berbew | f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8N.exe
Size

232KB
MD5

79e4ce440d593460b65e51bc49f9a270
SHA1

5a674a93acedbbfb489a527613065295f0b199c7
SHA256

f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8
SHA512

efdbf7034f57ff06f4c422813744cdb02427c3c621a76662f2b3cd43ef9b2b3feb1580777d480ae81a09e8a3462f9dd5be91c97325ddb710f7e724369593b4cb
SSDEEP

3072:NOTKPyOqe7usluTXp6UF5wzec+tZOnU1/s5HH0AU/yRvS3u121TzlbNRfzPadOF:NOTKPybe6s21L7/s50z/Wa3/PNlPX

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjmkoeqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bljlfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiaoid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iknmla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipmbjgpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alcfei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkoigdom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adkgje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoabad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elgaeolp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qklmpalf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hifcgion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojajin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emphocjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imnocf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnfohmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmlfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbjmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nccokk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neclenfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Illfdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjjiej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecefqnel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdlfhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlfpdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgjndno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikdkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Johnamkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogekbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffclcgfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjdaodja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbjmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpcjgnhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4048	Achegd32.exe
3932	Akcjkfij.exe
3052	Alcfei32.exe
1096	Aoabad32.exe
4460	Abponp32.exe
1612	Bjicdmmd.exe
1800	Bcahmb32.exe
4128	Bljlfh32.exe
2172	Bbgeno32.exe
4540	Bkoigdom.exe
1464	Bjpjel32.exe
2192	Bblnindg.exe
2152	Bjbfklei.exe
4668	Bopocbcq.exe
5060	Ckfphc32.exe
1372	Cobkhb32.exe
560	Ckilmcgb.exe
1804	Cfnqklgh.exe
1240	Ccbadp32.exe
2212	Cfcjfk32.exe
3628	Coknoaic.exe
2420	Djqblj32.exe
3320	Dmoohe32.exe
3020	Dkdliame.exe
3712	Dbndfl32.exe
1900	Djelgied.exe
3516	Dmdhcddh.exe
5084	Dbqqkkbo.exe
3096	Djhimica.exe
4072	Dlieda32.exe
4376	Dcpmen32.exe
4920	Dbcmakpl.exe
1384	Djjebh32.exe
1632	Dimenegi.exe
4840	Dlkbjqgm.exe
4088	Dpgnjo32.exe
2028	Ecbjkngo.exe
1596	Efafgifc.exe
4800	Eiobceef.exe
3848	Elnoopdj.exe
1272	Ecefqnel.exe
4924	Ejoomhmi.exe
4992	Eiaoid32.exe
5032	Elpkep32.exe
3836	Eplgeokq.exe
804	Ebjcajjd.exe
3716	Ejalcgkg.exe
1108	Emphocjj.exe
2664	Elbhjp32.exe
2036	Eciplm32.exe
2864	Efjimhnh.exe
3472	Elgaeolp.exe
3264	Fikbocki.exe
5092	Fbcfhibj.exe
4876	Fimodc32.exe
2872	Fbfcmhpg.exe
2984	Fjmkoeqi.exe
2956	Fpjcgm32.exe
3964	Ffclcgfn.exe
4504	Fmndpq32.exe
2164	Fbjmhh32.exe
1792	Fmpqfq32.exe
4600	Gjdaodja.exe
3940	Glengm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lnohlgep.exe	Lkalplel.exe
File created	C:\Windows\SysWOW64\Bdpkjpdi.dll	Lkalplel.exe
File opened for modification	C:\Windows\SysWOW64\Gidnkkpc.exe	Gehbjm32.exe
File created	C:\Windows\SysWOW64\Eiaoid32.exe	Ejoomhmi.exe
File created	C:\Windows\SysWOW64\Fmpqfq32.exe	Fbjmhh32.exe
File created	C:\Windows\SysWOW64\Hkpqkcpd.exe	Hpjmnjqn.exe
File created	C:\Windows\SysWOW64\Kbjodaqj.dll	Fiaael32.exe
File opened for modification	C:\Windows\SysWOW64\Dbcmakpl.exe	Dcpmen32.exe
File created	C:\Windows\SysWOW64\Djiiimel.dll	Icnklbmj.exe
File created	C:\Windows\SysWOW64\Igpoaebh.dll	Poliea32.exe
File created	C:\Windows\SysWOW64\Bmgagk32.dll	Lcnfohmi.exe
File created	C:\Windows\SysWOW64\Mgphpe32.exe	Mcbpjg32.exe
File created	C:\Windows\SysWOW64\Mnfnlf32.exe	Mglfplgk.exe
File created	C:\Windows\SysWOW64\Paoollik.exe	Pmcclm32.exe
File created	C:\Windows\SysWOW64\Kckqbj32.exe	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Dmoohe32.exe	Djqblj32.exe
File created	C:\Windows\SysWOW64\Iknmla32.exe	Idcepgmg.exe
File created	C:\Windows\SysWOW64\Fiaael32.exe	Fefedmil.exe
File created	C:\Windows\SysWOW64\Mcpcdg32.exe	Lcnfohmi.exe
File created	C:\Windows\SysWOW64\Dapgni32.dll	Adhdjpjf.exe
File opened for modification	C:\Windows\SysWOW64\Iknmla32.exe	Idcepgmg.exe
File created	C:\Windows\SysWOW64\Chmbeqne.dll	Mkjnfkma.exe
File opened for modification	C:\Windows\SysWOW64\Iojbpo32.exe	Illfdc32.exe
File created	C:\Windows\SysWOW64\Ilqoobdd.exe	Imnocf32.exe
File opened for modification	C:\Windows\SysWOW64\Fpjcgm32.exe	Fjmkoeqi.exe
File created	C:\Windows\SysWOW64\Oajpfn32.dll	Hpabni32.exe
File created	C:\Windows\SysWOW64\Jebiel32.dll	Nenbjo32.exe
File created	C:\Windows\SysWOW64\Ggpenegb.dll	Pmlfqh32.exe
File opened for modification	C:\Windows\SysWOW64\Gmggfp32.exe	Gpcfmkff.exe
File opened for modification	C:\Windows\SysWOW64\Jpdhkf32.exe	Jnelok32.exe
File created	C:\Windows\SysWOW64\Didmdo32.dll	Iojbpo32.exe
File created	C:\Windows\SysWOW64\Bakgoh32.exe	Bhbcfbjk.exe
File created	C:\Windows\SysWOW64\Kgkfnh32.exe	Klfaapbl.exe
File opened for modification	C:\Windows\SysWOW64\Mcbpjg32.exe	Mcpcdg32.exe
File created	C:\Windows\SysWOW64\Hdokdg32.exe	Hlhccj32.exe
File created	C:\Windows\SysWOW64\Cleegp32.exe	Chiigadc.exe
File created	C:\Windows\SysWOW64\Gfjkjo32.exe	Gbnoiqdq.exe
File created	C:\Windows\SysWOW64\Eadhip32.dll	Cocacl32.exe
File opened for modification	C:\Windows\SysWOW64\Gblbca32.exe	Gnqfcbnj.exe
File created	C:\Windows\SysWOW64\Pfnmog32.dll	Gejopl32.exe
File created	C:\Windows\SysWOW64\Dlkbjqgm.exe	Dimenegi.exe
File created	C:\Windows\SysWOW64\Jhdnigno.dll	Idkkpf32.exe
File created	C:\Windows\SysWOW64\Hhihhecc.dll	Bohbhmfm.exe
File created	C:\Windows\SysWOW64\Glipgf32.exe	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Hibjli32.exe	Hfcnpn32.exe
File opened for modification	C:\Windows\SysWOW64\Hifcgion.exe	Hfhgkmpj.exe
File opened for modification	C:\Windows\SysWOW64\Akblfj32.exe	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Fmndpq32.exe	Ffclcgfn.exe
File created	C:\Windows\SysWOW64\Kdbjhbbd.exe	Knhakh32.exe
File created	C:\Windows\SysWOW64\Akcaoeoo.dll	Ekmhejao.exe
File opened for modification	C:\Windows\SysWOW64\Ifomll32.exe	Iikmbh32.exe
File created	C:\Windows\SysWOW64\Boenhgdd.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Ckgohf32.exe	Caojpaij.exe
File created	C:\Windows\SysWOW64\Dhbmpk32.dll	Dmoohe32.exe
File created	C:\Windows\SysWOW64\Mimcmnpn.dll	Aolblopj.exe
File opened for modification	C:\Windows\SysWOW64\Gpbpbecj.exe	Gihgfk32.exe
File created	C:\Windows\SysWOW64\Jjqkamhk.dll	Bjpjel32.exe
File created	C:\Windows\SysWOW64\Hbceobam.dll	Nccokk32.exe
File created	C:\Windows\SysWOW64\Jmpjlk32.dll	Mcpcdg32.exe
File opened for modification	C:\Windows\SysWOW64\Dpgnjo32.exe	Dlkbjqgm.exe
File opened for modification	C:\Windows\SysWOW64\Jpcapp32.exe	Jmbhoeid.exe
File opened for modification	C:\Windows\SysWOW64\Akcjkfij.exe	Achegd32.exe
File created	C:\Windows\SysWOW64\Dbqqkkbo.exe	Dmdhcddh.exe
File opened for modification	C:\Windows\SysWOW64\Gmimai32.exe	Geaepk32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9548	9460	WerFault.exe	447

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmlkhofd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbelcblk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cobkhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coknoaic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdaociml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnfnlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkeldnpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfjkjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnifekmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfohgqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbdgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoiqneg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bakgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geaepk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdemd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgbefe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iojbpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcnmin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjdebfnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfipef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnepna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekmhejao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiaoid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glldgljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iknmla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnahdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imnocf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjpfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpfkpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdhedh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icknfcol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpmbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpmld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckmonl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipjoja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoheakj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlkbjqgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpcfmkff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nelfeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alelqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmdhcddh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnnjmbpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jinboekc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohcegi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebjdgmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knqepc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iikmbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgcqab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emphocjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjdaodja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmpkadnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpnoncim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcbpjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpjmnjqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knhakh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qoelkp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elgaeolp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbfcmhpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpjcgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkgpbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldbpfio.dll"	Ennqfenp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akcjkfij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qklmpalf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hknkchkd.dll"	Gpbpbecj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bljlpjaf.dll"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipmbjgpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Fbelcblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmlfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajpfn32.dll"	Hpabni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjgbadl.dll"	Lkeekk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjieo32.dll"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgdkaadn.dll"	Cfcjfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckbcpc32.dll"	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkalplel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbpajgmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Achegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcahmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djhimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdmgfedl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Neclenfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omjpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nadleilm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojajin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occmjg32.dll"	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bblnindg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccbadp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfdcegm.dll"	Ggahedjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmaopfjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlgjal32.dll"	Bebjdgmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djjebh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijegcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qoelkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfnmog32.dll"	Gejopl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jinboekc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gicbkkca.dll"	Kkeldnpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkjnfkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkicbhla.dll"	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bopocbcq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fechok32.dll"	Ojigdcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfjcc32.dll"	Iikmbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmggcl32.dll"	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqkiok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjoqncg.dll"	Achegd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eplgeokq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4048	3284	f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8N.exe	82
PID 3284 wrote to memory of 4048	3284	f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8N.exe	82
PID 3284 wrote to memory of 4048	3284	f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8N.exe	82
PID 4048 wrote to memory of 3932	4048	Achegd32.exe	83
PID 4048 wrote to memory of 3932	4048	Achegd32.exe	83
PID 4048 wrote to memory of 3932	4048	Achegd32.exe	83
PID 3932 wrote to memory of 3052	3932	Akcjkfij.exe	84
PID 3932 wrote to memory of 3052	3932	Akcjkfij.exe	84
PID 3932 wrote to memory of 3052	3932	Akcjkfij.exe	84
PID 3052 wrote to memory of 1096	3052	Alcfei32.exe	85
PID 3052 wrote to memory of 1096	3052	Alcfei32.exe	85
PID 3052 wrote to memory of 1096	3052	Alcfei32.exe	85
PID 1096 wrote to memory of 4460	1096	Aoabad32.exe	86
PID 1096 wrote to memory of 4460	1096	Aoabad32.exe	86
PID 1096 wrote to memory of 4460	1096	Aoabad32.exe	86
PID 4460 wrote to memory of 1612	4460	Abponp32.exe	87
PID 4460 wrote to memory of 1612	4460	Abponp32.exe	87
PID 4460 wrote to memory of 1612	4460	Abponp32.exe	87
PID 1612 wrote to memory of 1800	1612	Bjicdmmd.exe	88
PID 1612 wrote to memory of 1800	1612	Bjicdmmd.exe	88
PID 1612 wrote to memory of 1800	1612	Bjicdmmd.exe	88
PID 1800 wrote to memory of 4128	1800	Bcahmb32.exe	89
PID 1800 wrote to memory of 4128	1800	Bcahmb32.exe	89
PID 1800 wrote to memory of 4128	1800	Bcahmb32.exe	89
PID 4128 wrote to memory of 2172	4128	Bljlfh32.exe	90
PID 4128 wrote to memory of 2172	4128	Bljlfh32.exe	90
PID 4128 wrote to memory of 2172	4128	Bljlfh32.exe	90
PID 2172 wrote to memory of 4540	2172	Bbgeno32.exe	91
PID 2172 wrote to memory of 4540	2172	Bbgeno32.exe	91
PID 2172 wrote to memory of 4540	2172	Bbgeno32.exe	91
PID 4540 wrote to memory of 1464	4540	Bkoigdom.exe	92
PID 4540 wrote to memory of 1464	4540	Bkoigdom.exe	92
PID 4540 wrote to memory of 1464	4540	Bkoigdom.exe	92
PID 1464 wrote to memory of 2192	1464	Bjpjel32.exe	93
PID 1464 wrote to memory of 2192	1464	Bjpjel32.exe	93
PID 1464 wrote to memory of 2192	1464	Bjpjel32.exe	93
PID 2192 wrote to memory of 2152	2192	Bblnindg.exe	94
PID 2192 wrote to memory of 2152	2192	Bblnindg.exe	94
PID 2192 wrote to memory of 2152	2192	Bblnindg.exe	94
PID 2152 wrote to memory of 4668	2152	Bjbfklei.exe	95
PID 2152 wrote to memory of 4668	2152	Bjbfklei.exe	95
PID 2152 wrote to memory of 4668	2152	Bjbfklei.exe	95
PID 4668 wrote to memory of 5060	4668	Bopocbcq.exe	96
PID 4668 wrote to memory of 5060	4668	Bopocbcq.exe	96
PID 4668 wrote to memory of 5060	4668	Bopocbcq.exe	96
PID 5060 wrote to memory of 1372	5060	Ckfphc32.exe	97
PID 5060 wrote to memory of 1372	5060	Ckfphc32.exe	97
PID 5060 wrote to memory of 1372	5060	Ckfphc32.exe	97
PID 1372 wrote to memory of 560	1372	Cobkhb32.exe	98
PID 1372 wrote to memory of 560	1372	Cobkhb32.exe	98
PID 1372 wrote to memory of 560	1372	Cobkhb32.exe	98
PID 560 wrote to memory of 1804	560	Ckilmcgb.exe	99
PID 560 wrote to memory of 1804	560	Ckilmcgb.exe	99
PID 560 wrote to memory of 1804	560	Ckilmcgb.exe	99
PID 1804 wrote to memory of 1240	1804	Cfnqklgh.exe	100
PID 1804 wrote to memory of 1240	1804	Cfnqklgh.exe	100
PID 1804 wrote to memory of 1240	1804	Cfnqklgh.exe	100
PID 1240 wrote to memory of 2212	1240	Ccbadp32.exe	101
PID 1240 wrote to memory of 2212	1240	Ccbadp32.exe	101
PID 1240 wrote to memory of 2212	1240	Ccbadp32.exe	101
PID 2212 wrote to memory of 3628	2212	Cfcjfk32.exe	102
PID 2212 wrote to memory of 3628	2212	Cfcjfk32.exe	102
PID 2212 wrote to memory of 3628	2212	Cfcjfk32.exe	102
PID 3628 wrote to memory of 2420	3628	Coknoaic.exe	103

C:\Users\Admin\AppData\Local\Temp\f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8N.exe
"C:\Users\Admin\AppData\Local\Temp\f76688af47d6cb29c4accae99cc3c907af1cff26354d8e2dc2c0f138c21225a8N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\Achegd32.exe
  C:\Windows\system32\Achegd32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\Akcjkfij.exe
    C:\Windows\system32\Akcjkfij.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\SysWOW64\Alcfei32.exe
      C:\Windows\system32\Alcfei32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3320
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        25⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        26⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        27⤵
        Executes dropped EXE
        
        PID:1900
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        29⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        31⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4376
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        33⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1632
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        37⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        38⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        39⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        40⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        41⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        43⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4924
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        46⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3836
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        48⤵
        Executes dropped EXE
        
        PID:804
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        49⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        51⤵
        Executes dropped EXE
        
        PID:2664
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        52⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        53⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        55⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        56⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        57⤵
        Executes dropped EXE
        
        PID:4876
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        62⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2164
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        64⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        66⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3032
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        69⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        70⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        71⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        73⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        74⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        76⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        77⤵
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3724
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        81⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4092
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        84⤵
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        85⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        86⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        87⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        88⤵
        Drops file in System32 directory
        
        PID:1548
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        90⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        91⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        92⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        93⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        96⤵
        Modifies registry class
        
        PID:4728
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        97⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        98⤵
        Drops file in System32 directory
        
        PID:3092
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        99⤵
        Drops file in System32 directory
        
        PID:3692
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        100⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        101⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:400
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        103⤵
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        104⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        105⤵
        Modifies registry class
        
        PID:3308
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        106⤵
        Drops file in System32 directory
        
        PID:2140
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        107⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        109⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        110⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        111⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        112⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        113⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        114⤵
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        117⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        121⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        122⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        123⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        124⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        125⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        127⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        129⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        131⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        132⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        135⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        136⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        137⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        139⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        141⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        143⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        145⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        146⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        148⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        150⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        151⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        153⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        154⤵
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        155⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        156⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        157⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        158⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        159⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        161⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        162⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        163⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        164⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        165⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        166⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        167⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        169⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        170⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        171⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        172⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        173⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        177⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        178⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        179⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        180⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        181⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        183⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        186⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        187⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        188⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        189⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        190⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        193⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        194⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        195⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        196⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        197⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        199⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        200⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        201⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        202⤵
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        203⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        204⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        205⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        206⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        207⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        208⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        209⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        210⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        211⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        212⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:6604
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        214⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        215⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        216⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        217⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        218⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        219⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        220⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        221⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        223⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        225⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        228⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        229⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        230⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        233⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        234⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        235⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7728
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        237⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        239⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        241⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        242⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        243⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        244⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8080
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        245⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        246⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        247⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        250⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        251⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        252⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        253⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        254⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        256⤵
        Drops file in System32 directory
        
        PID:7904
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7916
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        258⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        259⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        260⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        261⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        262⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7356
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        264⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7460
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7744
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        267⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        268⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7892
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        270⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        271⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7204
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        273⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        274⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        275⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        276⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        277⤵
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        278⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        279⤵
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        281⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        282⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        283⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7384
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        285⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        286⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        287⤵
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        288⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        289⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        290⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        291⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8260
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8304
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        294⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8348
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        296⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        298⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        299⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8612
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8656
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:8744
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        304⤵
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8836
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        307⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        310⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        311⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:9140
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:8196
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        315⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8332
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        317⤵
        Modifies registry class
        
        PID:8380
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        318⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        320⤵
        Modifies registry class
        
        PID:8608
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        321⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        322⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        323⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        324⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        325⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9020
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        327⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        328⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        330⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        331⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        332⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        333⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8772
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        335⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        336⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        338⤵
        Drops file in System32 directory
        
        PID:8060
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        339⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:8536
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8708
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        342⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        343⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        345⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        346⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        347⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        348⤵
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        349⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        350⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        351⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        352⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:8916
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        354⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        355⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        356⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        358⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9408
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        360⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9460 -s 400
        361⤵
        Program crash
        
        PID:9548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 9460 -ip 9460
1⤵
PID:9524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abponp32.exe

Filesize
232KB

MD5
b9c8e54a8693346d7ae930824550bd22

SHA1
39af16b56a3e58619aa0450822549bbc0297f0e6

SHA256
d4fe3fa0fcf791ec57e022e3c4d957981c0801378252cccf9439da1db63daa25

SHA512
0f6bff8a079a9ccf1a1bbbd07fb4647cf5b62e0342d27e25de91c1cb4e4e906af1982befffd53c0dfb09c8f2b73e43476c7360824bd94336acf50aba14b767f8

Download Submit
C:\Windows\SysWOW64\Achegd32.exe

Filesize
232KB

MD5
6c23bbc6e6dd4ae574b4f5bc2114ff74

SHA1
c77d75dfb0c6b5e3e8a7e64b6fac3ee50de207dc

SHA256
67b98dc957f8c86ffe82a4e6206263a39080e62d300d24343f0d59b209de937e

SHA512
31e968b9c8723ab75fc17611d24c49077660b897e999dc3325bc0dae4f288eee5b26f793bb92f707e5ac46e03d71368e331b364e2cfda46008322a114110e410

Download Submit
C:\Windows\SysWOW64\Adhdjpjf.exe

Filesize
232KB

MD5
7f0c2db92f6b4d4eee45ddd22bdc83d7

SHA1
c013f15393c1302e50cd9d0b7e69bbfe8c05a851

SHA256
4b3e1bd6ab0da421dc266ec6f66d7098ab04c313cf34ffbe6dc8d5351e5e094c

SHA512
4ade51a34e349e722d4b1ca395e9c1e7285725966af9a909278a52242f36524d1542ab1043fbd702eddd18b924fb1d3bf0c4b059e5b874439b7f547ed3a7a626

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
232KB

MD5
8c16d483ce5ff77e8e9e2b499969813d

SHA1
5eba67ae077dbef8422f2d4d2eee1ecb99c98e29

SHA256
1c24167943e67b86d85dc2c2057fea9cd715b7863c5c308f4a79e0ab47e6ac79

SHA512
9cb9c68c9870bb79a7efe95d15aa9bcc59195cea8194da3a1f0a341185b84d6e5cd153a7a6fb627be894f4a6cfcbd7a1475399311ce4f5e029c3387b0ef20b58

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
232KB

MD5
02583f6d458ed4dc1ac3daa65ee4377d

SHA1
d9fdc9154395ca3e732be5dc92addfb8ffa4a5d8

SHA256
21c95dd426e2eb9d76f2314aea03b86ffec8563eb6ba02624754f2a06721832b

SHA512
75d8590654e1bb805e0f4fc2ff79095a7389407c578238698336d3ac9785180d282110bb066fcb8e2927ed136a8ef92b6c289e2660132e01138187fc546486fc

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
232KB

MD5
725a2606f26ccb796c6a41a48692cb29

SHA1
44a5570d879f1f0494451c03b32a571012db6c38

SHA256
18e5caacdaebc209f77ad5cec7bf2442c4c558d3979118b866ea1da5b194f5cb

SHA512
5d5390d1581a1230faf75ff7f774e819edb1778a32fe161513a3e81b48588b8d342858dc06d8658e97649cf9f78c66f07f0933a4b4dca92f2c123158e5b58068

Download Submit
C:\Windows\SysWOW64\Amjbbfgo.exe

Filesize
232KB

MD5
b2f422fb5f8bd34c37632452235cc3b5

SHA1
58fdbf0f56f61e0f34843f7f1584946fa11dfcd4

SHA256
14b99e79d7ecfd5cf2a05db8cde9f1b35a09c004fe01f5eabd9083cc10d5c935

SHA512
c982a0160f47a9c93703702d8baeabc35f70f9875f02ce8b04b68ce8712c264d2fbc9a07b90c48184ea2aca07818a24e0dd2555fc3e13bbe2777d76e222a3744

Download Submit
C:\Windows\SysWOW64\Aoabad32.exe

Filesize
232KB

MD5
4086bda8f93f5c4a704e11e2340b6676

SHA1
32414e607aabd9618f28e23edffef4921551736e

SHA256
549f25601fbc021fc59a96e2b3157d660cc0f6c011bcb5bf86415f8880af15b0

SHA512
4ce042e686317575572a96f813b4373bfeb4f8374184175de81e9ba5c215e3b1434140fe6945ebf1e1ba200e3cb78338db9cb2a5013b3a0b08fd6c689f97cc0f

Download Submit
C:\Windows\SysWOW64\Apodoq32.exe

Filesize
232KB

MD5
1337f143588ef0c014abf9fba6807b1d

SHA1
d5afca7d2d5b70b36588a0c9ce57591888991497

SHA256
eb6cd9d248f81f5a6f9e38f9558460ae7af0de7a74f9498af42f501567a33944

SHA512
2a3c9e5b5f0ab9e954af888c31dcac257bc41ce074e6b093d27eea4dae4706d3088c8afd688034723e558e44c5580d9cae5bec4c3689b645017b64cccf49ca39

Download Submit
C:\Windows\SysWOW64\Bahdob32.exe

Filesize
232KB

MD5
29544e65d932105743398b549c1b4b15

SHA1
f7658f9260337e2a5a23cf8d48d5c797fae6a951

SHA256
fb0fafb003629be60b59e9ee2676526bdb0286351ea86e867da7ada391d57139

SHA512
162bb5121bac6f73352ea66925c5720b8979a8920f3beb5593d5e196adddc50767291f731924201420fd13534a033ceb9405dd7dfb5b29273e9da8bf71b88d4e

Download Submit
C:\Windows\SysWOW64\Bbgeno32.exe

Filesize
232KB

MD5
23c34f152faaaed1c9267e5bc894532d

SHA1
599af222e33df988fb4af0e01e39cc9b0d6f33a8

SHA256
53b1b25bec764ad1d7b0dec9d66d4fa6b188d3cc3ddacf2451b6fb1362189d48

SHA512
bd912e1def3899e11cb6bc08d868943ccadb37c6c4c673f81ed8608e9a639a5871afd95de0bbe7e207888bf525954fe654f0a7cec9b773ba75b369ce3c02afc7

Download Submit
C:\Windows\SysWOW64\Bblnindg.exe

Filesize
232KB

MD5
2e7ef3be0acb4947b5c689d5ecbab85b

SHA1
176166f95de7262058e0470d4db7512a4e715c2c

SHA256
03a3b42499452b66df0c229c77b0ca05d5abab88fe7dd5dfb963073ccba07162

SHA512
a08e47ebc6694946cf0713ae20d1adf04fedcbe1f6321b50acb7fdf338351809680ddc65c62caa6049d064041c2a90bb8683b4b8b28fe068a5ae1fc41a31b169

Download Submit
C:\Windows\SysWOW64\Bcahmb32.exe

Filesize
232KB

MD5
8479d6de2f4de10dc07b00742477ebe6

SHA1
b4eb54131730187f0c74b6350a8828ccb0c463fc

SHA256
3768246e2cee6979c1909bfc37519f20db3568585fa1e5cf5899c56bf677ae41

SHA512
35851685bfbc53462f0c60dcdf240b4ac1f48dc4cc66dd0625ecd133c4ecce74438b2ba1204e6489b181b2fcfd34b14defc5b50075efa25c60ecc6e18bcae057

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
232KB

MD5
8930dcc2e9771a2a11304b1b210c7b48

SHA1
ff347f5d13d613d4b00d046417495eccd7faba8f

SHA256
80ded94cbbf5fc92f1c47f3748a5e84ba66386a82094d90e226614c853bb76c1

SHA512
0e044cd1c82be4beb327da4b6988c4052b7381aba6378e01865cc11fbf82e90bab60a05ccdfa27df012827230fe5314175a25b0ebab05dfdef5bc96ac40c00d6

Download Submit
C:\Windows\SysWOW64\Bhbcfbjk.exe

Filesize
232KB

MD5
fb2a2059525482b61157212d71cb2873

SHA1
68279a9c60257a0eb30e1a93e51143b0e97a0270

SHA256
bb021986acffae90d215f26bd9c02e28dc4a06e5d9cbc793c42acd4bd523c37f

SHA512
5563f326a6e1e3eddbd807f087cb47afc3832a804b3cd2d98d8023fb7d2a187ee1badf792aeb6c6f35d894bd06edab401a2781ad024295e029c848f610a76e02

Download Submit
C:\Windows\SysWOW64\Bjbfklei.exe

Filesize
232KB

MD5
e5e07c49b2a90514c239472db755da69

SHA1
3b8a0ef872da7fb08397a8c9a5e3271b1087396f

SHA256
d1bbc0eb6eb71c7d51f7bde8b12e7994e18755fc6f3d3849d58a960d9f93727c

SHA512
538d3dbe2329dea44aac7f0d5c86d10604be4392cb20c3544e1043ff58577f6deac898a4f6683a509d073980b9cea29bb0073480782f01e1cef29658a970dfbc

Download Submit
C:\Windows\SysWOW64\Bjicdmmd.exe

Filesize
232KB

MD5
1aa0fc04c3b2b4a744ced6c49a8dd242

SHA1
5f1239468c66aab8245522e649a33bb1f7261584

SHA256
aec61d1b9a61d9ed61a6881e0c8b2dd81d1b2ae098770cbe251816713e1bce11

SHA512
2dd3f86b8a07479a4fd4c38278f5bee9af347d81b3ab6a08243caf13d4be6005b24b53f81e09b75643a2d701fc887ce1af20e06cd8653d95b10fdd7f52a4dddf

Download Submit
C:\Windows\SysWOW64\Bjpjel32.exe

Filesize
232KB

MD5
702835f63e929bc020cb7f066009c550

SHA1
63a7ad12bf6f4f42e5e61058c40f0b5c293d26ed

SHA256
482f09d5c9d1cc9b82c724ddb9ffee657a2ea175db6df8619ec2f3b59ddcb69b

SHA512
85df1b82b58251ebfd3e4c14a4b4c7e210c6bda676eaa76894672e2267e52b0bcad26d90d06537f873f336f4bf26e8c835f1fb98542e499f5b575e24069502cf

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
232KB

MD5
fe545ae73b57a28297ed0e36c35c2cda

SHA1
1af99e87b03107c5df7fb31c08bb9ad494170316

SHA256
4b1724ff7f067177551c6803a61274a725c7cd7de67e71b3ae2c9d9a662b7a73

SHA512
d6befe7d2faf095f86f3c40e22b0a9a2a4f70608dc0ec216205e8766a5127a595f83d6c445558dc71876fd2c5701ebad3175f23ab4dce7c35d7cf04da74d14a9

Download Submit
C:\Windows\SysWOW64\Bkoigdom.exe

Filesize
232KB

MD5
124bf4e5324def7fe702035bb9f4d1a9

SHA1
d98c231ae6fdf6b1558d3b9905d32a2f56fb7405

SHA256
49fcec16a19a4af33850da1afa07482deb2a92a964d8655270c72fb1f299d5de

SHA512
9e8394663a77bc7059b13b500dd8a14c8509b4f1ee22ee5c7c08bf19ee215e00eaa8a90c0de6bb376cd35191bcba5315462d3209219da519162446683bdafd6b

Download Submit
C:\Windows\SysWOW64\Bljlfh32.exe

Filesize
232KB

MD5
01a16d1320e8b7082bd99f6b18ff9090

SHA1
03c44316b06cc2dd71e1de6417b9cc25b8d5156e

SHA256
44f7f17dcee9830291d2cf0d71efac22a2bada1c52a9a4436e6ef5124cea7b1e

SHA512
4c693b4c812427dbd1abc7a995616b3415a461545baccaa74ad61e749a59c08e4b15bedad1248d820ea42fdc4658ef0f4fee7783409787cd51fd9c14d0f1e614

Download Submit
C:\Windows\SysWOW64\Bopocbcq.exe

Filesize
232KB

MD5
370fae606cf14106b5840af1a522209b

SHA1
a70c45e2e0262617505e406713339a0dd14292d2

SHA256
65046f30a6dad96ed8ba20f7b4d7e9c1da3685ff1e1e9dd371ac4122cce44168

SHA512
7e7544e69a2948b131437c6b6538b3796b208dada6799ff760b8c1cce419e00a7640320c01e0627ff559e08281c51d7eb08b65e6574ce80f8034d07da70519e2

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
232KB

MD5
29ada431d7717db9681f1c4ae9420ec7

SHA1
cbbfcb4a8e5b3a8e8cca6f2543fad5cd06975378

SHA256
41630baa1b9f47200db0aff30b39f8532080b63546ea3380f1aeacacb8ee1d70

SHA512
8501f6d9f9950a812116af61ad6fc31efa802fab6757f9560712f40fe2aa8b88512f84dba28abb96e25bccc5dfe9ed177e56d4515f78035e1bae97a0e2a4f444

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
232KB

MD5
9ae7b3a2850e37b0ef6d90772395054c

SHA1
bd31bbf5fbf42dbcd49b1daf56444214e91252aa

SHA256
24129eb066cef1d636e4dfacce99d0b08143b9ed8d7de4bb316b758f07ba961e

SHA512
04df9f51eda6d56792605f0debe939731196a07fd97f6d8aa7698d086fe96b50055638ce25d31ece4855eb762559fccf699dde661233920e38b3ec8cdfc41d46

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
232KB

MD5
a8dffe9ce3b623d4e74eafd48bf91ade

SHA1
93e0e80b6433e12127164f3370714e742c582578

SHA256
e9b0412fbd4f2f5863d98a3e3f4dc6abc7c3aca242fdb53b030892eaa3b50e8d

SHA512
76c7fe8f063063cfd041dbbf3c857fb1c441ee0a68396ae0928a149f787c1f8738154f83c4af0971bfc6cd814a4a1ff117b2001184795673fb61d14e83814f9c

Download Submit
C:\Windows\SysWOW64\Cfnqklgh.exe

Filesize
232KB

MD5
0b76625bed3858cfc4fbbface64f9577

SHA1
b03ef40c03bdc28881d2ba3f01385eb4407f6cd1

SHA256
54c4afd399a4806f8b894ec2ab925bf66e1c661d8f4f3baa2a727c934f101d03

SHA512
10cb924d255dd30b5eda870fbf28f73b6e8c3d03ac7ad0dea960e906d3c1966693613471cb79770dfb30bae56f426ecb83d8bdd71a388d3f2b40ecddda56b70e

Download Submit
C:\Windows\SysWOW64\Ckebcg32.exe

Filesize
232KB

MD5
eee40cd5cff09d52881fa6b5f18a3009

SHA1
d24275e22072da519e7f9348c33d1f93f87f79b0

SHA256
c89cee89ea8d2dcb5206251b74558fbea6e750672152adb85084d62623bda3a0

SHA512
6de479020eb17a097340214a0aa6fac94ed49c51b2b53ef744509e867bbf6ae0bccc45c5b59299e77c6da180c4234e44eb58c83ee06e5c4f910882fb48e0e1e5

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
232KB

MD5
58dd66a1cc30e3bf6d7ad5d08cef93cb

SHA1
8f79a8da1c4f318fa73b7df4df76348e4634a72d

SHA256
0b6e8a7d5bc9e5e52e6b9d42e41343941f0388955bca02c6eb07b5e4f00e0d49

SHA512
3e280bce838619712baff13a00407b19e9a363000698938eaa7703a2d73a78245d3fb077ac55a24e483fefd725b718c305d366e5ee86927c53fe68a0c1c235ee

Download Submit
C:\Windows\SysWOW64\Ckfphc32.exe

Filesize
232KB

MD5
a40d43530406e1096b88a60d0c089607

SHA1
4317d682b9d388e8a15dd393ea82f786d3d43e55

SHA256
b70bebac45567bccc1faaa75cc1e164b5effe283d7b79c4a16c8dad0c182b466

SHA512
ca6a7a5d2d6e9104a8a063cbf1c116f53e5115ae029eb19c7eddd865facc156374034a3b3cd7879d894d36ea293fd245e004b4bed2f2654b1f493eeaa6ab43aa

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
232KB

MD5
3445205d7cbcedc8ca3792527d3335f5

SHA1
0d452acb4c304cfe882d17a6a976005f72a2f508

SHA256
ba7a0adb6ccd4b75e0ca2ce0679676ef92c3efa94d08db89ccdb7caddb91a8d7

SHA512
19eee9444897d22c594bf8136daa243a71e7bc4caaef1df7d7dcfe5f718910ef78526664d43842294caef0a5c8a2f4d9a95ae6db7db1786983c01171243195dd

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
232KB

MD5
bfa3e1bc1a9feeb176d425bac0896c6a

SHA1
c7d1452d49b313f64c2908a5c3d3d373e944b5b5

SHA256
07f61e2606857ce011f0dba11d7b4f61a62240bc290ab1ecdb917dcd6a4a491b

SHA512
91fe18b4447260a43898380c615ca6dcab72cfc229bb0ecb28e536d54ad3807f1bc02c4bb44256e32182deedcf4ea43398c8bd9ed6a45ff55dd36ddc8aa68b26

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
232KB

MD5
b803be3bf37e5fdca16b0b4f9151e7b5

SHA1
284cde1e7e23273aa0136f7b2e387cf51b40896c

SHA256
8e257418c139e1dd3f944da3748145aa5370dda79f18bc76ede736b2e371ebb5

SHA512
d473352a36f78fef79a15841821089d65b65d5b0702817be497b9c6a18cc707d97290adc379403f387a2ee94de375d3974e00814afba063572779584c2c8016b

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
232KB

MD5
1732c055c885bc4faa50db73ee548c96

SHA1
11e26a1f1ac5bc287b479b8778be204342734ca7

SHA256
b625d4d44fdb34a2851200c53a62158ea47286c0f465d67a140baa5a33528894

SHA512
72a30bcadbc8f33d45f7018f4ff16074ebe9d37e14302f22b1f3d0072410baa7d8ff0104ea918906455e255a7621e999d4e5a982ece1d242e84e7dae339ddf73

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
232KB

MD5
0dac1c5f2aa80025385d9d139b38784b

SHA1
72fa5c797138845bcae6cb66ae0091589b88665b

SHA256
ec7b148d797017bf3f8646a0a171e0bd782cb6341ec079bcd8787de5a643c719

SHA512
589f1324ca296f5771e7807a0cb228dcab4f0f6acf0c1abb149a4209aaee4678739a5c8c489c2c4adf6923f4f5ddc4cd9acc8b7625146cd58f72737c2579fffa

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
232KB

MD5
8c9e1f8331301346de1576a1d269c921

SHA1
9c56646adf00d4141af8abe2cf7d48cb7531474f

SHA256
513d1eee7e839907f5b8abcf88df5d2c7b6835da3a070f82196689645f6d34bc

SHA512
efac0cdb880c6a11143e010f150675a69324de3dff4ad6d2d4dd40763c374da2fd4f85e0413435692ed406155ecff78dc4f64a88ea92fb84e518028dfb3f658b

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
232KB

MD5
cbd8a21d9b69f6c847e98bfabe601de7

SHA1
7b87886e5e5b366ade009144bbc6cba9950568af

SHA256
2dbfa4db478ba2f9ed04242c8bcc3395a5c56b66e634e91ce8f78ca111780538

SHA512
54d6319c0a26e251c1f05ec74db10dc66df1547fe248f6a5db760a4f2e1d2bce04cb53b6b63c3a37b9a090798c2e7d9783015d3f5e296c28c588a858a625a90e

Download Submit
C:\Windows\SysWOW64\Djelgied.exe

Filesize
232KB

MD5
661f6ab86bc3f2ad2ab379cc0ff7c653

SHA1
ad3c0733ddee16f65250d58bd6773c935732700a

SHA256
84ce3ec449850f6856c1aaa554e73f4c95b8af197bc1ccf218688139da7b6e11

SHA512
60e5a5a76693704fc415d36f0d426b365baf9f369d8e4f7c3b07b11aab499e0beee7a16e167728761825c6e02aec010e007a2b4279d16b43690949c4dd90ee08

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
232KB

MD5
6297ab9c80a6c17eae3c06f3a2074219

SHA1
6c4b0c0a11fca4a238be1396bdee2be731cf1e99

SHA256
c3693461d74b7b9246b3c4dccd043aa809b1687e4da1b9092bb8e00323a4705c

SHA512
af34de3664b3aee673027bb33cb798b4d024b59a23ace72805302bceeeada536983d718f7488600bc567e5f8bdceb44988be49cb24666aac00b3727cb19a4abe

Download Submit
C:\Windows\SysWOW64\Djqblj32.exe

Filesize
232KB

MD5
0bafcd9a16d24ac3a75f059a1cbf8dd0

SHA1
02b182360498aa9e3c4a163b83da130d00fa6319

SHA256
a3dc2928ab5d803beca9fdcd1c01eafc6e443376a6bdf12b509021043d1e30a3

SHA512
33d7a0d842cb6b32895a4999fe24bcea7cf63a49a5235b6354908ab96c0e0facea88a6ea1793499e8aa49329a70b1e17fec155bd7bd2966ed0645b737818a288

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
232KB

MD5
aa4ba36e403c035cd2be56c7ed62e755

SHA1
0eaab4c8b0e78f82f277698381c37cc58c34e290

SHA256
bf0b76e74ed95a6196e77ec1cabfbbcad90e2648708bf12bf3c9133f376adf5e

SHA512
c2f658ce8553f12733abf98752c0aff5f6374d3230b27469f6007aebeaeae80de41f20a09c8ca0b6e6773518bdd86e074a34aad1766c9673bbc6e8186ca7ca92

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
232KB

MD5
134ee55852fd7ee3301b26a52149b7ab

SHA1
392b2b1d01f20566096a07b9bf67b5a9d109da61

SHA256
daf319f778c12e0d6459280a423e337578ca561b44e6e5550bfab7ab765f0d46

SHA512
92693e1295731d52e92817f38a316f17b5faabd03bfb98841a179b54070a0e5ef24828f30cc71ddc038c6b581977394d41a9c73d39982bb3fda5a65de6d33d12

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
232KB

MD5
0229f72c5ef08d080fa0df4029efc258

SHA1
f9a47d31c2bfe5076d4998b751c7e96d4c1a7d50

SHA256
f1f55c8a89681edf9342ad3b2978a23a9b9fe886132edcac8c36faba2343a31b

SHA512
050745bda121ab7454c25add3ecf5551d2f863a3bbf31b6ee0184e5320c74562cba6da405871a799625ef68b5657498ae5c9b9f040df7a5dc8ed4c5cc4131baf

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
232KB

MD5
176ce0bf8a3df92305090947a1ab8e22

SHA1
ee4cab051944496d6443c16131c727e5d1554fc8

SHA256
fdb6cbbf669d89029a87c847c19c9bccfe0b6c1be9f714d3cc103d4ee98f5f10

SHA512
e2472e4f25cf660a8411c808a56914b88580b0dc109391e4480fad7e0e7643d18e2476094e58b14dd0df8e36b00c051847d793d18d5b85418cf6a202b2392775

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
232KB

MD5
4d69d2e518abad3651129fb79240bbd1

SHA1
004641c4ea960d382f7575bfdf037413781d7199

SHA256
aa47f933731ec20267fb0f1c9e7b84351f306d1a3f878c636b3fbb8b43a8eee3

SHA512
0f538243acf22fad851cf5c25e33073f3361e7da8522a89e1fd80086b3f12766d794f22084e065677b0674d988ba26180dbc3c484058cff0051606c299c03b09

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
232KB

MD5
39210acaa18321a0f6a2badfdf6585a3

SHA1
b241e4db535111a4ac2634341215252122584982

SHA256
37c42829b8e209953b5b2aadf397973f6023e50d31c6113da2ccaba455784862

SHA512
6c9435493df7eeafa662a91c1c7373346fb267f350ad222111f2c1714411acf3972657caf0aa0bdd74a4546eaf237a544709015a012248b5f73f83e54e599b0c

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
232KB

MD5
e4a951a3ddb1fd7c2677a9eed8b3f81a

SHA1
57ad9654e2d855f3b55126f877683b72e4b94ee4

SHA256
5f5a9d98e7ccfefdb0147fd83fc52de4a0d8008408fbec1c33b41ead3678c27d

SHA512
31274eea2b9b58d7547c109052bb12ec3b91593e44b34db21512df208cf9d31eb08f2300dd42c3fa481c06a23a42a7485b59dcf124a005f4e8504e80abc31057

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
232KB

MD5
6c00179c151928097c1edd4d2ff98689

SHA1
9857d8dc435e5f98851f944831e4ddfa3520dbcd

SHA256
76a38e4bba39e9df91a75288258c6dc2b81f248b57aadbf365613f05d2b83fd6

SHA512
a36a59ba7449a6ee9431c428e28ff8014f6799732ef2af8df276365ac426fd7a60cfad27ac2e323e9369631785fcd3b7d8acd2a3c041e7836c3beb183a9db38f

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
232KB

MD5
208236b7b6b329011c340bd87beac353

SHA1
e3bd81f646ec0394ca9a3cd9365a603f7288666c

SHA256
2023338975c3ba45566ce6f2e52e3a691bdc3f9708b6140668d83ced0411994f

SHA512
2dbb690c35e329a1b20f20eabb4961cff326782bbd1aac8bef98384434b981c2f5a13280a9713d1f231fa3378aa739bbe84d3b3a9d4c99079545910ef336b581

Download Submit
C:\Windows\SysWOW64\Fbjmhh32.exe

Filesize
232KB

MD5
09bbf2c5be880b1712f74ad78a2f0019

SHA1
656f35fc06eb2abedcf90fb38a5aaf68962c969f

SHA256
fdff20708bdfb3fe523ace8052f2ce845cb833b6f63ab0735a3cda065c349882

SHA512
521cf0864c86582de5340763ba93dab0d069f39bd40a551c993718fb6d212c0913a00a56fff068e735e34f19bc5228ec4adba5140ce4d4a7d8573b7e0e2a8c47

Download Submit
C:\Windows\SysWOW64\Felbnn32.exe

Filesize
232KB

MD5
50f9040a5fa81394397348b474391176

SHA1
39c825c3c8f10aa1809d91a8b6cdac46be3380f5

SHA256
44692e8dd65e2fa1d7a3987e8ffee5aac8c6b1b79e03655ff2c0f4e665114a32

SHA512
63c4ce72950368347c791039897e53fbe8a7b1479647756304a3db614b0b57e42955821734e4f47f5a73135780f80f08e9f54be14810d91a79c5418c2bc84517

Download Submit
C:\Windows\SysWOW64\Fikbocki.exe

Filesize
232KB

MD5
0b6d08ebae3b731fee3f138161d7a224

SHA1
58966a74dbe91d704f9542da0fd916f900a81901

SHA256
8cd159c4e905578e7914d3c15dc4739d391bc87350a1c9cee872bb1ecfb7a124

SHA512
b197cde03b6291b088ec7b80ab0558631721706b4d845bf3b477164c2a71b1050b7dc4ecbdd1faa90463cc95966ee326e7554ef685cdf4616c5e2487a6bbf3b6

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
232KB

MD5
18b09eb62a1cfb57e25f97399c52e8fa

SHA1
3c292edcde112c8391f6b5dd1f513acc6ce0d8ae

SHA256
00b296238ef854a0f3175bdb40531875b71d605aedafac97c8e40f3be4b1f2e4

SHA512
10935c98ee6a27470b74371281b293119daf1e52a1cf04f6552c154be9d0a47a2f44d81213d816419ee5a4adb32cd8f58cf650137ab13a062c6e4877a05ccb49

Download Submit
C:\Windows\SysWOW64\Fpjcgm32.exe

Filesize
232KB

MD5
1f20c6d838b7bcc1397c013fd6335b6b

SHA1
612247b90ccf645cac45cc899f9d7b5e96dc0201

SHA256
067f47e42c0c56acaea874f755dd05e43a400798997c2a3513ec3da42152e626

SHA512
cedc765b5b20613517851b5125002cf819bd864a3dce25f6543b1391a07b3962f9f5c18e53ac35f2e45544a3b01a7ebfec353d43e46bcbcf7aa53f5d8c00e841

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
232KB

MD5
25ddf6d2ad77377b51a0cdf2eefebde5

SHA1
66d8d8a9f4c13549ba1c3bc0c75ccc6321b7df65

SHA256
453db3cda8721927fcf1dc9c1f2b9c972a23174d72b51c5ffad4579625e98f22

SHA512
9bae7edf5c76b73a942635b7ee42ed9d7ac89b32e4c96b146cebc4dbeaa0088a635716c315bee7c3f9847ece078e09643aa32925cee8762d8ffd3328be1d2e31

Download Submit
C:\Windows\SysWOW64\Ggahedjn.exe

Filesize
232KB

MD5
a805464bd47cace6e8d772228f998f45

SHA1
ad834b172f0b1a5471a7f2447275e35bebeb982f

SHA256
ad49a43acc3f66411f7a320f4d9a63d87888f0155a706f7f70104ff0550b78aa

SHA512
ffce64e8df94dc6f67b0333684130ff956a6efad1ad5e22e8e1b6e5ae747c63fdcf6bf47ed95486bc5b5dbd1653e9f7fd6ed9526e7f13aee724bc4edc05ec3fe

Download Submit
C:\Windows\SysWOW64\Hdhedh32.exe

Filesize
232KB

MD5
db4c89959915a5b060f6051788244a7a

SHA1
15910131b0ab8465c51a000889584f205d48e34d

SHA256
b41d0c9f39c370c1b906808765ec2df0ac40b94e6e6eea4b2d56fb53ae684b92

SHA512
350f98e282b00ea2b74bb64208682fcb8dc97dbe59ff2d0a5d6f2a987f3863303df79e147b73ea6391dafee3e8412ce155c2df10f64bf5643e094965659d1ffc

Download Submit
C:\Windows\SysWOW64\Hfjdqmng.exe

Filesize
232KB

MD5
e57698e1910121bc4de84a8df13305f0

SHA1
e1fa327180a5bfa4eadf1f386f5d4baf6bdee09d

SHA256
8999eed72e09901727cf4a3d49f4782d5266bb094157c508175325ca4655ef3f

SHA512
fb81422152763d2dc450f6f70ef9f5862bb97c9045057b2cf1a22a645d18e0d117c75989236dbebbbaf2a71aa5ddcc7338453aa57b1e9b400145bc4853346371

Download Submit
C:\Windows\SysWOW64\Hmkigh32.exe

Filesize
232KB

MD5
9b4ce6f2eec54f0d18af71346634dec8

SHA1
facbcc84d66acc40637ade8e11e34984fb2e586c

SHA256
74ef45f9305f92b76045c43ac2612d5b5dbab123e7ac795a2a508cc73b47b426

SHA512
c083e64c38189f245778111ed6141343205feeb0decad1a86f3d0ccbbbac19a1c97490274c6336f61acc2736bd0fd273a54c6bb00f492cf11fa50a085c511b4f

Download Submit
C:\Windows\SysWOW64\Hoobdp32.exe

Filesize
232KB

MD5
0ccb8cd2d417a0592ddc108443d56c15

SHA1
8b37e1dd1e604e4d69a3bd256822f07f538f4001

SHA256
eb988c1ef1be5d5a1980050288aa3dc9e0d7dfd25cf8c7eb0b11c4159059ebb2

SHA512
bea9b3c4df19a7e03c42d3cfc3b948bbfeafb9bc9000b4b5bb53d3968fe60ad7f427a1b9e43ece4b2a5b8066a8761422efbf75f09ed16a593ed4f21285c02bc0

Download Submit
C:\Windows\SysWOW64\Icknfcol.exe

Filesize
232KB

MD5
ff3d8e1b9dd03c65d4b39e10dbfd35d5

SHA1
0713fb3da8c111b5737aaba94ba37c1d7ccf605b

SHA256
8788c76857f3c61327e6098fdaf9d2ea25c57b99a02de7fca285d43cd2fc2d21

SHA512
8c4c3a04ab46c7f7646fab82ec0a64874be3e1581f1acaf8e59714d957ea388d032ba8612c961c4c31de548cec7e9092d78e0e89852bc74aaa68e16770a02990

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
232KB

MD5
b07c916e29845461e47bdc6fa45a0135

SHA1
410ff1024a5d788e7d9e767951729f47e21eb88b

SHA256
b7f0cecb00421c5938f15d9259d00dfc48f26b76e1a85f989710218337f6b5aa

SHA512
7ebcaec50bb9fa63823c8b2e3f0d7206f9701cc967a624cdc84b780e4feb0a6c3cee0ceab5c45ded8ed7770a9f6a463bb31c474bedf971c23915c51823bc4b27

Download Submit
C:\Windows\SysWOW64\Illfdc32.exe

Filesize
232KB

MD5
813e0aa31f7e8db617228535da5fc974

SHA1
12dbaa9c57ef8b0fc8722761b3d1639758538ea4

SHA256
e11ea849954ca65d3108ab05ce4881c27bf62795199b63caa5e7a893a0c79bb6

SHA512
3b62cce8d52b2ede2d1df9029cc3d4f6966182956ad2c13f2aa20ac1fb648495a7037438d21c0d075b0271d813b44b6f585523a91d88a3e69b8042037da8950b

Download Submit
C:\Windows\SysWOW64\Ingpmmgm.exe

Filesize
64KB

MD5
d1a6c61d1a308c47ae64c68aecd6f7f1

SHA1
caae265692c92562eff93621815b8a8bff9877e6

SHA256
65f6ed8be8fe640b17fea9b091ab9e0a341a994028b80f0affd43e7bd5a5e05d

SHA512
8889586e23e44f234564baa54da01ae998ca003044f259b8e2c012310a79e7adc2b1e2fb1e33bc05c491992506146ab4e6a52f9d7d5c9f37c9e61cded1148afe

Download Submit
C:\Windows\SysWOW64\Ipjoja32.exe

Filesize
232KB

MD5
c930cde07e9f13287ad8cb6035c619c9

SHA1
4a7e31cb0ff760a5c3e6b63b95bc3aa8c0a90eb0

SHA256
18ea92606bddc9da5d59c926b7e8d04d5a3dd1a5466b3d8546db400ce1dd0d38

SHA512
c03ea4f90b21528bcdb689f6f0352d448235b99ae0b03efadbddb52360a4c771c90efb051956b00351ee2a88343ade6b72d4d4dd75b403321f578657c53860a6

Download Submit
C:\Windows\SysWOW64\Ipoheakj.exe

Filesize
232KB

MD5
20aa726361f7d212c4a8bb7ab3c863c4

SHA1
f065401026e90b2357bf15dbfed9d309a9bb67dc

SHA256
9fe6b1f30a1812e57fc7bc2585bd97ff3c54ee31596807d00eca3034f64529bc

SHA512
25db4a767760af8070311e40a3a0631dacc5f73fef1e0e5dc07913f0a17978243ea3681993c892202fd589e600d288ac09c791b87608181891e7a59525de1913

Download Submit
C:\Windows\SysWOW64\Jcbdgb32.exe

Filesize
232KB

MD5
f63657b9bc94f7a58823eec78a58ad17

SHA1
613b73fbda9a400f55bde9a0b1cc77a744e4eec5

SHA256
b4cd3455a5a83b0a1c2a589fe0fc085877af1c7808bba3b04ec67e90732a2f1e

SHA512
101588d2633c7262e54cb57892a28d2757daefe1418c507b9d284616dabbfe5bacce46897119cf4c6b10364c8a68b7b20ce0d0acb77bfe1f398d1058c7eef32f

Download Submit
C:\Windows\SysWOW64\Jcgnbaeo.exe

Filesize
232KB

MD5
fbe69adbf295c825a4e2552011a3cd10

SHA1
fa889e15b93cdc971145af8874549cc4a7242369

SHA256
ed123ba9a6ed68bd9068a0af9319f420a67714925fe1b23d9541829970ac6008

SHA512
276963051fd5762f26b1384c0668575c244a15bbdb7bea659951f93883b2130ecfd2e9731d0d2bb372bd97fe9392585306e1b2abf47bdf019aa92363064c6cda

Download Submit
C:\Windows\SysWOW64\Jpcapp32.exe

Filesize
232KB

MD5
ad0b61c129e46a4cfba0dcc6bc89339b

SHA1
3554cb5a7bff6d2a2b5f8d7a0dfdfd5bde9c8147

SHA256
e9fb88988609d03d06a0f53818560a64c0bd5e4c29447977c9a8b2fd10155a8c

SHA512
72ea8b5c9044dd5253679aeb5b76fa7ac69c3653b9d3f01e22b7c0315ac7528b1d8131f0a20cd216febb6e6b48a6ddef6654d2a35b2c7642bf3bf1b5efa8f768

Download Submit
C:\Windows\SysWOW64\Kdbjhbbd.exe

Filesize
232KB

MD5
f169dd91a3e8a85b6b2f456158eca051

SHA1
81b1646698d673b6a3450807c525df2c49251471

SHA256
76b55570e4954c4a4b082139928c5b23c72982635dd2608ac9e500062c536a77

SHA512
ca241e2a3904625ea97460628b61997c6221d34d544ce1d5a23272aeb03cde541f34ca73af8d6bb1845ad65d8498ace4351254b0c4e9a04e84efea46e093a34f

Download Submit
C:\Windows\SysWOW64\Kfpcoefj.exe

Filesize
232KB

MD5
0c2a5b9aaa0ad8e065a1358e99c36fdc

SHA1
54554297c7bcc459d5e76b5b2c482bece938a98c

SHA256
12cf339e421c732900959576d8e5c01bca1cfbd4fd4dab7e2c5a890767b50aee

SHA512
aa6f6e054d54eede7c9f9c478bf453e53265bb10bb4f91af8c2e364582311b0e2b45e6fbb9ed3acb65259a83040e5335c4ca8fb32ed9018d86fa0e6e5b4b7cb4

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
232KB

MD5
137c3ba294a2085d525139c75f98eee3

SHA1
5a5de27321d9964b2b4eb1e96cc39695784fb14c

SHA256
2c76e5bd57de2506d35919ba4f9c762e5f5723f621242e1f755695d4089eb1c8

SHA512
0f95c94b1b75730ce33f71f8f9fec024b5b9ed4bf714db7dc1a1b28acd84f0974c683bc21922729df6f0acd87b92a07923178a43023e41dc19ab32e1e5d5f0e3

Download Submit
C:\Windows\SysWOW64\Klfaapbl.exe

Filesize
232KB

MD5
919a808fba87a4bae7a59d844cd662d5

SHA1
a70655d331251231be859b526ec5aff0c142b9be

SHA256
395350e620670cc96d8d5abd1d48d48adaa1b8d5669e888d0ec2748a4d681db2

SHA512
ce8fcf2ddcd4e41d64bb34a1172657f62f7c28f40b9f2245a3be2482f1d280fa4182c48563e69c643a948665a3fc8e61359bfc5c22bc5bb979419da0d8901e48

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
232KB

MD5
238e599d61d54c871815d6f082010205

SHA1
a4c097904265d49744374eff8706428039a0cb9f

SHA256
8518336baa47d256f8d6dbf0c98d0837297a509c066407049fb2a3a22e7476eb

SHA512
6efdcad8e7ff938a7bd2542d21fb4a514b441506fae3e3d7c8896a83ffb73106166439038710f13e5d28ec3232831477e4c2fa5f9bba2960c5db37a0584ca91c

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
232KB

MD5
1c2fb287000d2233fa49e87034ffb917

SHA1
87dbc1d4f36a989e869dc7a53cf73189add045c8

SHA256
1e203d7002b4c3fd97d6ee3fc791cd515a98626b40de82888af98032d8a1639e

SHA512
5ace96fb1b48334d36415d232466f74d356ab5858c8285e4d623bd562050b9ef609fc2f27877ac4f674402f33935e2bce767bd731a30bd97ba953c57a8dfb60e

Download Submit
C:\Windows\SysWOW64\Lcnfohmi.exe

Filesize
232KB

MD5
1170bc0304d9e56dc22de6c6ea9bc88c

SHA1
2e0c0c13cbb44502dc2f306bbb7fe187378366da

SHA256
d70302873274a9c6d97c29ee9b7caa40442bdf6551607837a14254b5527b9f16

SHA512
94586da9f1c115b979f0c6c624a6a1e44827a16eb1bc2eb5402eec4fe19acea668bf723ef2807599bf988b4de3b51596a3eebe95a645b63b0c93340f6cc0f80e

Download Submit
C:\Windows\SysWOW64\Lgpoihnl.exe

Filesize
232KB

MD5
26de8ece9b1fae6d54a014b4ed1e9f5f

SHA1
656ff1b3ed2563cb6c083757926fa64d7338f81d

SHA256
a321e0fbec73c2bc0703db56f96796f1c7c07feaf6a2aa333ddebc2f6948d0a5

SHA512
f2d9bd1546571c9f8aa533ed8d5ce9eacfa103bb2f96ddcbedbf8b91921a011788159d42c9ca59095126eaca3077b8669af075e241470045f3d3785f5a1b3b16

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
232KB

MD5
316ce9752374bed56bfea0b991c91161

SHA1
c4bf30dc98f97a3d574bef51f42c4cac2650cd02

SHA256
5ac2d105cf795009800ca2129e88d9b4499cd28b39459c563d988876deee1b16

SHA512
f911b1747d25b71d732b322219cab4485b11bba358979d4045a3147775ecbebbe11bbd1be5e7714b70aa6964f85db5bba2158be29bd10caa3827ca156499f38b

Download Submit
C:\Windows\SysWOW64\Mcbpjg32.exe

Filesize
232KB

MD5
832afac38b2322850dda6f6f8dd1c832

SHA1
c258a4160d83bac5fc7026e080721fa7f2882ec3

SHA256
9d9aa909b9755c1f0a6bc2e30db9b12f4158e76c54f64e49dd2398d664561a0c

SHA512
0d2a52583fc98d64b86fd644bae203f47ff3dd95699553931490d80bba3a472954a511e4c6621faedfd1c646a21a6cc639ba7e1864fe7cfd2e1aa9aacc638e27

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
232KB

MD5
ae82a6bf36fa8e07c16b33bbb9ac34e6

SHA1
777c11951abf8bab686c1c78a67a0ea9dd2a0278

SHA256
717e785ca78a03135bf929ae3ad4c00df888608a69f36cf3fbf70ede48311a53

SHA512
11f67519b5bf1ac3d687d0428268d717ef5f4b89cfb9a34117bbbe2798060129f3e171733a32fb143e6d54e1da527fc8aaefe3ed4498ce70915d7ec2231e194c

Download Submit
C:\Windows\SysWOW64\Mnfnlf32.exe

Filesize
232KB

MD5
68ee57cce61baf85653c78d775dd4a6d

SHA1
df8e2631fd9b318a8d563291f703fae09e6bc8ab

SHA256
7052326c83d01ae3d8af36de3807ca1622be9475801bdc327d77edc2303267ff

SHA512
1408f72c81a2f7aaebe48539525c80a7e834c5283df950043a316320dc885a91ff8b5479cd51623da560a5421dabaade0dd7916e23784e9cd00fa1cf131f7e38

Download Submit
C:\Windows\SysWOW64\Mqkiok32.exe

Filesize
232KB

MD5
1f694fb1c95cf420c081c3fb7ae26a42

SHA1
c55a14e25a1f62764ec6592143e42e795d986c35

SHA256
3f2e11aef08c973a4a9412e253e0b353d51abd6c7378f2ce11c66af26f7183ec

SHA512
097cc51ef3c0cddc490ba708ad9559935b867004abffc142d0544c6e5a815cad413eeb481af546ca3c1704f640cddaf622e10641294899a2f3196a2c52406b94

Download Submit
C:\Windows\SysWOW64\Oelolmnd.exe

Filesize
232KB

MD5
d97be0811788c7b2320a1bf4e309271b

SHA1
4a981d88441b47db745ec0899a96f36cb22cf098

SHA256
f3782bc94b3b446329bcd2e9636f999567365d577f211620deb94dc5ed351784

SHA512
2eded22a2428e008cc9d4d846be0ad56bc476af36936bcbc2a5806d90615123d9ef856afefce99ac20db7492394f48035e1c126bc4163dc7ac253dc3683cc94c

Download Submit
C:\Windows\SysWOW64\Ojdnid32.exe

Filesize
232KB

MD5
c09739c47d99a97395209c92a9d83ded

SHA1
f4d4d57b10c76ad2cf5ce94b53d4cc18ce093a62

SHA256
1f405e772b5c50292d0bbf13e700394dfa638ccfbf74e0be33fd06adffc8b12c

SHA512
5678339d70e3177e3eada11b3fec8191caf114cf6f45ae25ba2027f577ad8f4f6c74b49936f1959c57f1b4eca9899428e6ba0d45a5d21380f1824fd04b6c1ed9

Download Submit
C:\Windows\SysWOW64\Ojigdcll.exe

Filesize
232KB

MD5
aae2e8c7242f43494b337f26b5abb804

SHA1
edeeea39164558779c8cd685369e22bd7e864ddc

SHA256
ddaa8d5fac015f3dd9b072205c408844c04931d28b911fb4a98b2c88cb94d1cc

SHA512
6b940b96b07e3234dced27e3a94e421b890b7ee9854eec46da37a805bec639a6555bbcbd556c41b66662cd0b9f232f2028a0816ed20d19136ee28c09bca12fd9

Download Submit
C:\Windows\SysWOW64\Palbgl32.exe

Filesize
232KB

MD5
feb55c28f9b4a69bc1d79f092691e8c6

SHA1
69ffd6b28d73b333ddf88d324388a5fc7fccfe53

SHA256
bcdc1b3cc99b85439234b3a933e8f914f1e5774de217966193b6f4b35c69cc86

SHA512
a51b65c1ad049b92e5d7a0657c9de68e0d3744ac24233f5845e34d3f0b6eed1b26626f7b40c19f67177ddfa5f4e11bbdaa2e4466a5b13c85489164c421052dbe

Download Submit
C:\Windows\SysWOW64\Pjpfjl32.exe

Filesize
232KB

MD5
9d916c5208de4a77a54c35dee732d1d2

SHA1
52500931e01bf4bd847b766313d8060afe384f6b

SHA256
750a0dac7bf5a6c155ba15632623f9c5502dfb0ee8d353587a3a283e1a218ba2

SHA512
f80a9d5a22ed88c2f8770e0518d9f287f36827fd9f3f9a0375b204d3ad3491aafe232994c7205cc9a4aaac3dc47990745f2411bd7b321685071ca71a39e73d51

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
232KB

MD5
dfc37643bcda8f229c37f1f8bb8ba34b

SHA1
673c3edd634081c13b713c002cced71925cd0646

SHA256
eaa9c76941e2d5e8a46bbe0691846b6856002fe8418c32b1ff1d25262922a8c4

SHA512
434de981b4d49447378050794eb531df85da35ff61c7e058d381a8aa354de5188cab5566266c8021630de175b65b6e6bcb337c353e8469d72854e5ba32293f13

Download Submit
C:\Windows\SysWOW64\Ppolhcnm.exe

Filesize
232KB

MD5
7d412e682e4996953025f1ccd3eb2ee0

SHA1
fbf92649001f4c488917251e9917816eedba4b9e

SHA256
8fd89eb34a6479ea9085e83e4e446c11968f4a596dc2a692b321ec1bcf2efe86

SHA512
aa47ffac304a50119395fbc880db415764d29d2f9d2ce71e306eb4d6b7eba296eca5dc78c892f830b8e43c4f045b9e3f663840090051d506e28209d3bb387fb0

Download Submit
C:\Windows\SysWOW64\Qaqegecm.exe

Filesize
232KB

MD5
69bfd19a37627746811f3059657dcb14

SHA1
5b371a51a0aa8c5ca3f3b995326771018c38125e

SHA256
0744d5f8f63460c440f82fb2072c98e4f3908066fff5a33e8858824a8af6606a

SHA512
182551761cb870f2cdb484749a788b36c9f069be904358ce9ed9160d3b9a6a6ce1fb383672979275cc8902d177241b96cbe0b3d45a93c75088ece775625d53d0

Download Submit
C:\Windows\SysWOW64\Qklmpalf.exe

Filesize
232KB

MD5
dc2e9de343144283667e9b13fd2ec76b

SHA1
ae4cb97c39240fa1af8596b26cb3dc7b0a515cc2

SHA256
b504efbcbddfe11423e0853ffc15c6915e993407ab26f1c28436ff9cca9e617c

SHA512
43a8b5fe7e1b7f21708462ceed51bde779f8da62544f74de12c55a2381b66d1d44af8fc134bca16e9d88b4fae5e0dc8711926732c0364dfa35b98fdc8dd1072a

Download Submit
C:\Windows\SysWOW64\Qmepam32.exe

Filesize
232KB

MD5
5d7f9d00b18b47d136a1aabf3004411d

SHA1
090ea36a469c0c3a164e874ce230ee4ea0588bee

SHA256
511e1c041da8093965c56e90ef2bcd4a97076c20e7bf15a28d01c6ac19a60107

SHA512
5f2f08acb35a9ab688933825e7100f82842d78431b75c3a966429f47892101a2bb749be0da66fd237d0a966fb57857098a5511459399013d798d8fdaeea9107e

Download Submit
memory/560-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/804-345-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1052-497-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1096-567-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1096-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1108-357-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1240-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1272-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-521-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1372-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1384-266-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1464-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1548-589-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1596-296-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1612-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1612-581-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1632-272-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1792-437-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1800-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1800-588-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1804-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1900-213-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1956-503-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2028-290-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2036-365-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2136-479-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2152-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-431-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2192-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2212-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2292-472-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-180-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2664-363-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2864-371-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2868-485-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2872-401-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2956-416-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2984-407-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3020-196-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3032-455-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3052-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3052-560-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3088-561-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3096-236-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3104-515-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3144-568-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3264-383-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3284-539-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3284-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3320-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3404-473-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3472-377-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3516-215-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3628-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3712-200-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3716-351-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3724-527-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3836-339-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3848-308-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3932-553-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3932-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3940-453-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3964-419-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4048-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4048-546-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4072-244-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-284-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4092-547-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4100-575-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4104-554-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4128-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4376-252-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4384-509-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4448-315-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4460-574-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4460-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4504-425-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4532-533-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4540-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4600-443-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4612-495-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4668-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4708-465-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4800-302-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4812-540-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4820-582-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4840-278-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4876-395-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4920-261-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4924-321-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4992-327-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5032-333-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5060-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5084-228-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5092-389-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9364-2512-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads