berbew | e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297ba

Analysis

max time kernel
90s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe
Size

232KB
MD5

9d1e59a19b40895c90c185a5f7c8fa40
SHA1

65b05b32dd11a1cfb51ff6a8b27f606b10ba246e
SHA256

e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297ba
SHA512

e014b0df7bc0309e947cb0a08f5a876ff5a8b1185e5fc2e2915b1424d2b27da65d192de3550efdad44b8dddf866e48f75793e0734b48066e272aa72cc0268446
SSDEEP

3072:aljdHcXTX4V7usluTXp6UF5wzec+tZOnU1/s5HH0AU/yRvS3u121TzlbNRfzPad8:apd88V6s21L7/s50z/Wa3/PNlPX

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikdcmpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anaomkdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklhcfle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iloidijb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijegcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knqepc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebommi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oacoqnci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bahkih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nncccnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gigaka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfglfdkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jocefm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojfcdnjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnadagbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmlfqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flngfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinqbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hehkajig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnicid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohlqcagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eblpgjha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdigadjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kofkbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lggejg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdqfll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gphphj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoknihb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkkjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hplicjok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcndbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phigif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdpjlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfmojenc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdcliikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbbffdlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Johnamkm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2980	Elbhjp32.exe
3560	Eblpgjha.exe
4516	Eppqqn32.exe
1408	Ebommi32.exe
2296	Fcniglmb.exe
2808	Fjhacf32.exe
1384	Fdqfll32.exe
3896	Fllkqn32.exe
4488	Ffaong32.exe
4520	Flngfn32.exe
4196	Ffclcgfn.exe
2096	Fplpll32.exe
2640	Glcaambb.exe
2348	Gigaka32.exe
5068	Gdlfhj32.exe
1280	Gjfnedho.exe
3168	Gbabigfj.exe
456	Gfmojenc.exe
4696	Gdaociml.exe
4068	Gbdoof32.exe
1392	Gingkqkd.exe
1932	Gphphj32.exe
1172	Gdcliikj.exe
4156	Ggahedjn.exe
2132	Gkmdecbg.exe
4364	Hpjmnjqn.exe
4600	Hdehni32.exe
1952	Hbhijepa.exe
3828	Hkpqkcpd.exe
5112	Hibafp32.exe
4124	Hmnmgnoh.exe
2996	Hlambk32.exe
1412	Hplicjok.exe
1716	Hckeoeno.exe
2660	Hgfapd32.exe
3388	Hkbmqb32.exe
1144	Hmpjmn32.exe
3732	Hlcjhkdp.exe
4412	Hpofii32.exe
2324	Hcmbee32.exe
4996	Hginecde.exe
3164	Hkdjfb32.exe
4168	Hmbfbn32.exe
3080	Hlegnjbm.exe
5028	Hdmoohbo.exe
1396	Hcpojd32.exe
1704	Hkfglb32.exe
1208	Hiiggoaf.exe
1244	Hlhccj32.exe
3428	Hpcodihc.exe
4788	Hdokdg32.exe
4424	Hgmgqc32.exe
220	Hkicaahi.exe
4448	Hildmn32.exe
3624	Iljpij32.exe
4568	Ipflihfq.exe
2080	Icdheded.exe
4612	Igpdfb32.exe
996	Ikkpgafg.exe
4208	Iinqbn32.exe
2692	Ilmmni32.exe
4868	Iphioh32.exe
1068	Icfekc32.exe
4356	Igbalblk.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dnpdegjp.exe	Dmohno32.exe
File opened for modification	C:\Windows\SysWOW64\Nqbpojnp.exe	Nncccnol.exe
File created	C:\Windows\SysWOW64\Nchkcb32.dll	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Gbchdp32.exe	Gbalopbn.exe
File created	C:\Windows\SysWOW64\Bgqoll32.dll	Lgdidgjg.exe
File opened for modification	C:\Windows\SysWOW64\Cdimqm32.exe	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Kdmqmc32.exe	Kjhloj32.exe
File created	C:\Windows\SysWOW64\Lknojl32.exe	Lgccinoe.exe
File created	C:\Windows\SysWOW64\Gbalopbn.exe	Gpbpbecj.exe
File created	C:\Windows\SysWOW64\Pnpkdp32.dll	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Ijagjini.dll	Ebommi32.exe
File created	C:\Windows\SysWOW64\Glcaambb.exe	Fplpll32.exe
File opened for modification	C:\Windows\SysWOW64\Hiiggoaf.exe	Hkfglb32.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Kmkbfeab.exe	Kjmfjj32.exe
File opened for modification	C:\Windows\SysWOW64\Bklfgo32.exe	Bepmoh32.exe
File created	C:\Windows\SysWOW64\Ogjdmbil.exe	Omdppiif.exe
File opened for modification	C:\Windows\SysWOW64\Kjhloj32.exe	Kcndbp32.exe
File opened for modification	C:\Windows\SysWOW64\Cbdjeg32.exe	Cofnik32.exe
File opened for modification	C:\Windows\SysWOW64\Fnlmhc32.exe	Flmqlg32.exe
File opened for modification	C:\Windows\SysWOW64\Lqhdbm32.exe	Llmhaold.exe
File opened for modification	C:\Windows\SysWOW64\Ogcnmc32.exe	Oplfkeob.exe
File created	C:\Windows\SysWOW64\Hclnnc32.dll	Fcniglmb.exe
File opened for modification	C:\Windows\SysWOW64\Hplicjok.exe	Hlambk32.exe
File opened for modification	C:\Windows\SysWOW64\Idkkpf32.exe	Ijegcm32.exe
File created	C:\Windows\SysWOW64\Gbqcnc32.dll	Gncchb32.exe
File created	C:\Windows\SysWOW64\Ngqagcag.exe	Njmqnobn.exe
File opened for modification	C:\Windows\SysWOW64\Dmadco32.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Hankellh.dll	Ilafiihp.exe
File created	C:\Windows\SysWOW64\Phdpmbnc.dll	Kdigadjo.exe
File created	C:\Windows\SysWOW64\Nchcpi32.dll	Cnkkjh32.exe
File created	C:\Windows\SysWOW64\Hdehni32.exe	Hpjmnjqn.exe
File created	C:\Windows\SysWOW64\Hhcmlj32.dll	Innfnl32.exe
File opened for modification	C:\Windows\SysWOW64\Igdnabjh.exe	Idfaefkd.exe
File created	C:\Windows\SysWOW64\Ogacbllg.dll	Phaahggp.exe
File opened for modification	C:\Windows\SysWOW64\Boihcf32.exe	Bmjkic32.exe
File opened for modification	C:\Windows\SysWOW64\Cdkifmjq.exe	Cggimh32.exe
File created	C:\Windows\SysWOW64\Hiiggoaf.exe	Hkfglb32.exe
File created	C:\Windows\SysWOW64\Fenghpla.dll	Enpmld32.exe
File opened for modification	C:\Windows\SysWOW64\Hlglidlo.exe	Hiipmhmk.exe
File opened for modification	C:\Windows\SysWOW64\Gbeejp32.exe	Gimqajgh.exe
File created	C:\Windows\SysWOW64\Ibhkfm32.exe	Igajal32.exe
File opened for modification	C:\Windows\SysWOW64\Peahgl32.exe	Oacoqnci.exe
File created	C:\Windows\SysWOW64\Jkdgfllg.dll	Bepmoh32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkkjh32.exe	Ckmonl32.exe
File created	C:\Windows\SysWOW64\Nhmofj32.exe	Nndjndbh.exe
File opened for modification	C:\Windows\SysWOW64\Lobjni32.exe	Ljeafb32.exe
File created	C:\Windows\SysWOW64\Coegoe32.exe	Cdpcal32.exe
File created	C:\Windows\SysWOW64\Jhdnigno.dll	Idkkpf32.exe
File opened for modification	C:\Windows\SysWOW64\Napjdpcn.exe	Mnpabe32.exe
File created	C:\Windows\SysWOW64\Aolblopj.exe	Akqfkp32.exe
File created	C:\Windows\SysWOW64\Iocedcbl.dll	Aopemh32.exe
File created	C:\Windows\SysWOW64\Oblknjim.dll	Cklhcfle.exe
File opened for modification	C:\Windows\SysWOW64\Gbabigfj.exe	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Cjjfon32.dll	Kmkbfeab.exe
File created	C:\Windows\SysWOW64\Cikamapb.dll	Hifcgion.exe
File created	C:\Windows\SysWOW64\Dkhnjk32.exe	Dijbno32.exe
File opened for modification	C:\Windows\SysWOW64\Hlepcdoa.exe	Hifcgion.exe
File opened for modification	C:\Windows\SysWOW64\Jilfifme.exe	Jpcapp32.exe
File opened for modification	C:\Windows\SysWOW64\Hmnmgnoh.exe	Hibafp32.exe
File opened for modification	C:\Windows\SysWOW64\Jgbjbp32.exe	Jnjejjgh.exe
File opened for modification	C:\Windows\SysWOW64\Neqopnhb.exe	Nnfgcd32.exe
File created	C:\Windows\SysWOW64\Kcbnnpka.exe	Kmieae32.exe
File created	C:\Windows\SysWOW64\Fbpchb32.exe	Fpbflg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9516	9220	WerFault.exe	479

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibafp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hckeoeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacoqnci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peahgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phaahggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jllokajf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdcliikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdigadjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joahqn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcniglmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgmgqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnjejjgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbgihaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoobdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipeeobbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gigaka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gingkqkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meepdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaalblgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flfkkhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngqagcag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloidijb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlfnaicd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohcegi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnafno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flngfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lclpdncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlmdbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnpdegjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hehkajig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hekgfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqfpckhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojajin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdickcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elbhjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffaong32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjccdkki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqpamb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paoollik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akqfkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljeafb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pffgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idkkpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmfdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inlihl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmkbfeab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Napjdpcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Poimpapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aafemk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhclmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgpoihnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmnmgnoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmepam32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffclcgfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbkdke32.dll"	Kqphfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfllfd32.dll"	Kglmio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejoaandc.dll"	Aekddhcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojajin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idkkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajfmkfhq.dll"	Jgbjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebimgcfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmpcbhji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmhdkknd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcgbdc32.dll"	Gdaociml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajpfn32.dll"	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfamlc32.dll"	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oeheqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmkgk32.dll"	Akqfkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clgbhl32.dll"	Ckmonl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmacdg32.dll"	Kgdpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibaeen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njjdho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npgmpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdehni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjhhfnd.dll"	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhcmcm32.dll"	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjjkaabc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffclcgfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gabfbmnl.dll"	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hibafp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpmcbhlp.dll"	Qlgpod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahippdbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmadco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjfngdm.dll"	Lnadagbm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efjbcakl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pipeabep.dll"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmjaa32.dll"	Eppqqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjnppabn.dll"	Hbhijepa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpofii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnlmhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbpcnkaj.dll"	Gejopl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbeejp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfmojenc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lobjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjccdkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmqmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeeobqbq.dll"	Ddligq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2980	3292	e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe	85
PID 3292 wrote to memory of 2980	3292	e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe	85
PID 3292 wrote to memory of 2980	3292	e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe	85
PID 2980 wrote to memory of 3560	2980	Elbhjp32.exe	86
PID 2980 wrote to memory of 3560	2980	Elbhjp32.exe	86
PID 2980 wrote to memory of 3560	2980	Elbhjp32.exe	86
PID 3560 wrote to memory of 4516	3560	Eblpgjha.exe	87
PID 3560 wrote to memory of 4516	3560	Eblpgjha.exe	87
PID 3560 wrote to memory of 4516	3560	Eblpgjha.exe	87
PID 4516 wrote to memory of 1408	4516	Eppqqn32.exe	88
PID 4516 wrote to memory of 1408	4516	Eppqqn32.exe	88
PID 4516 wrote to memory of 1408	4516	Eppqqn32.exe	88
PID 1408 wrote to memory of 2296	1408	Ebommi32.exe	89
PID 1408 wrote to memory of 2296	1408	Ebommi32.exe	89
PID 1408 wrote to memory of 2296	1408	Ebommi32.exe	89
PID 2296 wrote to memory of 2808	2296	Fcniglmb.exe	90
PID 2296 wrote to memory of 2808	2296	Fcniglmb.exe	90
PID 2296 wrote to memory of 2808	2296	Fcniglmb.exe	90
PID 2808 wrote to memory of 1384	2808	Fjhacf32.exe	91
PID 2808 wrote to memory of 1384	2808	Fjhacf32.exe	91
PID 2808 wrote to memory of 1384	2808	Fjhacf32.exe	91
PID 1384 wrote to memory of 3896	1384	Fdqfll32.exe	92
PID 1384 wrote to memory of 3896	1384	Fdqfll32.exe	92
PID 1384 wrote to memory of 3896	1384	Fdqfll32.exe	92
PID 3896 wrote to memory of 4488	3896	Fllkqn32.exe	93
PID 3896 wrote to memory of 4488	3896	Fllkqn32.exe	93
PID 3896 wrote to memory of 4488	3896	Fllkqn32.exe	93
PID 4488 wrote to memory of 4520	4488	Ffaong32.exe	94
PID 4488 wrote to memory of 4520	4488	Ffaong32.exe	94
PID 4488 wrote to memory of 4520	4488	Ffaong32.exe	94
PID 4520 wrote to memory of 4196	4520	Flngfn32.exe	95
PID 4520 wrote to memory of 4196	4520	Flngfn32.exe	95
PID 4520 wrote to memory of 4196	4520	Flngfn32.exe	95
PID 4196 wrote to memory of 2096	4196	Ffclcgfn.exe	96
PID 4196 wrote to memory of 2096	4196	Ffclcgfn.exe	96
PID 4196 wrote to memory of 2096	4196	Ffclcgfn.exe	96
PID 2096 wrote to memory of 2640	2096	Fplpll32.exe	97
PID 2096 wrote to memory of 2640	2096	Fplpll32.exe	97
PID 2096 wrote to memory of 2640	2096	Fplpll32.exe	97
PID 2640 wrote to memory of 2348	2640	Glcaambb.exe	98
PID 2640 wrote to memory of 2348	2640	Glcaambb.exe	98
PID 2640 wrote to memory of 2348	2640	Glcaambb.exe	98
PID 2348 wrote to memory of 5068	2348	Gigaka32.exe	99
PID 2348 wrote to memory of 5068	2348	Gigaka32.exe	99
PID 2348 wrote to memory of 5068	2348	Gigaka32.exe	99
PID 5068 wrote to memory of 1280	5068	Gdlfhj32.exe	100
PID 5068 wrote to memory of 1280	5068	Gdlfhj32.exe	100
PID 5068 wrote to memory of 1280	5068	Gdlfhj32.exe	100
PID 1280 wrote to memory of 3168	1280	Gjfnedho.exe	101
PID 1280 wrote to memory of 3168	1280	Gjfnedho.exe	101
PID 1280 wrote to memory of 3168	1280	Gjfnedho.exe	101
PID 3168 wrote to memory of 456	3168	Gbabigfj.exe	102
PID 3168 wrote to memory of 456	3168	Gbabigfj.exe	102
PID 3168 wrote to memory of 456	3168	Gbabigfj.exe	102
PID 456 wrote to memory of 4696	456	Gfmojenc.exe	103
PID 456 wrote to memory of 4696	456	Gfmojenc.exe	103
PID 456 wrote to memory of 4696	456	Gfmojenc.exe	103
PID 4696 wrote to memory of 4068	4696	Gdaociml.exe	104
PID 4696 wrote to memory of 4068	4696	Gdaociml.exe	104
PID 4696 wrote to memory of 4068	4696	Gdaociml.exe	104
PID 4068 wrote to memory of 1392	4068	Gbdoof32.exe	105
PID 4068 wrote to memory of 1392	4068	Gbdoof32.exe	105
PID 4068 wrote to memory of 1392	4068	Gbdoof32.exe	105
PID 1392 wrote to memory of 1932	1392	Gingkqkd.exe	106

C:\Users\Admin\AppData\Local\Temp\e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe
"C:\Users\Admin\AppData\Local\Temp\e45bb52bb9b2a14153f38894e5b4c46c54951bbca7a57d3a4231f76798e297baN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\Elbhjp32.exe
  C:\Windows\system32\Elbhjp32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\Eblpgjha.exe
    C:\Windows\system32\Eblpgjha.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\SysWOW64\Eppqqn32.exe
      C:\Windows\system32\Eppqqn32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1408
      - C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1280
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1172
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        25⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        26⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4364
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        30⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        36⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        38⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        39⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        41⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        42⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        43⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        44⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        45⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        46⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        47⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1704
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        50⤵
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        51⤵
        Executes dropped EXE
        
        PID:3428
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        52⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        54⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        55⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        56⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        57⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        58⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        59⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        60⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        63⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        65⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        66⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        69⤵
        Drops file in System32 directory
        
        PID:4300
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        70⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        72⤵
        Drops file in System32 directory
        
        PID:2248
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        73⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        76⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3552
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        78⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        79⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        80⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        81⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        83⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        85⤵
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        86⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        87⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        88⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2104
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        90⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        91⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        92⤵
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3236
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        94⤵
        Drops file in System32 directory
        
        PID:908
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        95⤵
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        96⤵
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        97⤵
        Drops file in System32 directory
        
        PID:3044
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        98⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        99⤵
        Drops file in System32 directory
        
        PID:3960
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        101⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        102⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        103⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        104⤵
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        105⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        106⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        107⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        108⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        112⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        113⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        114⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        115⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2540
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        121⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        122⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        124⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        128⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        129⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        130⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        131⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        137⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        138⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3876
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        143⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        144⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        146⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        147⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        148⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        149⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        151⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        152⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        153⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        155⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        156⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        157⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        158⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        159⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        160⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        161⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        162⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        163⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        164⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        168⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        169⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        171⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        172⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        173⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6072
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        175⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        176⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        177⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        179⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        181⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        182⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        183⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        184⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:6808
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        188⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        191⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        192⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7164
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        194⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        195⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        196⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        197⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        199⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        200⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        201⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        202⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        203⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        204⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        205⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        207⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        208⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        209⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4840
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        211⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        212⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        213⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        214⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        215⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        217⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        218⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        219⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        220⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        221⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        222⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        223⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        224⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        225⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        226⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        227⤵
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        228⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        229⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7200
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        232⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        233⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        234⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        235⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        236⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        237⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        238⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        239⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7696
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        241⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        242⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        243⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        245⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        247⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        248⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        249⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        250⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        251⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        253⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7376
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        255⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        256⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        257⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7684
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        259⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        261⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:7940
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        263⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        264⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        265⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        266⤵
        Modifies registry class
        
        PID:7192
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        267⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        268⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        270⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        271⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        272⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        273⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        274⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        276⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        277⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        278⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        279⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        280⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        281⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        282⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        283⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        284⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        285⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7824
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        287⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7312
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        288⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        289⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        290⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        291⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        292⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        293⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        294⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        296⤵
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        297⤵
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        298⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        299⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        300⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        301⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        302⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        303⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        304⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        305⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        307⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        308⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:9168
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        310⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        311⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        313⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        314⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        315⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        317⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8872
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        319⤵
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        320⤵
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        321⤵
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        323⤵
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        324⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        325⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        326⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        328⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        329⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        330⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        332⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:8656
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        334⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        336⤵
        Modifies registry class
        
        PID:9200
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        338⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:8836
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:8344
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        341⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        342⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        343⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        344⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        345⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        346⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        347⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        348⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        350⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        351⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        352⤵
        System Location Discovery: System Language Discovery
        
        PID:9500
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        353⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9632
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        356⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        357⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        358⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        359⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        360⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9912
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        362⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        363⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        364⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        365⤵
        Modifies registry class
        
        PID:10088
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10132
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10176
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        368⤵
        Drops file in System32 directory
        
        PID:10220
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9256
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        370⤵
        Drops file in System32 directory
        
        PID:9316
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        371⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        372⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        373⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        374⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        375⤵
        Drops file in System32 directory
        
        PID:9668
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        377⤵
        Modifies registry class
        
        PID:9812
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9856
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        381⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        383⤵
        Drops file in System32 directory
        
        PID:10124
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        384⤵
        Drops file in System32 directory
        
        PID:10160
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        385⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9220 -s 408
        386⤵
        Program crash
        
        PID:9516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9220 -ip 9220
1⤵
PID:9404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agimkk32.exe

Filesize
232KB

MD5
1337f143588ef0c014abf9fba6807b1d

SHA1
d5afca7d2d5b70b36588a0c9ce57591888991497

SHA256
eb6cd9d248f81f5a6f9e38f9558460ae7af0de7a74f9498af42f501567a33944

SHA512
2a3c9e5b5f0ab9e954af888c31dcac257bc41ce074e6b093d27eea4dae4706d3088c8afd688034723e558e44c5580d9cae5bec4c3689b645017b64cccf49ca39

Download Submit
C:\Windows\SysWOW64\Apaadpng.exe

Filesize
232KB

MD5
1b620bb5196a16b79e73299dac7b6b9e

SHA1
d7a7e0d067a11e79b283362d6b039cacc0eeda50

SHA256
649f2d8ea9ecef3666a8b416c1c390aee2f9df2708a393f9f2624e8d78171f24

SHA512
aa3c307e061bb71d98c5ef6b9007de6450896b2c7fbef3af02040aa9fbb7996a06879b5855902b02eeab7b54668b4841f4319292c0f69546b2d301c4280ead9d

Download Submit
C:\Windows\SysWOW64\Bdpaeehj.exe

Filesize
232KB

MD5
80b52584a83a2b53b6b5f9ca2b220393

SHA1
cf0a3c38dc046543e3610af0f7ea73e49c83c6c2

SHA256
4810f7b7ee866ba4c9f6ee01e93279add78e3e803e7e87d53af4acfbbce6f63c

SHA512
d9bf206740f96c6c0c442caf1167e11c6739f9f4b81ac462e959c98e15bc35dcdfa9423fca9a540b90d84c3bd8346026f442f866ab54a50cf7a7b5e7876ead95

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
232KB

MD5
b09d55b2c9f4a6810a54954acb89354c

SHA1
1e17626043a0fd5d9da724cd01d0afad019db97c

SHA256
87d3b362cd208ffc94b023ada5de5bb960fa07214089f8c5b104240210453f07

SHA512
c855b7ddbd15568c1788ed9de56a18114fe4c121628f2e3f3ace0cde0382fbadfa55024710d47eb9a2c569566b61acb026c52e1967124e2ae3accf9f57e95742

Download Submit
C:\Windows\SysWOW64\Bklfgo32.exe

Filesize
232KB

MD5
8a216b4dc9f276570f3b77b804e068cb

SHA1
7b33bdad7617387faea20c030ebe7c86647efde6

SHA256
daf191b598f33e25cc46d4f5795488b91129de30613b5cb607a5de27dee2fc70

SHA512
db134bea2310a57a74492cab2cdbdb2a38d65d626a360a236fb240bc31c4ec92dc832d3b0c151ae73ec5c691f5609553cc4293a08d05d62ceb1be27ce073f7db

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
232KB

MD5
39d9dd1d66f579815bc0ee80f53650c3

SHA1
5b31cd430be5534ee5368c355c48c554245d1aba

SHA256
eff750048fbf3e89800d09b3d1dbcd066024dace7b6e559435cad4fba7b175d1

SHA512
6aa598091a66192f5a7874644bab1834b2a7c7224c20b93723ae5660ae247092d66508a1670345f1dd7e12d445c4e164ca0cad27d9a619ad959e535a521d84b2

Download Submit
C:\Windows\SysWOW64\Cdkifmjq.exe

Filesize
232KB

MD5
bcc7645b5f711f711dec224cb5e861a1

SHA1
8323ab51bf299f7a26ce0d852c08176b272c04dc

SHA256
e56ce4cfb49eb776791483e882933a8201df76692a949031cba369b905517c12

SHA512
42b48f0515f98be3676a448faa8a5e4c18c3cd3420a6c585dc64b8c48b2ec1ed12944b30b2792073c06ea49ae26bd7031410bc32d23f1b9cfe8ee0d4dc96fc39

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
232KB

MD5
64d6fae5fe7769f9a5a050dcf5271301

SHA1
da1e58879745237eccef2842ad4168ed6791b8a0

SHA256
f7b2b714474a91d7697a22ad6506fa5f172d167c79843cab753b649410e1808f

SHA512
d4a5d03a0fc8f62862d59c8c9e1bc1e310e17655d09ce71fb7b73ba59c38a5b247a2e3190d00b9f7d3d5cfb2bd57354c20a23e901038fc54828b12a9170aca04

Download Submit
C:\Windows\SysWOW64\Cfkmkf32.exe

Filesize
232KB

MD5
9ca00d904609b6af534cae5d1c4884c3

SHA1
1b7157aa38bf1a2bd4849309f742db2ec1948ce3

SHA256
4a69955f0f81cf4f7d8f586b2b5fe0d81e2f2514c21b8502d238a6e939dd04ea

SHA512
40fd42b538d5fab1be5c5dfbd5f29348653d67d0b8bca0d6083fee1b0f1c73243c0acecf40c63d69dbe573e4fc2fb3187be7da57ff13a27689f45dd503c03058

Download Submit
C:\Windows\SysWOW64\Chiblk32.exe

Filesize
232KB

MD5
3072628fd80ca6880cbd940d7aa5d0ff

SHA1
97e7258d72a152728aa54d40e26c49b320ef7255

SHA256
4f3ac897a572353e89d74626c1378f3fc15645cc63f42e870ac891e52696ae9f

SHA512
827d21204a8df912fa5bbd1c415e2b32ced8baaf4b9d66f23e8cf3257dcdb88df7981d41d2e13160f6b657c9e5aff206518535fe1a1a1dc141f2a1446f3471a5

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
64KB

MD5
0fd3ef15e2eb83019209d4575a045402

SHA1
31ddd51f41e30ebccb7a167c30fd50282dc0ba41

SHA256
7b64215da654f866e53c5f66c21cadcb3c7a2305d199d09c6993517b4fe1a36d

SHA512
5254faf1061046e2683227ee1630a42b49a196eeca564562b4bcb31842697e6c96a7223e9be91818635abfa2c17800e44ed7cb1054305e5b26be863970f15605

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
232KB

MD5
c57de0c54f9e073b133c6a72876b51ba

SHA1
49c0e149bdc42617a0b5271ba42e9b29971a4492

SHA256
0f68b0cd719ee237e0b488457be94dadf6356b4553a6e04b3dd2abf3d8a4e5a7

SHA512
0f6f96957aef0e229ff4964e2d06a4100288cd1bf293d796bdab7001618faa9e2826c454e2df8589d3bd604247aed5a788de38f0411dc021b478fb14d13de4b6

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
232KB

MD5
ad96d1127cb64e4d74a8e96c6cbd39ad

SHA1
c483f638ab711f1a08fca921c8f6242173f6e60f

SHA256
f520644ea03117ce7e5aaddfae1ea1c85f59bd36d8167846b6a6bbd34bb7113f

SHA512
379cb6fc6b648af97e1f12750edd77b4f2eb9c046cf62cef9a9d38b81d69590399fda56cca85dbf4fbbafa10d7296361ca5605c7e8f5d949893b1966e41cf91e

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
232KB

MD5
8af4b3f0d7f0980f3cbeeb644b8a3677

SHA1
fc6f337ab3edb39ed20b69b88f9047814a25f87a

SHA256
2210cec7259fc1162bec8b90685ccf1351aa33522b3c579456441549f2e9d9a0

SHA512
79061df349ee9c60e0c310574c8aa17b879a4058aa84f4ce5537d357ffed81ac518001d546841b36fb74817504c9404b282108c2c969cd931b9188e38c149753

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
232KB

MD5
0c888f8d40c07c55b711c1e670578d05

SHA1
6281d1fc59e3b4216b5692a616b19b723eeed499

SHA256
d585366b6a71f97706fe67cfbc02dc8d6e5cdb6076b11827b8092a5ffcc06890

SHA512
dd4e2d5190f00a0f8a650ae931460ceb799cef4089b7fbee4ae77e022a801da49ad75d11ec8dabc6d43a1ce9da418dcd5a142798e378718187ce47376a89e6d8

Download Submit
C:\Windows\SysWOW64\Eblpgjha.exe

Filesize
232KB

MD5
ba418d16c92a319a5b2da2155d660bd6

SHA1
5769937bc5ba5ae8b895d37126a303b3646a56f0

SHA256
da0ef59787a536bfc709766ca5d88b185d68b4c13dfdbae3e965903120153588

SHA512
f33747d786961be87299e5cd726d6cb8db43759fd3a221bed462014ace94ac0ad385392c84d59bbc20b82ed54c79337c114278ac07794f95ebd98135f4cf0809

Download Submit
C:\Windows\SysWOW64\Ebommi32.exe

Filesize
232KB

MD5
375885a64cda3eaee321294514db7222

SHA1
9bee2e1fd810ce1218f57075d3e573d23fed2909

SHA256
13bf76453204fcd638d81d082b4652eb9e36c1e0f62bc5006a6778e6af95b40d

SHA512
1edb8e979196333de3feb26ec79db5f9ce5d9f30e0fec7b6edf18170e9f157fca31c660a40ae96d7f9203f62382b2d4e3a020db2e07524b37ed4bfa36d4ee591

Download Submit
C:\Windows\SysWOW64\Efjbcakl.exe

Filesize
232KB

MD5
8e471421f3a491e3ca7a57756840f09a

SHA1
9f9fc2f2eb6fe17a85013ec96757db22c575f539

SHA256
ad97d3e7da6dd88d5fff9db0d84baae20ad97a47ae83012d5c04295354df79a8

SHA512
f438adaf2edaea93d1b52fc2c48e7e17167af14edecd4379107e0143f2a95d2c5963bfdd992bb1d6bd3d2516cf0a0a5de305705a419e5479871401ba69361e43

Download Submit
C:\Windows\SysWOW64\Elbhjp32.exe

Filesize
232KB

MD5
6ba94f4562b7cba268ecac8aecda1b39

SHA1
2188f2ee73487bec0c802762c212cf77a94721ea

SHA256
e10dfb16d9d3782f6f99013cadd8568f5fcaf0179a1f36bf9cc88c413e299e0f

SHA512
ff4b95215b27a41d6a124649f4610788c0921640ab424e70040b572841aaca02a3693de70cdbabf061b65547468efcc16c6db8668c844abefddf5365b9bdb40a

Download Submit
C:\Windows\SysWOW64\Eppqqn32.exe

Filesize
232KB

MD5
9ed90283838f2f9cf2838a0e3e632a16

SHA1
eb2f7caa20ef258f2b3e310afb8766ea3d51bb14

SHA256
ada193b8bb9bf64c08a6407597477d5c988c13b81be11495e4dda0388cbfe279

SHA512
b947214afb9b951c1202fb78dc388c219ef4fb3335e9a47d6944059f83c8a284b0e379c4da83630930dcc93a2d85614150787610f4ad4a0ff4a4581ca8fe537b

Download Submit
C:\Windows\SysWOW64\Fbelcblk.exe

Filesize
232KB

MD5
12f535c69f6e21eef0a63e70a8030a5b

SHA1
cbc958abd4478d00dbd34551ed6f39a54797d255

SHA256
30c25641039d7a2b307972af4bf1084d515ecc533b4ecfbdf9cd7e696627ca92

SHA512
21ce454db6c1ae9ea13b4e24311a0f8fe5d41d851565f3200d243a5148227fa19362684699b9b55c472225c1bfe0d23c2e379c018a73efa802ccf67aaa39b4bb

Download Submit
C:\Windows\SysWOW64\Fcniglmb.exe

Filesize
232KB

MD5
8dcceb0ddcddfb08346ad3cda3fed2b2

SHA1
a03deb02da66be5f34a3c6fcd9200f1c73dc112b

SHA256
61d74ac03ae7c9dd16e4c6359de63a257831feeb57942b4dbb19a5bd53b52fed

SHA512
5bca8eaaa1e8f90d3cebe125abaf407eba245c1273aa1ebf24f85f7ee70c037f5b037d67c6c58e3b1a2029f6fa854ddc4bb5847d658986d5c1da3f9a7697b4b8

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
232KB

MD5
1ac0790003b09e59ced346f4720ff193

SHA1
6f4f9f645e3f8e3afd61fb53ea7de5934429355c

SHA256
c18480f3d1b18799a564a1f0b1dc993a39a7d9cbff5545a7102f44b896329a42

SHA512
86223cf95c6abf551833b9daefe1b76b670f14792e2bbc0bd36f73c91e8fd208bdb3f8928514c7337433f33b74ff8dda278602d08a0bb95bbbb75700d971c030

Download Submit
C:\Windows\SysWOW64\Feoodn32.exe

Filesize
232KB

MD5
3027019f078be29fb0d4ba1117816780

SHA1
e0b8dcb008368920dd4fd21995eb9e78c5776589

SHA256
2b7d8a7dd73beedd9c516b0ba8d3b8b225f110903dfbecb540e38d4ee7cb75d7

SHA512
5fbb64fda92f9bd35a16c23e2d87aeaa64726640c1f4efac1aa7b4fff9e944a73f474c20204eb2670243b78d9fa7472c5c081a89be930a3d966ffcd797a8db29

Download Submit
C:\Windows\SysWOW64\Ffaong32.exe

Filesize
232KB

MD5
58eb757087fdc160a5facb6d05df85e9

SHA1
dad3565d70f0ba8008b16b827af3bcde21af4d38

SHA256
581689235a0c98d9f138295f33a3be0d16f364acb888d8ab4b6fe6d2c46c3728

SHA512
d42a2b8f64cfc7b8d73f9f85ce8939d03aca79bebdb99b0c2a1e888023010ba7ea94d8a96560ff7bf5953fa96b39c13e3d114b1f0874e5e7fc44c9230a959c00

Download Submit
C:\Windows\SysWOW64\Ffclcgfn.exe

Filesize
232KB

MD5
49b2b29593a2ea863757bc6ab7ca9ee4

SHA1
30586c7ff81492fa5109f98182fa1168fa4de64a

SHA256
963cadb739d8acb33a7efe4d07c37907476c25ddb4dda774ae0cef2dce760e6f

SHA512
d29643842226e90cff911673796848fbf2d5337cd729a2508b95e9ea2a91f93c5abbb1537d6b14b12ff2943474f8e9e66819992382add01a3d96ebb0b3f3460a

Download Submit
C:\Windows\SysWOW64\Fjhacf32.exe

Filesize
232KB

MD5
4afafab6633f93abad8ad4a2c0a4219c

SHA1
76712f0b706c1a39977040c05837e258f92fa62f

SHA256
9de23d72aa14115daa7d4edfd8b170ec331350f5f68687890cf5b9bfb12ee3db

SHA512
42251cc80fe9119ce9c6cca1005c625069c05f948e4634e50b70391896ea2c4a9d7dcb4242ff4e8b35e1d95cc43c2b53995637c70e5e8535de405514a3dc2ad7

Download Submit
C:\Windows\SysWOW64\Fllkqn32.exe

Filesize
232KB

MD5
512748464370a8c724b28b06707eb187

SHA1
cdead88bddee4b492dd12dfc255cba22268991ae

SHA256
437f2ab8c20feb5189f5806a1d96c2a73beabe415188a4b94b87a09920fb71da

SHA512
ce5baf133dff1773405838d71653ca82a106e3eae2ee4e01ceaba26aea3a579597b2052e72dc01723b70d751794d2ce166ec0d46d064138623b92645f342588e

Download Submit
C:\Windows\SysWOW64\Flngfn32.exe

Filesize
232KB

MD5
fe20c5af1334f72e2b4cad75c4a58816

SHA1
aba4b67ad426bb38cf30848e2c9be008004a6068

SHA256
c1e1852195156935c2cddf722675f780d041e99ae8899ca0141ff34ab3b1445a

SHA512
8cf6787986220c1ec6a8188f0fa96b2a60f689dab9e5d74f7a714804c82aa3823bf03fb6d43f379796ec96c889a70f00a74589d6e72ce6a61f211814a29c95f0

Download Submit
C:\Windows\SysWOW64\Fplpll32.exe

Filesize
232KB

MD5
5949522ef6c7ce3545078c76edfe03ca

SHA1
77b280cab854ee088d534f9610be2a14ee06fb36

SHA256
8d9b5570a81fe19c08a32ec4d912f52aa647c4927eff786f3bcc5d6f4f5910c5

SHA512
154fb26c486abb7e3be02426590946cd9c6bf57c607558ecadbe7796aa20f9d3bd42b53d81468b0306974f19b7c153a0582242d0e4a7bc6c4aad2cacaa6a3993

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
232KB

MD5
3e2796f1386810fb2583df5c96d9c779

SHA1
de562a733101d058f0d7ca346371152b92466171

SHA256
76a94e76edd277a9980f70557fa49d8f789cdc725b39f015aed1f7d11b19a237

SHA512
ffb9cf6e3445ddf5880efcb78a57145ac849a25d0df36dc8ee35253e1ccd26f1937604d74a9ae28ea8d0f6522aaa9bfb8b2d2ddf4b89edd1160ea6e399203316

Download Submit
C:\Windows\SysWOW64\Gbchdp32.exe

Filesize
232KB

MD5
f0821892384ed7aa27252795a5456245

SHA1
8f9af3276d82a83da780320076cc6cbf8a8d888a

SHA256
8d2569ca92611f267ead8b23e51a3db595a7e5bc32725ee8db9494d35411fe14

SHA512
c8cfb759ace51bc793837de19d97d7fbd42dd02f7ede0eb8ab42321ac5e19e6017ed49b4949161677c3db182103eb97a705f2122538ffcadeea4ed54c811a51d

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
232KB

MD5
29838d1aadb4eb85af2731750e692a26

SHA1
16f439751adcbb927d1a769cd916ca0c574e0a12

SHA256
563466a20bf3d4a1e569aa5318f6fb168cf3fbdd614bbd08900970b1de8a3825

SHA512
df9f03a0f9995de0aaa269beda972b6f2e10fa488b4eadb73fe690b2a70a4ae77db729be4bd680ce9d260600a827897fc7ab190491032c9a74d93fa578e253f6

Download Submit
C:\Windows\SysWOW64\Gbeejp32.exe

Filesize
232KB

MD5
3c804deb952bb40013c493408a199842

SHA1
c687c40361ea0f4b4b84b0b3cadcb9c788d14364

SHA256
bbd37adc7afbf0154898da14700fc09a49135decbdd40d497312eab3cbac14c1

SHA512
6b2aa134f333d085ee7372d18b48df2752e0b4db8aa0001596052f5fc9b261864948e2a2860fe4c4ecb8f0d2138441831d449372a7977166f6e7dba48b6d491d

Download Submit
C:\Windows\SysWOW64\Gdaociml.exe

Filesize
232KB

MD5
38f33d8c4ec182a4b695a07144e273df

SHA1
d4bf86466d98252f997c1edfac10c9c84587151b

SHA256
1826633b207c4e7bcd05953f587061e68c2f55b3b90cad3a8f8fc8ea6b8af3db

SHA512
8b0b024b2f286d1451f6fec4a2e9ca66d18d33357eae2566b209df7095ba43942f6ad7fbd9f335f65c43f91516e60bf18d50641dfe52fbc45d986040d3a0b5a7

Download Submit
C:\Windows\SysWOW64\Gdcliikj.exe

Filesize
232KB

MD5
7f6fe59ad6d8e9536a2b168d0a570e37

SHA1
eeedd17d829d02cdf424f72aa3be6869040aa7d2

SHA256
ffcc0c318ec5e67aa5ff542960e78d2c70e74df86812e25360b5d79c1a6dfb5d

SHA512
89d59d071e0e1fea588789a2e523bd7ad54cde33d15f7da09dad2a133468b07254ff35ac2231cd6e764bb6fa909b43e445797c66c00aa17ab27db2dbd26a674b

Download Submit
C:\Windows\SysWOW64\Gdlfhj32.exe

Filesize
232KB

MD5
d94846f2631f30585ee1ab6a3e6c644b

SHA1
bd099d8b4c1ebafa7eab2d245e762297bbeaeef4

SHA256
e8d8462d1b35d8d39ce60dc90a3601d633b4841653bf023a729f55c4868d6d3c

SHA512
7fe797ceb3bee5e90a0146cf830204cd4ba4ad66d7705ac0f78145eb2f9b840e1164e2d253afe15a8598150557b0fdd111c0f7a0be508f2fe003b5afc5e516fb

Download Submit
C:\Windows\SysWOW64\Gfmojenc.exe

Filesize
232KB

MD5
ba8c32650ed62adc826c34c8f8fd69f1

SHA1
746dd6cc5f6cade34f7410c96104fd5bf74558fa

SHA256
44a3133fa8334d53c94dc4e0151d3ebab3404c17e2f1edc3549e2d384e477a91

SHA512
dd22b8de714e2e04923418c62a3c2119867c3302947f29f249d398b16537ea3a398a3db323ea7e2217e2085122706b9a84cac008446c34fc31812ec6162bb939

Download Submit
C:\Windows\SysWOW64\Ggahedjn.exe

Filesize
232KB

MD5
6b09c407bf128b82a3e684cbd9b6e498

SHA1
25265f185492d21aa545e103543d6ea1d8eaf219

SHA256
476674e76a1f8a7fbb902fd63f2e34020957a17ba9fa106e39017842cab4ae39

SHA512
cc0bd408e8370ccbc6ef1a7f55cc80b9bdcc77dc51ac31258c0de36cd9751226432356fc574d4ff81c14babbc4b3a7531de38c003427e6738e2cdc807ca80ee3

Download Submit
C:\Windows\SysWOW64\Gigaka32.exe

Filesize
232KB

MD5
427010b3a501df1ac5917685f9579589

SHA1
6b92ab47307385104555773a002bbf8eb3a72f6f

SHA256
9d00dc51260da383a9447b1390173f7f41a9c2039d50236ebf72ea553ed15bc8

SHA512
5de944ecfcdff8be4736e89dbb5c73f86e6b125a2e1db3733b1d04137647badbe0a6729ae020107a17e41343ccc28f16644fb5d19c1eb65cbcc1cd69fac5f89d

Download Submit
C:\Windows\SysWOW64\Gingkqkd.exe

Filesize
232KB

MD5
824d54c1f9edb1f156a7114e6bfe92c8

SHA1
19a5562cdf40bb127f9844e9987b7eb63a4d47e0

SHA256
75310fe965fcfcb13d6a7318c572240fbc65468b1c78f73bd3cb5250dfbffe87

SHA512
457d02c2b348700c233a8ac5db46ea4a4ad43c0f6ea810de29b08dd332abae3ddf4da7fd06e1003de899de3f732828fd63de92a4789daf94cd3f02a4e9e56068

Download Submit
C:\Windows\SysWOW64\Gjfnedho.exe

Filesize
232KB

MD5
fa211ab2dbb76614588c0617b4096133

SHA1
437b272eb6d74d1869deb1d538e9c5b3fdfdbc12

SHA256
3ef7df71c36b8b4dcedb6f1602a782de47acddc8c739b9a417852d8c451eeaa9

SHA512
331e70246327c3e775c97513816fd4d9aca5e8ceb7ae9bf6442fd837d1affd50c01a7dd59e4a5fbd6cd35cf6c587b8227074c4e4d5436283d09eb6750cf11a9e

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
232KB

MD5
de16d512c444be759d47ed508f9f9cdd

SHA1
642cf49d7e06875f6efe730f288bf04ad9d3f938

SHA256
e179bc66cf63a62154441c47128c109b55a4b39aedf611fb1933a1c302cd47df

SHA512
ec1ca1893695e6a643254ccd568586b2dbe45c6c605c18312777c6327a82f6740fc835169fe2f3b180a7f8964e1eb08e97931b452b78714dc2ccfcc1655efc16

Download Submit
C:\Windows\SysWOW64\Glcaambb.exe

Filesize
232KB

MD5
a28fda81db1ca4077775547e15cef9a1

SHA1
8c0992a8839dfb210dd4a55b6cbb3a126b1fbfd3

SHA256
f4c9e5d84bb82f1377e85d3e145f3f15f1c4642138c930ac05db8bf4100ac81f

SHA512
d1805c95adcb97acdd4eff840d43bb83ec99f0a3bf4bcffb6901ba4579e169723df9eb83e21b1661291aece6f3dca679df876e72b10064ad269ba8aff013276c

Download Submit
C:\Windows\SysWOW64\Gphphj32.exe

Filesize
232KB

MD5
154077254e328593ff616a644c2b80a5

SHA1
e3b35fbf6069aef4dfae19dfdb42219b8a2d2e6f

SHA256
c0b24be11d4d0362763ca021c41e4bf341fa243f694bdadb618ea5ec678cfec3

SHA512
164cb12920c4483caf1aab75fe0d2a68eea7b9492a209d4f8e3a89c8bcfa980e1fb1cc0241618342ae119989bf59bae6b2799b5098d9b9db358c1252d25085f3

Download Submit
C:\Windows\SysWOW64\Gpnfge32.exe

Filesize
232KB

MD5
e23b33ce116874034cbb02749840867d

SHA1
788e76a59b1431923896e56f5732712d989e8185

SHA256
6b787745967dcefe89bb4865e9876435206b1edf086275b014944b66ab6db8d5

SHA512
68d09906a0ebd5af0a5dfcf74fc0e201244742d500f4e833e87115fd0bd1252a385c677e54ac8d57664deb3dae364f03b7fe66522dc5ba3f5ba665fa36730b9d

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
232KB

MD5
558e5e8539d7472ccc8c3df285a6a931

SHA1
1796e0184b1c649b8eeca6b3943ab4b6fb4fcc75

SHA256
9bcd2c674facc18132bfdb9054b8ed892927d0a08dfe63249289e73dd748191a

SHA512
39d8a4d8f929745e71f1e2a757aefda1b840046a28ab3c49992a1a019c3a8f1becb0a843a0d36a8f90420b16f7d3c0116ac71690f9949b74e3d6f959b7dbc9b6

Download Submit
C:\Windows\SysWOW64\Hdehni32.exe

Filesize
232KB

MD5
b028007a5e37d6f09c5f2cc34faef5b7

SHA1
8ef33082299931b703bb4dbc7d10484a6bf72319

SHA256
8e15dd8a25ae255871b298d66dd1553a954f855a1eabac30ddad84e11f687f8b

SHA512
e7b4ce3d3a2de59212c8aa76358c95c40ecf8202c5a20d70be424da500fceb1685620f53d75d6f2079a2c2e597042566c4251e8a0336eaf4cd92a6dfeca2d232

Download Submit
C:\Windows\SysWOW64\Hibafp32.exe

Filesize
232KB

MD5
b082e55926228b3a19e77d9ce64e0b33

SHA1
25e9cc3bd5d8c933dda6d656ffa10f765a13b9c8

SHA256
11d74540466bea310d08e43ceedd705356d1c20db8a60dce0eac4a3a03944e83

SHA512
8c87deeae76fd5149a9df9700cc5c4834fed9041ed2deefeaa0c02612dd899d955a3c69722e99c35602f0702d1aa92e3bd66b56ddba4988058b4add091690f5b

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
232KB

MD5
322b9e4d6b360c198c40c188c0801dee

SHA1
f899758c764d99b4ecbcd845bfbe5f96e541ba40

SHA256
31708958890bde77927c361653d9d3bd1556fe8d0f735cfafa72b2e87ce03d4e

SHA512
701d7db5694b91ce09e164758394123d56414d5492b8b221ed3a246aed544d890b2bef093dda928feee71b2ac3a2934528e3d43f3b8a6b38a31b258a545f331a

Download Submit
C:\Windows\SysWOW64\Hlambk32.exe

Filesize
232KB

MD5
7049cd40d26fb8c0be271ec882a90ab6

SHA1
88a7980eef73bcf464b6b4ce9963d4d0b175d6ed

SHA256
939621c27761ab9fde1143eeaac5df3118d08a8bd84a653fc40ba9045a5f9eea

SHA512
ee87c6a0daed2824c6ef84dc9b9baef32b817b2648423632d187cfe97eb95bff5e2c6a844bb4f9924d4911af656d32c1fd0425b148be7b6381422775d6f785f3

Download Submit
C:\Windows\SysWOW64\Hmnmgnoh.exe

Filesize
232KB

MD5
a1dbc3daf104061f018ade11e9877808

SHA1
ca2dda36cf453ba7d6c5bd8ff9fc257d6d00330b

SHA256
0d592a6ca6eb0888004fd75a8ba40617ce218a6ffcbe2db5b6d3c0b3559620ca

SHA512
aa4af3cafb05bceaeb64a8639a572c491b162d67715c617a533ea9c376dc3b115bc635c51000911c9eb1c3d4359acf4fd2bc64bd75fe2045f4099a9fa2c917d6

Download Submit
C:\Windows\SysWOW64\Hmpcbhji.exe

Filesize
232KB

MD5
8c37575605903a88d188b1507b32a02f

SHA1
f163a7d40da6ed7bcab5f62c011cad858d9f0270

SHA256
016582a6427b13c16553092c6749eff4f850d5f1d7d7224485e0e4dd6ccc6e23

SHA512
d29f99e715edc893ecc86b3d4019c7dfd10ebd0ae0c7e7dd6d20eaa41df389ca8ed344268545737d1e5c6f09ad5f9425ee0a8995ae036d4ae0928ac17196ca50

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
232KB

MD5
aadf27df8ae612962fb0638c7922adac

SHA1
c085510f2c410bee7537623d84b67a5abb23b490

SHA256
aa06259ad0a9d51b5815c898ac0b33c2912e48c42007999c3e23e0e3ac2e4fa0

SHA512
5f79e3b6efb9da9130c112e7b243f7b17df76f5b80fa68b7b4f1e9a385c13f21780f8cb9f3f705e5dc9869fe1c360d6f0e3f2983caaec820a302cf135288c78a

Download Submit
C:\Windows\SysWOW64\Ibaeen32.exe

Filesize
232KB

MD5
3c07a59da5710cb59b79bb9ca3716934

SHA1
038bf5acad8569a1218daee993ae5d88234d70ea

SHA256
3a6edb438e70f0d4c8e77c4c9201a524195e9984fc907335195145d5fd1bfd3f

SHA512
2271beb193ce8c4510afdabaf026989da62215547113cd115ea3f94cd244bf41956badefb29e1a8e5012d974cdf2d8ebfdd138c16ea80c1d6ac6f4945ef5f76d

Download Submit
C:\Windows\SysWOW64\Ilqoobdd.exe

Filesize
232KB

MD5
e8c0dc592e3da434185287c4168a605a

SHA1
64369657e0acbaca00dfba144825dc5c9a9a8db6

SHA256
affd543c36cb8c3b29621ad2d16534cd4f1d23db434e7d3e3ed64fe3b9e8a024

SHA512
623051b589160d1e1595cb3440193755721fd0feb394833c3f15609473f5dc302eb6e09ee0077a987340312064e98a5eb06fd512a391a0e166bb360690848c7a

Download Submit
C:\Windows\SysWOW64\Jiglnf32.exe

Filesize
232KB

MD5
c58d649fdf638f1c72d613064a53d676

SHA1
865125930c478f634c0cba5a922e35473b15a3c5

SHA256
e76a089f98b133b954c910906f003bcb0d4d0d8c3551668075009ea7e3e3af1d

SHA512
53b76a9a7c9f78f43ebfa5ef1d6396a1dee2deb6ecf47e314e5d2ec05a51c35f679064c4158da75447df263c591de6e66fcb4939203516e8f870d81045e505d3

Download Submit
C:\Windows\SysWOW64\Jilfifme.exe

Filesize
232KB

MD5
c99fc94e5983e37b9cc316d9a953529e

SHA1
962f8d3919a52becde4ced2c0a4db4ca229f5e4e

SHA256
f1851ba2219812f775e331ca89d916311bf60c06ca2943d1682d2316a85e9675

SHA512
e40078e24785226105e4cb4d4c6c1782d683ef644bcfc0e3d312697c9f241a88f1644ebe3d4a5cecb8b1bf087342acd2c2efb0f46b3ee8bf3facb214e27f78b3

Download Submit
C:\Windows\SysWOW64\Jllokajf.exe

Filesize
232KB

MD5
5c3a5bb6876f71fbe628285fa527bbde

SHA1
3fe36cafcadf3129333ba62247f747a1f19c4c90

SHA256
2d1d688ba4ff7c2d4d3bd7ba4ceb475f16c2098e26e4f5b27d3751c59dbb2572

SHA512
d8b2aed084244cf3f57cb285b580856b3d3bf9b153817cd92b189ca163b6dc8ad6966334d47d199c979666256359d31131e9cbae18246e04cff12543697bef02

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
232KB

MD5
5d2a5ab5f5b180e020adedcc01fdbd07

SHA1
cba872501b4c105ae8e527785ccb3debea99c3a3

SHA256
453033786657af0c03e7e354bb3eb539df9a45cfe4ba9711a48c280a9755321f

SHA512
786f09d23973d679544ccc46df3f81dc627f1dcbc29db191553e56471bf8fd515212425ddd2d003aabae7f761cdc2ccd4c1361f28816aaa2cf6b8f2296a15add

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
232KB

MD5
950cafa8ab6164f11de9e2bfab630765

SHA1
6903e6e9ab818bf1d3b5418b2fbf42b6bb819b47

SHA256
831eb966e970a58b09b963a18ce618d33736ceb7301feaf9957dea64b17d9860

SHA512
cdb5fe3955000b36b9df6534f624cf19b6618e5dd5a0fc5ac53962bbf9fc0abe3091d5f8e5a25c4cfa396f85d72ede189044f4fb29b05770fba98f4fa8e9c63c

Download Submit
C:\Windows\SysWOW64\Knenkbio.exe

Filesize
232KB

MD5
c3acc5abde711bd6b4496754999257dc

SHA1
b340a541b57341e6da8bda3a36bddc32d575000e

SHA256
47b13e9a1bf3c9d9fa77383838e5b8ac2902655d64cf77d481df4f2c7ef7163a

SHA512
41d104b87c82a3608994933d6f4c0d2fb13b6a238e770f85c628817a78f8eeead4f15acc8bd10c2179fd4bd7a0ed1c1b96d9ff7bc0ed00a85f48a780a8e61142

Download Submit
C:\Windows\SysWOW64\Knqepc32.exe

Filesize
232KB

MD5
ca1d2adc1fc475a01f49a9cb4c8323aa

SHA1
d46fd656a306dd26276f3313f68196f4fa485379

SHA256
78dac9cb5f96d2c6ee5756416c3d0e9bd565d2344ee444a46bb67f3c53375317

SHA512
c55d0a666bca2712bcc43dbf1947f500c4040188488458fb65a6d83ba2c03af1bca3dbefcac351ff49259f8659f62a8247dc0c41689c2aa200e31d0c8e0772c8

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
232KB

MD5
c0878bfd68c56924acc757ae00470163

SHA1
7f69564e22d97ac19776d4566446c2f90bac58f5

SHA256
d473296dd31992ec12c4a49545211245b7adaf48420035e684c8001218c99462

SHA512
88d0ecaf0ecf909b088b75854408fd9be5cb44f20e8cbbf2d297977f28710b37d476c11dcc0999a05101e96ab69d149b536216eceb51caea6823aa5fe1c45bb2

Download Submit
C:\Windows\SysWOW64\Lcjcnoej.exe

Filesize
232KB

MD5
efc1f8037a65a1868d0b433ea69f18c7

SHA1
f47f804e4790d23f1666f12914c2c3936328ca20

SHA256
26646d2bbe6be2f60b68a7760edd49eeca690e44cf19113b674e83016d9fe535

SHA512
e70fd1f827f6819e292dfc88b4b73997e7dca52bac70bfbe54821d9503f4371974e1279e5391fa09ed05502315bfbca77ebb91b44cd62613fd3fc72e1d07ef82

Download Submit
C:\Windows\SysWOW64\Lgpoihnl.exe

Filesize
232KB

MD5
37ecb666b223e65d9bfcc6fe4fec01d7

SHA1
a1157a4ef29f903251ae799a9ff44c366da340dd

SHA256
ae4b092764fe3094d21f8393a6b76d009450f09c2f5ea08046795fb2438d7dc8

SHA512
ed2c86aada5a9d5389992ddfe41d150f5fd261742486d4ffe342b0d027adad9696d3b54d88fc168de30a5b3350fe0987ba1bfdb771eaaea7fa405d56d6f578d2

Download Submit
C:\Windows\SysWOW64\Ljqhkckn.exe

Filesize
232KB

MD5
2669b8a84b5a45237731f10884c53407

SHA1
3f7554d83ac81f74d9de595dbd64f8ff1cd309f9

SHA256
8c040481841e4dded1db562e14cbcee8a763a781a6441c67ded1d1f540c7a772

SHA512
d78cb4b5f16d17e2e7ccecdfcfd37db16d513a6114e7be03a27bd20f78895045097b94455e8e966a941e7672190c78fdc27fdeb9de7a080e5b13f6d4009eed7d

Download Submit
C:\Windows\SysWOW64\Lnjnqh32.exe

Filesize
232KB

MD5
3e60ba532bdeb4b79fde25a4fdff402a

SHA1
623729e24e544a67a96806222465488877eb6225

SHA256
9c482a3c0eed011119a4d77ffe55d4d84464b9adcf8b0d0cd28f768f39cb67dc

SHA512
f132f41a77aa78d0bcfdbca3acf8b062316ed88efa8ec49470653b08cdbe7cea0e781f567bace1428350c9833eb11f54f55f0af5397b89993fbf4d089b490b54

Download Submit
C:\Windows\SysWOW64\Lobjni32.exe

Filesize
232KB

MD5
7daaab8acb88ccd7a344b2b61b2f256c

SHA1
d27afdbeac2d75e232c2ca82896aebf0198d18f0

SHA256
30b4a71470e95eb176e573cc0c092945d229a286205edaf17c874079764148df

SHA512
85441f3bddf538668a6109d4bf2b5645f6317f567a60cc6becef8945a1d7726180fd90b5076d509691f2c56601d25e05a2666d51cce7436d109c41be7f3ddb0f

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
232KB

MD5
dbb779b341735eecf31c924357aeccf2

SHA1
3d63c7a751b945ac29bba5b99d3d236bf8244397

SHA256
d4f7573605971cc33a955f2706a9d1dac2aa9687e551cc598c00311a66816b9b

SHA512
f24eb1a3d0c36f82b2ff2585d9de6b6bbdb40c5bb6c0ec88f45fa84677c5d1d41995bd1857f610ef6feeab5a5afc36d465d3abba554d7efb2c88812701fe5abe

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
232KB

MD5
8e1f0f905e7d6795cddcf1748abf5ba3

SHA1
eee1b163b9a7477eb53d26048e954b058f5b5dad

SHA256
a8dc08ae036a63c15980a58394264961120ec2acdb55b45e82ee088748abf9b3

SHA512
501505d2d271d696b3ad9125a3ed42344d200b435b5707d7f03ecf5c81156462c789c4bb7495f354696ef45d6da1f692840d7f3478f830d978eb4513e036e812

Download Submit
C:\Windows\SysWOW64\Mjjkaabc.exe

Filesize
232KB

MD5
6321bc0f21654e03348868cc24e106b5

SHA1
8c716ab8f0140566a9f4f3e4b30ba3d950d172e8

SHA256
dcded38b7ef35174f55d2217f929180d5f78d8c61bfb3179210a02742d1e04ae

SHA512
f3601e6dcd09c1c1420a86eccaf82d3cf45ea287efda71a1379b1afb0e2a13630b218317842b8807fb4d7f5c547f85348a19703bc211281c2d5b6fcf37235ca3

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
232KB

MD5
a22a2e881f561936f15e799db32a3256

SHA1
3ff067ae2073736f05e65a7ed483aac0a82e601f

SHA256
5593c28af9a24209475e5d218898d527b635c878fe6a4b4536e76e7540c2e280

SHA512
f998ed3f1adca4a913c188fc7ed6fab22a00ba0f6fff8f269b98c2483c40dafbffacfdb7697dbd39123302caae4f330cd377adddfc0ac8808fce7d7b12259862

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
232KB

MD5
405ccc99ded29bd7ad79dc34b543542d

SHA1
d745f07b4edb9062cb37e3bda47c79d6233be0bd

SHA256
46e41a8154b7921d8faf54b00a3be9c92e8a2b7ba5f964aaed34d8376a105b33

SHA512
cddd52bab59d81e5e3acfcd1e78f12cd929902d6df4fc0166ade4f2a5498e364d21318c10a3ba77a1f8b0d4bbd75457280b61eeb6d4d1b3dff514a426ba055f8

Download Submit
C:\Windows\SysWOW64\Nlmdbh32.exe

Filesize
232KB

MD5
6666d41407f88435db4796848506758c

SHA1
1e9ec736617d41282cb5c0322393597ed6fd3ef7

SHA256
2c06b42f1b117b22a2718663d0b7f2d2668d8e9909381d08d3567c985c27f5de

SHA512
c962c97c7c1c08678359261d1238780f54001dc1e941eae658f6f55411f31c1ed0db5365eb805b6b1e769985d8841c920d9ee5b1e6d5e4528166b37a6643a7b8

Download Submit
C:\Windows\SysWOW64\Nmdgikhi.exe

Filesize
232KB

MD5
a013547601fee66c6095c2c7101d1c1d

SHA1
31ef33be604ac3698ff7249408bcacd05110e6a3

SHA256
285ed124d1e41569770b3f007bb721c0afc0d2b3651cf820ffa95139a5750f40

SHA512
83ec1bfcfd396d88716bff4e5b6f379d28dda82c24f55854b277666be8b605dbc49ea83e60b44fda148a3e34d99edd8f38d4291c8e617b1aef63581fa5e56b02

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
232KB

MD5
a345c13999351db864b14af668d2ff82

SHA1
e12364ec1724a71c8472d0be3080b80baf28f84b

SHA256
cac2c3990b2460e8ed17bf6c73d605affcd03c700dd379d9f8d69304821f3df8

SHA512
a1f147d12ccf41db46f55e6468b65fde79cbe707dc8faf2155983631b8030c7e996c045a8646604c4b384e4b951554c99575f8af58afccd80e226813d658d47c

Download Submit
C:\Windows\SysWOW64\Ojigdcll.exe

Filesize
232KB

MD5
0632bc87ae36f8968e6da5440c8714ac

SHA1
ffeb253442727e94d5c18fe0cfa81b620b7a273d

SHA256
c87e5b78b3647041730d713ac056b1e4822f2e2c479f934a8e340378e4e15fbe

SHA512
ea086317384ee900d3a756f82a7cc6dd8d5acea8db182492a89c2318a88a41a0541d797b6372844cc44b395462b899d823531d5e26c1027daf596074417190ac

Download Submit
C:\Windows\SysWOW64\Omdppiif.exe

Filesize
232KB

MD5
b10e070ec8f0ba5a69565894bdabd9db

SHA1
8a05226b70a60a7c119bf33fe50c660d2db9f975

SHA256
d05de6da1efc08f98ea34caa7e85e6054e76cae12bae0c419b13d3e0aaa550fd

SHA512
4d3ccd55a8d55a3437cd0c2c8421b6313c8931921f641df9ac69297537a41e7bc1d76cbe720f5ebac9bcc53299eb0df63ad84f944c2b4ea5e0c1cb0c5514e5c2

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
232KB

MD5
d30fff793083a391c8595311b13ea6c4

SHA1
72d845abbff8eb9473c006b35eac5cb3dcf99a90

SHA256
c9a4f1c3916ed6a025f5f92d1c90a88a4def1d1a5166fc182f29648c68055ba2

SHA512
062d00bbaafab68305885e49f0c7ade0713deda7dc377aaa84adfa31d8667f120814946f960268fecaa6514ebfaed0e75181c841027c807d8f1ee7a8228e79c0

Download Submit
C:\Windows\SysWOW64\Phdnngdn.exe

Filesize
232KB

MD5
b1ae83a903e745c5ee0b4e191ac2b53b

SHA1
29884602815211ef4b2e86dcccbf1b89c065489e

SHA256
b3a2fa7aec959701d68255bf3db66a6cede3274e18e0860c9d1c03eb24de6ec3

SHA512
87e947e7cf05f9bab840105f013becad534ce5873678879e968b33c899182d784b24a33d258c909a81016ba6cc5d1a77bcda94bc59c77a55619251a0a2bc0322

Download Submit
C:\Windows\SysWOW64\Pmpolgoi.exe

Filesize
232KB

MD5
f9053796619f110f35627c3a8baa07aa

SHA1
ca83f9165d1f575809bd59ebacc5cb8152710f7c

SHA256
712bf1ec4962e7d1d1a77f957b34487365085e1ce8192a90d70f91a84d741e98

SHA512
90f33623931a3263cc2e1734d1d6d39764d6c925ebe113f84a0a1a2ac23b5c9e3da6a92e8f9e4ae8ca3ba7e448fc102d1c0778981358ec373b0c1d9e13f806a1

Download Submit
C:\Windows\SysWOW64\Pnplfj32.exe

Filesize
232KB

MD5
aa3374bd55ddc89275ef803d19c8a169

SHA1
1195a168e271eda3459935c3dcb667fa254a13c2

SHA256
8cdc6fc7b858b5a0cf43bf240e8fac4812722f6444fd55e68e344a3f3a2b0872

SHA512
654d18a9712448e4326ee71c0a210630d740f1ed20ed036be4fd02819506a0bb806b7646d4c940edb65744e3be69c658cdb27b0d2de1f1f97acc1529b1e15655

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
232KB

MD5
9d916c5208de4a77a54c35dee732d1d2

SHA1
52500931e01bf4bd847b766313d8060afe384f6b

SHA256
750a0dac7bf5a6c155ba15632623f9c5502dfb0ee8d353587a3a283e1a218ba2

SHA512
f80a9d5a22ed88c2f8770e0518d9f287f36827fd9f3f9a0375b204d3ad3491aafe232994c7205cc9a4aaac3dc47990745f2411bd7b321685071ca71a39e73d51

Download Submit
C:\Windows\SysWOW64\Qaalblgi.exe

Filesize
232KB

MD5
796cec041007d4b0b65be49e71d13eb9

SHA1
d6772a5af5083bb7f75cfd8b9dfa8b266d153ae6

SHA256
e19222c8103305ea96ca05c045ee372d594924470ce773858db7087e5516c94f

SHA512
8838f6c8e4c1e14eb91c9f2dec32cca4343890b50f632083d21a6b70744c1948ae92d234376b7fd00756f9d6f61c4fff1b0e9511248f0ee106c0adf6fd330382

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
232KB

MD5
e00db029dd2714d1bf440b753e75874a

SHA1
35b08035fce77015a94171499670ab6d385b425e

SHA256
6f0abea301af59c7632c93bcbb55ae6ddba822d9aaecfd546cea844a16fce4b0

SHA512
2fd869c58cf65e7885b5d99a95fe5c38174932486eba9bc275dc16fe48b9576879066030b088966a9e16dafea7e28fcfb258add2f287fb74939acc05ca7a4e44

Download Submit
memory/220-386-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/224-489-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/456-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/996-423-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-447-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1096-518-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1144-290-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1172-188-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1208-357-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1244-363-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1280-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1360-573-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1384-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1384-593-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1392-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1396-345-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1408-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1408-572-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1412-267-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1464-502-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1668-459-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1704-351-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1716-273-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1932-181-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1952-229-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2068-483-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-411-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2096-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2132-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2204-471-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2208-594-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2248-490-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2296-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2296-579-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2324-309-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2348-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2640-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2660-278-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2692-435-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2808-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2808-586-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2960-566-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2980-551-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2980-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2992-559-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2996-260-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3080-333-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3084-465-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3148-587-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3164-321-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3168-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3248-512-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3292-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3292-544-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3388-285-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3428-369-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3552-520-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3560-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3560-558-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3624-398-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3680-496-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3732-297-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3828-237-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3896-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3980-552-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4068-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4124-253-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4156-197-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4168-327-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4196-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4208-429-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4300-477-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4336-538-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4340-545-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4356-452-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4364-213-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4404-580-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4412-303-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4424-381-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4448-393-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4488-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4516-565-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4516-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4520-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4568-405-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4600-221-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4612-416-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4696-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4788-375-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4852-532-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4868-441-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-526-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4996-315-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5028-339-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5068-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5112-245-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5404-2654-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9388-2668-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9736-2659-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9772-2689-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9816-2688-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9864-2687-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9912-2686-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10040-2680-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads