088 wrote to memory of 2360	4088	Hpabni32.exe	106

C:\Users\Admin\AppData\Local\Temp\3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe
"C:\Users\Admin\AppData\Local\Temp\3b90f38abc19757fb4f4a126b7e897302180f9be44234154b5e3134e4baf5cbdN.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\Gdjibj32.exe
  C:\Windows\system32\Gdjibj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\Gjdaodja.exe
    C:\Windows\system32\Gjdaodja.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\SysWOW64\Gigaka32.exe
      C:\Windows\system32\Gigaka32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
      - C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        24⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:944
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        27⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        28⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        29⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:412
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        34⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        35⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1372
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        38⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2240
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        44⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2108
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        49⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        51⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        52⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4224
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4576
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2752
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        57⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:908
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        63⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        65⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        66⤵
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        67⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        68⤵
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        70⤵
        Drops file in System32 directory
        
        PID:2280
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        71⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        72⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3016
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        74⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        75⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        76⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        77⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        78⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        79⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        80⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        81⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        82⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        83⤵
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        84⤵
        Modifies registry class
        
        PID:3552
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4168
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        89⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        90⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        91⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4128
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4068
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        94⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        95⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        96⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        97⤵
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        98⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        99⤵
        Modifies registry class
        
        PID:2960
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        100⤵
        Drops file in System32 directory
        
        PID:752
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        102⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        104⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3584
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        106⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        107⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3048
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        111⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        112⤵
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        113⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        114⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        115⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        116⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        117⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        118⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        120⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        123⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        124⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        125⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        132⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        134⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        136⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        137⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        138⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        139⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        140⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        142⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        143⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        144⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        145⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        149⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        150⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        151⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        153⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        154⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        156⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        158⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        159⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        162⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        164⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        168⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        170⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        171⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        172⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        173⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        174⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        175⤵
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        176⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        177⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        178⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        179⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        182⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        183⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        184⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6988
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        186⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7136
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        188⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        189⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        191⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        192⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        194⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        196⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        197⤵
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        198⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        199⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        200⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        205⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        206⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        207⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        209⤵
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        211⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        213⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        215⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        216⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        218⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        219⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        220⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        222⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        223⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        224⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        225⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        226⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        227⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7252
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7296
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        230⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7380
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        233⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7512
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        235⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        236⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        237⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        238⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        239⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        242⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        243⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        244⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        246⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        247⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        248⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        249⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        250⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        251⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        252⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        253⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        254⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        255⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        256⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        258⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        259⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        260⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        261⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        262⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        265⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        267⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        268⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        269⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        270⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        271⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        272⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        273⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        274⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        275⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        276⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        277⤵
        Drops file in System32 directory
        
        PID:7816
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        278⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        279⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:7744
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        281⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        282⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        283⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:8296
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        287⤵
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        288⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        289⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        290⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        291⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        292⤵
        Drops file in System32 directory
        
        PID:8648
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        293⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        294⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8780
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        297⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        298⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9008
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9052
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        303⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        304⤵
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8196
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        307⤵
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        308⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        309⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        310⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        311⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8684
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        313⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        314⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        315⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        316⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        317⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9124
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8304
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        321⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        322⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        323⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        324⤵
        Drops file in System32 directory
        
        PID:8712
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        325⤵
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        326⤵
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        328⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:9152
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:8288
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:8444
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        332⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        333⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        334⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        335⤵
        Drops file in System32 directory
        
        PID:4712
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        336⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        337⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        338⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        339⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8324
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        341⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8640
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        342⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        343⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        344⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        345⤵
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        346⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        348⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9384
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        350⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        351⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9472 -s 412
        352⤵
        Program crash
        
        PID:9596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9472 -ip 9472
1⤵
PID:9536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adcjop32.exe

Filesize
92KB

MD5
3a6a75f4e7e97d197f4083100148fb10

SHA1
0cebe2768a06b68e4f06f9a69595fd610ec2125f

SHA256
d0013f9afa438fe13ee47fa81d1d5bc2c14e42c7f3d044a4965d44f94bbc9149

SHA512
6e93022e851edce5e2c4e066154cc96ce7e4e6e6cefca17394f4c70ff431bfba79c3607141d57c00403e731f61fd6a12cd01c86069fba49434a78c0b9eb62178

Download Submit
C:\Windows\SysWOW64\Akepfpcl.exe

Filesize
92KB

MD5
6a9a388051e3340b73a01575ba2e93ae

SHA1
c5c43bc5af6509cd8abe43564e0f55e8b0890a67

SHA256
500c63d5f1c0dd53828700eddf3cf2f91b330b67031faaf9b5919b05a24ee57e

SHA512
46e72eea7138cac41b593515bc51a32a73af57f12ba2059ab2136f2ab6326a8cbcb1375357405b9e2ea648040e20954344d3f0c6471240a0b0cd2ebcd40f151b

Download Submit
C:\Windows\SysWOW64\Apjkcadp.exe

Filesize
92KB

MD5
45de9425050fc0514d22db13c7a34d4a

SHA1
828bcdb32e8d646c646b8cba1a913fb27cdf4c1c

SHA256
91e7e3e28621a88e8fbdffb2ec2f2780d399b8f1f2ec047a3edf57cfc3f59ee0

SHA512
9a6203e442a40cb7e4d127fac4434f8f4ba02c27b6fcc6f77354c239fbf0992095f5f314e37a80cb24af12d136f18dbb524e3dcace0cdccffa57c40fb49d0286

Download Submit
C:\Windows\SysWOW64\Apmhiq32.exe

Filesize
92KB

MD5
42b50a9e063f5b9a966161c820d6cb49

SHA1
0ceab63f9ea332970b3e256ae2f671815d16aa00

SHA256
9a644a62b3373bd6337436b2448e3669db5abef46f2da1f8ecda0b19cafd1a83

SHA512
096446642c388297011018bbc9e0028cc5186743fd90abc3fc19d7d520ea79c01129c5fc6f16152895f47e27e4a2e6b3717e5c1471a115b806b82641688bc599

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
92KB

MD5
3f50f6a9170019a76fd076926e8dbf9c

SHA1
47c1a409b4a24ef8732de49bb19df74ad7c601f0

SHA256
0e65644fda1a48bae2eb91867513d970b22bb5a5f5d3cd4d0711a29282f4edcc

SHA512
fc5d09c2ac3e1ecfe9e74163688614c17d62b7e18514a2ff152ffb690ce237f3b31250490f2051eab21c11e6734f120dacbad9c7077aec19d0d1e6f1f215a135

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
92KB

MD5
8c960cf74eef00a57309f984fbb37c7c

SHA1
acc71eef4d1331fa6dbad92350f33c390790f3a9

SHA256
cbd0a0187cf44b649128eb1b1a47d3654a1e9336a69d4d30644d93b065a9e165

SHA512
f2d7486a88ca5b13b0b217bed378adb6c64954efc60a3262f7ba5d985c892cc8d493389e932075d4e6c77f3a6c97f50fbe94919280edc0962811b0e982484e3a

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
92KB

MD5
bb2c5b713421da45c31cd05aef9df20f

SHA1
a16a5b37a8ccd22fc85481589471c586268a7c9b

SHA256
02b62558e87091bc3a0edff721484ed14f152f1bd9c9861b414858ac30b14360

SHA512
031797f517f21f317fa639dc45e756e8584b68ebd60ec4ec5d2bf3f824d2f52dbc0fa21298a25332c8a3fb634c5f709e1659cef7ea946c73b7bbe065edf7246f

Download Submit
C:\Windows\SysWOW64\Bnfihkqm.exe

Filesize
92KB

MD5
131e1f2228f891b1a10adb1037624948

SHA1
8308e3a9874647782a7b8c676f4492e20a5438c1

SHA256
eb5ddc310c413520cd156c757704a0c4a79752303a97eb1ed5a0e5cb46f28bcc

SHA512
5ef0b9b45f54241fa74dd87e1e8b82382663e3f4d81ac581d3af9963ae4cfdead22190d721f2a049af5d80729aad9909b04004179385ebd2e419d73b66b51d60

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
92KB

MD5
5619283fc202a8ddbc1bb515a2dc059a

SHA1
825ebf33e9d4f2bfce23e4180655783797b1c790

SHA256
f5b036d2e2d406842ae363499bcee2bcb2221a1842f1badc0451ac73f11d0dcf

SHA512
00e9b20932489f67e3d082cf123164b779167ec4062734a2815423b131e9b016b2af7de17d993e9321540e61f4cf24c704e50345a4493670549e7fed0baaabe5

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
92KB

MD5
b6b457cef4d9c7c45505532f6f6b4837

SHA1
88a7925757d8d744b9d470c7367953b6bd5fa38b

SHA256
e6254ae458aeb0b7e272d032fb0dc278cc4476ce5ff43f9e1abf032a7fce0ecf

SHA512
e099f7cb3530a50bf46f5f5b0ed542e3a74e33235d12af9a1e6c52227e91a456fc1ee311fcb4aa9c9e6a07b06692bcc0ac1eaf995697f071af59df592952ba20

Download Submit
C:\Windows\SysWOW64\Cljobphg.exe

Filesize
92KB

MD5
13a3c3bd54bc6f9375df54539a67a3d8

SHA1
bfdf48d29d698896cd7ff58bcd82e8a7d35f0db5

SHA256
96771e5e26395fd296eaac279b373ff49c483607c07310fe68b5574d97bbc025

SHA512
9eb2273e46a64fc8332f93f8cb72537f6a28f72bffd868d1d8a1137a83265c7371d31aeee0b971d144751c07a08df96d2b7bcf9650e43cec8a7d995ef18f0107

Download Submit
C:\Windows\SysWOW64\Coadnlnb.exe

Filesize
92KB

MD5
3dff5162c44d4c0e112dd19d9c63626c

SHA1
3e56c0fad0da0bd14e7cb617e632061182283a6b

SHA256
a198e4aa802cacf2c525284e43d00095be187a1ac8ba59f5291ad47815169a64

SHA512
387f530ebec0c8ed67890ee9605c1bfa4279303a67ca2fe8e76bf8d37d284d9a73b42d82ca9d7386baf27ee8c9bbf33e7f507fbed02a332b5357f55ecdcd0395

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
92KB

MD5
de6954ae59f86658bf580a90ca1bbd1e

SHA1
684ddc20c8f782c9d206fc40a1052f6de087f63b

SHA256
8e13db160068f849bb390ed37c27baf8415bf49dcae0b7d45dc17ca08169f7e4

SHA512
3ac304ec4e769a7a70ea0c5f369a764b9f0df0d61769e8daaa6ef398893382ba11060eef6dbf259792c5ebc1da3b93b1d0a13c52d4396223064468219fcb1294

Download Submit
C:\Windows\SysWOW64\Cponen32.exe

Filesize
92KB

MD5
83948ac1fe19bd19c153cda1662192ad

SHA1
31b6ca9210892d7589590fdbf023cb0f80179d95

SHA256
9afdbaaf3aed332bed851c0a0546c12e1da9d41cb670a6e5e2e7ed55cfc284b7

SHA512
8497376a2ee14cc7c1cbf5eaf0435670ee656e162ff46e1ad4ea646e4023c6b07cf39d9e7e1396e6364dc9d2f3464376db7f475a6f4d7200ca1da07d6620408c

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
92KB

MD5
1882a21ebf836aa5552b670746e5d544

SHA1
9b3b9c909b86a6ad35f58259724e6a6c0a9ddbcd

SHA256
5e87fcef1a751827fcafb4d534ae6ed6dae4d7954991ea04fdbeca5827938c34

SHA512
b5f7a49085aad5c07df1f6c0e78015b247aabc58ba493b21cf07bd259dcf31d904ece8fdb85b378a6c24035d8dce25bcc5957d47c0274c6dc134f0e0105e930a

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
92KB

MD5
ac673ee738886de0a492ab906a3bb972

SHA1
9747e864b94b8a8fcd1c8add2b9a14accdc567d6

SHA256
ccd3c2b944ba2be9b6348750e0595a22818c71359883bdafd95431eff0d6d6ec

SHA512
be9b268333e22ee32845e6c08235d56b71f7da0f0bb8cbf638495e61886ed03f17c3caa187a14903458cb92c84d8d9352562bdbe7f5c10dddf144ec823094f97

Download Submit
C:\Windows\SysWOW64\Dkndie32.exe

Filesize
92KB

MD5
7883b971a528c921fa83c850b69c76bb

SHA1
877e287a3518fdc624344c8d3958ab72c8c2e8ef

SHA256
ebc9c9038358247e21614273cfeded2006007bd5ec1a3c0b4ef2649dbde29744

SHA512
97d21606ff6e0f8339eb959ee179ae78f0d5e75dbac82771462b35725c90995d7ae935335fe1657600fbf6abec562875d348085f94ecae7449ce390d1730943c

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
92KB

MD5
756917134340d047c26a08d81cd729df

SHA1
6cf29e5f3fb3334789044266daf81748db8fa784

SHA256
29442ea00177a23c6217fac8c341a12312e3b275a2755cdf006d80a3da67a534

SHA512
43ce8a4b23b9ac29dbc7b174e5cb03c3709ffa9b4e5b60a0b41617e05210c1a419ea10fd6b293e137cdd707abdbe9c3adf419779fe39ab2a7005cb71fa9d5e17

Download Submit
C:\Windows\SysWOW64\Eblimcdf.exe

Filesize
92KB

MD5
18ea64086a87a31d9d6e7ba8a3860d5d

SHA1
ea294355f59ebf34dc246f1ab2884c4244d7ff24

SHA256
ab6cde2f31396fd44e0a9b86019e83c8ea048ab58d8c20ec9c0e5fa014dd37f5

SHA512
361e201dfa1a6c8a0c89f84c63ed1b92c2d8d70690b217e0c8e5cd30d6888b7737a8f1258449dba6cd03dd918e570c85c0819fc748a66f75c478ed41d81feffb

Download Submit
C:\Windows\SysWOW64\Flfkkhid.exe

Filesize
92KB

MD5
9976043147ecc73efe98102b1be3f81e

SHA1
79a35e55dc6ce9d69dbe4f069b3f1a88e759ccdc

SHA256
ab77ee13f7bd18dabe3da40148f003e3525c4720d65f6feb2d3f8b01d92acb63

SHA512
bafefe26dd942d38361550ee7eab808f825089a23aaf1172a62e326dfda9826bf0932ac5ddb06826f857da106a96356455e7b6d5bda49c50dd449d77ecbeed89

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
92KB

MD5
4cfe5284b16ea08e61e3035c20406020

SHA1
306dcb1380e351c00e7674663e87210ed50ee643

SHA256
d6e68219b7213ede531e1b701e0910452203762829abaff722876f5b619ccc95

SHA512
96d3c9a758fd2673ba7ac39228ad00d5606e1bb75280df3e87fc2010b401afcece2b0d4ca188c2ae87e018023f7205d7b36c31695e7fb781d476000d0753c8ff

Download Submit
C:\Windows\SysWOW64\Gbofcghl.exe

Filesize
92KB

MD5
a24886836091e1ec3767f527494b512c

SHA1
304a29aa45a1dc5679cff38905b631f07ad4ec6f

SHA256
94125e899d8166b032a83649c276540ee31e1915420ecc0f6f0ee06c74483374

SHA512
90b5f54500db73d934d7b5facde6c0ab0c460853ab57b28c60ff2bd52f2d62eef1f55e5acfbf223ce09ce0c55c91bfa97bc9f785264f23866d8862a38a8c4403

Download Submit
C:\Windows\SysWOW64\Gdcliikj.exe

Filesize
92KB

MD5
4901912782ff1ffcd4b8da398fe9532d

SHA1
e282ceab0ce29555beb09cb4dd6e7fb94e2298e1

SHA256
67b80a33f69c35bace27f31f6ceac92c1d22ef73e82693a086af500524ee635e

SHA512
7c2fbb7c23f1e205e3b944f3c30eefa1bcdab75842cf3e69c4939e9a5e2954e61cc673cfcbe281692c11220679109328c3bf24d551e4576f90d08041ae102148

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
92KB

MD5
82e53349e69dda984615327959f9a3ec

SHA1
f92f97ecd8870496c26d01ad72cc790de60d6aac

SHA256
e67d9b053972f26a3f9b9615f34269eb9115deebd8a71cba054c1b4de5898d53

SHA512
c2882ed19400068ac35fcd8f334502715612e9611d5e69940981363171e241f91b728c0cc7e0965557a788ee6980751478360858ba243934e836401360aa30e5

Download Submit
C:\Windows\SysWOW64\Gdobnj32.exe

Filesize
92KB

MD5
b0efe228549981b0ac3d477697dcd3cc

SHA1
115df14529831747d5f79c0f9ba8778780bede5f

SHA256
84e5b69cb571c4e60e5ecc805af4d7c628b28d11d6f88015e1cb59ba740cf525

SHA512
33b008eba1740bc2dcc3848c3e4a0a7adc79ba4e787463a21a382ddca19877679d1b25d597dc741967202df9c8112e5c45224234ae6bbff875327b6c276dccb4

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
92KB

MD5
d534e11fb877fec8b9607c7959aa16b7

SHA1
fa9fb95953563767bb6bfc444dfd7cc2fb655688

SHA256
0e1767aee2445c00de9875e4c282f74286fb0fd28c5dd75b23c1f3f20f09366c

SHA512
b9e40ec0636ab1f471984df6d3a2b6bebca39710fcd402690e98d79cdc91da8b4761aacc9fde2f02c1347ec251a22ae6de133f5c8aaa55e18c33858514da5eec

Download Submit
C:\Windows\SysWOW64\Gfokoelp.exe

Filesize
92KB

MD5
e4d549ffd3bc3655d45b40def93c5c95

SHA1
5f8899b9f58ee0832de570561694060c367563ca

SHA256
9b3d50d9281afc8692fb6da1d639869843a648ddc6b7e9ac7b8829e1970637e6

SHA512
038a099ce3ef23a80fa0d92c1d09f9bcfe14f8a07e1793f93c1b45932b42195ee2c4edecf48149dbb8529be5b9e75e6d00af8dc422983e30a7cee84238b517f4

Download Submit
C:\Windows\SysWOW64\Gfokoelp.exe

Filesize
92KB

MD5
85f68463b7f319054bb88653da67ef22

SHA1
09ab32b610ce65eeca9a1d7b255a861bf97e107e

SHA256
fc898b402ff008a9309f3db7d73ca3e4c79c1d5b3b0bcc62455039488dff9672

SHA512
e7468a69214e1445d93702b003cbf66c899ac736732b27f2469a0144cd50bd451f360bd9a00dda3afed3876ffd27e6df3ef1747b823d085257de675a2b86eaee

Download Submit
C:\Windows\SysWOW64\Gigaka32.exe

Filesize
92KB

MD5
bd0588e1bcfc72f747cb68ee4cbf9aad

SHA1
5519e1f54b515a5b152d2fd5b9a5cfdbb17aa1e8

SHA256
fade2abe66061d40cb5c93c9b2ba7c1d49d7fe00edb7796b6d5fe39daf95c0dd

SHA512
b5fe8e4e5f7051e397f0941b8d832e9b34372674316dbcfb9786591c0f83e22a349d24dd55005058b7f7b3cee5daae0251080ff222a7fd1216ea103a560d5480

Download Submit
C:\Windows\SysWOW64\Giinpa32.exe

Filesize
92KB

MD5
a4c9de423802f409db750ed575c47b62

SHA1
a849c5fc41f552015b01647cd34bb9af0c345edd

SHA256
32f606c73b518e79a4cefd2a83565374ef67a58a3f9eef46de716e663e217f2d

SHA512
060e4fe312382ae46f836ec477245a5f89860d199fe5f0841893689f6aa11114fcc084d29f106b9763c0097870eee0f9ffbf737feb49d4915d9a5486298faaaa

Download Submit
C:\Windows\SysWOW64\Gikkfqmf.exe

Filesize
92KB

MD5
5fe42dfc2915845bb96e9b1d016f34d2

SHA1
7558bc65b2d8cb7d975178bbc9d64e6dfc1b173f

SHA256
cbb46e81b8a91218910925eaad45f2206786c3f1f12738b4f853023d5bf7307e

SHA512
ed241815f227da332a005562233cdf8326b2881a708343019da912c566a4cf53560024fb4a9caeefb4b39d41ee2a7c6dd04d11e75d571f57766141ddec0ff30e

Download Submit
C:\Windows\SysWOW64\Gipdap32.exe

Filesize
92KB

MD5
af4a74b49156fb931961631bca70c5fe

SHA1
33ea9928f19913cdadefdb498faf4cb28a6e130c

SHA256
504a4925cd65a23f0018bf6377eb87c7c0d12519a56bb8bb345c1973f344202b

SHA512
9dcb4a05d8205b5d7fb124a5dd481b03743389ecddcfa813575c4583feb64066c18543681fdc0b66d9d9521cac2fc9aaf2ae948b1c542799d6f699d5d21607e3

Download Submit
C:\Windows\SysWOW64\Gjdaodja.exe

Filesize
92KB

MD5
15270d6be9fb57b7182305abca734215

SHA1
04cf128326972a157475d8a31311926c032a8a9a

SHA256
fe918d69172c5e641e0da92647ce09b56fa204d2906da2f24200107b74e328f7

SHA512
a9dc7cc0720dcda98ffd5df273db3ff68b8f1e17a2c811dcaa5c7b5baff5f517dbcb69bff0dfd346fa0d7312b59d1bb482541e73d031311e56ab82c5bf347c87

Download Submit
C:\Windows\SysWOW64\Glldgljg.exe

Filesize
92KB

MD5
6365d253c9d7b20009c76d43c71de77d

SHA1
44fe29bc02aa3e336caa1575905a95d2551bac55

SHA256
90949435162115f101ec155091229d1f0601fe1a7c1e3192a8a8fc432e5c35b1

SHA512
daac32c1a5881481fce5bb89f9d470c12b19dd40167b820a8bc896dd97de7e89a0ea6afffaffc3bead2195924b23f3c8fdf2052d0bbffad98ba9bbd8e1e8d27c

Download Submit
C:\Windows\SysWOW64\Gmafajfi.exe

Filesize
92KB

MD5
ec5bd36fe491240e3b51abdf44625e17

SHA1
3865436adb3c30e5e13443ff8b77fae5a424fd2b

SHA256
ce8fb49b3d3aacbd7a16284abb97238cad91af21f1cd0afb0e0e4a85cd942016

SHA512
384f433e86df3fb6a6a6c081103a514f7e9884dbf6a55690e573c93b29870dcd4328b549aa5bbc58301d5aa73f2e336a52bca5344fc2b24a0da26e8e2f6d0311

Download Submit
C:\Windows\SysWOW64\Gpecbk32.exe

Filesize
92KB

MD5
c3a6d7dfd77c2ad6e4b3de5a2701252e

SHA1
f15c74dcbc1acf9ceb83906c3969f41553a3c135

SHA256
1d1e54fa25f0db573b75832bb67b1bde9221c466231e17d67ecc2f46e5e196a8

SHA512
9244f8cf5cfd5652d06eb1a781cd36193842befcd9af5800caed2b5c7b46fdad9e4c30e9c484707db5d3dc39faf90cd64901b284afb1caee48bba874e5ed7a1b

Download Submit
C:\Windows\SysWOW64\Gpelhd32.exe

Filesize
92KB

MD5
9a2dde1796f86196a63ac564863c640a

SHA1
c44592a9b268c3196be905bd5e31ffa5d3e6edf3

SHA256
d11bfbe84160b9d6520584e2682a7236a0e33365268722e71b2feeba81a70d77

SHA512
80cb25aa7e770e46a32935a96093b2d0addb333bd7878543de4232c17df4479a6ce75126d5ba72a397e022344e221b351341605b12cd05de3dbf28d95582f5e6

Download Submit
C:\Windows\SysWOW64\Hckeoeno.exe

Filesize
92KB

MD5
78fe0198763799cfc06e07edb12f3689

SHA1
3d9ce940b64d8adcb742455510ac9ebeed23bd85

SHA256
3bfb1d84bd196c9687895174c7507fd62a144334d560a09abc22024f91bdab7c

SHA512
5d12243d217862c6abdafc69061f0f00cdd990521961416749173a040eab5d1f47b584e89cdaa6b2ea6a94c97354ad78a45314518b759e755a2d89888a89256e

Download Submit
C:\Windows\SysWOW64\Hdokdg32.exe

Filesize
92KB

MD5
7f4f22c8d53ad98174be667335aa1ad4

SHA1
472a74c5a8b6e24eefdbfb389e1c16b45216bf2e

SHA256
23cbc7a4ed6cb9ef81dff7ba7fad09aa7c68d9754b793cbfbeeda73dcd004e09

SHA512
86034865280a3d7930475ff2a5997f7174d6faf42e75122df97958114960dd2088b1bfcb50b6897cd939aaf7cd7cb1a50f873160ff9c1842ef21bc05f977e204

Download Submit
C:\Windows\SysWOW64\Hginecde.exe

Filesize
92KB

MD5
b8c5497e7267f2513b178afb44f34f5b

SHA1
befce8424deca7e52568ecae00cf5907150629be

SHA256
5299bb423219ea82ccd9ab43d604ad4ad2063edf4dd771d3643cb30ef4494cae

SHA512
c654a9f6f00b316f35e18d4fff76632196d93e70a38816124aa00f5fa7df039025cb11167f953b4305ae497807b4806fe2bf2b040ddd65b6f9f1f535ff1d1f5a

Download Submit
C:\Windows\SysWOW64\Hgmgqc32.exe

Filesize
92KB

MD5
9c7e878e16d7ab4204a20baa4c4ae2bc

SHA1
93d1c14ae221a68945d9a56fcaa44a7a6ca55ff5

SHA256
3240ced14a43d5dfe3906722b50728d32a2c93c9519d1ea29279205b9f825fd8

SHA512
3bd1fec5374cc7b4056468b1615444a10c8b6596c6ffe186d016799f1af082c8d09708d54d728e33c46536c8c1fbfee39a3d78881d5d9773282783352eb9f941

Download Submit
C:\Windows\SysWOW64\Hibjli32.exe

Filesize
92KB

MD5
2f6a3a6ddd7affa3b8d42c0dccd2fae4

SHA1
7c3f017a1666ebb6a95305c9e004635e08d05470

SHA256
cba50558c7ab24445aea61df23fae20b563e2d1ad22c9e30ad6504951f604589

SHA512
09b099c17ee7ea9a11fbd7155d810d150054bbc66065b74103862aedf5a1daee90c3a5c93d6f8b9d5a467500e433abaa87bf6ae230dd9417c10e39cb3b1db682

Download Submit
C:\Windows\SysWOW64\Hienlpel.exe

Filesize
92KB

MD5
a47c0dcc6757a3daa7a8a6cc5abfdd35

SHA1
e8a96286a8081bf390fb8a2ee447940dfae71d11

SHA256
7a5fbf00a7cd37d7f3f537478d3a38ea368df84baac62f8ed39779c7b842185f

SHA512
00afdd7571ad5266d9cccbb2e508322c2a05b88b4f4e0b85a92a0c1b34a98c434385ef99e7fccc8ce654b32ea5cfed471cb58970d9bb6c152986d91266dc6070

Download Submit
C:\Windows\SysWOW64\Hiiggoaf.exe

Filesize
92KB

MD5
3c2223bf7a42cb0dcbafd7f639fc3b73

SHA1
f6de85ae1b97ef970cf4b5ebd482987a772c9055

SHA256
4cf35a1fd2339fc80ae74c709e8881c310fc19465ac8604b7c409409e8f2dd64

SHA512
a8fc992c58cc0f59847bb7ca0066db873377fdf6403ac4a5ede7737581d6d7b8e11a1ee51a216c70f61a8f0a172300578f1c4c3da6e9818ac6c735d72a7247e2

Download Submit
C:\Windows\SysWOW64\Hkfglb32.exe

Filesize
92KB

MD5
14cd2518c9f3076690537ba99dec8ea3

SHA1
a594c6127ee33489075b985b65558f56e38207de

SHA256
343cf57fdbab0601cfc81fce27ea9f85473d943b3e63ad20ecb7c5b1bca8014d

SHA512
cb9e4993a963e80057861de2f8ce115bf7405ebf681a67df353e28869e3d23ce444c1c3317a35da8cd45260254fbcc5505f32426e547e36c8e6cc31695e47b54

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
92KB

MD5
6ef611f876ca49a04fdf644a1731115c

SHA1
331340229c5ed21b2d56712905f804d709c6ba29

SHA256
14d37a86257a3384b854d94b62a193d62c76b3427cc76dbe91db228b67427b33

SHA512
96ac7f7776cc6ca4a418f44504f0e996891c88c8dd448ea0a0f8fa1cbe1202a004363d35d3374a5de63b3a32d5b74a438151585c9ded3602027b9372752ac070

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
92KB

MD5
db5efbeb93236995a1b73aa59329c147

SHA1
cbc694b7a22b695dce3dd203a0443026431f8d77

SHA256
6eef91a965a42c077e919a4d92385b2841ca5f790644b263e8ba90f3aea8e2ab

SHA512
fdcbd8e197682b9f43204b2f0632b642d1877ed0e6a7fa40e089e4a710b39f0166cf1945fcb5a27d68f5358a95fc38b5b056d5a268937cf6e8480a70fdebb9d3

Download Submit
C:\Windows\SysWOW64\Hlambk32.exe

Filesize
92KB

MD5
28177fb7b0c50f963e166881e7074257

SHA1
26b3cf006e8387af985eed550aab934b08ce2d61

SHA256
77d4e45740bcb9e9f41fd878a756cab678078d906350fe16d77bf795fa38da19

SHA512
667f9883b7442d16f0be894de82a6d7ecc6d3f4c57197d4d11017815bfd5eb82d04b9aadb3d2bdc6c09f42f75447b77ccb3e606fa35fa41c99bcc4930e607d59

Download Submit
C:\Windows\SysWOW64\Hlcjhkdp.exe

Filesize
92KB

MD5
40deba0029530202933770e391c7f3b1

SHA1
632bec81d968bfab23b563e2f71265ceb1979008

SHA256
c1a52df707f471b0fd4ac3fab8a82de24eda006db09935a9b4e3a67190f70612

SHA512
0604736457ea87a90fecf31aa138cfab50400ad4fc47c64281ee8409444495bd19108888f054ba667a87e5d05d99333273966fc365af1204ea5e73e5960c4678

Download Submit
C:\Windows\SysWOW64\Hlepcdoa.exe

Filesize
92KB

MD5
5ffbd65c7c40b1dbbffbcc77f3af2747

SHA1
5b3164c79f8a554cb66d524b4456d8db1408bcf6

SHA256
d87a7fb7b0bcb6e8b9b0fce7e7b2c0b2d43905bc36560caeb3642d2bc3949e56

SHA512
0576b71229e3987e3d85ba0927e7d0e008b838e1d5d32363c1795b8845217649ef416e9756580df7740958539a35c48ad8e795f3c6ae6baa9c5284123b1b4111

Download Submit
C:\Windows\SysWOW64\Hmbfbn32.exe

Filesize
92KB

MD5
e27489784510ec02b8f51bad492035f7

SHA1
b7e5d3b3ba7f192bd4d42bddf30e2d70dcee4c07

SHA256
441b0c8b194f1774cbc6e3465d0f1a18d5839b4f951e5e360f38c4777237ed71

SHA512
9950218e568f26d5f6841760e7f5f3c922cd0c2282ddd0d236344cca8f85cdac9db3b39fad8bbdbd684575f7a6b84522a320d18f6ebd674d148b2cdc1b242387

Download Submit
C:\Windows\SysWOW64\Hpabni32.exe

Filesize
92KB

MD5
7cc8bf80258682716a3c5458ffd111e0

SHA1
a1e0e10b39cf70df72f20e785f04816e0610b30c

SHA256
0f1e91c1a44b93f7a9850826cefca29438176991fc0c5153f22f93c48cb9d8ab

SHA512
888623144f0a52476856cb52b080c959360771dad118c31d3844042d0869f9eb5b301251642d15cba7eecac007fd21c3c735cb3771be88a182a04a1a29310a06

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
92KB

MD5
b74b66cce212dce3b1d696a21cf6af3b

SHA1
798333fde18483e3d8ca5eb1611a39fdc65f3452

SHA256
47c7a6fc9f06cc36707a7c12e669d52f3b4c6e4b4f0f86b63ccc5f8c4f883479

SHA512
2edf5de2100d98e156ffae38bd42aa353993ed59f121aec7c8b269e6ebdd6be7d79f85e3ebceeb2fdaf5fd2565408c4a8c01be6f749c87292c22e690e7e70b93

Download Submit
C:\Windows\SysWOW64\Icdheded.exe

Filesize
92KB

MD5
a48733a961ba43d9e1f08433d5726aa2

SHA1
fb3a00e7d116d24ba0691552469375b37e6c860f

SHA256
91b6f2e22a50cc2054589790b9189dead89fee41382a18ab03d303a68b1eedbb

SHA512
174004b0943e85761908035f9e5c5044f996032bfe8f3032464de9346c3f445f0160085e1774f813ed91964a605ffda2534dc6c66a938c17d6c9b8394a182474

Download Submit
C:\Windows\SysWOW64\Ickglm32.exe

Filesize
92KB

MD5
cb2468fbfe54df5bcc11d6d91d85a2c1

SHA1
d9367f26674718034e26b97cefbfe5c424158459

SHA256
48351c5db3840d6c9e12718076df586c83272d772846d96b95a4dea272e5801b

SHA512
54fa4c3b82f9da785800222482df51c68266042557763b84e8e57a4b313ebcb5f495d49e968f9c4dd35553c2485d7d1744638d62fc3e77ee584923001b6e01bc

Download Submit
C:\Windows\SysWOW64\Ijcjmmil.exe

Filesize
92KB

MD5
8ceb48e32f487d6d44608955a4617e17

SHA1
e8e3fdff400d96040c23b77682b87a0e86fe2ffa

SHA256
47e21c665abc8373bc679c594f86643409e065d751b7dcc9d6fb141042d09ceb

SHA512
e0414647ee90106d9d6a31afd85b164d030e2cb1cccb2576177893b8ecd73ac02cec0d87dfa6ad2c0342da5d0199c9114aec1bcd731263a6a82bb9265dd1ee6f

Download Submit
C:\Windows\SysWOW64\Ijqmhnko.exe

Filesize
92KB

MD5
b70079d0035fe13c7d76e79a15c27b92

SHA1
467e01ee05b62b6d1e1c07020071d480eabd8829

SHA256
0322e952fdab65ed217ec1c2ddb010406f799a6b60cb9f82ad1eceb9b5cb5e33

SHA512
ca8c4bba088640c610921d510263166fa7dfec6b3ec7f40b3228643adeba00f69ec336ee33278e995d8df1e805d2205fcd05707c911cdfa82402bb0179745ab1

Download Submit
C:\Windows\SysWOW64\Iknmla32.exe

Filesize
92KB

MD5
c9fd68cb946efba4680848442ebc4664

SHA1
2a1f87a4abb427a002feaa23bfd9e13bac850a4d

SHA256
aaa24a61c1dbe44800789c49cfddfc2633abeeec307c6b8edbc18fd461ba0763

SHA512
4897f0fe3ca91ff6d6c67da14338a779efd6e05fe0384e3394e92ac071aef8be534abf2d5db6a052f02d8b233dbd9c71ccf359d9989b2fe8683c7faf303ff82c

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
92KB

MD5
5a3b9a8f10fc9dd541665fac8220eed9

SHA1
2f5845cf292e6e2b6ef9e250503c4c90c433c770

SHA256
d70c2e8f75e629ee0efb876eeeb7445ea2fca64953bc5a37bde78971ecdc7356

SHA512
8eb4cbcbd01480e0fdd995fdf3462a1bebae13605a102da8fb05112be3ef1909e8415f60f9c6c59cb162b2874819f3b07b722a73addc2978860b0daf5d5d192c

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
92KB

MD5
13ed5ba17a1f1757df10d9f67c7a6ba0

SHA1
d8ad8ba5b8e030890975ef49b12a48bdf98a424b

SHA256
a85f8b2ecc59e12ba8b05562c49ef7db09aeaaae2c759c8f627c92948bd75d20

SHA512
be8fdf01a45c3e6618f2130f2b490e9d87e650529257c3084ca732d828aa7e096ef6125ff7bae325949fe20b93c42bb305d28d9d5a1b44c39677646fdbc13d86

Download Submit
C:\Windows\SysWOW64\Injmcmej.exe

Filesize
92KB

MD5
9343ed403ebf5ca344d751db30bed997

SHA1
e8b48a1346b874383ff37bd0b3e7f01e86210668

SHA256
29a51e193fd0f3a2a71d2834222c300f765dc86af9caef80706c6a88f8acd159

SHA512
566e88a5ef8c5cca35a6bb30a413c25fa29276c73da940094f0488b2c84ea99da7b8e43e05c2c68d9e056e4fb414e2868d90ceba5b49d947100ac4e3574777a9

Download Submit
C:\Windows\SysWOW64\Ipflihfq.exe

Filesize
92KB

MD5
054c3a3a6bdc81d01368761da3e441a4

SHA1
80bb3648fb7945d750e8a150eae8cb6df18fc95e

SHA256
506b02895d099f37a8451fcd67ca5cce42d00a314b9aee6fd11352e3a2fbfe57

SHA512
6dc708bb1ff6abb3eac29dc78cac6289948d03aed09ef60956916a08e7bcc903a17d3d2c5c3b13a31023d7d7029c9cd4f6de50dffe0e1ebc2e0b7cf87e842d1d

Download Submit
C:\Windows\SysWOW64\Iphioh32.exe

Filesize
92KB

MD5
60149f802df4af2f8a4534036d41cc23

SHA1
d7050ea2b06094b98d28a65bcfc42f3cc27e8f1f

SHA256
f5e22b31290182b25c96d1500c5952482841d5fe99c10fb0aae4814da98b3212

SHA512
e3d57f51615f617e007dfe682c250f9045d64f38daac83a4b350ec3b8c9d3b27a8a9370ada141139ebdc175af01f82ccc27e31d43e9fab85ad0552c8f972ea27

Download Submit
C:\Windows\SysWOW64\Jlhljhbg.exe

Filesize
92KB

MD5
78b95310e55ab059bcb2958c022049f7

SHA1
51148dcc7c0d1de264d150b3007b008d1debcc11

SHA256
3e2413aa2d7a9f44c2ce3a078dc9c40bd8cfbf528b3868d94ed8a05502dcd2de

SHA512
5dbccc2436f684d5d177325151dc97024e8caf927b3b74e1897cac19601fdf0162f360e86f7931efa6362b880303d2137fc68fcd54641c000fe9a85a8b49a07b

Download Submit
C:\Windows\SysWOW64\Jpenfp32.exe

Filesize
92KB

MD5
8cff15e90858a5da48ab98e9ea4c4ee4

SHA1
574d80a60bc2f393d8f37d7adddb713e0fde4378

SHA256
48195dfcc30a7d999bc1334340cc485b1536a78fac3cca1bc7b36264eff4a94a

SHA512
f81abab6c03cb72ad6f7762172ca8a76d7cf952387d5da1a09991b2b65574f962e097dfdd464523b7de0e108cbc4844d08adea9f2fb9d7894581bdf590f5a561

Download Submit
C:\Windows\SysWOW64\Kflide32.exe

Filesize
92KB

MD5
4184d20e697571810eee2cedd03b791b

SHA1
fc835727745e43219e9b69a8e71282fb28a8a97d

SHA256
9fe05ebb4c3cc2f6ffb2646401474959e0bdc81d079561270e7f9e476b40e976

SHA512
239675f143d88a3d1c3b40a730bc34106733a7492ee78a258499181306bad410ffd69eaedd37e37950e9cd4ef1bc7a6f9ec3ef2cf5130c9ea378789763950cb7

Download Submit
C:\Windows\SysWOW64\Kjjbjd32.exe

Filesize
92KB

MD5
6235637989e376523d976f679a39a008

SHA1
4d4f045d93c7ce993110dd47c7236d2a2b42e1cf

SHA256
885e6cb495e145f745615e70c7baceb0c3ae6c19699cbc7bb42854830c35cec8

SHA512
6c7ed3f9f2d4155784a2f86b9c2d11f84cf1037244348c871f91a1f4e13e84509c766bef2001c662d1c9d18d058709b489a54e684e808729105906310603452a

Download Submit
C:\Windows\SysWOW64\Kmieae32.exe

Filesize
92KB

MD5
ddac119a523799adfe08641cd69fc838

SHA1
c7345102ad8ab8e87209a7753912d02b80d6f7c4

SHA256
7d025bd5d3ed533e77cfd784edf3ba495a3fc67fe62501ff32b9281dee61dde5

SHA512
3bd438baad1511e018887a4ff6d88fd7712e5e31102d148f365da927874a239540020b5877ae3a87a23cc444f1410ca8933df14b131aa502eee5bb5d8bf186f0

Download Submit
C:\Windows\SysWOW64\Knqepc32.exe

Filesize
92KB

MD5
8a4f8389fa59f27496e773e5a56090e2

SHA1
c0b6498b2f2e480c8b252aa53f624bcaf9474471

SHA256
6cdb6cc05aa19b7d277e9351367fc1d984c7a7228e60bb8b5497d8d34ada6def

SHA512
3488678a512d55abdf48e5b44a228cba87d220ae771fd76289207032df255f63b9f50e382fd8f3235726e608ed17a2c1bb1de1bff74f84d80c12f19084ada059

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
92KB

MD5
39d172fcc73072533a05e70e8f506a5e

SHA1
0f0ad0d0144009a12977a500a99324d8f66e8fd4

SHA256
5cef4fb05ba4c9e086c44b0dd022cfdfde8f9eb7bf46edca1233c4f19c454c86

SHA512
66bd55a5a026b4b32377e785a47ce0f8e213c7b0b8c5722cd45581f14e66e15606ed99ed834ddcc7cf546451c30759abbfe97204068bb21f968d230f967d03e4

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
92KB

MD5
bcd8cca2f114e43077f875e171b4da05

SHA1
c875a55ed9d902f11d2a2f61b8c8df2f9345cbb9

SHA256
914b0f4b7e43bb6e1ebb4229c96a3878310f5b680186dd79c82bcfe3758e1377

SHA512
a210db1fc695d88177f811e01f9d3445da749db31e3667fc8055f6a671bbe9fbd99b4520bf8773c2246299af540541daf47aae98501d7b827ee2bed73ce50897

Download Submit
C:\Windows\SysWOW64\Kqmkae32.exe

Filesize
92KB

MD5
dfeed58a72642682365d1948409eb61d

SHA1
ac59d021e9a927a0dcb1eae56b0007e3cda01902

SHA256
1c88691e1c6ca25f89e451285ea2fab1a2e4b3d0e030da123eb47b9830312bf7

SHA512
3f49e5352a2805c6876c6b6e2d5a3d00fa0a8083d3308999c1ea97b271f58d492e7fd7e23de568f3249699761d7c06f47e2b72b0228e2047dc11126bbc6eb7bb

Download Submit
C:\Windows\SysWOW64\Ljhefhha.exe

Filesize
92KB

MD5
c426d6dd81ed2da7eb44c7a9184687aa

SHA1
423a5d4f205afb71a2a97f62826cb9d3e9c4d9ed

SHA256
b6cad5af5059f3eded23e68a46d6c2e563610b286fed704587e06e360497c277

SHA512
3494e612e5e0a7e00d2d35ea6e9b92b54202a8306e7e89748b4063f1ce47ff1e5d5ed8faa1e51fe96ae37cbce4de6a9e12e2e913802112ac43d06628adcba62a

Download Submit
C:\Windows\SysWOW64\Loighj32.exe

Filesize
92KB

MD5
c9be740cf24aebc8b648ec526a69e296

SHA1
09ba53812c1b67870b0f738a44d73d483289cfc6

SHA256
06aaef22e4b3b1423d78d5a3d9a3fd5944c345e46534e56748bcd164ced94984

SHA512
0d1bb7373ee9692591b2a7d649a2ec400a6a5425d2369177f0814853c351a70636d9bbd002e4b99101d643ed741910f6fa3612b4f9fd513a145bcae4f6261320

Download Submit
C:\Windows\SysWOW64\Lopmii32.exe

Filesize
92KB

MD5
9451d8c99520efe55b33d83a1b4514bd

SHA1
a3530447420b8015915fcaeb8014823f33f7cc6f

SHA256
4573adcb4c8cfc1571d4f20eb7677b6294f1a34b29201f258cf0a57458c62e97

SHA512
4657daf8d1e8c9af4ba603694f80a1fe1deb6f5e4deb9d8001cffaef014eb625122da921cc9e7ea03ceb34ff9b0ed0124eaad60eaa1f27af17e0a6009fa19fc2

Download Submit
C:\Windows\SysWOW64\Megljppl.exe

Filesize
92KB

MD5
863f2f5a4d101dd44407aca34e11b801

SHA1
9c0f3ff01a7ef3ae22d6707a0bf6794120dd08d0

SHA256
496c9115b3f4915eb2d50f4e0f521cfbf9a5dafaad85108ceb672c8c60e36a40

SHA512
9df42f4ee9c56cb608d8a7dce1c337434d840fdc111fc87a403073772fa59b14b158fb801896cab5501bfcb1f4a2c52708abfcb254746274b14f2e0fd6a569a6

Download Submit
C:\Windows\SysWOW64\Mnfnlf32.exe

Filesize
92KB

MD5
7e8ab1efaad49b1871103c0bc4c43158

SHA1
3db186cb41d278d934e4dccca48cdf2b919c2ba7

SHA256
758e1ca96a88bd49468a5b3308327022f3b0493aa7ed1db674974543e2f1d5fb

SHA512
7831d5308bfcf31c8f81af65716e2b04181a878fcce783617b1b27843d6295a93f1dc2445d0f58a531e6c95c49d6e6680b35c4764b57922ed4b5e24e50afb41f

Download Submit
C:\Windows\SysWOW64\Nccokk32.exe

Filesize
64KB

MD5
ccc0847cb07cf1df083c024c8d32e672

SHA1
467b548669163cc27ec3a335c59e5099864ff5c6

SHA256
53f4736f4411c5d5355126efe2f3da65990e8ffc6cca916d1f1a8ed1c7730d21

SHA512
2968ebf31ba796eb08eaecb2e39470f91c1f11e450f3b93fcd253f6b797bc726ef0d6bccc038973ea657edbf5823eb960c7792dd6d859cf0a52a0b90f6ac129e

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
92KB

MD5
62b160a59c449f9f4b0efc836d518aa5

SHA1
aa7a0430e389a25566d111b5a2facc23271c73ba

SHA256
e920377410b3c980f220658fd3b0b85bd4827b492e0b4ea1f1e565cebd93528a

SHA512
c0d458973d567bd0b321b9e6a3c40501a63d1bf2812b39d88929d6c871b0b365bf043a51d50db6dcf5b9ec68225959ded910a3633f0216c505e247efdb5933c3

Download Submit
C:\Windows\SysWOW64\Oalipoiq.exe

Filesize
92KB

MD5
fadf26f0669a1dc9de20fcbf37a16efb

SHA1
f2bb2ef714ad847e24d119208048cba49e2963f2

SHA256
71d971d588bfdf5818d72f49ce883dc3fddaffdaeafacb46ce7753e90292498c

SHA512
8df66e31277718f91d11b388916d06f64f4ccccd25a43f38a58ea26029c5d146182ccadcf7cdabe54423c5ea37109a2fadc33f021c0d12a82e45a9c94c3a11ea

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
92KB

MD5
da69d2f437796283ab70b89d894e2bf0

SHA1
d8a95dada411a4eb8640d5cf41a35aeb3fbfc484

SHA256
ce729f5d63af7c257ad2251d76551aef4cf4a227230afd4dfd7153b6410549c0

SHA512
1f8e525fe8278069f6ffcb5fc6a62d1f3d19bfb4b948d95b89e6343fe065a5e7fa24bd343bf13f8ee38d20d4d64b32165ea2b7a15093ac4bae19da6f217e5321

Download Submit
C:\Windows\SysWOW64\Odoogi32.exe

Filesize
92KB

MD5
990699c4c50f55bfa0bfc2db7d31712d

SHA1
5585a17833bd4c226742f7bd6eb05f3d120b2780

SHA256
701c807aa1ccde357a07632e1262dd9f254b5b99b2e064765fcfadc25d06b99e

SHA512
b925f1dc1af58b28a78ec68fa54b980691da2359a637823dbb666f698a1cb4c068fee884b5f4d660288f19313de3f113564a548b47c52a1ede5580f8663bfbcb

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
92KB

MD5
051b9d699b02ff4d0b0e2352445fb643

SHA1
3783df2bd883f655a5f27c062a2eafca0bfef0c1

SHA256
781eb4625fb351b08daa10d57a816cb5712be8929e156cb8164294618effa1f4

SHA512
09e213cc223f6db6aed23ffa0a3f5de388f5cbae521d0b969a26d8a1c13eb9489b1ccf97c54f36bc88d867de0dfe0361268ad1175b3659e3c3c753b18b5b0143

Download Submit
C:\Windows\SysWOW64\Ombcji32.exe

Filesize
92KB

MD5
9aefb44b0f953f9938cc09bd0d0c4a57

SHA1
697286812b9e1da5951de16dafc8363bb578fc64

SHA256
59cae598f996998d079ea442a6c7a34635041cb7b5e27101be9eb1bd03cb712e

SHA512
de9e4e4fdeb54b1a13f67690255115f9a0aea811a0e66f56f35cfcad031e26cd1490516c82f1a497a7728fa99bdc8b7e8022d2165d54cdf16b0388ad02d446df

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
92KB

MD5
89e879f214983ef008f5a20a955bb658

SHA1
ad483a40cba9b98a9185f73ed0b217df2ae6be0f

SHA256
1cace0b7014d61fae9bbec6dc8f9dd40ca2dc791086113cb64bd57e937bc0366

SHA512
1201af635d62923fefcb7b4192f7d936834835c6ffb49dc70d7993d72d05bb7f79af4101e7bdcac2f088e8cbbb28e51d474fbbe4adb442f6aea16c9abfbbd8a4

Download Submit
C:\Windows\SysWOW64\Paeelgnj.exe

Filesize
92KB

MD5
09998c1e70e281c5ccd0575ad42bb89f

SHA1
80558bf1ad4edc8afc0be77679009675d4a80ab4

SHA256
720aaa0c8e67c3d2e69603483e6301ea953394ca9d64cc58dd9623b097f33d8f

SHA512
34d4c265f5393fce1801227b17626b48f8b73a0dacb6f35d5433105e0ed857cdcc20414738d197363fa662a5fe3f5d65f2b46e04f61362e62d7a750b9c98b60c

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
92KB

MD5
2fcb111ec7a4d92afd9882c4cd455ddb

SHA1
f1e33a173ecaa1af65c4b1c370c48de6d90057ee

SHA256
a9256aa944bcf4d5aee1a8b02258d19fe9eb845941bcb801a1eed49d4ba16111

SHA512
f4eb8a67eba51843630c9c922469fe1c88bd823816e5c16fd170d1a79c0eb5e168c681f872e9608f52cac8d0d3668ac6fd76e4a1e87b5760d767f77658c19aa8

Download Submit
C:\Windows\SysWOW64\Pahilmoc.exe

Filesize
92KB

MD5
91d9bb8b2fae8c58cf2abfa498986a7e

SHA1
46ca17f5510496445eb4098336e26cac5fc6aa63

SHA256
491e90d1309e7b793b803380641b3f15587c5b165b7f7a2d5117cbe41fae2263

SHA512
39085b3f6e6d812f69a582a5c6ba4ac396c8f6e677a8f7d3b1f19bc9f4ddb77f9d38763621150d6c20a15ef8dbfd080b5ae90de7ec090ed7fe7f9b6ccf10476d

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
92KB

MD5
23e80ff507d332b437b2ceae333ff069

SHA1
96e78e7c15e0627eb513aa68a117df356f9c8d95

SHA256
0501c117513338557f07f2f7dbcfcbdfacfa277e2fe9fe9eee18ab5afd0ae61c

SHA512
76068fc8b31d0ac482a97ed62902c6b28b44e0276adb76334d15102b0ca7078fa6d7479951d62858fbadd40543b58eca4391d38dcf9729ae30d82c7d31407a96

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
92KB

MD5
15057afbf91dd5ffee519f9fe93d35a0

SHA1
0e2595adfe191a8e58caa2b015bf68c2fe2ff223

SHA256
3e892403a5785c693a456b3a8c139587d6241ff70a4134f67e51240eeb52beac

SHA512
a2bec22f0e30916e770de92cf1f7adb0774ae566f2daaae409809436bffef25005c00118dd45661e860b8a7f46d27857873782719329e12bb69a96c213c2d490

Download Submit
C:\Windows\SysWOW64\Pofkjd32.dll

Filesize
7KB

MD5
c9a6ebd3bb40ca27247170c31dd41204

SHA1
23e51dc886c2cc7253db7cd9d984a58a6adfa0b7

SHA256
a7fe11a6c8ef4310f15322225e3fdc92fdc9f9420a20c43e69cf157b548eefe8

SHA512
54a6b7780c6a892c8de123647d0272fa3d1e6af0e90aafe2300f78f9e89edc7ffcc177cbc541c46e38754093d5c97c5e283ce569c869cb1f5f6997f77a6e6f85

Download Submit
C:\Windows\SysWOW64\Qhmqdemc.exe

Filesize
92KB

MD5
dbd85a0d4734311db34c36492ea6a074

SHA1
790bf0f78b96b8a21f3440d45d2e72c638a3cabb

SHA256
2aae4019b2680def2c18fcca6006f444963285d1e8dcf8cf70ab9106087dd3bd

SHA512
bc9f6b23d9ecb3eb1ee6e17cb71cf7403edb4629f2ae1eb411f8ffe801561af48a436258ff3a2327bfa58fa57461e727dbe1322f555a7e2f711b6bfe375f774d

Download Submit
memory/220-514-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/412-252-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/428-80-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/540-538-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/908-412-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/944-197-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/960-508-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1036-255-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1052-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1100-418-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1104-184-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1248-448-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1360-151-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1372-274-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1424-216-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1456-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1456-579-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1524-573-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1592-119-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1716-268-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1748-358-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2060-400-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2080-159-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2092-95-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2100-208-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2108-328-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2124-200-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2156-394-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2240-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2264-472-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2280-478-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2316-310-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2360-175-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2496-352-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2712-593-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2712-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2752-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2784-406-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2804-544-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2804-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2928-532-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2956-502-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3016-496-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3100-526-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3148-545-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3152-88-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3156-111-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3256-223-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3424-316-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3452-262-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3472-466-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3532-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3532-558-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3552-566-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3560-587-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3564-71-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3588-430-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3596-340-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3644-143-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3660-63-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3684-364-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3704-103-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3784-520-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3892-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3892-551-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3916-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3916-572-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3956-231-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3988-322-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4016-128-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4052-454-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4076-490-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4088-167-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4124-436-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4168-594-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4224-376-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4232-442-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4244-552-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4252-346-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4292-240-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4312-292-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4368-334-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4396-460-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4444-286-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4576-382-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4672-559-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4832-47-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4832-586-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4880-370-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4892-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4900-565-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4900-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4968-484-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4988-304-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5052-280-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5084-580-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads