berbew | 99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe
Size

96KB
MD5

af2cbdbd9e4cee94cf4bebc969ca61b8
SHA1

a6890eb12562d6f05d119b30f58ccf29c98e917d
SHA256

99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0
SHA512

19698e758791a091c7b3db5ce7aced745a24948501686bdc396178bc006b3c9558722afe56f9689270e9971ae32b14bf8246526f7bf8f6c1c44397400a5c17cf
SSDEEP

1536:Z6VbRRtxkfKTHNIOcXFQXc4JgclCRQ+0R5R45WtqV9R2R462izMg3R7ihX:YRt2KbNwaXZCe+0HrtG9MW3+3l2X

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aahbbkaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qdoacabq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aekddhcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eppjfgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hipmfjee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jmeede32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpjmnjqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hdokdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdbjhbbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gfodeohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjjnifbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Klcekpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npepkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fikbocki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgeghp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljobpiql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odmbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmbphg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqpamb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nghekkmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Baannc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opqofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odoogi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjodla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojajin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkhkjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopmii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Modgdicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmpqfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Higjaoci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akepfpcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doaneiop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gidnkkpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nghekkmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oacoqnci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Popbpqjh.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4444	Fikbocki.exe
852	Fdqfll32.exe
4008	Fbcfhibj.exe
3152	Fjjnifbl.exe
3432	Fmikeaap.exe
844	Fjmkoeqi.exe
1896	Fmkgkapm.exe
332	Ffclcgfn.exe
904	Fmndpq32.exe
4512	Fffhifdk.exe
2864	Fmpqfq32.exe
4688	Gdjibj32.exe
5060	Gfheof32.exe
3544	Gpqjglii.exe
2248	Gjfnedho.exe
3688	Gpcfmkff.exe
1640	Gkhkjd32.exe
628	Gbdoof32.exe
2012	Gmiclo32.exe
1852	Gdcliikj.exe
4004	Gkmdecbg.exe
4384	Hpjmnjqn.exe
620	Hbhijepa.exe
996	Hibafp32.exe
3648	Hlambk32.exe
532	Hplicjok.exe
2452	Hckeoeno.exe
3664	Hkbmqb32.exe
4292	Hdjbiheb.exe
4908	Hkdjfb32.exe
4760	Higjaoci.exe
3092	Hdmoohbo.exe
4456	Hiiggoaf.exe
5012	Hdokdg32.exe
4508	Ingpmmgm.exe
4476	Idahjg32.exe
8	Ilmmni32.exe
2212	Icfekc32.exe
4284	Iknmla32.exe
3452	Iloidijb.exe
1668	Igdnabjh.exe
4268	Innfnl32.exe
3824	Ilafiihp.exe
3632	Icknfcol.exe
1540	Ilccoh32.exe
4428	Icnklbmj.exe
2992	Jncoikmp.exe
4612	Jpaleglc.exe
4600	Jgkdbacp.exe
4484	Jpdhkf32.exe
2660	Jjlmclqa.exe
2860	Jdaaaeqg.exe
1632	Jqhafffk.exe
1704	Jknfcofa.exe
3540	Jnlbojee.exe
4388	Jgeghp32.exe
224	Knooej32.exe
1264	Kggcnoic.exe
3388	Kmdlffhj.exe
4000	Kkeldnpi.exe
4228	Kkgiimng.exe
4376	Kdpmbc32.exe
3144	Kcbnnpka.exe
1716	Kdbjhbbd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Icfekc32.exe	Ilmmni32.exe
File created	C:\Windows\SysWOW64\Qdphngfl.exe	Qaalblgi.exe
File opened for modification	C:\Windows\SysWOW64\Jmeede32.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Icfekc32.exe	Ilmmni32.exe
File created	C:\Windows\SysWOW64\Hhbdbmfg.dll	Pkbjjbda.exe
File created	C:\Windows\SysWOW64\Oddfcg32.dll	Aahbbkaq.exe
File created	C:\Windows\SysWOW64\Cfpffeaj.exe	Cnindhpg.exe
File created	C:\Windows\SysWOW64\Qcbhah32.dll	Cfbcke32.exe
File created	C:\Windows\SysWOW64\Polalahi.dll	Jmbhoeid.exe
File created	C:\Windows\SysWOW64\Difebl32.dll	Moipoh32.exe
File created	C:\Windows\SysWOW64\Fmndpq32.exe	Ffclcgfn.exe
File created	C:\Windows\SysWOW64\Pldcjeia.exe	Paoollik.exe
File created	C:\Windows\SysWOW64\Hmlephen.dll	Cndeii32.exe
File created	C:\Windows\SysWOW64\Dmokdgeg.dll	Lpfgmnfp.exe
File opened for modification	C:\Windows\SysWOW64\Npepkf32.exe	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Omqmop32.exe	Ojbacd32.exe
File opened for modification	C:\Windows\SysWOW64\Qlimed32.exe	Qdbdcg32.exe
File created	C:\Windows\SysWOW64\Lfojjf32.dll	Jpdhkf32.exe
File created	C:\Windows\SysWOW64\Jlpncq32.dll	Napjdpcn.exe
File created	C:\Windows\SysWOW64\Ocdglf32.dll	Nhahaiec.exe
File created	C:\Windows\SysWOW64\Abjfai32.dll	Ahippdbe.exe
File opened for modification	C:\Windows\SysWOW64\Hipmfjee.exe	Hedafk32.exe
File opened for modification	C:\Windows\SysWOW64\Lcimdh32.exe	Lnldla32.exe
File created	C:\Windows\SysWOW64\Mjjkaabc.exe	Mgloefco.exe
File created	C:\Windows\SysWOW64\Hiacfqch.dll	Jjlmclqa.exe
File created	C:\Windows\SysWOW64\Lkhpjc32.dll	Cnfaohbj.exe
File opened for modification	C:\Windows\SysWOW64\Amnlme32.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Caageq32.exe	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Ddooacnk.dll	Idahjg32.exe
File created	C:\Windows\SysWOW64\Kkgiimng.exe	Kkeldnpi.exe
File created	C:\Windows\SysWOW64\Ppihoe32.dll	Glkmmefl.exe
File created	C:\Windows\SysWOW64\Ibfnqmpf.exe	Iebngial.exe
File opened for modification	C:\Windows\SysWOW64\Komhll32.exe	Jnlkedai.exe
File opened for modification	C:\Windows\SysWOW64\Nadleilm.exe	Nnfpinmi.exe
File created	C:\Windows\SysWOW64\Phodcg32.exe	Omjpeo32.exe
File created	C:\Windows\SysWOW64\Eokqkh32.exe	Emmdom32.exe
File created	C:\Windows\SysWOW64\Jhpicj32.dll	Ngqagcag.exe
File created	C:\Windows\SysWOW64\Kmephjke.dll	Pplobcpp.exe
File opened for modification	C:\Windows\SysWOW64\Cnfkdb32.exe	Ckgohf32.exe
File created	C:\Windows\SysWOW64\Gdcliikj.exe	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Fmggcl32.dll	Komhll32.exe
File created	C:\Windows\SysWOW64\Lnnlhc32.dll	Gjfnedho.exe
File opened for modification	C:\Windows\SysWOW64\Kmdlffhj.exe	Kggcnoic.exe
File created	C:\Windows\SysWOW64\Dkahilkl.exe	Dhclmp32.exe
File opened for modification	C:\Windows\SysWOW64\Kjjbjd32.exe	Kfnfjehl.exe
File opened for modification	C:\Windows\SysWOW64\Cpbjkn32.exe	Caojpaij.exe
File opened for modification	C:\Windows\SysWOW64\Cljobphg.exe	Cfpffeaj.exe
File created	C:\Windows\SysWOW64\Dnbokg32.dll	Hdjbiheb.exe
File created	C:\Windows\SysWOW64\Lggldm32.exe	Lclpdncg.exe
File created	C:\Windows\SysWOW64\Qbobmnod.dll	Mgaokl32.exe
File created	C:\Windows\SysWOW64\Mjijkmod.dll	Ohcegi32.exe
File opened for modification	C:\Windows\SysWOW64\Pajeam32.exe	Poliea32.exe
File opened for modification	C:\Windows\SysWOW64\Clgbmp32.exe	Cdpjlb32.exe
File created	C:\Windows\SysWOW64\Cljobphg.exe	Cfpffeaj.exe
File opened for modification	C:\Windows\SysWOW64\Emmdom32.exe	Eeelnp32.exe
File opened for modification	C:\Windows\SysWOW64\Ifmqfm32.exe	Hiipmhmk.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Gbdoof32.exe	Gkhkjd32.exe
File created	C:\Windows\SysWOW64\Dcgmfg32.dll	Lqpamb32.exe
File created	C:\Windows\SysWOW64\Kbblcj32.dll	Ekaapi32.exe
File created	C:\Windows\SysWOW64\Fpgpgfmh.exe	Ffnknafg.exe
File opened for modification	C:\Windows\SysWOW64\Kodnmkap.exe	Kjgeedch.exe
File opened for modification	C:\Windows\SysWOW64\Ocjoadei.exe	Oakbehfe.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Baannc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10204	9260	WerFault.exe	497

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkmdecbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eppjfgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdjgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgkdbacp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkahilkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eejeiocj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komhll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibafp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlambk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahippdbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbnmke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dooaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgbchj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mminhceb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhmofj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pajeam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clgbmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnlbojee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgaokl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbcke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebimgcfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffclcgfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmbaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlbcnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnqfcbnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfnjpfcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojajin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfeeabda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgeakekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chfegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kggcnoic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lclpdncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiildio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iidphgcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgphpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fffhifdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpdhkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgifbil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmpcbhji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlimed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedgjgkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hedafk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pldcjeia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cohkokgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eeelnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hipmfjee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjjnifbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjlmclqa.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hkbmqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ckhecmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgeaiknl.dll"	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmigpf32.dll"	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkopekaa.dll"	Ennqfenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqcmdnk.dll"	Hmpcbhji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peaggfjj.dll"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qdoacabq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fopjdidn.dll"	Mmpmnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ialjan32.dll"	Eehicoel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfodeohd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdejk32.dll"	Hkdjfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkalplel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aeaanjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fffhifdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgdojhec.dll"	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjijkmod.dll"	Ohcegi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Glkmmefl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbfadafe.dll"	Gpqjglii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pajeam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbjena32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkogl32.dll"	Mcgiefen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Chkobkod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icinkkcp.dll"	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gabfbmnl.dll"	Mjodla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcgiefen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binlfp32.dll"	Npepkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hdokdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dooaoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcimdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnoaaaad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hdmoohbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Igdnabjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfoomidj.dll"	Pldcjeia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmokdgeg.dll"	Lpfgmnfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojajin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbhijepa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Popbpqjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejoaandc.dll"	Aekddhcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbeejp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejljgqdp.dll"	Jnlbojee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qdbdcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpapmqq.dll"	Digehphc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfnikd32.dll"	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcbpjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gkmdecbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcbhah32.dll"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bdagpnbk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4444	1932	99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe	85
PID 1932 wrote to memory of 4444	1932	99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe	85
PID 1932 wrote to memory of 4444	1932	99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe	85
PID 4444 wrote to memory of 852	4444	Fikbocki.exe	86
PID 4444 wrote to memory of 852	4444	Fikbocki.exe	86
PID 4444 wrote to memory of 852	4444	Fikbocki.exe	86
PID 852 wrote to memory of 4008	852	Fdqfll32.exe	87
PID 852 wrote to memory of 4008	852	Fdqfll32.exe	87
PID 852 wrote to memory of 4008	852	Fdqfll32.exe	87
PID 4008 wrote to memory of 3152	4008	Fbcfhibj.exe	88
PID 4008 wrote to memory of 3152	4008	Fbcfhibj.exe	88
PID 4008 wrote to memory of 3152	4008	Fbcfhibj.exe	88
PID 3152 wrote to memory of 3432	3152	Fjjnifbl.exe	89
PID 3152 wrote to memory of 3432	3152	Fjjnifbl.exe	89
PID 3152 wrote to memory of 3432	3152	Fjjnifbl.exe	89
PID 3432 wrote to memory of 844	3432	Fmikeaap.exe	90
PID 3432 wrote to memory of 844	3432	Fmikeaap.exe	90
PID 3432 wrote to memory of 844	3432	Fmikeaap.exe	90
PID 844 wrote to memory of 1896	844	Fjmkoeqi.exe	91
PID 844 wrote to memory of 1896	844	Fjmkoeqi.exe	91
PID 844 wrote to memory of 1896	844	Fjmkoeqi.exe	91
PID 1896 wrote to memory of 332	1896	Fmkgkapm.exe	92
PID 1896 wrote to memory of 332	1896	Fmkgkapm.exe	92
PID 1896 wrote to memory of 332	1896	Fmkgkapm.exe	92
PID 332 wrote to memory of 904	332	Ffclcgfn.exe	93
PID 332 wrote to memory of 904	332	Ffclcgfn.exe	93
PID 332 wrote to memory of 904	332	Ffclcgfn.exe	93
PID 904 wrote to memory of 4512	904	Fmndpq32.exe	94
PID 904 wrote to memory of 4512	904	Fmndpq32.exe	94
PID 904 wrote to memory of 4512	904	Fmndpq32.exe	94
PID 4512 wrote to memory of 2864	4512	Fffhifdk.exe	95
PID 4512 wrote to memory of 2864	4512	Fffhifdk.exe	95
PID 4512 wrote to memory of 2864	4512	Fffhifdk.exe	95
PID 2864 wrote to memory of 4688	2864	Fmpqfq32.exe	96
PID 2864 wrote to memory of 4688	2864	Fmpqfq32.exe	96
PID 2864 wrote to memory of 4688	2864	Fmpqfq32.exe	96
PID 4688 wrote to memory of 5060	4688	Gdjibj32.exe	97
PID 4688 wrote to memory of 5060	4688	Gdjibj32.exe	97
PID 4688 wrote to memory of 5060	4688	Gdjibj32.exe	97
PID 5060 wrote to memory of 3544	5060	Gfheof32.exe	98
PID 5060 wrote to memory of 3544	5060	Gfheof32.exe	98
PID 5060 wrote to memory of 3544	5060	Gfheof32.exe	98
PID 3544 wrote to memory of 2248	3544	Gpqjglii.exe	99
PID 3544 wrote to memory of 2248	3544	Gpqjglii.exe	99
PID 3544 wrote to memory of 2248	3544	Gpqjglii.exe	99
PID 2248 wrote to memory of 3688	2248	Gjfnedho.exe	100
PID 2248 wrote to memory of 3688	2248	Gjfnedho.exe	100
PID 2248 wrote to memory of 3688	2248	Gjfnedho.exe	100
PID 3688 wrote to memory of 1640	3688	Gpcfmkff.exe	101
PID 3688 wrote to memory of 1640	3688	Gpcfmkff.exe	101
PID 3688 wrote to memory of 1640	3688	Gpcfmkff.exe	101
PID 1640 wrote to memory of 628	1640	Gkhkjd32.exe	102
PID 1640 wrote to memory of 628	1640	Gkhkjd32.exe	102
PID 1640 wrote to memory of 628	1640	Gkhkjd32.exe	102
PID 628 wrote to memory of 2012	628	Gbdoof32.exe	103
PID 628 wrote to memory of 2012	628	Gbdoof32.exe	103
PID 628 wrote to memory of 2012	628	Gbdoof32.exe	103
PID 2012 wrote to memory of 1852	2012	Gmiclo32.exe	104
PID 2012 wrote to memory of 1852	2012	Gmiclo32.exe	104
PID 2012 wrote to memory of 1852	2012	Gmiclo32.exe	104
PID 1852 wrote to memory of 4004	1852	Gdcliikj.exe	105
PID 1852 wrote to memory of 4004	1852	Gdcliikj.exe	105
PID 1852 wrote to memory of 4004	1852	Gdcliikj.exe	105
PID 4004 wrote to memory of 4384	4004	Gkmdecbg.exe	106

C:\Users\Admin\AppData\Local\Temp\99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe
"C:\Users\Admin\AppData\Local\Temp\99551f117c16532390e9fe999c123c47d5a6d5e5683b06686d57624db8311fd0.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\Fikbocki.exe
  C:\Windows\system32\Fikbocki.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\Fdqfll32.exe
    C:\Windows\system32\Fdqfll32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\SysWOW64\Fbcfhibj.exe
      C:\Windows\system32\Fbcfhibj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3152
      - C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:844
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:332
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:620
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        27⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        28⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        39⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        40⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        41⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        43⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        44⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        45⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        46⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        47⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        48⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        49⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        54⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        55⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        58⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        60⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        62⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        63⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        64⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1944
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        67⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        68⤵
        Modifies registry class
        
        PID:1352
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        70⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        72⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        73⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        74⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        76⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        77⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        79⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        80⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        81⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        82⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3952
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        84⤵
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        85⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        87⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        88⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        89⤵
        Drops file in System32 directory
        
        PID:452
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        90⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3060
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        93⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        94⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        95⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        97⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        98⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2584
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        100⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1736
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        102⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        103⤵
        Drops file in System32 directory
        
        PID:4152
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        104⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        105⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        106⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        107⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        108⤵
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        109⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        110⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        111⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        112⤵
        Drops file in System32 directory
        
        PID:768
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        113⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        115⤵
        Drops file in System32 directory
        
        PID:2856
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        117⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        119⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        120⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        121⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        122⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        125⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        126⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        127⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        129⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        130⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        131⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        132⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        133⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        134⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        138⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        139⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        140⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        142⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        143⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        144⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        145⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        146⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        148⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        150⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        151⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        152⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        153⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        154⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        155⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        156⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        157⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        158⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        159⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        160⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        161⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        162⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        163⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        164⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        165⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6184
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        170⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        171⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        172⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        173⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        175⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        176⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        179⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        180⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        181⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        184⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        185⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6180
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        189⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        190⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        191⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        192⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        194⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        196⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        197⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        198⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        199⤵
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        201⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        204⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        205⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        207⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        208⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        209⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        210⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        211⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        213⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        214⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        215⤵
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        216⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        217⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        218⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        219⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        222⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        223⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        224⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        226⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        227⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        228⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        230⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        231⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        232⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        233⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7592
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        235⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        236⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        237⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        239⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        240⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7896
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        242⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        243⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        244⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        245⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        246⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        247⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        248⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        249⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        251⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        253⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        254⤵
        Drops file in System32 directory
        
        PID:7492
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        256⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        257⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        258⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        259⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        260⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        261⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        263⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        264⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7208
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        265⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        266⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        267⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        268⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        270⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        271⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        273⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        274⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        275⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        276⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        278⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        279⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        280⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        281⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        282⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        283⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        284⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        286⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        287⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        288⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        289⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        290⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        292⤵
        Drops file in System32 directory
        
        PID:8340
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        293⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        294⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        295⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        296⤵
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        297⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        298⤵
        Modifies registry class
        
        PID:8684
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        299⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        300⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        301⤵
        Drops file in System32 directory
        
        PID:8812
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8848
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        304⤵
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        305⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        306⤵
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        308⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:9196
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        310⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        311⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        312⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        313⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        314⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        315⤵
        Drops file in System32 directory
        
        PID:8704
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        317⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        318⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        319⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        320⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9168
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        322⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        323⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        325⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        326⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        327⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        328⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        330⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        331⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        332⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        333⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        335⤵
        Modifies registry class
        
        PID:8972
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        336⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        337⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:8676
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        339⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        340⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        341⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        342⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        343⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:8472
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8908
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:9224
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        347⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9356
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        350⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        351⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        352⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        353⤵
        Drops file in System32 directory
        
        PID:9544
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        354⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9632
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:9676
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        357⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        358⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        359⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        360⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        361⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9944
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9988
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        364⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        365⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        366⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        368⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        369⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        370⤵
        Modifies registry class
        
        PID:9300
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        371⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        372⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9508
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        374⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        375⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        376⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        377⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        378⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        379⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9976
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        381⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        382⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        383⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10132
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        385⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10220
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        386⤵
        Drops file in System32 directory
        
        PID:9280
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        387⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9608
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        390⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:9848
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        393⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        394⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        395⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        396⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        397⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        398⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9708
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        399⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:10156
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        402⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:9260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9260 -s 412
        404⤵
        Program crash
        
        PID:10204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 9260 -ip 9260
1⤵
PID:9800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahgcjddh.exe

Filesize
96KB

MD5
6ba6d220fa311f8cc456293da9763b00

SHA1
8d52f41a486a432a395f778fc10c8f64011b9f1e

SHA256
f735eaa3efa239353dfd2ac0509c6976e1979b97ca18d9b191acea4afe6ae53e

SHA512
e727dfde3c4ab5654ad4af4a7dc929684ce8d0369ea2cee60791c86a8cff37a3146fd0fc6593a0fce81a5b07b9f99d07b3fc2a599e0aa2d82ae23902c1b7cbbc

Download Submit
C:\Windows\SysWOW64\Aonhghjl.exe

Filesize
96KB

MD5
0f97f8b0ca49b519cdb0a4c88999025c

SHA1
d3e384fccaf34ef2ad6cb5508dc8360ee69fae21

SHA256
ca5c142ca1ee9261f409494cd72f935468de5611994167d3ad759812fb2ac082

SHA512
62131b9973dd1e72d4a6439284eea469e94aefcf64ca4c6847bf1a33ff94695dce26b16ed8857d70d053707699fc9d036cf61d16278da26583f79e46ceaf655d

Download Submit
C:\Windows\SysWOW64\Bdagpnbk.exe

Filesize
96KB

MD5
fb544fd7828aaef07832cce8d627e9c5

SHA1
79122baa13f467722c85419ea993bd51e6a91b54

SHA256
6c5dd063857b405bb8168c1158fabb7377616982da3439e7657731063710a497

SHA512
4962cedfe4953dd53eb57335651702d25df6ca188a33f86dbd2e5309e5327f082b75f5876973bc03a9f422abff32a2776f4f61c355d6a3cdb79b60a21eeb62cf

Download Submit
C:\Windows\SysWOW64\Bkobmnka.exe

Filesize
96KB

MD5
86f1504d00463e3541252ae813565d3a

SHA1
b3d572ed5ffd74ba4488621e799988dd79365370

SHA256
df578fbe5a052eb36c6f6e298e21de9ab342dea74437aa4064253b54d1b17645

SHA512
3e2b0cfd5e63b1af256f9868d82c090d7b1bb277c509ac13a1996b7640deb67e0152f63f29c7b2f52405244b63d7d77768cc8f369b195c740e3ae02bbea7617d

Download Submit
C:\Windows\SysWOW64\Bnoknihb.exe

Filesize
96KB

MD5
acfba77825513473854bcf8012e19479

SHA1
3e5b7c302609bc4ea72dbbc86be466a5d43b8002

SHA256
3a70c5655a64cb11fa5390dea44bfd8e9983941ac866e7e0cd0d861ba84e9725

SHA512
534a3e4d7fbf5bcce5f2cd503d9389afe9f5cad568573e25a4490deeaf88f5cb8e23b4684a4b019554fad82714e746c8501a140de904f5752ec1bc171423b094

Download Submit
C:\Windows\SysWOW64\Cammjakm.exe

Filesize
96KB

MD5
9cc61a67151beb38c0b337c3ec020c6b

SHA1
bd2affadfe09e718f585a96810d6a119a77380af

SHA256
49ebc695de317ddd3b20d9304e8ee54f22a984639785bbf4b19bf925aae61094

SHA512
5b12b2817fc80658d633d43acd25625d3ef0dc0ec36e840ed3f69a209aac6c51ba0d55c06798befbccec6d1acd32ed7fc73089416aabf5748dcc0f7fcf63083d

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
96KB

MD5
7edfb33b5087cff58fa33f9f88b23782

SHA1
6c03bdb358d07fb3abeaa7e8fddce7b554c4b482

SHA256
270458a8825dfc1bd286f6842aaffe107555448de374cbb495c254bb98b4c45e

SHA512
c3e0ea3c3e3f3f6afa496a3828a7be7473e41cae6f254120e5f4c69fc2a71bfd33fa24e93f4e665dbe47939ab8e3dba4d11812aa52b457eeb05b361ef532932f

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
96KB

MD5
b315f3edd25dba392980ec4547d3a739

SHA1
d12359517a41e314b316177667865e13d8e57dca

SHA256
01cb47c31b6b767da30e6472009ac0cd068488d4a11cf65f16523af49f52bdb7

SHA512
cab94d5bd5c475f32e8792d28ba4398d7f43013bc66eedc24e2bc13ac6e063456af0158a51c3b4944ef42f385395dc21b20561921fd3b47231f341fdee794b13

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
96KB

MD5
e570128529ad0dd7d068f6f90f793e88

SHA1
8faf627d5a6363546d407e04ddbe228cd376fd82

SHA256
8913b3dc6a961d067c7a76fad029490c5773bc579a0b4811c83bfdf909ef8657

SHA512
0621dd811ddd65cc5cf2f7a1ae62a644d409edbfc3ee3bf78fb18d16dc71987113f1ebe08fd2cbc5e75dabf10914526e6255f922954557ca751a4aa081262325

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
96KB

MD5
95de9792c74fb3fec2eaba8485265336

SHA1
133e52472f4a83404eff0cbea78fb86a1e3912b9

SHA256
f34d7dd8bf3bac18b6e41053049fb2a75e9d57e2485fbebed9732f4b8e1aace4

SHA512
3bbd3a450e99408fced64fac959c9b28acb9c19f3991f6dd0de3a197b8ca9e3bfc59f1a26b2894c461658044a6e661dbb57a9cbad091bd1c64a046c25cd1afa4

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
96KB

MD5
6360d4f857bc76c32251b8a8cf3a1de7

SHA1
21a584477ebe11db202b2214450aff534197f097

SHA256
1142bcba6d781e9d1bf09a8fc09dc7a445e51b342d0ede62fee36c9ab7a0cacb

SHA512
d2a7a83b5c33cfde29e8f720dc5919609ef96580a5ef0137afe144cbec4b071d27a19c9eaf3ffaf32f163e88bfdf56428cb036cbde4f442a2cea7f5388f698ac

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
96KB

MD5
9cc94a7f6c7f4489bbc554e6bd064bd8

SHA1
c71d95a8f61bd523878bb0e3e5791b6c2d227a3c

SHA256
f74c8386b232fb6af8bef608ccb998a142ec2fd381893bcfd504215f210fd61a

SHA512
1bb8006e3c6044278204c132ac84b21e48f082e3b39a394d8769cbe3e76b640145f947498f023a88bc5a8ca462d718e11b59b7ab598372de8333541453deaf87

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
96KB

MD5
c070b2d7c80a1c6df8c4353717f88bb9

SHA1
47a6e7876e2a64807506e4ad0cfe053b66fa49ad

SHA256
63579a7f8225233c9f4169b610ec00a7395a9d51e99f55b133aec00670faaa39

SHA512
9a3f837dd408c788057b9654457d33f5f323ee70cb5edffd31a693685cdce4cc7dac7418f3caf7b92004a691d90175f8e3ba7974eb5b2fffe341cee2b923d98e

Download Submit
C:\Windows\SysWOW64\Eehicoel.exe

Filesize
96KB

MD5
b78f2e3d6d47593819cd55ab5274d3a8

SHA1
081649578bf3e899585558b6c580c3f86448a4a0

SHA256
0bf62ec684387969c1258a83b032823a2ff65f8e3b4a13039a5ac1a4a51ed2f9

SHA512
bcdc5c9c02a3d185b6d0bea1e3dfc2a48fa5be652d1212416fc5205752a0fd6f81b8ed3129c2523bfbacb966e4f346f24f6ca2a4a464e7ccf84db981001e3e7d

Download Submit
C:\Windows\SysWOW64\Eppjfgcp.exe

Filesize
96KB

MD5
529f183cd8f1ce20c76885210bcfc49c

SHA1
0150ad3bda21c28cbea829612ee68b7cc00b0459

SHA256
cf196f264aa3c592d0f9e44603552d0a677e979b1b31b7cbd8875f3b9ef03d41

SHA512
9575b390f6dbcba907919a79ca9e396736200c14b75711d6c01aeab0c9cbf8f9b51d53c249328d03c7bd361992ab69f6a3a9e680273ad78507adfd10f0d5316c

Download Submit
C:\Windows\SysWOW64\Fbcfhibj.exe

Filesize
96KB

MD5
c533800c217d36cd1b1e8da539758b41

SHA1
65843ef4a76d6d9aa1d6c1844ec22c39bf53a1dc

SHA256
ecf7e0a373738cf041867148be37928e5e656d4061b13b6714f043b2ece41f1c

SHA512
f4451d321d72b1dd82aab68f2042068e6b33daafdd3fcc0c24fb8deb1d76653bf232d9d63122d823153d66733c6d04efe95e75cb119be41994ff3a3949e2b3ba

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
96KB

MD5
76796184ed4cff812fa84477d6c3d04d

SHA1
1c9006b752c36618eebcb9bc719ca018c4c98de9

SHA256
a8b52f742209a5a0129c46c9349206a0d0415144a7c53ec7b8b1f61632f1f66a

SHA512
b8ca075bd0d4640649291e4c9568787bb01d746c1d21faedf9ba6a0a8a6d8d5008b9c2a81da99b87aec2ccab200954ef8850cac4a96199832906b4613321aaaa

Download Submit
C:\Windows\SysWOW64\Ffclcgfn.exe

Filesize
96KB

MD5
29724e6b9777f34a2d0ab1efcae2caca

SHA1
95bf86e665175aa256747e32e8fed4e2c924b4c9

SHA256
0e4ce4efe6cf5969121b70dfed088da1fd9d6d1670f27bb7978d5d2a62e09459

SHA512
ffe10a7ad9151d661f67bf51e3c8438226447d7a52077065e42a784377fca8499652125ef03a396e82c1f16250cbe47b2c453e4d7e693e6e3a7f56592609455b

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
96KB

MD5
8760b68be08298dcb92d8d190cbee04d

SHA1
579398065fe68ca559d1871c6216feb88128d35b

SHA256
275a66f949d92f6d111c547db6635edfc9b47f149427fcad4cb32aa87a239f1e

SHA512
8dc36f91e64a08f631bf18e3cf853005701e819169dc2c850cc31efcbda243b086fcc1b4d679e4b87775e9abaa9eef90808f82f629f0eb16c74ee030faeb4d08

Download Submit
C:\Windows\SysWOW64\Fijkdmhn.exe

Filesize
96KB

MD5
8052699b1cc472179ff8b80805e9fae2

SHA1
93421669f6d06a693854731c1aaeaf341277a764

SHA256
e9b9bd46baf49bf253c72a950ba1162aa621bf2425569e0c31d4cf5d6c419c8c

SHA512
3364cecc08cb6536f212af677f8badf68bff7cc53f4e3ce9d585d8fe045dbcf16f130a567a7065df19b5d084f0e2f73d357e228958e0a8af141a62fccf350505

Download Submit
C:\Windows\SysWOW64\Fikbocki.exe

Filesize
96KB

MD5
c3a5a7d8f2b1e2d7a6ea04cf4d453448

SHA1
a0f54e2311ba596b1d81a763d885879f603f5a04

SHA256
4724f6b8d0c1b33e843fccca32e32f7cb06f283e8a4066797ad81f94183971af

SHA512
23cfccddf0b55622be4d62a6b0d9548affc4fc6abd0d2f7d06fb27c6b907689f78ea1e5d2ce3056fc8438d3343a0b2a754f1c3161e7f4c495c2b59dbfd05748a

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
96KB

MD5
d6e711b52ffd34915dcff95eedad8d1a

SHA1
eb368d07fa00aafb8207b45b3df8a84a2b5ba14e

SHA256
215d70d12e3dd98cca94cdea98a9d2b1b7f1177d90ef035b553288113afef24b

SHA512
a888d2298e0e18b5fdfa17dad69fb98dc1bd4ba8db45806b9cc385738699bf1020303cf4f7d8377f91e167d7d692355897e5f15197e192a3ec042e45b7ff44b0

Download Submit
C:\Windows\SysWOW64\Fjmkoeqi.exe

Filesize
96KB

MD5
bcb04ddf6ff9b182adedd045fa3aabca

SHA1
c08862b28523a35666c290430c5240f0fde66995

SHA256
220a89cc177a75a242f66f0019a579abcbe638ba3f6d4e578ac4944f509b244c

SHA512
3d896b0614d004bd480ec5ee104dba83b37f281d2fcfeef5a69234906c53a0d9eeedd6b9744f0dbe121876744fed78b38cbf1a593074134a4a6e8c57d770eb83

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
96KB

MD5
3b793700908b1dbdf1511a5b1b1912a6

SHA1
7ae4bb062df39e432ef0607d4cb53a561b4f51d1

SHA256
bd13dc9c484aaaba13549bae522fc83ec680f8f2a3b001c1640e88ec71452598

SHA512
b567134c1c420b5b266a595bd1a011dddef263d906d146bab73c815fefc5331f61b941672a13ce929f4fbf1e2dd872986079b1991b35872cf5c3ffb506536d86

Download Submit
C:\Windows\SysWOW64\Fmikeaap.exe

Filesize
96KB

MD5
93f5dbd9412dc89e44e9d24c1def039c

SHA1
f206d200370921ba13e52c596116abd2143c5a19

SHA256
35d400f6aa125597cc474e6b5d72887a0270f80e8d75fe66dbfc08a4bb390ce1

SHA512
8e86a018bab676f86f6e5bc59a02e0dad288440e843cd19c17133446bcf649a5ef8d2199bfa5f8b4be2ee1ad77b391506fc0443c260f67e701792e751231a788

Download Submit
C:\Windows\SysWOW64\Fmkgkapm.exe

Filesize
96KB

MD5
7c44adec62c8795c63d90d5188648beb

SHA1
d4f047fd2a96372e62a0b123ef60f79f59668c03

SHA256
c7bfd896abea4714e231536b69234ea16a47008ccb7a65caa2c94ff1812cc332

SHA512
2523cb33b4ecc6233981bcdbe5ad0a47f6602193466d41929390a02708c681a3ae88bebd4833f280ffecaa435145774cf81aa2dec0e577b3a3bd804ad51baeaf

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
96KB

MD5
c08a15c036ae761f9993ac84b94ae7a0

SHA1
8aa09551fdc7845315bc0e543580acff4b01e23a

SHA256
db5747111c2afd097682ab749e72820c6d6a5d742d3d604ef5e8f04d8d633a8f

SHA512
7cc9e791a642fbd606609641e3f7c0df6897e28aa6c9e47ba08ec8f816f0396497f3bc8cca199931316c6a32a06f73cd1387520175d5e35b2eceb8a2ff25397b

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
96KB

MD5
a781e1e0a4395e80071cb090bb4ece56

SHA1
476ea8f8af89aaebb250ed5d8443f4b66adde649

SHA256
d980808517f3339c36a39e935ea21efe48d049b66eb904d762a3adaa329b9d52

SHA512
266b3d06f7bce8991cc0605e5da6db4083fc83cd00977188fc0b20d02f9a7783b58a447650ba485f58bcf0dfaa26c1c98f9be2bf91c18418b6dedf2237517d90

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
96KB

MD5
d44c541a0c0a6501ae28181ca86634c0

SHA1
6a480a928ffd1cb13510bc787eec098428b059a6

SHA256
29f7d141df41b35104dde18fab2156f00d4f2d6ad337b0c4f2502c6d558e2eda

SHA512
96435800468bf251f2ee7f611c0307609bd0c3503bf711c4e294c71b0672a5524396e22717d999af1871b34f69c4fcfeb9462e87ed72b744e38dd3fb76121125

Download Submit
C:\Windows\SysWOW64\Gdcliikj.exe

Filesize
96KB

MD5
21e9d6fb98bf4f2008fdafd4c19c22c5

SHA1
9eb6866ec376125b108c67844cd10d56b31516f8

SHA256
f4b6903ff6c671daa10bc9a3b5cf333bc95ec5029577964f75bf2408fb377b6b

SHA512
bcf9c2bca9d900e622d13acdee2265e68e8d7c090d8ceec2f00a1b654af24608ede273e039e930345d645b2e8dcf41ed88461b25e1484aec7de0ee90055d750f

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
96KB

MD5
1c927c163f5269e083ca3ae54fd36270

SHA1
002c5a66fbe49059d6a1c2513de8d29bc4f9d0cd

SHA256
4e289d53573f0e0e9970d10ac708af4197a9080e1fbd5bcdb1684c10a1ff9f9f

SHA512
73ba481ecb02d84b1af4788e3f820e60279d1065cb187f8f90af5d43d2e115703fe60ce8b1075aa61b5e7fde21a2657f3590e4d46fcd97a5646a2c24df5e2666

Download Submit
C:\Windows\SysWOW64\Gfheof32.exe

Filesize
96KB

MD5
eb8aa90b5d185d6e53f55493734002df

SHA1
1cee3f75269038f6b018abe2ed4ab4362d0b81ab

SHA256
34f70da62a4cbcf8b6bac633ca15cb8ffa30f137f8a932ad80b114aba160b4a0

SHA512
04d7324a33ee86f87b28e22d1b4b89449af0b5096aedd2bea6b68de006cd7b57fb4f46fe0c30e730060dacc86fd20a9fde066367fbdff952a5014495283ae9c5

Download Submit
C:\Windows\SysWOW64\Gjfnedho.exe

Filesize
96KB

MD5
5ad0e18fb359baa34859e69850cc7185

SHA1
73b5653e41813cdfa6525cfe8a6bd73d84a1dfbe

SHA256
15e95f9baaaf820afe919a5c0d83d45a3af5ed7cf512bb7e4ff7288bf82fe453

SHA512
e71b06720b3d850300c514c8548029fa775fdb1a0dfb4407145dd90c342cdb2ebe97338dafc7ca4514ad646d10ba4c6b1e38ef601252d061b114b075d4822b15

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
96KB

MD5
49009d5ae113a1bbc810629403483ed5

SHA1
c68b627b5bc15e5f3326828746ae417ebcefb141

SHA256
9de8df2fc2d06f7d6f388cdc035050972422f2b08aebe4f4ffad45f22ef14746

SHA512
f2d3fb06f6ae70baba804f2d09673931526ae7f958871bb703b5f1c0e5366db81211cab6117be1eca273640855fbf2fde4a8de29d3be17ae82c80391c2a706eb

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
96KB

MD5
7c96f1302da9746f625d6fe8ea4211a7

SHA1
90ec3fc0462d0375ce062318689f9901b62dcc7a

SHA256
94ef00d6f14890f93d4286a0db7fd17477e54efe03250f584a1767c94cfb09a6

SHA512
e14ac5baa4c4271bb62663fca6aea7f48eb6156a1a5403cdd3854a295fdd1ab6c6e7439c8cb6e0b9a03190bb731aeecd30405569e3a17c12a98abb958d6bc404

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
96KB

MD5
f79760e0e59bb3881666d9a23388063f

SHA1
2dabbd98cc9f2e2316fc575926fc0b9b7dc16922

SHA256
1ac2c84963f759770164f876584f63a5cd26fef2d212a7d79ae8c2d35f2f70cc

SHA512
36bdb26a87757c9529bf7a1d4ca607952c3c7f0bca5d838f64b0064f99b6839fb829e9b30c72cfcad49adeadfaa79aa50577a3ffd5e2c6d810d75f113597eab7

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
96KB

MD5
3800d2773d64e735bb0e5e2084830e10

SHA1
15451f490da2199baee1258a4c4bdefef9240309

SHA256
51c7735bfd37ad35cd9f53cede6308336504db6dfa1a78af47f11a56c4a39465

SHA512
17abe71c0c5b6262e2d5000a78f16f909050e4c7adea4d500cc5fda07277414ef27ee2b8504407a1084ab1b96ac7cbeed229cc50cda035e68ec37b1cad2da00e

Download Submit
C:\Windows\SysWOW64\Gnepna32.exe

Filesize
96KB

MD5
886dffee84bfefc2fc75857b8d09fd44

SHA1
3c23cc34c9b7f3c5fe500fa7ec56e2c89a390bf6

SHA256
03d84096d2fd76d6175d51c4ac4831625841f067368733bd3d6a0f4b1eb7d85a

SHA512
0d6831ad41be48e8ae885288e04bc34c74a7bdd9e0955d995ef3e926f1b1344229a11670d507e3276cfc43e405d8c788e71c6afa5ee41f4a709e4e90d251edbd

Download Submit
C:\Windows\SysWOW64\Gpcfmkff.exe

Filesize
96KB

MD5
21c81f00fd7e9d2354a990b4d4b7a492

SHA1
a6ba6fc1a0409daaa9c160e13cc5ea7e99bc0786

SHA256
bf054504b13d361948b159c74f4614253883761c87ae77bc418fd16fb4d91a14

SHA512
64b6e9fa3aa244064e7b42316044ecb3164bce53964b6158a5f16b4ecd956734930dce6702701c5f44b4ec80cbe478efbf9dceb14cbdf3342c6a38e6d13f734e

Download Submit
C:\Windows\SysWOW64\Gpqjglii.exe

Filesize
96KB

MD5
64180bc37143d1aaf5799068524fc8b7

SHA1
82620cef4b7eab21ba1de3503285d203fdd4bf03

SHA256
a92daed501cd5d5f71f49ed72ec1f26cea94502d5ed920f6a303653a4f8591e6

SHA512
eec225d2a98f8c80c9468b3c8fd78e7a37f575027732ea316372e009d864abf378610abd5523a77c1a85e448744560f8ab6a98cedc9c768420039b55447c2bf3

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
96KB

MD5
aafef4c0a00b49169c8fc6b4499f59e8

SHA1
1ee99362397026badd5ffe654559a1f703bb5846

SHA256
9fc7731d2dd0ab16c506e363e4c0d2b0f12e1b868b19751686c838ecd605a4e0

SHA512
cfa0994d3ed152228d9e44c123688f403053dd91b3103f63a966bc3ee23f5e9262e5a661d876b9d331d95197b9bf8005ad13ecb8c654bd692d6fdbfbb7b7af05

Download Submit
C:\Windows\SysWOW64\Hckeoeno.exe

Filesize
96KB

MD5
d377643f597532b2b287fcd8bea7e623

SHA1
297c4dc4c0d612704045c0b254fe93fdd42f4f44

SHA256
564a61bd45c99e018c3b3d056a338f8a4f7522d1df2a41443d9c0d8c6c660189

SHA512
eadbbf26a57f9d6ee0c405d0f807b042d611ac75385a8704820b40de1e0b3e74b814ab7856c4e27937122ed9c1569e6a276e7a2f264cd340b9abbb81754dff13

Download Submit
C:\Windows\SysWOW64\Hdjbiheb.exe

Filesize
96KB

MD5
279d08a572176c130bdb9dfddb8768e4

SHA1
eec7a1a55bbc8492ab2802d97eda7a131a83a2ae

SHA256
838c003f9abc45a0d3786827aa602c5a6dfd05afce2fd2e97eb965cf6fb10a04

SHA512
c0f8daa23f8069bc20704f7917c5f7a407d21401c5d3669ea11d09871706cda2191f02050cb79700adc5aa07eb4a2b1d207b74ab2e7b2297003e8d32367ba8fc

Download Submit
C:\Windows\SysWOW64\Hdmoohbo.exe

Filesize
96KB

MD5
09c5f3ad4bdd2433b68872efe1161bb1

SHA1
71d69c7e2bd46c29f135d18d53fbff814574c0a9

SHA256
b153a0590ec7e7802d8d50dd7a45aa38d2290d688f2090aa827732df505e3d72

SHA512
8b812890213cfb2467d602dc5119ecccba81bed952a399cc64d50dd74ec2c427629ceb9c2e87e3b92a5462651f5382185f32b1728cab6dd1d5083ce12ed8412d

Download Submit
C:\Windows\SysWOW64\Hffken32.exe

Filesize
96KB

MD5
f54219c3fa5a0a7db21cede1e593ba96

SHA1
fb114df7d108b615da29a0c08f4a4355bd2cbcba

SHA256
da90425de5bc0485bed4854deef61d43d5f618f188ed98011fb50251d101e62a

SHA512
3e7df5e4ee18eae7f4ac2ec5acd473600e3f745b1ef692c99cb200f741d06c91bf4e7b01e8dbcf4fccfbbfa7b158166efd8c12e6ff5649a56afb41d9b9630eb1

Download Submit
C:\Windows\SysWOW64\Hibafp32.exe

Filesize
96KB

MD5
a39355c2864f3df801b6d38aabef49b6

SHA1
2433efa1054ac6f3fde0cbde6f6b2d52715e7a3e

SHA256
d7c4a6e98a6ffa9f122e83d8d3902116c28cf39045542371ac2dc4a3ec1f7200

SHA512
b732404fb0e1cdadf697ddb6b79e96c99fdc9e6cc15e2a7abff1400c03af64db193ca5849ac976ef7864df854aa65a46f7ead998a91167cbe3ff0fcb23698ff6

Download Submit
C:\Windows\SysWOW64\Higjaoci.exe

Filesize
96KB

MD5
7e321c94035a1421a388150e222be8b9

SHA1
5f458feb6b49987e2ff1501c0381cd0785925e8e

SHA256
5e4e7363fbb3adf8b0ea23617f0aa33be9d25b3735c584b25670371a4bb8ef28

SHA512
a53b929b409202f7d3735d02cc1511f0db23fcc37fb91dbbc80a9b6ac7b0494aab4380effc7b8df264dab10f9d8c9c7f34d25ff6d0571e4d9af8cdc458da1d60

Download Submit
C:\Windows\SysWOW64\Hkbmqb32.exe

Filesize
96KB

MD5
a4330a2a83239539f3230d8f4d124eb3

SHA1
f759f4dfd327ae236fecdede28880631ce5926f4

SHA256
675aeabc7bba604e2893f68f8bc3d0553fd72749cfca4d686f72300ee1335d14

SHA512
d1d62d7a2806f3aaa1ada9b8fbb1013735c6167018848a28820510652954c8aa9469c12f942684eec1f53a04f51a762156f450a928326a20ce4fabc39b8cd1f4

Download Submit
C:\Windows\SysWOW64\Hkdjfb32.exe

Filesize
96KB

MD5
c86452bcb6bbfbee30bca67f9bcecd54

SHA1
bea2b4819fb461e90f6fa8e55c9f363920e02b21

SHA256
709ec68a78aabab27e862365c47a5f9f1203457f255bac03a94d09887c0560e0

SHA512
004aadf30ebeb41d100ed1f12997a1242459568f1b47b574a0d377f47651b3374f763baac82ecaf13a5a5786cc980d03f9db5f1e3f885700a6e6a2c911468a97

Download Submit
C:\Windows\SysWOW64\Hlambk32.exe

Filesize
96KB

MD5
563db2d27dab7f2ac6ba9cee55f8391b

SHA1
126fc5e5021363871395be788ffe1e4050cd11ef

SHA256
5f6a54cbb6baa90ce6526f51c09ab7565ded2a19cf4d2d8dcb93c4b6a7ff44ff

SHA512
58be19b27853cfc92d61a6e06ae9ce601bab02a091be2024eccfb95a29e2ac53c93e7e14cec8f05072f2192aa17e6180a17ead9ec6ea0316c6ec8579a512293b

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
96KB

MD5
9e209f2217a18e7e79a30aee75dbfdd3

SHA1
e73f3f21e26867bf406a32b298df7c6eb06e3ffd

SHA256
a58f50e9031316a3167f912b97dd4bb6ba18f4e8d9eacc3e3f639632c0598f6a

SHA512
4a7391150e0b4e63037fde7b79794759b98547190928336204c88fc4d5a456260d8ace0f02b921932597eb8c03afd9893056429feab69b22197f5ed181cd936e

Download Submit
C:\Windows\SysWOW64\Hplicjok.exe

Filesize
96KB

MD5
2db86b11d4abb6d10018d75a6ce665ee

SHA1
73831c801f9f75d79b6635825018de427da1c8c5

SHA256
7162b6093571263e57f306896ccfe2bdd7845527b2e286ad4eaa5890a5cb5d41

SHA512
385abd1b089442810e8cf27978830bad935cd78e8dc518251e8f9a1f0de9570e39c86ed25f4e3739cd8d5582a84d961f79ce936682e61fbaadcdb37000671863

Download Submit
C:\Windows\SysWOW64\Icfekc32.exe

Filesize
96KB

MD5
bc467d093e6b3e01b43332cae3bbe576

SHA1
1309de5ead2dd98d9f504e1949732c46bc0315da

SHA256
7a2c24017148b197f6067104f1b1a06f31048c832b715b94095148e5ae63285c

SHA512
faebd31db72fbaeb857f1eed439fa39ab57d7a0f0c96ed7bf013311885d2a3004cbcea97eb1a67484a0dec5599c702a97110771327c518e9f514411525b47968

Download Submit
C:\Windows\SysWOW64\Ickglm32.exe

Filesize
96KB

MD5
8c7eb5cf0b86167b6fd022661e531340

SHA1
a581f98e810fae7123873e563e59b2b6eafa3516

SHA256
8a2b203248ccf6e3f1fabc8f4404748271021cc3a8e2e7d21f4fa8cfa5349946

SHA512
437d278701753536a95672e7dc14ef01bfc5fd198c2589c6928492259a6658473a09bbb56a1e80110500a31ab7bd2e823803ef852e506c2c7455e0341077267d

Download Submit
C:\Windows\SysWOW64\Icknfcol.exe

Filesize
96KB

MD5
4d8b10e9057b9ec7c17242c84d7bcaf9

SHA1
49a4ff23439317441246775d2a75cd3f5321d919

SHA256
7a689073af8ab4f66bbbe4a052871b842d9118401547c5ed843a7a78278c010d

SHA512
71dd870f94a92561abfe5d0f458ad96116ffbf6f8f72b7a418834b7eda32fd1dc8e6526d2910519a2654e288795d0098512783df0f6b25a0fae1e2fcd1c76012

Download Submit
C:\Windows\SysWOW64\Jcanll32.exe

Filesize
96KB

MD5
e38a02fab517cc3d49a968b0554313f6

SHA1
20c9c838e2a3cc4370cb3a5e30fa14aedf8731e8

SHA256
730a51b6ab93bc48de0f3583bf26a8c7145c6486c5a3ef9c6a6ecdef3ed0418a

SHA512
b0bf9d6e00301fe7f2a161ae16f8eb634809a84505c653aedee59d9c7a5c926035973591c401578eb0e30135c3632f71eceb750156691c28f6516d83c5b72dcb

Download Submit
C:\Windows\SysWOW64\Jenmcggo.exe

Filesize
96KB

MD5
4ea889a02f591c73fc79ac1a3257a01f

SHA1
2f6661fa9d6194f294fbe159519ed9540c92d361

SHA256
bf8b21809afbb82caf17ff05837514099117a4c89721dce70b268212fd7f3dae

SHA512
18678ae161658b21704b14bdba6e7031bfd0f257aff8790b533cb4665288ffbaebb940ffc06a1d3b0fa7e75860e2071c3f413754598fa680fce1747bb4682d97

Download Submit
C:\Windows\SysWOW64\Jgbchj32.exe

Filesize
96KB

MD5
5f126b02a29e1dce617ca2099d7f146c

SHA1
4c06444e66f5c5b6ee6d417f8cb21aec738054ea

SHA256
fb0fa9bc634fc4ccacdc455fa1433658a2d2582968463cfde6f6557fb029970c

SHA512
2ecb2144e0aa8e2ccded384209adaba1ec6b5dc41d9b66f3b51f25e4d57673506d36baff39df4031a8980efe7f23a2e5edab2f2874b8fbfd156e15c670539651

Download Submit
C:\Windows\SysWOW64\Jinboekc.exe

Filesize
96KB

MD5
66b928e6c10da6c73e0c0fdec1b9f921

SHA1
12782db1c508c46c326df7ac4e83813a54f01e7f

SHA256
8e8df53ad0c2a7bb1d12056cf0aea961c321905be34febfee185ca67c5ca899a

SHA512
567d7302f02c5c963eca9b7bf6dcaf762f291d5433b451c99cb15aedd18e72e165f8555abb3be10bbdac4a54b4e2c308865ea62c591d5fc9dd2650e9863ed9fb

Download Submit
C:\Windows\SysWOW64\Jnlbojee.exe

Filesize
96KB

MD5
fb339829fcbac94906c3f06830f740c4

SHA1
3f1eb17c53bc09b8c31d55b8730e8b5fb1c347ea

SHA256
07fb5eec7b6eea652b6ef096fed3c99ad79b1efd4cd773d2c944c988779a077e

SHA512
03bb5aacf36d651aa5a7c7d4010db117794494add71e5f96795cde070885f3656bc6e75d0cf0a8c002c3b3dbcf264bb30794a7de516655899cc245e41c69605c

Download Submit
C:\Windows\SysWOW64\Jqhafffk.exe

Filesize
96KB

MD5
4e44612835e88e2508b898edb473ea17

SHA1
6ea61f85c4cc8353e71db4a6a66fa1301c53d6a3

SHA256
3ffc7425ea304670c9dc12a0df218bd1f7eb6a6c3ea87ab60d40c13ed7d08ee1

SHA512
beb229152eecbb25a0abbc73b413f5061a0ea1582e1ed28c9be0b60c4f4dafe278fa697500d4f7dc1d40d98cdf972c55ed2bac03279c2e5ff9b866f81e59396b

Download Submit
C:\Windows\SysWOW64\Kcbfcigf.exe

Filesize
96KB

MD5
7156c8d285d53cb5d8e499e8cccecc1a

SHA1
1637c0ecd56b1c385aa7b842adc56b63dfb74c0c

SHA256
5c492961e384c06f8c5e94e3e8f29c0d9304c86011b0a1d6dabe53b81e190a19

SHA512
5da0dd0fcb8c442e52036bdc5a7b2b14e253dc698c4d03b4aae397e5bb6938645abe08ab44d47caa6c2aad8ffa1f0beb13dcdb1e807aa66517004c38d74e3ebb

Download Submit
C:\Windows\SysWOW64\Kcbnnpka.exe

Filesize
96KB

MD5
6828088d0dc41374df7ebf681ddc242a

SHA1
d989cc75b348dbbb0392d4f23e048e6e6281afbc

SHA256
259e0b3786a0de167c3cde1dceea62503c22f07bf099188eadb57f3129962401

SHA512
a837eb0c850fd7563cf1a1912323ea8a44b0bbbb7434247d320abd8bf446c3f857d50a9715a2f161a8bc44c4c1b3ddc1604c128984c60d7d974f7191b36b3a05

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
96KB

MD5
0e895f29df3b587ebb0f6bce8b543f9c

SHA1
4f12e516ade22f034eff0795982a57b77fd717d6

SHA256
d10dc98a4ceaf4cb062afea9fa4c4d13e3cc975c2ea262fed76ce6f63c079584

SHA512
82bec93757c6dd1f2d977f2ea431e7360b81397e69b779236c24f18bb1ec2c4fea626a253f8d06567aa2449529c8efd331a8a5ee28410b10c47b146e39b95fa9

Download Submit
C:\Windows\SysWOW64\Knooej32.exe

Filesize
96KB

MD5
5aebe11be8444baf91baf5825b9f0c5f

SHA1
cf1c087d195cc5f2130580ba0a3f2dc65eb63760

SHA256
58154a42a163d8588379a80169cf9285fcba375e635e038206be196fffa68936

SHA512
0909f557fc6f59ad9a2cc9b37bd71cab510cca2b85ce3e09d63c4b2dcdf48971a1072d97e1ec624c5a67d8d55e8340af9333f0107e355bd36930bf60a597499f

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
96KB

MD5
306cf15037179291464b550216f2c822

SHA1
c3846be30dbe5370008eabbde3e110b9a4236685

SHA256
23e8b2e7c9e78ce4b97531c5ae377d34e0e3e4b025e2837c5987aaf0f4865fac

SHA512
d3bfbc0265ee1c3d52bd67950851b5aec5fbb1aa3ef8a373f9e114e67011ea79f1e273c80627a18265adb65e517c501391afc0e0e4e359451c8e5fa5b9baa267

Download Submit
C:\Windows\SysWOW64\Lggldm32.exe

Filesize
96KB

MD5
8a047ca36ab2b42e3878c135eefc1dff

SHA1
9ebb6e16670a78a87296b40215077632eadc31ad

SHA256
16456bca97dfd3ff98d9b1f5b0c123b4335b31353969250e6f03668448aab23f

SHA512
754ba077ef5b812341c4c57060fdf7e8f3ed343ea997f4b06927f54c972b0bf6562ade27bb91e22b2d14f2fdaf29dd8d75c3546e4484695456c761c438906e6c

Download Submit
C:\Windows\SysWOW64\Ljnlecmp.exe

Filesize
96KB

MD5
ffe99c1cd9c6d883aa04129a8355a18d

SHA1
f4e2848cef9cd47734d3d3bac01db2c24bba8860

SHA256
8c76cd8676bf5b76ea79fea928a919957c2ca0c966d4f059f774aba05769ab77

SHA512
2b7b78214341df6b96dd437c5f0a1f11f6d2e326741174e1fff9d48b1d180d64cf356161c5cd9bf317e4954599b296f1acff2dac906cd7aec7517a470714fe88

Download Submit
C:\Windows\SysWOW64\Lnoaaaad.exe

Filesize
96KB

MD5
9203605698ab40697e546cb22012f286

SHA1
f07b93507c348e432c5c2453854f4d7be5ec870d

SHA256
908bc3c99132388c59bd15b5dbf530bba2078c255e9b73f8fe12b5beecf5bff2

SHA512
1e9d8cbd1fa347809028bfa9b1ea68602ebceb249833f9fc123c1096c157b500a00fbce90e0a55594da8b9303cad1c805fa8bac90840350f5a48e275bd8341e3

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
96KB

MD5
1c5475194bad04fc84c8cc8ce0acf444

SHA1
81b51fa59436b6e1fab24653f34502ad19b59d27

SHA256
ffbbabcd692ecf6aad84696ee7a7b2fa890384b6eb2630016bd5c8e4a138a637

SHA512
0cb318b3c4285d4b4c889ebf118e8b9519c5c8a13920aa3f8bcf0b8cbafa32741def4b835aa30ebf7e9c4493197c27c01d2d46b5ef6ab3234ab81ce025a63654

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
96KB

MD5
5a02cd3b3a3bc76df73a5ae738e464ca

SHA1
f3e932e07dc469234824b9e387b4e347c5dc33fe

SHA256
51d6a34e6fe414f672f6c5ae37b61927fc616c5ba61a3fcfe43132444978b26c

SHA512
19e05532244364d866a9dec76bf834a85feb0d295d2383a128d8f1005bf51a1ea8e07da0e2d30c31ef55ce2a4d5b3aa3f04681e6598758b3f89159798da560cd

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
96KB

MD5
1e48fb9fdb692811521dd2c02dca3bf8

SHA1
ad4f66ca8c33e92965ca739f0c80495fe7373669

SHA256
aa02402c62340d93f73b766cc22eecb68ee4846483ce8aaee3ddf6a4f870e620

SHA512
b3f16f66d2d30175328529221fc7b493aade2d7d546d1e709c515d10daa55914915d91277a1156bb864a9cab1c688d00418bf14b5389a9f0eb74215761acb9fa

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
96KB

MD5
93059e66c405eb203ffa856a1d112952

SHA1
3677f3b7ca9beac2126dcb9567f1997ba056336b

SHA256
7c70bd6064d5bd5e31358d27b55726a2f56e01cb80fb0ffc1b322b7b79521efb

SHA512
00ad1ff49b96405503bc8d060d45e6881f1d328293c6b5a17a6188d09aab49736c7d5d929eb9cb9d395a3a3ef682de5343c42071ff14ea52bb1746424fed1207

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
96KB

MD5
9b5f3afd06bc361ef36ee13b33c029ce

SHA1
a4f5da29a04184adbec2d7b4c5320b5874a1a79e

SHA256
60cef9b1b095fa811ab0bfbff6e38a37a309fcc8cf2ff1ad39ede8785b5e2e7b

SHA512
fdaa3c0257ea869940d379ce84d707cdf047b318b6ab03785abd0cca52a0b6e0b8062bc8aaf085116a7e7ff11ecf8a2306b14d8f41358683dbc8785f4a849c50

Download Submit
C:\Windows\SysWOW64\Npodfe32.dll

Filesize
7KB

MD5
afaeaf8d3aaac895a771ce169afa9f77

SHA1
1a9ddd0d51f91ae5dd22170e573bab12b453377f

SHA256
d81a4c4a11431a20ccd83702a500be7fffe9413b24fa358404fe52c1a2f101ef

SHA512
55aaf914b85aea0a748a350e081849b94b9f8e9f0dbb74724cbeeef07f929f02285e53104affdbfa4af21767df3ed3487e1f665c4434fbdeee499d4d2dc5e91a

Download Submit
C:\Windows\SysWOW64\Oacoqnci.exe

Filesize
96KB

MD5
8186b5c1efeff42ab0103160b0385118

SHA1
43941e77bfefea2b9f95c103d2f12590ee56a903

SHA256
0dae6046f81f550cc80c043b0e2cf26da1fa03062d2392269f6966f227713d69

SHA512
419e7f7878e31973e38da5864da03539c9bead98f644eda3cfcd5bc45e8088834f28fad77f21ea4bd0da06a8dfeebd26f1d34d96f603a64c487b757520fba01f

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
96KB

MD5
b4e25183e2626eb183d9cb370d062610

SHA1
47448a7fe3755456f046088aa2596b6fe6110611

SHA256
06e0f950ae35d447f18e88faf8f114c3360aacff15e2ad51cc0b9d4eb656f24c

SHA512
b676ebe1840be0094af3e7d25eedd36c817142346e70ee94e634f86ac26107040cdd8b2a41b453c920059fa0844cc5dcf759a38467937bebc0614d7992be0d01

Download Submit
C:\Windows\SysWOW64\Ohcegi32.exe

Filesize
96KB

MD5
f999648c1b3666b1380a61bbea087821

SHA1
97da38d1dc63a420e4c5c7ade162cb577d82c438

SHA256
fd502b895d1a203b51e30b75156da12450832c55719788dae9a12fda6783b441

SHA512
7d6bd2b328890239bf44591669868e6952c240763829efc71b10669502bd27db7397c540401ea2bb30df80f3f3ba80e0f6bb9e6cf915afaa9f63b7d98f154530

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
96KB

MD5
6704dd7b13dbe444bdd4a1ec8ce19550

SHA1
68339a334b0a72be0943f287b6b161ccc916ca79

SHA256
e8d6ea73ce79eb05e3b2aee624a2f728b184128cfd0e09cdfdd2ab9cddb6863c

SHA512
0d6b55bcadbded0ff73cf27a9b67fff060e59bead82e174e0a16f31768f27a7401537262b0485cc371ae1c7feb45a8e39af60be32378221f991e9eab6d0ecfc6

Download Submit
C:\Windows\SysWOW64\Olanmgig.exe

Filesize
96KB

MD5
11a46f38516f0a27d2d59ec8bed2a309

SHA1
90f07fda6b488028d8555388110930e07c23134e

SHA256
d7487ace3a2c1fe3f308b389a2ecb5227763eb9e03104a924521754292e0a662

SHA512
79ae88a359edc9a1707348aad0e7eb5fa9d7f20a08a5f327119a44c21ae740341a7e3fcba60996bc916b4c5e3f0cbb0a8871c526d817f98ee577e61bf9e3dfc9

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
96KB

MD5
c6e3208136481f258571fe2003e6f51f

SHA1
48d8ccf96c7ff8998a4f991e93550f7965af9130

SHA256
41323379ed288fda9d8d54ad1de17a47f5b5bc3452e0cf36eb96ee6e6215764d

SHA512
41a617c356360961ea5b55842a6b5732d6421ca17c49e79c66ec1525dc59402b68079a919e39c52579f80c2be7e7b4fe64f2178be158e85cb4c65add5df0a741

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
96KB

MD5
95f5537a5ddc97db0793b4c5cdfbd0f8

SHA1
0e9ab6ad72a927b1286dcc44f9779b8b3ee7b3e6

SHA256
8967080f3108b91782348685974c0e594bde5ffe385b2c7a0fccb4cb78f89baa

SHA512
d914ec973f2711eb31128898854eab591e6793bab55dfbc03c52c23b1f62bad78710fc863f619591d7b9a7e5fc30b567b76918c4fa1bb87a0907983087b4b071

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
96KB

MD5
d071eace2bc07149509a915053776670

SHA1
89f2e756bd298dbdc90a570a49365af324cf3237

SHA256
9b69f86ca2d03815a040bae360223b32206d18a1aab55e305e46a64f404075fb

SHA512
55f8272c056a1e8a006338643de5441c35884ae10a6715c3adae65eecb28a87a34558503d72defedf704f1e7022061eadf3cd45893c3ff9b8e44d34c43efffd6

Download Submit
C:\Windows\SysWOW64\Phodcg32.exe

Filesize
96KB

MD5
e9464284d93363e9e2ad38688a8704bc

SHA1
ecaf094b1f851de88926d9d74b86a265712baab6

SHA256
018a93b08231fbb85cb2324094b91313354fba42f7c00e01060e967c55fa3a7e

SHA512
b5853fde05a0e1292067fbf14c718a95cc3655c85a64150cad8d13674dd43763a045ba6cee5fa9ade279b39fa5a864872dd74609ee5faaa444a3c1a0aee2b37d

Download Submit
C:\Windows\SysWOW64\Pldcjeia.exe

Filesize
96KB

MD5
a6e87ff15e7b13231d33fcc4b0ab3558

SHA1
336cbf09d15fd92d6e9295bfefa47e16b2ed5593

SHA256
482aa951cc93fae3ddc1baa7a07b7bb6cd69b76b6f39df709e8ce982f3710cd0

SHA512
0b70fd8374ff304e5b5399550df6b86f84ae6000f23260df0ca1565b2a6874e746eb789ff0bcdcef799a8b0fb2db150254861ec1a496cc7033e94ad883f4abec

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
96KB

MD5
6bee65bba4d74b23fcc99a0761901f64

SHA1
16b9b3969688e3a4f0983fc95a761b872b35739f

SHA256
ccf2b38c75db00308dadef2080f2e0bcba2e4df5da2652df24a445589f3384fc

SHA512
77c630d27cb3313f5a42fe446a610f585e3466f14f49b19cc39246a2a92d510ed6eec6070b69ef0734ecb79035b122f82cc1c127fcf45c9edf7aa650e9471ee2

Download Submit
C:\Windows\SysWOW64\Pmpolgoi.exe

Filesize
96KB

MD5
953a2d608b4b1956574e4fe0c07213ea

SHA1
5f34837f3761bfd39d95b0f47145ba8e6b2077d5

SHA256
43d8046c42266e6049fa9658971f43136cd625d63e9aa3fb8207dcc867ce2aa1

SHA512
fecbc2ea7ab4b2e46e15cd9c798d69de20c815682328e15fbfe9d63f84b2001331b05e64fe29f28d40230f43db8dc0ee328fb82885a8a753dcb44abec669ee3e

Download Submit
C:\Windows\SysWOW64\Poliea32.exe

Filesize
96KB

MD5
8009644976ece1fd3244453b4ab09beb

SHA1
055f9cceb9d1a65d1236cd13fa3a9cdc1e95db65

SHA256
d43328f8f3efe4d0f3d2aa6d23378a294887b9b42b5adb3641413f579249875b

SHA512
0aa9dd2f5c52aa29808d7dbe582193e8e13eb1cdb92a901fb95e17f1492d05c9aef03eee447a2f025e3f879dcbd3e907ca86cf70061ba48cafe4c7719a567fda

Download Submit
C:\Windows\SysWOW64\Popbpqjh.exe

Filesize
96KB

MD5
49529e4be4425296b9941a7bc7505bad

SHA1
b4a476fa7a5dea71f6e8c0976c3d0214a934e15b

SHA256
350d4ff661c103acb237118ccfd31359d071c856ac3880274e647e9b7d3bc5ed

SHA512
7876cebd82976e3a1a522b483abf2e835a0f2312b591c10ec15be56191a6cc59b2c28740a90e690cdc8303f1f887762e35b43d6ee5a6d2ee4893c23068c85c7b

Download Submit
C:\Windows\SysWOW64\Qacameaj.exe

Filesize
96KB

MD5
5a8824fff23ebd2f57dacb7c8166ccd7

SHA1
8314f9d416443f342335e2e244455224790f3d44

SHA256
1c37ad531ac8e83e1524b78c6fc4f437f14fe7b6f404f673c893e0a4e0404b81

SHA512
05e3fd546d1d00252953fdc0fa3b235c0729966b3916022793ac03a1ba1c8d292e79715399ec59645dfdf1e055a4b4923c87f831e65d166ce408e968716a2d2c

Download Submit
C:\Windows\SysWOW64\Qhhpop32.exe

Filesize
96KB

MD5
da47b68090999f3cb0d7a282e2d9b4eb

SHA1
f2c310e8a4c14fca4e04bd67a6841346d2bd74b0

SHA256
525f11f56fa65a01aceb2017974dd2611ee548ba0bab6f84b069724e9330cde8

SHA512
f1a5b35d5e01000caed26c87371f25bc806263d5ee1feb8f3e1f888647585bbaa60f0ccb7fd1add31af3fe372cf2e6aff70fae43943922a5bba12fce626590f1

Download Submit
C:\Windows\SysWOW64\Qjiipk32.exe

Filesize
96KB

MD5
9aa8e121219cd74dc2606d79496aaae3

SHA1
e38275a4633a35b1abedbf543d73e8cd04c848a9

SHA256
433981cdfba54130625c397472d9ad3cfedd30421cf0dbb81cfc71a1fd6ff665

SHA512
58ea04801c4eed7141f8f3080259eeb695e7fa22d32b62ddc2ee8fe73da38172047647688e967709a328b037185fb9312f1dafc09e7ed3f419e3b0e014b1c8e0

Download Submit
memory/8-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/224-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/332-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/468-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/532-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/620-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/628-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/736-532-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/844-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/844-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/852-558-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/852-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/904-71-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/996-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1124-520-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1200-538-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1264-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1352-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1444-508-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1540-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1632-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1640-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1668-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1704-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1716-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1852-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1896-593-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1896-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1932-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1932-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1944-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-151-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2140-490-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2212-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2248-119-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2452-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2500-594-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2660-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2864-88-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2924-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2992-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3092-256-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3152-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3152-572-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3388-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-579-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3540-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3544-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3564-484-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3624-580-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3632-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3648-204-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3664-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3688-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3772-573-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3792-460-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3824-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3952-559-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4000-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-167-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4008-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4008-565-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4044-526-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4228-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4252-502-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4268-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4284-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4292-231-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4384-175-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4388-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4428-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-587-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-551-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4456-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-478-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4476-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4508-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4512-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4600-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4612-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4688-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4760-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4800-566-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-514-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-244-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4964-545-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5012-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads