berbew | 2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7

Analysis

max time kernel
136s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7.exe
Size

97KB
MD5

af793d27632009f885c6cc0535823b1b
SHA1

a8aba92b5e1de3dc44dfd66f1045f62e43a574b5
SHA256

2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7
SHA512

a9d0c45d7a7099290af4c05f96f3925ac19139aca41e75d12e1bb8e6b54065960127180b0eec8cb7cff2ab3659f84717cad7c80562973876892c702916e6c61e
SSDEEP

1536:4jRuSikAdB0TSk25MxPg/ucUdBlMPUOXUwXfzwE57pvJXeYZc:4jXivdB0TSk2gPguRBqPVPzwm7pJXeKc

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbjoeojc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmojkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlnjbedi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jghpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpbflg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcoaglhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opeiadfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Illfdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pknqoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aehgnied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adkgje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmafajfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfnjpfcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlglidlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojdgnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fealin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kegpifod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmnbfhal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plpjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plbfdekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hekgfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Popbpqjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akepfpcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chglab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmkigh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieidhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngjbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chiigadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emanjldl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmhdkknd.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3816	Nlcalieg.exe
2648	Nnbnhedj.exe
2980	Napjdpcn.exe
2220	Ncofplba.exe
2940	Ngjbaj32.exe
1720	Nndjndbh.exe
916	Nmgjia32.exe
4056	Nenbjo32.exe
1796	Nhmofj32.exe
1196	Nnfgcd32.exe
3076	Naecop32.exe
1940	Nhokljge.exe
5072	Njmhhefi.exe
1460	Nmlddqem.exe
2020	Nagpeo32.exe
4220	Nlmdbh32.exe
2724	Nmnqjp32.exe
4316	Oeehkn32.exe
1244	Oloahhki.exe
2080	Oalipoiq.exe
3100	Odjeljhd.exe
1448	Ohfami32.exe
4392	Omcjep32.exe
1192	Odmbaj32.exe
2040	Ojgjndno.exe
4416	Omegjomb.exe
4428	Oelolmnd.exe
456	Olfghg32.exe
2824	Omgcpokp.exe
2224	Ohmhmh32.exe
2108	Okkdic32.exe
3544	Paelfmaf.exe
4472	Pddhbipj.exe
5076	Phodcg32.exe
4904	Pknqoc32.exe
1172	Poimpapp.exe
1656	Pahilmoc.exe
2952	Pdfehh32.exe
3716	Plmmif32.exe
880	Pkpmdbfd.exe
3212	Pmoiqneg.exe
1364	Pdhbmh32.exe
656	Plpjoe32.exe
2760	Ponfka32.exe
540	Palbgl32.exe
400	Pdkoch32.exe
4296	Phfjcf32.exe
4304	Plbfdekd.exe
1408	Popbpqjh.exe
2320	Paoollik.exe
1728	Pdmkhgho.exe
3152	Pldcjeia.exe
1120	Pocpfphe.exe
3904	Qaalblgi.exe
4992	Qdphngfl.exe
3696	Qlgpod32.exe
4932	Qachgk32.exe
4856	Qdbdcg32.exe
3700	Aogiap32.exe
4036	Aeaanjkl.exe
5060	Ahpmjejp.exe
1856	Anmfbl32.exe
3444	Aednci32.exe
2844	Akqfkp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kodoah32.dll	Nnfgcd32.exe
File created	C:\Windows\SysWOW64\Blciboie.dll	Pldcjeia.exe
File created	C:\Windows\SysWOW64\Ahbohd32.dll	Gmojkj32.exe
File created	C:\Windows\SysWOW64\Gmfplibd.exe	Geohklaa.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Qjfmkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ahfmpnql.exe	Adkqoohc.exe
File created	C:\Windows\SysWOW64\Omgcpokp.exe	Olfghg32.exe
File created	C:\Windows\SysWOW64\Cleegp32.exe	Chiigadc.exe
File opened for modification	C:\Windows\SysWOW64\Fbjena32.exe	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Ioolkncg.exe	Iibccgep.exe
File opened for modification	C:\Windows\SysWOW64\Jcoaglhk.exe	Jleijb32.exe
File created	C:\Windows\SysWOW64\Nmnqjp32.exe	Nlmdbh32.exe
File created	C:\Windows\SysWOW64\Okkdic32.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Ebgpad32.exe	Eoideh32.exe
File created	C:\Windows\SysWOW64\Hpidaqmj.dll	Jgpfbjlo.exe
File created	C:\Windows\SysWOW64\Phfjcf32.exe	Pdkoch32.exe
File created	C:\Windows\SysWOW64\Cbdjeg32.exe	Cofnik32.exe
File created	C:\Windows\SysWOW64\Pkpmdbfd.exe	Plmmif32.exe
File opened for modification	C:\Windows\SysWOW64\Chiigadc.exe	Cfkmkf32.exe
File created	C:\Windows\SysWOW64\Nbenoa32.dll	Chlflabp.exe
File created	C:\Windows\SysWOW64\Nmqmbmdf.dll	Flfkkhid.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Ppgegd32.exe
File opened for modification	C:\Windows\SysWOW64\Okkdic32.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Jkchlonc.dll	Cofnik32.exe
File created	C:\Windows\SysWOW64\Ckgofgjn.dll	Ahdged32.exe
File opened for modification	C:\Windows\SysWOW64\Ckclhn32.exe	Blqllqqa.exe
File opened for modification	C:\Windows\SysWOW64\Hidgai32.exe	Hbjoeojc.exe
File opened for modification	C:\Windows\SysWOW64\Qdphngfl.exe	Qaalblgi.exe
File created	C:\Windows\SysWOW64\Hahqkaaa.dll	Bdbnjdfg.exe
File opened for modification	C:\Windows\SysWOW64\Ekmhejao.exe	Eiokinbk.exe
File created	C:\Windows\SysWOW64\Lbmolo32.dll	Lnangaoa.exe
File created	C:\Windows\SysWOW64\Fmbgla32.dll	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Nlmdbh32.exe	Nagpeo32.exe
File created	C:\Windows\SysWOW64\Anaomkdb.exe	Akccap32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnfbcbc.exe	Eppjfgcp.exe
File opened for modification	C:\Windows\SysWOW64\Ffqhcq32.exe	Fnipbc32.exe
File created	C:\Windows\SysWOW64\Fpejkd32.dll	Gemkelcd.exe
File created	C:\Windows\SysWOW64\Opcefi32.dll	Oakbehfe.exe
File created	C:\Windows\SysWOW64\Qdaniq32.exe	Qpeahb32.exe
File opened for modification	C:\Windows\SysWOW64\Aggpfkjj.exe	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Iibjhgbi.dll	Bahkih32.exe
File opened for modification	C:\Windows\SysWOW64\Apaadpng.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Coadnlnb.exe	Ckeimm32.exe
File created	C:\Windows\SysWOW64\Lhnjoi32.dll	Fpgpgfmh.exe
File opened for modification	C:\Windows\SysWOW64\Ppahmb32.exe	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Eiokinbk.exe	Efpomccg.exe
File opened for modification	C:\Windows\SysWOW64\Gnqfcbnj.exe	Gpnfge32.exe
File opened for modification	C:\Windows\SysWOW64\Kckqbj32.exe	Klahfp32.exe
File opened for modification	C:\Windows\SysWOW64\Amlogfel.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Npgmpf32.exe	Nmipdk32.exe
File opened for modification	C:\Windows\SysWOW64\Gpbpbecj.exe	Gmdcfidg.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Ppgegd32.exe
File created	C:\Windows\SysWOW64\Ogakfe32.dll	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Qgaeof32.dll	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Ihbjebjh.dll	Pdmkhgho.exe
File created	C:\Windows\SysWOW64\Kfpcoefj.exe	Kpcjgnhb.exe
File created	C:\Windows\SysWOW64\Ndqojdee.dll	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Bhhiemoj.exe	Apaadpng.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Cdkifmjq.exe
File created	C:\Windows\SysWOW64\Mmlmhc32.dll	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Ginacp32.dll	Akccap32.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jljbeali.exe
File opened for modification	C:\Windows\SysWOW64\Mmhgmmbf.exe	Mfnoqc32.exe
File created	C:\Windows\SysWOW64\Pnifekmd.exe	Pfandnla.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10484	10392	WerFault.exe	476

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iomoenej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcmdaljn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lomqcjie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfcabp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oakbehfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aopemh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akqfkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekodjiol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fneggdhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgpgfmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpnfge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gifkpknp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hekgfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkndie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nenbjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfiddm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnbnhedj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlgpod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpfqcln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhbcfbjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epmmqheb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgnlkfal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgbld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plpjoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bafndi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eehicoel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flfkkhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaldccip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcalieg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akepfpcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbpajgmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feoodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcoaglhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdhkcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnfihkqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiigadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnbbqpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmfplibd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdoacabq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgnomg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nagpeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qachgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbpchb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnipbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfjkjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbeejp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncqlkemc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncofplba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nndjndbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfgcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekmhejao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahfmpnql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Napjdpcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfghg32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpoalo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phlepppi.dll"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgbchj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoiqneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bafndi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnangaoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godcje32.dll"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhqndghj.dll"	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnhenj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klbjgbff.dll"	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcdqdie.dll"	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bklomh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodoah32.dll"	Nnfgcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efpomccg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fihnomjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gncchb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgqin32.dll"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlgjal32.dll"	Bafndi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diinlj32.dll"	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocacl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbbpmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjpefo32.dll"	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlgdjg32.dll"	Jcmdaljn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfoann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kajimagp.dll"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Conanfli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmfbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iibjhgbi.dll"	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlmdbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnidloo.dll"	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdaklmfn.dll"	Fijkdmhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnlkfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkndie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eiokinbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfjjlc32.dll"	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oclknk32.dll"	Fiaael32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anclbkbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmafajfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjaabq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coadnlnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbdfqocb.dll"	Hbjoeojc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbpchb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3816	2064	2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7.exe	88
PID 2064 wrote to memory of 3816	2064	2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7.exe	88
PID 2064 wrote to memory of 3816	2064	2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7.exe	88
PID 3816 wrote to memory of 2648	3816	Nlcalieg.exe	89
PID 3816 wrote to memory of 2648	3816	Nlcalieg.exe	89
PID 3816 wrote to memory of 2648	3816	Nlcalieg.exe	89
PID 2648 wrote to memory of 2980	2648	Nnbnhedj.exe	90
PID 2648 wrote to memory of 2980	2648	Nnbnhedj.exe	90
PID 2648 wrote to memory of 2980	2648	Nnbnhedj.exe	90
PID 2980 wrote to memory of 2220	2980	Napjdpcn.exe	91
PID 2980 wrote to memory of 2220	2980	Napjdpcn.exe	91
PID 2980 wrote to memory of 2220	2980	Napjdpcn.exe	91
PID 2220 wrote to memory of 2940	2220	Ncofplba.exe	92
PID 2220 wrote to memory of 2940	2220	Ncofplba.exe	92
PID 2220 wrote to memory of 2940	2220	Ncofplba.exe	92
PID 2940 wrote to memory of 1720	2940	Ngjbaj32.exe	93
PID 2940 wrote to memory of 1720	2940	Ngjbaj32.exe	93
PID 2940 wrote to memory of 1720	2940	Ngjbaj32.exe	93
PID 1720 wrote to memory of 916	1720	Nndjndbh.exe	94
PID 1720 wrote to memory of 916	1720	Nndjndbh.exe	94
PID 1720 wrote to memory of 916	1720	Nndjndbh.exe	94
PID 916 wrote to memory of 4056	916	Nmgjia32.exe	95
PID 916 wrote to memory of 4056	916	Nmgjia32.exe	95
PID 916 wrote to memory of 4056	916	Nmgjia32.exe	95
PID 4056 wrote to memory of 1796	4056	Nenbjo32.exe	96
PID 4056 wrote to memory of 1796	4056	Nenbjo32.exe	96
PID 4056 wrote to memory of 1796	4056	Nenbjo32.exe	96
PID 1796 wrote to memory of 1196	1796	Nhmofj32.exe	97
PID 1796 wrote to memory of 1196	1796	Nhmofj32.exe	97
PID 1796 wrote to memory of 1196	1796	Nhmofj32.exe	97
PID 1196 wrote to memory of 3076	1196	Nnfgcd32.exe	98
PID 1196 wrote to memory of 3076	1196	Nnfgcd32.exe	98
PID 1196 wrote to memory of 3076	1196	Nnfgcd32.exe	98
PID 3076 wrote to memory of 1940	3076	Naecop32.exe	99
PID 3076 wrote to memory of 1940	3076	Naecop32.exe	99
PID 3076 wrote to memory of 1940	3076	Naecop32.exe	99
PID 1940 wrote to memory of 5072	1940	Nhokljge.exe	100
PID 1940 wrote to memory of 5072	1940	Nhokljge.exe	100
PID 1940 wrote to memory of 5072	1940	Nhokljge.exe	100
PID 5072 wrote to memory of 1460	5072	Njmhhefi.exe	102
PID 5072 wrote to memory of 1460	5072	Njmhhefi.exe	102
PID 5072 wrote to memory of 1460	5072	Njmhhefi.exe	102
PID 1460 wrote to memory of 2020	1460	Nmlddqem.exe	103
PID 1460 wrote to memory of 2020	1460	Nmlddqem.exe	103
PID 1460 wrote to memory of 2020	1460	Nmlddqem.exe	103
PID 2020 wrote to memory of 4220	2020	Nagpeo32.exe	104
PID 2020 wrote to memory of 4220	2020	Nagpeo32.exe	104
PID 2020 wrote to memory of 4220	2020	Nagpeo32.exe	104
PID 4220 wrote to memory of 2724	4220	Nlmdbh32.exe	105
PID 4220 wrote to memory of 2724	4220	Nlmdbh32.exe	105
PID 4220 wrote to memory of 2724	4220	Nlmdbh32.exe	105
PID 2724 wrote to memory of 4316	2724	Nmnqjp32.exe	106
PID 2724 wrote to memory of 4316	2724	Nmnqjp32.exe	106
PID 2724 wrote to memory of 4316	2724	Nmnqjp32.exe	106
PID 4316 wrote to memory of 1244	4316	Oeehkn32.exe	107
PID 4316 wrote to memory of 1244	4316	Oeehkn32.exe	107
PID 4316 wrote to memory of 1244	4316	Oeehkn32.exe	107
PID 1244 wrote to memory of 2080	1244	Oloahhki.exe	108
PID 1244 wrote to memory of 2080	1244	Oloahhki.exe	108
PID 1244 wrote to memory of 2080	1244	Oloahhki.exe	108
PID 2080 wrote to memory of 3100	2080	Oalipoiq.exe	110
PID 2080 wrote to memory of 3100	2080	Oalipoiq.exe	110
PID 2080 wrote to memory of 3100	2080	Oalipoiq.exe	110
PID 3100 wrote to memory of 1448	3100	Odjeljhd.exe	111

C:\Users\Admin\AppData\Local\Temp\2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7.exe
"C:\Users\Admin\AppData\Local\Temp\2ad92c20c48d8ee122777603a1b03c515fffc9035edd70ec8b970518e21cbac7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\Nlcalieg.exe
  C:\Windows\system32\Nlcalieg.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\Nnbnhedj.exe
    C:\Windows\system32\Nnbnhedj.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\Napjdpcn.exe
      C:\Windows\system32\Napjdpcn.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        24⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        25⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        26⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        27⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        28⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:456
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        30⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2224
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        32⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        33⤵
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        35⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        37⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        38⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        39⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        41⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        43⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:656
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        45⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        46⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:400
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        48⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        51⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3152
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        54⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3904
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        56⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        59⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        60⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        61⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        62⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        64⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        66⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        67⤵
        Drops file in System32 directory
        
        PID:1156
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        68⤵
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        69⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2056
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1404
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        73⤵
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        74⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        75⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        76⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        77⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        79⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        81⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        82⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        84⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        85⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        86⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        88⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        89⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        90⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        92⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        93⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        94⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        95⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        96⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        98⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        100⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        101⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        104⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5588
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        108⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        109⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        110⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        112⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        113⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        115⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        116⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        118⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        119⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        120⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        121⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        122⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        123⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        125⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        127⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        128⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        130⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        132⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        133⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        134⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        136⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        138⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        139⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        141⤵
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        142⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        143⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        144⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        148⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        150⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        151⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        152⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        153⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7080
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        156⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        157⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        159⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        160⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        161⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        162⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        163⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        164⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        165⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        166⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        168⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        169⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        170⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        172⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        176⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        177⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        179⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        180⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        181⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        182⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        183⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        185⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        186⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        187⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        188⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        189⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        190⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        191⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        193⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7336
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        196⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        197⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        198⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        199⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        202⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7692
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        204⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        205⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        206⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        207⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7916
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        209⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        210⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        211⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        212⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        214⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        215⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        216⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        218⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        220⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        222⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        223⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        225⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        227⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        228⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        229⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        230⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        231⤵
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        232⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7612
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        234⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        235⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        236⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        238⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        239⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        241⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        242⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        245⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        246⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        247⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        248⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        251⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        252⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        253⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8184
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        255⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        256⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        258⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        259⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        260⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        261⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8620
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        263⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        264⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        265⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        266⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        267⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        268⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        269⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        270⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        272⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        273⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        274⤵
        Drops file in System32 directory
        
        PID:9180
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        275⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        277⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        278⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:8616
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:8724
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        281⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        282⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        283⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9140
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        286⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8248
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        288⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        289⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        290⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8700
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8840
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        292⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        293⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        294⤵
        Modifies registry class
        
        PID:9168
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        295⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        297⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        298⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        299⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        300⤵
        Drops file in System32 directory
        
        PID:9208
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        301⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        302⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        303⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        305⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        306⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        307⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        309⤵
        Drops file in System32 directory
        
        PID:8940
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        310⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        311⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        312⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        313⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        314⤵
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9408
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        317⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        318⤵
        Modifies registry class
        
        PID:9540
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9584
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        320⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9672
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9720
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        323⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9812
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        325⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9856
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        326⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        327⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        328⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        329⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        330⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10108
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        332⤵
        Drops file in System32 directory
        
        PID:10168
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        333⤵
        Modifies registry class
        
        PID:10212
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        334⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        335⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        336⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9376
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        337⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        338⤵
        Drops file in System32 directory
        
        PID:9524
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:9568
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        340⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        341⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9736
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9804
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        343⤵
        Drops file in System32 directory
        
        PID:9864
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        344⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        345⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        346⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        347⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        348⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        350⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        351⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        352⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9708
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9872
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        355⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:10060
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10196
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        359⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        360⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        361⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        362⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        363⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        364⤵
        Drops file in System32 directory
        
        PID:10080
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        365⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        368⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        369⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        370⤵
        Modifies registry class
        
        PID:10176
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        371⤵
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9664
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        373⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:9388
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        376⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        377⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        378⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        379⤵
        System Location Discovery: System Language Discovery
        
        PID:10304
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        380⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        381⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10392 -s 400
        382⤵
        Program crash
        
        PID:10484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 10392 -ip 10392
1⤵
PID:10456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adhdjpjf.exe

Filesize
97KB

MD5
1751a3e6f09738e67389b79d3a83a87a

SHA1
e841383dc7cea537015ba08e588fd43948141813

SHA256
0a1ec30067c6e2293b5fb4c8c60a1a71e28cf20f250506ed5d49647b8441b016

SHA512
f1dde27e93535063af3df0696745a2f3b2fbf1ec0180ee0f9701ab2b417f95e5dc7031d682a84abbdb4b53e87bc7f746d419cc19eac5e9552c183d09978cfccb

Download Submit
C:\Windows\SysWOW64\Aehgnied.exe

Filesize
97KB

MD5
f6a5928eb5ca720f5a11588d074109d4

SHA1
8267e3ea3f09a7d07d69bd391464719a33bb3c32

SHA256
a91df095f8a85ce5717e10279f081f89ef7662e6effdd58a7222b81c7cf86f7a

SHA512
3c71cc0ca135282cfcb6b905f843c3922384f867d12acefeb2aabb3bb5ec7635aa55a1ca6785fec1ac8470b158900c22aba39c0d6af3f17f8521eaf9c893b223

Download Submit
C:\Windows\SysWOW64\Bdagpnbk.exe

Filesize
97KB

MD5
5fbd6766b96f1bf718861da1b5fdbc8e

SHA1
15341c7e88ba69893b34c25968e2dc0b238af805

SHA256
89e0172a72e5b89cf2ac3d230fb0a76097af55562dfbf8284acd10e44e2f8a36

SHA512
29f57bf57688b01aac6c08f98c67604151d8d252c3ba7753e29b4785d861578c35b1dd9221e1887337380d37ae49d6ccf2e15ece79c2691276ea553385f31881

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
97KB

MD5
35c59626cfc041d109b821f122b55cbb

SHA1
1222a45a800c1684b0072b3bc1e7d79c8238078f

SHA256
4bf45fe9695dc0edb71f53669ef4997d5c9ab2daf783c589b1482ff555f8c9cf

SHA512
1e87533335e6f24ef10aca3656d22418532d253c9119c78c21bf92a0df12cf333ae30673f09ea062c31261f92d879acadf017a0f4018f6371c61391818565791

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
97KB

MD5
03be64a1b6410c5885b0069171e30e45

SHA1
5326b85439f6404f17883efdd5ee253352524b1d

SHA256
6bc6fc80f5918f0360229f1e427854e7243ec90843870d127c49f7de2fceb32e

SHA512
2caf910a31ce04059d3e8652592a74898e84e101852dde466c9df997a91e081cef9145ebeca48dd412e58bfbd13b881568057a0e69eb6ebb539eee6d9df1769a

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
97KB

MD5
641aca75a5473b75173b8d41810b3281

SHA1
bec1a4cc9984826e5eed909d913c6865f36db03b

SHA256
026f466d92ee00b5f917215636992ea282ae0218598ef08e8003fe2000d6b377

SHA512
f4d29f4df3c195072b87d7287871eabe8069f0907f52f7741f5a84901250aad4b86472c3f4e037058ecd536e6f974fddee32cee38205ad4ab058c6a03c248746

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
97KB

MD5
58668f74ddb65a2189b2fc191178241e

SHA1
f730c24dcabafb0564ba6ce99681e253d317bb92

SHA256
a2eddd2763ccec690bec36ab5792da11267c722d104bc0f0b19a0d1d44cf0c5b

SHA512
5c2ebd220b233f26c7b4f324a0c9d3520a436476c19773a4a32164106d420af951df8ff21175097106cacc7f2cb0a2ba066b89d79cde25928d53a54fdd84be7d

Download Submit
C:\Windows\SysWOW64\Ckclhn32.exe

Filesize
97KB

MD5
cc4cbc3aba773588a8ddf5867255b55d

SHA1
815207b4d415877d8639d136b1bc369da79647f7

SHA256
2d8c3ec86337699c98c175db11a76c5805f8e3e80f5744f999f326406d0d05ff

SHA512
4cc66f321c9a963e19dee298e35351669b0acdd52bb2710e820d6c43d64bc53185418d9c99d92d5b2d9e99c432e8502ac3ac2497ab918aa563028f3fba15a303

Download Submit
C:\Windows\SysWOW64\Cnfaohbj.exe

Filesize
97KB

MD5
1084681808caebda546c44d9672a4e95

SHA1
c9f0f0d8844992b78db52cbc43ed125c08df99a4

SHA256
c97af335c9c6b7a424b107ba02a099ac772a9f143c96ccc92ac5552f6ade5100

SHA512
8e741315ebaabfd1033e9afc3a959fbb7aeda5291b391cf2857f28731bf6ef5de335a777c15b2cc9c937b3cc26e9f35134ec2c75bd90da1f969220766e2504fb

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
97KB

MD5
3470fd3e68fd1026db81e251649e05e4

SHA1
8aab0cb1a7eff69441e354692aba64a6ccac0e1b

SHA256
96ddcdcf105046dca37f7dea375bbab17e649a3bfda4f949264e3ceb180e8573

SHA512
ce792e80f16725c4cc46042334095801b335e40c582f260eafbd54f6ad34802973fff2cc7fc323f988f3e1ab25bc47cb323a2d4eb5e7c477b75aa9b82a79dff0

Download Submit
C:\Windows\SysWOW64\Eblimcdf.exe

Filesize
97KB

MD5
02698948242581b08f453fccbb4adf85

SHA1
5bd43425b17bca8c6b765de6f467be6b5df84572

SHA256
b656c403e29557502abb3383797f2c9175d1311f41b5ffa23b2bf222ce9775d7

SHA512
9816c62b1e051bb2c7ff9bde5b23d15ff960a48dc9a9f98b297fa039150718d58ec3b80a5f4a4bc66bcc592e19cb4abbf18c6995e5e36b4f6e5be25b5c7fbb8e

Download Submit
C:\Windows\SysWOW64\Efblbbqd.exe

Filesize
97KB

MD5
6aa9ad1820324dcade6e662d9398e4a7

SHA1
a8597eee17d423a4d06a7415d662bd4442738844

SHA256
f74f6852051130edf4580c2ba62054fab3ecbb0d7ee115810d45589f81284683

SHA512
172d0a4026f1e5f09d5556bbc7f481123e9f7244e0d445a13af074fe1f8c8303113f050e318f8b7af46d84b640c1ff2e13b1379c5c214657dd818ce7b37ca2ab

Download Submit
C:\Windows\SysWOW64\Ekkkoj32.exe

Filesize
97KB

MD5
c81555492d4269d7c460c9d933d64eda

SHA1
ba8702c44cc558211e5a750ed7dd82ffb5d44755

SHA256
a54653eeee630d58aaae1abb6558dfbb942cc9404550c99a23d3918fc71dc0c0

SHA512
bb9c19e0fa5232a4447844bfc6ceb2d1af528a53327c2a25a332c8dc7f705fe17e6db9ab86b62b878e740db93b51ca3fd5f407e5c3a094c76e4520399bccd5b1

Download Submit
C:\Windows\SysWOW64\Ekmhejao.exe

Filesize
97KB

MD5
bf95a1de953d3d874dc3254ecddefbec

SHA1
933126e8e9eba8000efadf57d0911834de234745

SHA256
76ad24b5d4f2f04f64760fe524cd586603e9348b53fe37963f94b05bd05be371

SHA512
deac03ddf0959b96f233e4c79ba0ef0bf8a6a6f136bb6c06690391b54b507a94a754e4c23ff2c4aac6e6b38735f7bf27ab6d4bdcee4edeba7f280c12470743a3

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
97KB

MD5
9d054d51d9ce2bf1673b5d9240a1b4a5

SHA1
7c9cd170d4edc98ef80707cfa180fbf63f93cbc7

SHA256
667031290a2531cc96a7b2f4aeb4552abb79af0edbb8a9116c3fb800cfbb1bd4

SHA512
48dd93017e28c966d3066a88171f60e3aacee8c9854209fe97182e8df192a0bc9694bd951600bd5adb150d3e57761b8ba0d8bf0b99e20aee5fcb1c0ed62c6c8c

Download Submit
C:\Windows\SysWOW64\Gbalopbn.exe

Filesize
97KB

MD5
780e57b304b4a43dd5b8e82bd806eb9e

SHA1
f44e9c3ae3d1c2a3c84a939b8ef41ec52fec5665

SHA256
117cf27c789679a2e62715f9c086efc73f5574b3599bb070214acdc16014a8a4

SHA512
ea519e55af443d96cb2b98ca6bc9e37e9927341341d9c49bffc80876ee2762bdf4f1413a2b1b83633344b58dc295735877f2b92e371764f40cb22ea6ea43c0aa

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
97KB

MD5
8d2723f55bac36c428454a2aadef7c5b

SHA1
51ba64437d8fc64e91a3bb001218e60215b8e0ba

SHA256
093514e00d6c6545e8203d5d161ed6b0edbf303caaa24edebfc9bf03f02dc5e6

SHA512
ae6904c48fc3a37ef8589dc37146ca3a6390439c912e06e5689c66a87faf3c21a277d4e8acfd15f3d2cc1d02503ed67ecf4b8a1e0e2ed48e2ab1b845ca4ae7f7

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
97KB

MD5
d64eeaf8656136cc48f4e86b3a999279

SHA1
b60e66b88aa83912cabc29b0dc790fa5bda4243b

SHA256
4b0327020aeca79853c6e05d6b21646cb31f2f3362ff337c4671c6c0eaf310da

SHA512
ca8bb7560fc1c22c510ce4c67ddebf5d2301ea375bff8cbead128df97040a377192545299c23f15ab60e617074e423286bfbde81c70a02bdc056d8e576aa660b

Download Submit
C:\Windows\SysWOW64\Hidgai32.exe

Filesize
97KB

MD5
604eb578c5d543e2b17aed7ba991564c

SHA1
74768c6e6b2e2b2d78cf90106db245bc8e8e776a

SHA256
a7e04a45450c8c6ce4dfc86b75655d4680d744fd5b6af1d252a1fc97e1abd14c

SHA512
458d3a8877b9e27eded896929d192db5bfb91dce91497a2022a32c724f27268363e30b4dcc3367e530b704c9286bdc7ea5eb1386eba44cf111ff9386cfff9a56

Download Submit
C:\Windows\SysWOW64\Ibfnqmpf.exe

Filesize
97KB

MD5
0a78f7d9731810ee693da710d805cef9

SHA1
713c5c9fdbd5bf7bd737213c0a89f57c69d7d4b2

SHA256
82243905acb28899a6201bdbea12b9e1d9c7218baacc565c2c15b7833f0794f8

SHA512
35074c02f71573a79bbd2e3e4559772b2054d1d2bacd76fd3eb734783e9a2afcb595f0e0ee49e4e0152883f8e63b0de837e333dc12cdf9bca38f95cf95c34efc

Download Submit
C:\Windows\SysWOW64\Iibccgep.exe

Filesize
97KB

MD5
96109e94cc9d6f4a2849f7125a4958b5

SHA1
80c647d75ee77a96a27f59a4e59dbd674de75f40

SHA256
c86fa160aa0974d55ce890327cbb81490a3059473c9d7eeaa578a81ad45aa2d1

SHA512
97aab922275b78386ae25a9dca977552629a4d687134b2008562df7d9e7733d2748780a98c048d8e579fcd651d773b49c3a51ebdc9cbeb83112b2930330a8e90

Download Submit
C:\Windows\SysWOW64\Ilcldb32.exe

Filesize
97KB

MD5
f1dc241429b38f27086350c67432712e

SHA1
c71a06e2edd809f6b00e36dad9b93124c1deba26

SHA256
4dadab558dca8bb5e3a66cdc3ee14e19e056ecb3095be70f6d32c17f03425478

SHA512
55ae635f03d438b12271b7a622e6c6346b5ca3c2ca93577e9813f2f988b33eec2dd9a08e98b9969f040121e17c4e87b36dc0107fdbedec941864bf93b0e6b786

Download Submit
C:\Windows\SysWOW64\Imgicgca.exe

Filesize
97KB

MD5
ef20ebe9a56c4027f97d75e33b8a4e3b

SHA1
50c98e256c0ae058ecf39ec21237ce8b14ffaa4a

SHA256
d32f1d9ac584e2ee370c9637d0f55d3ae199abab893a1a3729bc94d738ef6064

SHA512
4d6364577d5a6459d336304b82ba1cc7e09a3f70faa679bf11a1926cd1a7885b749bdd08fb9f8c0b2a1edeb8a237f4c24f459d93db58baff62b955d45b4fa1a2

Download Submit
C:\Windows\SysWOW64\Jcanll32.exe

Filesize
97KB

MD5
20bfce6f5b75dbf4fcd6e1b6c8ada2b5

SHA1
ca1f62c09cde4c98972fc2e0a842388bba9eec74

SHA256
0476be822b173aa390dc4db2a0c2dc151910120f4d88845cb3f5d77c992c1e83

SHA512
53b45f7bd13ff9aaf59a00dd2c2063928c4236e2ee2ece8f9a898be7baccf85ebdae5314f2d17f24aad51262ec59952ed87fc343e6cdc56ee3b611900df14a97

Download Submit
C:\Windows\SysWOW64\Jghpbk32.exe

Filesize
97KB

MD5
b0b3eb86e262d34c47d2c8d1f3782821

SHA1
64ec6840aa5bfa91cd711cdad59903b9433ae24a

SHA256
a0d01c45bfeed20d2a08752fdf07cfd9305210172027c4110dff6ef27110f99e

SHA512
8cfef18a4399181aae05d9ca6e48e5d8e56624c60623ffc00fabfa82720e29c5d8745dc989e730e99750482436448b32bdde61e6bc6ba23533b5024af7af0b43

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
97KB

MD5
7bcbc79e4ff651252c50e744bfd0621d

SHA1
1de933de9bdf0bdf150f29207ceef5ba82eb1591

SHA256
605cf09ab937a49f90295dab9e61805222800ee5b76644211542e82bbca4269d

SHA512
bab9476489aa1a2e75fe8918c79dc0f8cb4ba880c4c918db2103f9a67a5c18cd96af89aad20166d68bcaf773275bb7fcf4349e56b252f2fbfc8d1b7bacb48103

Download Submit
C:\Windows\SysWOW64\Jgpfbjlo.exe

Filesize
97KB

MD5
49341e07fd0529eef155f5c000f4e432

SHA1
d55acf0cd496a5a58860ef9a7c7b5811f0e8b0ed

SHA256
c77b5ae96ec518bad0a247e309091f61840e929f6dabdc34743d2d96a1ec3a71

SHA512
af2235130dd83a505ceb6d1990a4ba83eba664611d0eb673836249417035437e2f1290d0f267ea7bc22fb00868527184412494eadb1c20f00b82fbdcf8f58010

Download Submit
C:\Windows\SysWOW64\Jjpode32.exe

Filesize
97KB

MD5
537990733182c6c75b861f45510f97ee

SHA1
68e8af45045b1e0990f7f76cb5aec3105375c96a

SHA256
da413ed538666387a8fcc02a8518c8acdac214c071b449a3775b887c06f73268

SHA512
b9abbf937fdf0582b634b5b60256179734a2aaa84548c342833ec83051b57f03c508ab137300807075f398478327908d0b4fe7b4300d03168d50af3ddceac2da

Download Submit
C:\Windows\SysWOW64\Kpcjgnhb.exe

Filesize
97KB

MD5
0e5a35ce785326cc537219c52118eee5

SHA1
03ceca2ff1d2b8984b15caeb31f5662ef69354be

SHA256
5483179f9e1393532c765aa285c6f5c050d33708336277d70841378e6670fc92

SHA512
32ddf7176951c739a097782c21cffeaa72cc73a0ead95e249e58a2a920b7b9091b5f5a3734f2bb72e3851f5bdca1db2e8529f62bac65625a58a8aec07ed81873

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
97KB

MD5
a38efb945bf83c25d68192948d0a7240

SHA1
218173afd8b36bc40f8d50564f03414920670a2b

SHA256
8be3d06e7cdbf0685e08d3953472477353f4dfd05c100e0e7511f29ead1f5937

SHA512
39f2e7ad43f8a06d84a2a6608229b3e2ae7eece380e153839a17e25991512e210a0f853e180c6afc3270ee4e3e13174eff2aca617daab70b41e45ca95edeccfb

Download Submit
C:\Windows\SysWOW64\Kpoalo32.exe

Filesize
97KB

MD5
b70f70fa878815d27cb35c206b22f35c

SHA1
12732b8e793360c581d2b39cc6a15ae3dbcaa9d6

SHA256
04cd724ef86d0967bfa01d6eece578cd630e099f164db69d38193bf07a521739

SHA512
3febc6a02d800e71f6f21d583ef18fbd0e1b8ad347fc1f3ac0502c9d7214c19b94991b877211f0f7a6586de28df84a0c94fd4bb3c7e301323df7b830ff149528

Download Submit
C:\Windows\SysWOW64\Lflbkcll.exe

Filesize
97KB

MD5
fb6a37ae4c3deeb39751873706a047c8

SHA1
38ebc2826b4597efe6a09c470302370363db88da

SHA256
9d3b2f960086362eec93e670b74a6de5a279bbe278ead8f6f7b603abee2895b5

SHA512
f92bb8202aa3f420b8d4f70a10429b2e4323e42808ce40fcc1fed41bd249b423babfca7f4d12a49f8296149e6662433e7a94878a2e2e698917e244c48920f901

Download Submit
C:\Windows\SysWOW64\Lomqcjie.exe

Filesize
97KB

MD5
8ca4664a4baae3d1494a53fb186b49ad

SHA1
75714f29a95c3c116444d48debf06ac7fe4d2481

SHA256
e79d0b0f8c4a6c1c5e0339eb843111668ffc7b85088e6523fb7632a763f77341

SHA512
0950a74f1ab208067529a7c1990511c08794c42fdf80980e5ab0809912999c1f505de0d864488787436b69bfce0bfa94a5405b5b847acec0982e30fef44b8f50

Download Submit
C:\Windows\SysWOW64\Mjcngpjh.exe

Filesize
97KB

MD5
d609cc5a0970eb5a38b40a1cf9a47274

SHA1
0daffe26feb42ce5cacc90850bbada01bb3e586c

SHA256
92f8d2a0debd47bed34096c892206f2e94c954d8a67692b0149b6d40dd851780

SHA512
ef162f3e915f8c932f0ff2586aec05aa247d337945e54d1df672df0e97f9aba1de876e8c16d2ba5f4cf8e3750843283bb14a5368454afa4dd9b8c80884bef3fd

Download Submit
C:\Windows\SysWOW64\Modgdicm.exe

Filesize
97KB

MD5
01a9f1cf39ecee45631308f8ac51e994

SHA1
a5ef5e61c086810258dd33e6f41fab0e03ed807a

SHA256
15e14444aa796b444be15deeba85ac7669926265c4305d81a0a82889c1a51294

SHA512
71c0472525bc1855966726570c53da8b96da6c8a3658747c76b05c8ca9973688e501c31230a59559345fe4745c072f320ed8ec758b8cc68999480d2326eba5fe

Download Submit
C:\Windows\SysWOW64\Mqfpckhm.exe

Filesize
97KB

MD5
b374f50cc2387bb2cb9f235486ced04a

SHA1
6a1ee5efd25e797262289e5a36930cf65e95e105

SHA256
59da2e1a95774446d6892328827669cb3ec9ec8faf6fa5244684825beaa560e6

SHA512
a87a9d0aaa54f8cf3290f5455cc24d09cad6f1bbfc7bed1e203a94d41117673cdac20b4c3bcc1be79ad44169b949377912edf79583dcbd3d12952df9226bed7e

Download Submit
C:\Windows\SysWOW64\Naecop32.exe

Filesize
97KB

MD5
43e0db2a68161cd9aedf84ce6b1e2bf3

SHA1
e97e10d75c69d781040cd194ac4d6a11b4d25d1a

SHA256
f3e0cb1f288f562d911d7267690776890d6a4b26cb419f7aa69d20efc6e6fd70

SHA512
7861e6c0ebc1b5654c8f5f095a8d4604d707459ee3aaa31084ad8c87d4978c04898ff02eeed38267c5d2169a1bcb4141209faa77da775b1dea41f458d350e310

Download Submit
C:\Windows\SysWOW64\Nagpeo32.exe

Filesize
97KB

MD5
ac09c4f3189e5603785c7c2d962cad7c

SHA1
b59b2f8a8d65d49758af794294bcf554c7e48b6a

SHA256
73d71c2a2ba5ee4a4ef9696902e0c68bfaa107dc5618d5891e9811607bf2bb84

SHA512
ab18a59695be618f81ca0333d1d575a804de358ce70552f405119bdb493cc015bc4e57bc0758356961104f0c6e076c2f0bb49d1683e082bb57df06319f7dfcc3

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
97KB

MD5
524d9b61b05a19238173adc2963af6f2

SHA1
868049faec5c3eab4122c58cad13ca88d45c5b47

SHA256
0fa3cc4923f409f6cdceda2a43e7f8e813214b82905a02b523577597e2daf024

SHA512
becc9bae36aeaa1dae305e9fe7dbb9746691d87443874eacb24f052e83e710b165833b409df21a852f0c710a89f0279fea74af78fc0010aa7770af94a523b2d5

Download Submit
C:\Windows\SysWOW64\Ncofplba.exe

Filesize
97KB

MD5
58a0b28f2b1aee4f2bf0c9beffc52bea

SHA1
cf0647ec1196409549c347743147c7fb16f22089

SHA256
019f9a568042e083151ae7091cc1c8991e07a1390a43b3011bcfef36b02e2c28

SHA512
da21701d31b9a8f6417269e5c94162720d90eebfa9ce459260db4829d5415db1da941ca01d73f0faacae1cb221025c5cd8c3567779832ca94ca472feb1635370

Download Submit
C:\Windows\SysWOW64\Nenbjo32.exe

Filesize
97KB

MD5
92f6c9e45532fc6a53011e86a5454d59

SHA1
77330077ac17edf6c2f1a5f339be9c65d085b59d

SHA256
e4c4e655074cdee5ee938ef3b909edc0fae47cac2b1ed2a691e0770de9c73de4

SHA512
65b6439045ae15660dd9cb04eb51a0bda07ecb4a1eb476e5c43dee9fd4647ed35026466e634092a9ad19e7659c21d4cc2c955430b7ab89efea222156d0a765f8

Download Submit
C:\Windows\SysWOW64\Ngjbaj32.exe

Filesize
97KB

MD5
31a172a8603eedee91ee67e224ae2b43

SHA1
7fab818106d07153cbe4a07e06d28cd165e8fa60

SHA256
1a77af525b7583703d5cb82a4f82ab41c13df6c9b2d2bada562a06f8c86bee4b

SHA512
d4508ad36a7542323c0186b62a5d0229f473ea1d58de7d04b4034aeaf7e2bf4ce6de95cb96d46f40c0897c7c6fcb26f8062d06549d06d2195c42128df6813e06

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
97KB

MD5
51e3f10501ae13f25f23cc3581968afd

SHA1
2e78d84fa8c66fd7bd08e0f775efd8ee36d222ce

SHA256
adbac30f7a6c31d7638ace75e447f9b8532711ac672b13147ad8ea83a5db1a97

SHA512
a1b22b65d9074109c8d5e8ad39179797333ac34858fd5f00d0626e296fe32d04eaf167ae825883af27f82fac2b62f17773dc56345ad2341eb6218970c6ca9291

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
97KB

MD5
f5a69a731721fe66be413695ac40fc33

SHA1
5e54f0ec90160e3fcf2950126f402c2d25a0669b

SHA256
ee7c5f81fd7a1c45ea90f992a67288f2990b699d58db2ce9b94eb4c1046282b5

SHA512
f0c46071c8876e72b9965307a6b1c777884e502d76cf51bd1b3acd51bf9c3871a71742e8ef93fa0bbce1532b72bc864b0a0d53a7b872cfb8922a7b138937a6d0

Download Submit
C:\Windows\SysWOW64\Njmhhefi.exe

Filesize
97KB

MD5
168086cf159d8bbe51f28bccb6c226af

SHA1
4390554ff9828f1e2b3fc319b952393b0291e396

SHA256
03adc3f33031ea2009a1a6e18803b57c52bbab9c07c4b23f17469b7a9564803a

SHA512
b7a0b8efd6ccbece763495f774b56950e72575cf2dd10ed394d3fa694f688f740e18522666469edf985eafdcc77f1991712aa9a62ea8133675e2442025f9a2d2

Download Submit
C:\Windows\SysWOW64\Nlcalieg.exe

Filesize
97KB

MD5
33ccd35c4490a0bd36af104155f5a2e7

SHA1
2bbea7d5e0121ad92d6c5d5904e9fe6ae5b1a751

SHA256
a38ee26a9f712ff5babab39d98b41d94a10cdc8e891ac7679e289255e3edd7df

SHA512
21e50117c4b201ead003850414716cef22dd4876890d221c767b394b5ca4195b186fb863ef2e786edfc4b81a5de5695e38ac3a85a9925f23f067b892e1348d75

Download Submit
C:\Windows\SysWOW64\Nlmdbh32.exe

Filesize
97KB

MD5
748ff1d0c25aecae4c423c0017c3669d

SHA1
4a8476b1a0946ddffcf69dd4b19533a0d137b9b0

SHA256
ffd74465ed2bf780069dc4d73bbc30d2c582f649f6ef1e4a4fca687fa0a78577

SHA512
d81d425dbf8aac91a6fae36b6ed375c135e141dfe4c154db81faa0121cd4283fc04980057ee3d80c4232ebb75cde41f7e35b0578b3ebb07725810a6977a44147

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
97KB

MD5
b215f99ccad66eddf8ed40f689adb806

SHA1
a4ef82bfbc3060aedc85c4990dd01d39615a1a44

SHA256
739e4615246cd25d7a6e4acab8625f597a56293df476166d0837a4ee012030f6

SHA512
ea0f088eea08c029d4e20fc0964129ee19bd750ca325ed0e8419774beaa81700c900881720eb578014311d2af6f4f463592f8e797e9d1c38c650cd04ad064c40

Download Submit
C:\Windows\SysWOW64\Nmlddqem.exe

Filesize
97KB

MD5
8a3992fcc42e89dca1be2f669a6f1b41

SHA1
e3f5ebc6f9712055947badb2bf05fc0effd7c2ff

SHA256
f9ce01330222b8ebc92a9eebfb66b14529a56570c3ff02f97170153483d845a9

SHA512
06ea4514864944be160fe5e51d3fddf754c6d2a75b3ec46363135d81530b45a391e5a1f9eafd88bcd9a8f0c5872990d04cf5370e26505b076195fd408d594823

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
97KB

MD5
e28b31f96d31d7119e1f4ee439fb8d82

SHA1
dc20c635892e78c0da37c7b4fcf42cce90b34cb7

SHA256
3c16d0164b28328072e9398b8ac468588a1a97e8ea15f05de10bad37eec2a322

SHA512
a14364f8de34821ff1b26d94e2a460b036954a6bad01a0238ed35b148caf572ca3b71ed4c76fe58496a39c5a7570f13efa4166f48b4bea8fc4fc186e127c53aa

Download Submit
C:\Windows\SysWOW64\Nnbnhedj.exe

Filesize
97KB

MD5
b11d36814285a6e8d0bda09bc493a30b

SHA1
986c50e32ad6cf531bd7c40c90b2808dd22b396a

SHA256
714a863ce88495a707d451da97378dbe526cfd30db60c951a767646052540e84

SHA512
439e7b224c216a367b2d3db9ca513c67a991484010f92b344240b13fb7497df403bc562b2b5329bc2d948548595734e314d19c88f409faa5cd581539646373c3

Download Submit
C:\Windows\SysWOW64\Nndjndbh.exe

Filesize
97KB

MD5
e50e02348610c6b6f7768bdba24e2796

SHA1
cfb9e7f01aeec95b3c91fa376ff054bb4583e591

SHA256
90d3b13915b629116180eb132a239c919e6abcf33e8a51511af15ea92e201580

SHA512
ad5e6558fc115dc41f82ef7fefb17186efcb198f3ccc88ad4893cca8ff38fde4e1d28b2ddd5187fd26153f9f6f0701ab2288eeecb3bcc39efe0e81997802b61b

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
97KB

MD5
0faf5d931cd6385e39b8f88c8a6a3b5c

SHA1
3746a4a28ef927a2578944f54e93d8639e21ec73

SHA256
0828e7b1d270df5b4b334951059ac5825fe453665f32d734696940501e21bb39

SHA512
653508314c9d1dd972496dec401e30cfd9031bab0b5da84ef6a63c3a9e2605d5f8917adf8d24db329e3b142a123763f185707e789b84220b3c8f87260aac8776

Download Submit
C:\Windows\SysWOW64\Npgmpf32.exe

Filesize
97KB

MD5
51c3b5c20b4036a5fdfbdf66ffba6edc

SHA1
b197814a42c9313cb50f6b2a3714c87d02753994

SHA256
42b9459696f9055d532b673e01351f406770941b5a774c420b785b702b03c658

SHA512
1fa21660e9219fcb32775736c127353f005ee6a309891d01bf7038da961a0a02976f4e68b028b822396b13942510de661ced80246e3e9a1f06826f8297e4c6c6

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
97KB

MD5
eb28e007e38553d0ffbdac75ac077f9e

SHA1
738fc0bd043d903c8c7104ee61b21dff4d8a9ba6

SHA256
30231e283bd1076c82fad20f86dcbff27a8be8cd5a35022eb6f1fcd6366933d9

SHA512
859de6a37b67404b50838339d6bbedf877edc9ec39873837093abeaf2c2f67d9a3b7c0cdf104eeb5f1bac1c5a02a4e025a474c6156a0c347cee5efefbc0f064b

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
97KB

MD5
a411255607781b53e072993d32bacd1f

SHA1
dc2e80317e56ce0711b9d3f016affb336b2147f0

SHA256
4220ce4840ef04afd9cae85de47554643693cdcc8041754bd7d4b1bc8fa67f69

SHA512
725dea9e2298f5b4c8800064f1fd3d94011835aa775d09ae2c98b2eaa19520704fec81b23b5f6268420a984949f2d6e7df3459762d36098ed12dc74f496e4670

Download Submit
C:\Windows\SysWOW64\Oalipoiq.exe

Filesize
97KB

MD5
26fa29d427ef42f0f7b0821ac159528b

SHA1
dc154b4e80b2b35bef242b2650814975e40721ce

SHA256
5ba9f42bcae3984a594c257da7fcf8a612e4c7a9c2ed439c2336e45dbbf26040

SHA512
8eeaf6a314f1175ede4a59266322c576eaa70cc71704800c49632b5aa5fc1acfe0dab7812ed4899e507bfb36eb19c59c26b5b144a99bf7eb8df0aa33eec90cd5

Download Submit
C:\Windows\SysWOW64\Odjeljhd.exe

Filesize
97KB

MD5
674a986c2f1928f6362aaa0efcacce03

SHA1
626a95d611cdc13fd589b016b92232799cd28157

SHA256
018545c4407541668abf78e87873f84bde3a4c65d97574d7054369094777313e

SHA512
360e33c0979ceac4b1264df3db885b4f58a50ad7d575b01826c4d05f82d37806e3b41894924722579f31e368a4b115d4d2dda49845c6c60b1f93191e88b7ba7b

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
97KB

MD5
a9c8434658e49c359962614b0752a092

SHA1
2e4f328839d0726b2647630bfd002b3c64e9c0f7

SHA256
909843d36bf5704ba337c572d31fd338d46f09786617ba055033baa61c3e4d51

SHA512
8a536274f7b09008e111ceee9fada1987318a4f4cf0c89573c1d11ff6a910a2a958fec6e236997e3a568ecdb7628982fd3ff7b821b7d1d96128db067e9c72c54

Download Submit
C:\Windows\SysWOW64\Oeehkn32.exe

Filesize
97KB

MD5
9fdf8774b7097666b78052ffeae60b03

SHA1
a1c2107012eb6c8f6ea9acaf2a722f86882449b4

SHA256
f132de1bc5905e813493df133956ed27f92006f00e6b183709160c9237c30610

SHA512
d04271b2f72f781c9354c99722d6300f50b88b7f2a06a810047e226a42e8b15f1de2d78494b1828a38f36860f9c4d8e323118259357d8c8645514bc8fb66f3ee

Download Submit
C:\Windows\SysWOW64\Oelolmnd.exe

Filesize
97KB

MD5
d4bdc10082f803fe2f9d73bb9929b904

SHA1
2b2a2326e2d3e8bebf5b923cde493b0f36563eb5

SHA256
59d367b54a6c5eafc31909a0109c8f743f4f6904a75a2f4e624bf77bfcf46f3a

SHA512
4dea3f61630fdfe72dcb895f7ab9622e1a84c24f134119843c060a8ea125d067a4ca2d3476b62f7b070b91e4f27cc292b686189c8063958a64d37a0a906228d3

Download Submit
C:\Windows\SysWOW64\Ohfami32.exe

Filesize
97KB

MD5
dd3658e6665caef6a65b97f15c79db69

SHA1
8ab2c8d3dfc68e3b0d7d2031933771904ac41469

SHA256
ef9e7aea9d2db1fd8f70dd4fd81fa6bf22e630c68e915a95d3c5fd3cd5426124

SHA512
55b757d3faf3970fc4237916b8fd2b43850ca733f4310e521c94a2a7e7d4a231e30b6afdc6fe2cbdf525818098e6290e2112933570271c315b44e619aca5cb9c

Download Submit
C:\Windows\SysWOW64\Ohmhmh32.exe

Filesize
97KB

MD5
28a30310cd168756b3be89218ddfda28

SHA1
ee27e54b408ee8614f24e824973891814b194991

SHA256
a58276b0f8da2265089bf1183598a718ca379a938d98b0e74fbbe34c08a3a4a6

SHA512
9f8b25a6ea00471e0eed351fbb96b9e1d4c24d241f3c14a184e1e32bdff888a3b8dafcb92bbe4b997efcdd1ed655b65e27d42d441248e724dcac85bfb4447d99

Download Submit
C:\Windows\SysWOW64\Ojfcdnjc.exe

Filesize
97KB

MD5
59c08881e719ec93713ca4a03628fda1

SHA1
a6f6ff6a68ed80c463b442ecfd2e51b58c69480d

SHA256
fc8c1a02e78d98d513921accf1547cf1ba9801f2ba782967e625ab3ff9c402f8

SHA512
e426056bec6f031afa7b4d6954c5cd422d2f5b84909926bec7acd56e1205475baf63acf51071fa411ebbd53aa187e1f4bb054b33a629f9205517ecc17423a03c

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
97KB

MD5
f511691a8177383e6f4f124c5fa9012a

SHA1
c30b12079bb4b977a4b48c10dd5433d1e52e0adc

SHA256
530cfb30bc5e186ea8b1dd1863bbe8cb0c606fa5e40b8b29f01dfc89e2ed97c5

SHA512
06d29f434e0ae81cb30b1fbf845fb616cb7fd29aa75d5a1ba187fc8aff3787183f58091e08fab2fe2542398b4a316d627593a8248f4fafedaf718af75897bf47

Download Submit
C:\Windows\SysWOW64\Okkdic32.exe

Filesize
97KB

MD5
fc1726c4a157d3c786b13326ac4c167c

SHA1
66cd09dccf77817658fc91e086acbc2324233993

SHA256
f6c928fe6e3e1e4df97fbcacdec30298ca20072b842d44dcdee7a5f07db45eec

SHA512
8609c2a44ff81600ff6ab1de0707699cdfc120fefbe46cb4d580f33de88b9a109dc3c231225a34748a0a5a214ba467ff83608a1ee2159024d45a6e959413262d

Download Submit
C:\Windows\SysWOW64\Olfghg32.exe

Filesize
97KB

MD5
1386127852b01ef7d320d58a780a593f

SHA1
aef925aae9b91c08f22e1830d6f7f403f91dd537

SHA256
4fe3dae0cbc3eb8755872671b461017e4b010a024d7de0dc9d919799814de8ca

SHA512
a32e04e219352695be9adf27da20e726c9146e2d3af8071d88e54a0051ed087a259af11383fb12bedde4d21e2e603ed2c3df4ff07da12b2d6748872b3ec6584d

Download Submit
C:\Windows\SysWOW64\Oloahhki.exe

Filesize
97KB

MD5
e9199533af4ed9adc864de1028e4f0b4

SHA1
9fbf219b4ab09a1ce3324a3694c7de86ab8a5782

SHA256
a853e54191f23c0692de0bc686509774eb07777b461b3079b59c0955dbc1869d

SHA512
3d59c626d2d921271d0759be5ff148b4fd18672b6fbe5053c913014817c8fdf90ceb2895aa91a9a5a68586e91b7b6313219202dcaf8e282dcbf758d488c30bf2

Download Submit
C:\Windows\SysWOW64\Omcjep32.exe

Filesize
97KB

MD5
27c5540e7db8baa19a5180c7cd417896

SHA1
ac3317b0c4bd5cf5ce61280a1c053dd53dd6c9a1

SHA256
eb9696d85aa8222b321352f23aba6313b690c636b4775cfb8dbcf79e121bf526

SHA512
d59fbf876d0d0b97976066fa514531ed54e1d33d7aa6b90fd552ce9f513cd291d7b04917f8dbf93a080f814c07d4da0c5b9b62f5ca311f13c1fa7b42f7caf755

Download Submit
C:\Windows\SysWOW64\Omegjomb.exe

Filesize
97KB

MD5
839cafda4b18d2f891ce6d88e06008c2

SHA1
ac0e961c72ed5d87f72923af8aad62c8acf84a2d

SHA256
a23519dd63d993ee23d53a023c413c231114e6a958eb8938444944a6459e6ff1

SHA512
5382f9db39128a1400b6a905c2fdbeef9c37fd90808b2b80e28cc0bb0a004088c7e127f94ba7cdeaae780d94bc3b33b9a99c48602017b32a32c56304631572d0

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
97KB

MD5
facb14dc2cc35d2708c71dc3fb881b42

SHA1
7df36f127a8b7031f485bec671427fe5e2ee5490

SHA256
fac4a794d388dd107547ce44d8f15fee176ae9a2bee5d4e6d4534606d1138383

SHA512
17ae66e218f690b4852276992ad95a19e922feb3c4a09ace5cc129512af69553c6ab132269385a4e100ae0a7de76492e4644c60d7fd1db23d36aafe1acc203da

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
97KB

MD5
60b598ecd28853d1453a616ca67bcbf2

SHA1
e6d98cef936fde2eecdca0fefa42bcc551146afb

SHA256
dbb2adf33d6b9c65b5d24dc2869f48d2f2e71b1adfffc4d9c94005abfa498414

SHA512
4073dd2ce5d449961576ad56790d7f89a470b1272fd5956f443ce3289ef19dcd192fd7568accc9600d33f41ef9741c814ac97cf2f22b734d17a72391f8d65325

Download Submit
C:\Windows\SysWOW64\Paelfmaf.exe

Filesize
97KB

MD5
7f90aba67c9dd3e5b827c28f010d8272

SHA1
4dfbe6f9cea8487821fccfe9ddec8eba971d934a

SHA256
8f8e339d975d8dfaa3affe9bfdb855fe334ddb94f1f63bf4234db6cfc52ac98c

SHA512
118e0cb22e3ecb10bd41668cf453ff5c0d9a36b6f1a4904b73adbf3280a26a93f9a94801c2cf9f9bfd00fa812200209efab80de44b3528ca0fce4b72355118fc

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
97KB

MD5
3cd557abcfd8b9c505b97802c3ee5f58

SHA1
f32edc2e6171ad3abee27468f111a2a8a548ca8b

SHA256
b001c53a6433964ffb630231c10079c32324b1d07e2b6fbe1211183965dc6bf1

SHA512
8491ecd08781c0a2a7fd1249f15f05eaeae6545cb77edbe5125f26ad9f5d4544e10aa1ed43c02ebb798e3cae12fd15c9b2ce1d670559e9709c5697d4b07b8e93

Download Submit
C:\Windows\SysWOW64\Pdkoch32.exe

Filesize
97KB

MD5
a35280379a9e86e1b71854e73b07e45f

SHA1
2507e5fbf6512e9c9b2636d12fdf1a16aad8b7d6

SHA256
02e5af03cca24b2aaed6518de719a22d7a174fb479be9503bd904808dd9cee30

SHA512
669606f5ea87f28532af8234719913505cc0d8dbb847ade613353b1f8c1cd21997322eeac5d62af0843064e701d1183826eb73cb042a76b4242d16c51c69208e

Download Submit
C:\Windows\SysWOW64\Pmblagmf.exe

Filesize
97KB

MD5
5d626fb92240409ed27b763c6e4b35ac

SHA1
fd6f976ac08bc9a08eb676d99603b36a5f5fb71a

SHA256
f15bc20991aefafc15d899b98def2db78cb2fd0ec5327472f5f44b81a87aa4e6

SHA512
b7d7271346e24d2b01fa3571cafd7a952644bab3db1a09e2e425b6c0f28f8ccb84c6fb13d3f6df05cb2d8c002edd1a4ad77ab92d8306db5447c3a8010bf24e99

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
97KB

MD5
64ddaf7d0c25023ef662779adec8ddee

SHA1
0dc9f624a9ca7b35429024fe4fa367b3790a4453

SHA256
efb25cd6ad2d9eedb6afb279f166f6fc6364aeb589d1714c815e775eaa581ae2

SHA512
aeef19dcad68148fd9ce32f72c527efffd0543771b77879ff026332c938f96c8a8ed052c06adba95eb3fa1896fe5522f14aa82330b341915ac4e3eaf019259da

Download Submit
C:\Windows\SysWOW64\Qlgpod32.exe

Filesize
97KB

MD5
177256720eab4cf4fadbfaccaf0fc8ab

SHA1
3fc430c7a88baf7277f6b623874f7ef9eed1472e

SHA256
82495263865f8c5144e7039827f6e973f4757ef0482afb8d7fc7d1b57b27921e

SHA512
d2f373319217cbf6d397706bf25ba0fd557d78ed239c9a988d37eb156a224d82fa32ec2c998927940a02df50b49c1ef461bf58896ced8b4029306fab8380fbea

Download Submit
memory/400-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/456-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/540-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/656-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/880-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/916-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/916-593-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1120-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1156-460-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1172-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1192-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1196-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1244-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1364-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1404-484-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1408-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1448-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1460-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1588-490-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-454-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1720-586-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1720-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1728-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1796-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1856-441-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1940-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1992-520-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2020-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2032-508-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2040-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2056-478-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2064-544-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2064-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2108-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2220-572-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2220-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2224-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2296-496-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2320-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-558-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2648-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2724-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2760-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2824-231-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2844-448-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2940-579-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2940-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2952-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2980-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2980-569-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3076-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3100-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3152-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3212-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3444-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3532-472-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3544-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3696-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3700-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3716-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3816-551-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3816-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3904-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3956-514-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3988-502-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4036-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4056-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4220-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4296-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4304-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4316-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4392-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4416-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4428-220-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4472-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4856-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4892-466-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4904-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4932-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4992-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5060-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5072-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5076-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5132-526-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5172-532-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5212-538-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5252-545-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5296-552-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5340-559-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5384-571-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5420-573-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5472-580-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5516-587-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5560-594-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9980-2692-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/9996-2719-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/10392-2669-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads