berbew | 0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804.exe
Size

88KB
MD5

9be3f2faf7d22139965890596caa5dfe
SHA1

ccf2e1e5b8f9572ecbe91d26694719738e569047
SHA256

0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804
SHA512

0b10c43ae05451168abd1540f66547820a74ebaf962c43cf156197ad4f4f65da2a9a38327b46b77f8d1dbdd9a20deed32261f71029a785d383cbae536ac0189d
SSDEEP

1536:1XCn36fSL9jFQRFz+qaATDfBF8WJaCHGxZAdwFL8QOVXtE1ukVd71rFZO7+90wi:C6f0jFQRFz+qaMcfxZXLi9EIIJ15ZO7X

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihmfco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbbeml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqoefand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knhakh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnblnlhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Manmoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onnmdcjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Badanigc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bakgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbelcblk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igdnabjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgjoif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eohmkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpioin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpmhdmea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obgohklm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahgcjddh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aednci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geaepk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpgind32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kncaec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmaffnce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gflhoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilnbicff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmkdcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfchlbfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glhimp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giljfddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpqggh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmhpg32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4336	Igbalblk.exe
4852	Idfaefkd.exe
4716	Igdnabjh.exe
1056	Ilafiihp.exe
4792	Ijegcm32.exe
3044	Kmfhkf32.exe
2488	Kjjiej32.exe
2932	Kqdaadln.exe
920	Knhakh32.exe
4412	Lklbdm32.exe
1916	Lqikmc32.exe
4868	Lnmkfh32.exe
2512	Lgepom32.exe
208	Ldipha32.exe
3692	Lnadagbm.exe
1704	Lgjijmin.exe
4732	Lenicahg.exe
4192	Mminhceb.exe
1908	Mgobel32.exe
964	Mebcop32.exe
1608	Mjokgg32.exe
1712	Mmnhcb32.exe
4864	Mgclpkac.exe
4572	Mgehfkop.exe
2524	Manmoq32.exe
4260	Nghekkmn.exe
1276	Napjdpcn.exe
1984	Nmgjia32.exe
1692	Nlhkgi32.exe
2616	Naecop32.exe
2084	Nlkgmh32.exe
3412	Ndflak32.exe
3116	Njpdnedf.exe
556	Oeehkn32.exe
3324	Onnmdcjm.exe
2920	Odjeljhd.exe
2996	Ojdnid32.exe
2808	Oanfen32.exe
3056	Ojgjndno.exe
3656	Omegjomb.exe
4076	Omgcpokp.exe
2088	Olicnfco.exe
2028	Peahgl32.exe
2892	Pknqoc32.exe
1292	Pahilmoc.exe
2408	Plmmif32.exe
4876	Pdhbmh32.exe
1300	Pmaffnce.exe
1496	Phfjcf32.exe
4508	Popbpqjh.exe
4952	Pldcjeia.exe
4408	Qemhbj32.exe
4576	Qoelkp32.exe
2316	Qdbdcg32.exe
3992	Aeaanjkl.exe
4164	Aojefobm.exe
2600	Aednci32.exe
3372	Aolblopj.exe
1176	Ahdged32.exe
3608	Aonoao32.exe
552	Ahgcjddh.exe
940	Alelqb32.exe
2552	Bhkmec32.exe
516	Badanigc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pjbcplpe.exe	Pffgom32.exe
File created	C:\Windows\SysWOW64\Pneall32.dll	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Dgjoif32.exe	Damfao32.exe
File created	C:\Windows\SysWOW64\Hnjfof32.dll	Ihkjno32.exe
File created	C:\Windows\SysWOW64\Ebgpad32.exe	Eecphp32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Bahdob32.exe	Bknlbhhe.exe
File opened for modification	C:\Windows\SysWOW64\Keifdpif.exe	Klpakj32.exe
File opened for modification	C:\Windows\SysWOW64\Lohqnd32.exe	Lljdai32.exe
File created	C:\Windows\SysWOW64\Hpnoncim.exe	Hffken32.exe
File created	C:\Windows\SysWOW64\Iohejo32.exe	Iikmbh32.exe
File created	C:\Windows\SysWOW64\Bjdbkbbn.dll	Kcmmhj32.exe
File created	C:\Windows\SysWOW64\Njjdho32.exe	Nglhld32.exe
File created	C:\Windows\SysWOW64\Mcdeeq32.exe	Mpclce32.exe
File created	C:\Windows\SysWOW64\Pififb32.exe	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Njpdnedf.exe
File opened for modification	C:\Windows\SysWOW64\Fneggdhg.exe	Fmcjpl32.exe
File created	C:\Windows\SysWOW64\Lqhdbm32.exe	Lfbped32.exe
File opened for modification	C:\Windows\SysWOW64\Opclldhj.exe	Ofkgcobj.exe
File opened for modification	C:\Windows\SysWOW64\Aagkhd32.exe	Aoioli32.exe
File created	C:\Windows\SysWOW64\Jcdihk32.dll	Fdnhih32.exe
File created	C:\Windows\SysWOW64\Mebcop32.exe	Mgobel32.exe
File created	C:\Windows\SysWOW64\Egbcih32.dll	Ibaeen32.exe
File created	C:\Windows\SysWOW64\Ppnenlka.exe	Pbjddh32.exe
File opened for modification	C:\Windows\SysWOW64\Ickglm32.exe	Iplkpa32.exe
File opened for modification	C:\Windows\SysWOW64\Ieidhh32.exe	Ickglm32.exe
File opened for modification	C:\Windows\SysWOW64\Camddhoi.exe	Blqllqqa.exe
File created	C:\Windows\SysWOW64\Ijegcm32.exe	Ilafiihp.exe
File opened for modification	C:\Windows\SysWOW64\Lqojclne.exe	Ljeafb32.exe
File created	C:\Windows\SysWOW64\Aoioli32.exe	Ahofoogd.exe
File opened for modification	C:\Windows\SysWOW64\Baegibae.exe	Bklomh32.exe
File created	C:\Windows\SysWOW64\Aciihh32.dll	Manmoq32.exe
File created	C:\Windows\SysWOW64\Cnffoibg.dll	Ojhpimhp.exe
File created	C:\Windows\SysWOW64\Cgnomg32.exe	Cdpcal32.exe
File created	C:\Windows\SysWOW64\Nlbkmokh.dll	Ehpadhll.exe
File created	C:\Windows\SysWOW64\Lkpemq32.dll	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Dndhqgbm.dll	Kpiqfima.exe
File opened for modification	C:\Windows\SysWOW64\Oqoefand.exe	Obnehj32.exe
File opened for modification	C:\Windows\SysWOW64\Jcoaglhk.exe	Jleijb32.exe
File created	C:\Windows\SysWOW64\Dgeaknci.dll	Ahaceo32.exe
File opened for modification	C:\Windows\SysWOW64\Eohmkb32.exe	Edbiniff.exe
File created	C:\Windows\SysWOW64\Chmbeqne.dll	Mgobel32.exe
File opened for modification	C:\Windows\SysWOW64\Nmgjia32.exe	Napjdpcn.exe
File created	C:\Windows\SysWOW64\Ieojgc32.exe	Ipbaol32.exe
File created	C:\Windows\SysWOW64\Qdbdcg32.exe	Qoelkp32.exe
File created	C:\Windows\SysWOW64\Gkgmdnki.dll	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Ojajin32.exe	Ocgbld32.exe
File created	C:\Windows\SysWOW64\Bgelgi32.exe	Bdfpkm32.exe
File opened for modification	C:\Windows\SysWOW64\Ipbaol32.exe	Ihkjno32.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Haodle32.exe	Hpmhdmea.exe
File opened for modification	C:\Windows\SysWOW64\Jaonbc32.exe	Jlbejloe.exe
File created	C:\Windows\SysWOW64\Kqmfklog.dll	Aeaanjkl.exe
File opened for modification	C:\Windows\SysWOW64\Ojajin32.exe	Ocgbld32.exe
File created	C:\Windows\SysWOW64\Ogjdmbil.exe	Opclldhj.exe
File opened for modification	C:\Windows\SysWOW64\Ogjdmbil.exe	Opclldhj.exe
File opened for modification	C:\Windows\SysWOW64\Akblfj32.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Jhkilook.dll	Eqdpgk32.exe
File created	C:\Windows\SysWOW64\Hcmhel32.dll	Ibgdlg32.exe
File created	C:\Windows\SysWOW64\Dojpmiij.dll	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Manmoq32.exe	Mgehfkop.exe
File opened for modification	C:\Windows\SysWOW64\Cbpajgmf.exe	Chglab32.exe
File created	C:\Windows\SysWOW64\Eejeiocj.exe	Ebimgcfi.exe
File opened for modification	C:\Windows\SysWOW64\Nagiji32.exe	Nnhmnn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11256	11112	WerFault.exe	531

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fooclapd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjblje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggfglb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhqapg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkmec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmadco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcmdaljn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfiplog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pffgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipbaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lebijnak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeehkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gemkelcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjcngpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejopl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgpfbjlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jllokajf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opqofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihmfco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijegcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipgbdbqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncchae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckbemgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnblnlhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieojgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqikmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgehfkop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmaffnce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aednci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camddhoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjpode32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbfab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iomoenej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enfckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gacepg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiacacpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iamamcop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqoefand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmojkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ickglm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofkgcobj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afpjel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Objkmkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flpmagqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iikmbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcpjnjii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onkidm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edionhpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgcjfbed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieagmcmq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipkdek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Impliekg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dggbcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jifecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpiqfima.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddjmo32.dll"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoioli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddifgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaodc32.dll"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kllfakij.dll"	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pccahbmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahdpjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipgdi32.dll"	Gegkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kqdaadln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbceobam.dll"	Naecop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jifecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmfhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Manmoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loighj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oaifpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ompfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amcehdod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkdpbpih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilafiihp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lippqp32.dll"	Fpimlfke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpclce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciibdmj.dll"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbehfom.dll"	Lfbped32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjodla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panlem32.dll"	Hppeim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inmdohhp.dll"	Khgbqkhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kodoah32.dll"	Nlhkgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojdnid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilchfdgp.dll"	Dmadco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjblje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oanfen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll"	Jifecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edommp32.dll"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gflhoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iinjhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajdggc32.dll"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mminhceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdhbmh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4336	1828	0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804.exe	85
PID 1828 wrote to memory of 4336	1828	0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804.exe	85
PID 1828 wrote to memory of 4336	1828	0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804.exe	85
PID 4336 wrote to memory of 4852	4336	Igbalblk.exe	86
PID 4336 wrote to memory of 4852	4336	Igbalblk.exe	86
PID 4336 wrote to memory of 4852	4336	Igbalblk.exe	86
PID 4852 wrote to memory of 4716	4852	Idfaefkd.exe	87
PID 4852 wrote to memory of 4716	4852	Idfaefkd.exe	87
PID 4852 wrote to memory of 4716	4852	Idfaefkd.exe	87
PID 4716 wrote to memory of 1056	4716	Igdnabjh.exe	88
PID 4716 wrote to memory of 1056	4716	Igdnabjh.exe	88
PID 4716 wrote to memory of 1056	4716	Igdnabjh.exe	88
PID 1056 wrote to memory of 4792	1056	Ilafiihp.exe	90
PID 1056 wrote to memory of 4792	1056	Ilafiihp.exe	90
PID 1056 wrote to memory of 4792	1056	Ilafiihp.exe	90
PID 4792 wrote to memory of 3044	4792	Ijegcm32.exe	91
PID 4792 wrote to memory of 3044	4792	Ijegcm32.exe	91
PID 4792 wrote to memory of 3044	4792	Ijegcm32.exe	91
PID 3044 wrote to memory of 2488	3044	Kmfhkf32.exe	92
PID 3044 wrote to memory of 2488	3044	Kmfhkf32.exe	92
PID 3044 wrote to memory of 2488	3044	Kmfhkf32.exe	92
PID 2488 wrote to memory of 2932	2488	Kjjiej32.exe	93
PID 2488 wrote to memory of 2932	2488	Kjjiej32.exe	93
PID 2488 wrote to memory of 2932	2488	Kjjiej32.exe	93
PID 2932 wrote to memory of 920	2932	Kqdaadln.exe	95
PID 2932 wrote to memory of 920	2932	Kqdaadln.exe	95
PID 2932 wrote to memory of 920	2932	Kqdaadln.exe	95
PID 920 wrote to memory of 4412	920	Knhakh32.exe	97
PID 920 wrote to memory of 4412	920	Knhakh32.exe	97
PID 920 wrote to memory of 4412	920	Knhakh32.exe	97
PID 4412 wrote to memory of 1916	4412	Lklbdm32.exe	98
PID 4412 wrote to memory of 1916	4412	Lklbdm32.exe	98
PID 4412 wrote to memory of 1916	4412	Lklbdm32.exe	98
PID 1916 wrote to memory of 4868	1916	Lqikmc32.exe	99
PID 1916 wrote to memory of 4868	1916	Lqikmc32.exe	99
PID 1916 wrote to memory of 4868	1916	Lqikmc32.exe	99
PID 4868 wrote to memory of 2512	4868	Lnmkfh32.exe	100
PID 4868 wrote to memory of 2512	4868	Lnmkfh32.exe	100
PID 4868 wrote to memory of 2512	4868	Lnmkfh32.exe	100
PID 2512 wrote to memory of 208	2512	Lgepom32.exe	101
PID 2512 wrote to memory of 208	2512	Lgepom32.exe	101
PID 2512 wrote to memory of 208	2512	Lgepom32.exe	101
PID 208 wrote to memory of 3692	208	Ldipha32.exe	103
PID 208 wrote to memory of 3692	208	Ldipha32.exe	103
PID 208 wrote to memory of 3692	208	Ldipha32.exe	103
PID 3692 wrote to memory of 1704	3692	Lnadagbm.exe	105
PID 3692 wrote to memory of 1704	3692	Lnadagbm.exe	105
PID 3692 wrote to memory of 1704	3692	Lnadagbm.exe	105
PID 1704 wrote to memory of 4732	1704	Lgjijmin.exe	106
PID 1704 wrote to memory of 4732	1704	Lgjijmin.exe	106
PID 1704 wrote to memory of 4732	1704	Lgjijmin.exe	106
PID 4732 wrote to memory of 4192	4732	Lenicahg.exe	107
PID 4732 wrote to memory of 4192	4732	Lenicahg.exe	107
PID 4732 wrote to memory of 4192	4732	Lenicahg.exe	107
PID 4192 wrote to memory of 1908	4192	Mminhceb.exe	108
PID 4192 wrote to memory of 1908	4192	Mminhceb.exe	108
PID 4192 wrote to memory of 1908	4192	Mminhceb.exe	108
PID 1908 wrote to memory of 964	1908	Mgobel32.exe	109
PID 1908 wrote to memory of 964	1908	Mgobel32.exe	109
PID 1908 wrote to memory of 964	1908	Mgobel32.exe	109
PID 964 wrote to memory of 1608	964	Mebcop32.exe	110
PID 964 wrote to memory of 1608	964	Mebcop32.exe	110
PID 964 wrote to memory of 1608	964	Mebcop32.exe	110
PID 1608 wrote to memory of 1712	1608	Mjokgg32.exe	111

C:\Users\Admin\AppData\Local\Temp\0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804.exe
"C:\Users\Admin\AppData\Local\Temp\0324968db33766f02ee637eac2df4a511ed3a7cab2cd67a2bd24aab0168bb804.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\Igbalblk.exe
  C:\Windows\system32\Igbalblk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\Idfaefkd.exe
    C:\Windows\system32\Idfaefkd.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SysWOW64\Igdnabjh.exe
      C:\Windows\system32\Igdnabjh.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1056
      - C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        23⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        24⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        27⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        29⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        32⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        33⤵
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:556
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        37⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2996
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        40⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        41⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        42⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        43⤵
        Executes dropped EXE
        
        PID:2088
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        44⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        45⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1292
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        47⤵
        Executes dropped EXE
        
        PID:2408
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1300
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        50⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        51⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        52⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        53⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        55⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        57⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        59⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        60⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        61⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        63⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:516
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        66⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        67⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        68⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4236
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:624
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        72⤵
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        73⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        74⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        75⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        77⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        78⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        81⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        82⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        83⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        84⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        85⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        88⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        89⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        90⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        91⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        92⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        94⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        95⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        96⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        97⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5104
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        99⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        100⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        101⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        103⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        104⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        106⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        108⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        109⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        111⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        113⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        114⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        117⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        118⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        120⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        122⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        124⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        125⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        126⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        127⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5464
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        131⤵
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        132⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        134⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        135⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        138⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        139⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        140⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        141⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        142⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        144⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        146⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        147⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        148⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        149⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        150⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        151⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        152⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        153⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        154⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        156⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        158⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        161⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        163⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        164⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        165⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        166⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        168⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        170⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        172⤵
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        173⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        174⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        175⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        176⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        177⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        179⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        180⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        181⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        182⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        183⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6824
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        185⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        187⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        188⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        189⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        190⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        191⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6832
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:916
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        194⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7220
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        196⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        197⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        198⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        199⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        200⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        201⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        203⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7640
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        206⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        207⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        208⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        209⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        210⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        211⤵
        Drops file in System32 directory
        
        PID:7948
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        212⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        213⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:8080
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        217⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        218⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        220⤵
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        222⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        223⤵
        Modifies registry class
        
        PID:7608
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        224⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        225⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        226⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7956
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        230⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        231⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8152
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        232⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7436
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        236⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        237⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        238⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        239⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8056
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        241⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        242⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        244⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7668
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        245⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        246⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        247⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        248⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        249⤵
        Modifies registry class
        
        PID:7716
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7936
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        252⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        254⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        256⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        257⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        258⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        259⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8332
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        261⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        262⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        264⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        265⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        266⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        267⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        268⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8716
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8756
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        271⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:8844
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        274⤵
        Modifies registry class
        
        PID:8928
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        275⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9020
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        277⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9104
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        279⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        280⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        281⤵
        Drops file in System32 directory
        
        PID:8208
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        282⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        283⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        284⤵
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        285⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        287⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        288⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        289⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        290⤵
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        291⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        292⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        293⤵
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        294⤵
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        295⤵
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        296⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7456
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        298⤵
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        299⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        300⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8500
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        301⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        302⤵
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        303⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        304⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        305⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        306⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        307⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        311⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        312⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        313⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        314⤵
        Drops file in System32 directory
        
        PID:8428
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        315⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        316⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        317⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8564
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        319⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        320⤵
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        321⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        322⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        323⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        324⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        327⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        328⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        330⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        331⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        332⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        333⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        335⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        336⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        337⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:9844
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        339⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        340⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:9976
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        342⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        344⤵
        Modifies registry class
        
        PID:10108
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        346⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        347⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        348⤵
        Modifies registry class
        
        PID:9288
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        350⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9484
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        352⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        353⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        354⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9744
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        356⤵
        Modifies registry class
        
        PID:9832
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:9896
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        358⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        359⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10084
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        361⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        362⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        363⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        364⤵
        Drops file in System32 directory
        
        PID:9416
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        365⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9508
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:9604
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9728
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        368⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        369⤵
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        370⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4300
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        372⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        373⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        374⤵
        Drops file in System32 directory
        
        PID:10204
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        375⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:9476
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:9668
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        378⤵
        Drops file in System32 directory
        
        PID:10224
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        379⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        380⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9900
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        381⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        382⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        383⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        384⤵
        Drops file in System32 directory
        
        PID:9620
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        385⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        386⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        387⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        388⤵
        Drops file in System32 directory
        
        PID:9524
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        389⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        390⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10076
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        391⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        392⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        393⤵
        Drops file in System32 directory
        
        PID:9700
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        394⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        395⤵
        Modifies registry class
        
        PID:10192
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        396⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10300
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        398⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        399⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        400⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        401⤵
        Drops file in System32 directory
        
        PID:10472
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        402⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10560
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        404⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        405⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        406⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        407⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        408⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        409⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        410⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        411⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        412⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        413⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        414⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        415⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        416⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        417⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        418⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11152
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        420⤵
        Modifies registry class
        
        PID:11188
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        421⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11260
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        423⤵
        System Location Discovery: System Language Discovery
        
        PID:10288
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        424⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        425⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        426⤵
        System Location Discovery: System Language Discovery
        
        PID:10464
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        427⤵
        Drops file in System32 directory
        
        PID:10536
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10588
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        429⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        430⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        431⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        432⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        433⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        434⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        435⤵
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        436⤵
        System Location Discovery: System Language Discovery
        
        PID:11112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11112 -s 408
        437⤵
        Program crash
        
        PID:11256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11112 -ip 11112
1⤵
PID:11208

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:10344

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:10968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Apodoq32.exe

Filesize
88KB

MD5
edb98a529859e0fe0669e3c75aa7c70f

SHA1
3daebc91c2a64fd32d79034b868555fd4f35ffcf

SHA256
d57a9481f93389af50b4b0913f97eef1524c5b7498f86a6e0f9416fed60607c5

SHA512
d20e9603e0db138c94444a9996cadb26be61bceb5a4049d41eab765d2a3fb65ca217709733ba5258996b85b077fa8cbe71b1421815da8ffe5e19ffdefc6e46d8

Download Submit
C:\Windows\SysWOW64\Badanigc.exe

Filesize
88KB

MD5
680342d45187cb133701410d73bbe054

SHA1
83481bf18adb05a63d1f49a23047b021bcbef5ea

SHA256
1c65f7dcad3e8330bf219d2e2558daaaa27cce22b716f7eae161c30f95ccfed0

SHA512
ca6ff7cc4ac3f3b99af637e7331c74d94b667b7564264caddaafbdaab0fcf0e7af6bca4beee2b3a06670632d9f8d379d3ab37379ce960ffad798f68fcab825f5

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
88KB

MD5
e620eb4db0203c623d3f4a8dd260a19e

SHA1
39d0c4e2ae9a927ad2b5a87fe1ddd47a7ad52516

SHA256
46c3e60dfd41cdf470f6e951d78f9a70d657886d4a9e9c405de10b4160d177fd

SHA512
fa5f604d652641e75b741c4b8b1ff27f188083faca1bb7a315259302e3f9130b46770d25d6260ef9dd1565898953a915db36b4ce8a472b4b089efc9ec411642f

Download Submit
C:\Windows\SysWOW64\Cocjiehd.exe

Filesize
88KB

MD5
ed4152139cf2f842fa14b2b114bda410

SHA1
83f4597df6d9fa686ce22afec0b724fda86e69ed

SHA256
9fca13007eaf1b6ccaf6116a5c7795c27bd2ebd15e8aa831c1f59b37b1e0bbf1

SHA512
1711bf8e14271255d971804436b48ccdc6c5cd06d300697c19ed91eca63779c12c3ead2b5ae5ea42add4f2904e71e70d99a17aa51057322fabb01da650845d98

Download Submit
C:\Windows\SysWOW64\Dojqjdbl.exe

Filesize
88KB

MD5
da39771600eead5c0c41e0f381871450

SHA1
9998a5706a5b6229ee74d09bb0e8653fbebc8b51

SHA256
a914b44116d655cb48f10e70a3a41bd74494614f814a62ef872dcd032f6cd34b

SHA512
7463742aeee247e323de5d5ea4254260e3581c4ae7331e6ddab7925424f40d26a78fe383e2183b0f2857cda9cfae6f3a5cd21f5729bb7ed974679c9f2d2c1cfc

Download Submit
C:\Windows\SysWOW64\Egohdegl.exe

Filesize
88KB

MD5
42a6c00334bfef75e5689c0caf7dcb0d

SHA1
47bad0c4ffcb9c015450de18b04544d58a6ebe2a

SHA256
9e330c5f932753f40800374a40f752a81f119ccc06e015938d9a3612c02d64f4

SHA512
4621bc2c96020599aad58cfc8adcb0d14b3ad948d18107b47c888cae880c6b3fcdaf3fac8d60ac27232163c2c11344cffe418aa961132c17b73f9beb6dbfe60c

Download Submit
C:\Windows\SysWOW64\Ekajec32.exe

Filesize
88KB

MD5
cbf352bda62b515e4f9ffbd7e31d9248

SHA1
4820a6900c5ef52a0ce307c6b59ec40934d942b7

SHA256
459d674e658b9f4592f97b249b073c8595898596e17d51b14a566b9da7d5e216

SHA512
8a349dcd180fc7f46e1e420739039f54c1144b6a4ea742075c74567f7f97885a2108370b6d9610e8089ac2acd65e2253773b7656de9d75965558d928ea663fb3

Download Submit
C:\Windows\SysWOW64\Fkjmlaac.exe

Filesize
88KB

MD5
4586a0c1360bcdd020c4f8873ea8f937

SHA1
bde318c10712d4d8c89a7c7d8a3bf5b31c5f9919

SHA256
d584599db64c27dd956759d973be8c09fb901691327d2825f1222de01772f318

SHA512
145de4f23a5929770e3e5e4f790b97a71d6f6c36353fcb0307dffe3def5336a769e122145365b8e7c008759291a43190b47b6237a6a9d28be10d518ea153fe8c

Download Submit
C:\Windows\SysWOW64\Fnkfmm32.exe

Filesize
88KB

MD5
590196735b2923a81ffc8d0d8ea61106

SHA1
628a5d2d5e1e8b9424b512ef48a73fc629aece1b

SHA256
ee1ef247ba655e0eac54585afa60436a3fbb8986fc7d003be305966c95a6b248

SHA512
20f7079b4f674a9ef2ddf9b8735bb79979a7eeac7add89ab7e80a4bec8376acd9b819c69bd014f148660066894423e4b616d6f2d8a0d243261eb23cad87c539b

Download Submit
C:\Windows\SysWOW64\Fqeioiam.exe

Filesize
88KB

MD5
43363b233f5e8c7191e48224e5935d6c

SHA1
ea7c68e04fc164271b1f2694a0b3c340d5490c25

SHA256
192fcf152911203e0582d338a676c4d272fc1d1fc5e34730844a07587cc4c95e

SHA512
a9ecd3cb60c62933f40e02de9cd6664df8b10e9d8ae6c4fcc0b21cc738f23f3bda8536625f431c6bbee84b950bf4579483728d325b38a067a30697c8e154a874

Download Submit
C:\Windows\SysWOW64\Gbbajjlp.exe

Filesize
88KB

MD5
3d9b9efc1d79ef44c4f4a4a1369d1099

SHA1
1fcaf9575cacde64be116336429d226a3d7b5532

SHA256
e24e6cc3fb27ebeac3ea78508bae9e77521160eff6ab8078b317853a6b2a3486

SHA512
0b7290d1ab4bc41bded5c74bc7791f0afe0ad5b635b30646a8bee27d01cfdd2060b56daa97bbb92ef56d21cccb67f9c8134b2cec75471fbca8d14620da1eec7f

Download Submit
C:\Windows\SysWOW64\Ggfglb32.exe

Filesize
88KB

MD5
bdb054af393531628525f8f2df3b925e

SHA1
34387a7c7b65f94af4de1f6d3472f82641281eb2

SHA256
7c45c0910d15dcd2812806ef1bea7e393cf6db0a8dd6b2a70e99fdd63f9139c5

SHA512
ed1ca96958c5e12752f73528e9a67d836ca74c54280cb24d2eb1edf15c8ac17a4276e2cfa321361e0ceab43104880affae2cd6833cd9092410886c0681553f62

Download Submit
C:\Windows\SysWOW64\Gnblnlhl.exe

Filesize
88KB

MD5
2c04cd1106461a69832d2722371a8694

SHA1
bafad85d9054a2f916565d59ed9976b86f9783d2

SHA256
7b0bc488e366fcc122277e8b3fe1a4b2d32f221f19ca488740ab5f313479a3bd

SHA512
5adc76aa38de9f496d097668be74d9342dc3ad21fdd89af57a3694f3c1aa2fbebd7042c54f4de4d21713408bd8e30a149e319066908ce0696560a42cb92d39ff

Download Submit
C:\Windows\SysWOW64\Halhfe32.exe

Filesize
88KB

MD5
a7bfdb4d24dd9ead825fcafa12a72aed

SHA1
ba059c263360d50b7432c99e95b78343cc4a18e8

SHA256
4f6f0e8d24610cffed6e05d06aa1d03fe076a1c21b923d6b07002f27228884c2

SHA512
dc201bd06b2232049dd607f591c892d8ddb31ddf12812f65d7fe88af1542cb901d4dcbb6e11ccf35b65ad66d64c98dfe8f55310cbe70a7c34889498a7e52b6e7

Download Submit
C:\Windows\SysWOW64\Haodle32.exe

Filesize
88KB

MD5
110d5665e37967fd47e55497aa974877

SHA1
10d39e0ffe3e6f6f4652750b3a534e772700c7b5

SHA256
93c15b027917b70ec120e4d7f4ddf1f810ce3be24647a7d7460b26bfee77531d

SHA512
11464c55ec18dece2344fbf75364cb4abd7c337f83e052319d255bfcf66648f002982c564332966dbf5b0ea78139189d57f861aac5d8c86832c0412999a3e356

Download Submit
C:\Windows\SysWOW64\Hbenoi32.exe

Filesize
88KB

MD5
987921ca3ceb72e6c85631fed39aa56a

SHA1
28b79017c08248dac63a8218cdafaec2b1a2345f

SHA256
1bd4952aa32c1c3f238b6c6332b8cb6c5ac2e7f4f6f622e2189eeb760d9bd6bd

SHA512
02658751b0e7c7adecd8722b90cc59a19c3b90bc4380014d6d3cf352eddb0530febd4eaf43b94f29c2682949d9b4330183b5f769ee3c983f48d57dc07152ab48

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
88KB

MD5
b0e2208cd16899af5904a46ac0dcfeb2

SHA1
9c3c9a7a2c65765e18a32de959de2d3e13997ff2

SHA256
abb951cf1bccafcecd9ed15dd4cef5ff8863bd49fd28d4e616da18ece9e2f5d5

SHA512
e207741817d59a83aa94c01e206a8d8f232770d37cbcfe9edbd1c4cef74cd53b3a6a43197a1219caa221068b4b98fd31b24c490767d8d0a28357d0170cb89e9c

Download Submit
C:\Windows\SysWOW64\Idfaefkd.exe

Filesize
88KB

MD5
10adc871c0f89128f70169b4907278fc

SHA1
a10b3e3d71061b0fc92a55bae6c1aa1a90547eb7

SHA256
a861c9744d74b077ff8c3c8a9fc0062cdf6ed14ca6a85429565a83a83bbbfb80

SHA512
644a0fa547efbf52e6f0ad81470d7b118414915a8fa391267f5a3012fcc1f962ce307a2aee83cdde80ccdd1fd070674e322c89c325e64c2e6815ebb94876eaf6

Download Submit
C:\Windows\SysWOW64\Ieccbbkn.exe

Filesize
88KB

MD5
93df613917fcc35a583a5c7c8c378837

SHA1
0f5e80c6884324100b1fcb03d6666cea26c1bc54

SHA256
d7b63bd417ba94b35d6b3a5dc6d9f6ffcee9a089dde437ff5653ce2181745b5d

SHA512
2f98943624124b5a654be67585f7b6b719cbb09b11f521f02e9b58ea5bf3331eea1e6d9b95ca00d8eb9aa55e029c87a9111de2fc841809f20f4891d9e78531ca

Download Submit
C:\Windows\SysWOW64\Igbalblk.exe

Filesize
88KB

MD5
e9fea33532946d4caf5c585d8fd24b6c

SHA1
2a075d4cf540b888cb381594c1b183d11c18a5fd

SHA256
0b07b481c3b950421c920f27513405b93353a13b8ee2bbb69b656b6e819bfd02

SHA512
373b51d50603fedd3eb12801391047840b5484b240881e93be9f8446a053d4eb5fbd3804ec1391bd147bc74fed7d8deedce74239c6db58049922c64f8b964886

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
88KB

MD5
a680d2f68a3b8f4e93ba234980c385ee

SHA1
56bf0be5d57458e7b7ee90ef1392472eba9e7d6b

SHA256
1abde9ae6ee5898d435d6fd28e27c9f1fb204b72fe7acbd1e9573861ae5e2890

SHA512
c238daf132941eab41d5674dbf2857954af179d8b1746ef7d010d0607f8cdff81f1b1d65b06e9d69ac7469c848513a6279db59d747f0c7ab01c8bbf1ae7e636e

Download Submit
C:\Windows\SysWOW64\Ihkjno32.exe

Filesize
88KB

MD5
f877f12396470c3c68dd1f224ee37976

SHA1
5bce352f4ce61aa45fb2a69d25b78eeca988bc20

SHA256
4da560da230cc6998c2c4fc9aac2de2db06a8fbb9df11af1b5f51a4ee66c01b3

SHA512
c16551ec966aa7a0bcb84929a299e41be964b53fd2136d396b3f00fed9e75e2c52351be98f6efc0042ebe455f3bdd0135652dd1a2900a5504c2ae4412dd87667

Download Submit
C:\Windows\SysWOW64\Ijegcm32.exe

Filesize
88KB

MD5
732fc445e83060e4127df13c3531e9e3

SHA1
7270972b606f02d52d08fca39476dbfa13ad7cb5

SHA256
40aaae998f99fa9ca53c165a695e083f772ecfd93739e6b5b587d835b8950575

SHA512
29ab0444f4d0be8b4fcd14e1acd072bc423977e1996ddd70f036eb21a629b3b9be829a479b54b0752d373159baf86d55f5cf7de1f1ba900d1d39d0a98a48d340

Download Submit
C:\Windows\SysWOW64\Ilafiihp.exe

Filesize
88KB

MD5
6f12d39951c0d844c59f6053e1d50bc2

SHA1
7004d70ce626a4e303718bdaa93b74db406a8c69

SHA256
68e52d0e1d44d964b796dcab5b4c4292c5523e39ae883ca0a117aa997265c9ef

SHA512
c7a288c4660dcd6090885620445bec96898a0f579a6022711b82cc6d3121024d2675e97f811bd2ab6560b0aa8066dd8c55c7092b3826dafe4826eb1d4184322d

Download Submit
C:\Windows\SysWOW64\Ipkdek32.exe

Filesize
88KB

MD5
bd365c85deaf0d54937274f48f95e8de

SHA1
44ce6b51a42b54853646e2d86d164ea14c605487

SHA256
2c2f08c1271cca6c1831c35f7abf8e8de331204dcbb7fb5f3b262b609bb6936d

SHA512
a8f0d89e133d53f4e6859b4074d58a1b0507bcf49472104834f76491a8d36ca94c106c4d50967334c5cbd6fd50d08052e80555c86d9e2afb5c9581e7180ebcdc

Download Submit
C:\Windows\SysWOW64\Jemfhacc.exe

Filesize
88KB

MD5
0836a4d7a78b5e800b173687140f0a6e

SHA1
cf6ecc31c43bb56fbc7b9d4c49badc6a8a3edc1b

SHA256
a09bc9c8e49fbd9851dffe1909f9fea7840c13f27d13b22e9b61b8ddafd0f1eb

SHA512
6bb6f1292fa1f55bfaafac3bee45207c86d326bc90f3d1a1b225057804641c8147eaf767366b19d86d9507b7cd58bfdc8e32abe7c9a61d8c9658d3d6e928143d

Download Submit
C:\Windows\SysWOW64\Jokkgl32.exe

Filesize
88KB

MD5
d2967546cd8be2ca612138704e317e20

SHA1
0bc4788a07cdfc16c5f23961f60a6106fe932e0e

SHA256
1caa71ba279f5ae4dc68712262d368a7c9f2d1b85e36c6cc57a8015ca91305ab

SHA512
e27bc65cf5e1b61574b60ef5ccd1a22f1b30eb562984387817fe739e85bf19a4ab9ea9b2b20d80abd09d568a40e9c0030b14cffea9341733949d27c1564b8788

Download Submit
C:\Windows\SysWOW64\Jpgdai32.exe

Filesize
88KB

MD5
e5cf7211b70865c3796f634680453a5e

SHA1
1c05dd6f930a9a4544c2262796a2ffea6d10cd04

SHA256
839396d670728d7e78dfc3a822da88a4659844478fffe2920650c2163a5a0cbe

SHA512
6246959fe6ca69b34cfdc91c668218ba87fbd4656fab090d1dc2f082510bf987ae24556493e44acd7017062eaf53e34a95367cb29d73603e4963013369c3bb34

Download Submit
C:\Windows\SysWOW64\Kcmmhj32.exe

Filesize
88KB

MD5
42c46840200113ec2496e8e79f609aba

SHA1
9217b5bb6a8e6a2f5c8a1d91282978fa4b9a164e

SHA256
9c7999c8b4ca4046cc0e1dfd37fcaace988fbddb6cc4030ed27f97b50a384ed7

SHA512
3254308377662b0299035ebe989ea8884719bb63acd40632a1b85d8d301a48ced263caf86c5170e9f6548a7c7d9fd4e06b4d03caa56eb51f1e5668ce654ea518

Download Submit
C:\Windows\SysWOW64\Khgbqkhj.exe

Filesize
88KB

MD5
97f63d94c7bb9ab97e4ebc3195977a44

SHA1
d7932ef5db2ccfb424527fe5d8497b4bba23092d

SHA256
6889496a6b43eaccd1ecc73b12484e82b1567a4b2923090ed0236d5e0bac930c

SHA512
c024ac8ab09e17ca9f3fb8d04221ff6fb2221f733e5c94a148b8e1a30103fd687c026d91f1d1f848ccd7b0e226493b4c9b61657f4e4f7114e51ce523868c5731

Download Submit
C:\Windows\SysWOW64\Kjblje32.exe

Filesize
88KB

MD5
ffb88c463444f13b29d885d522b59f67

SHA1
85b33a49db2f18151458f1e768b6d91f4f7950a4

SHA256
124515afdd6a6439e78df09f0939ca2921a56cda2d8ace64c67cecdfdd34ee30

SHA512
0146f8f754c4d856bb4eb68b679e25e44b0bc9b27c0bf01a4a3f3380bed5f7c75a9e8d24d673ee04e64e504b70ca857f267a5512fafa7db2e0f491225a78ab04

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
88KB

MD5
66aff2642b68decf2708d48bd32fe2e8

SHA1
afd52050540a20c2c8980a12a1a192dbe63fef85

SHA256
65792c0ef7cc6cafd12e0469d376a04b2d8288352549c68748f3cf4e80d4dc62

SHA512
6726b107fa3c28551dc2ece033716dbf0ba127aa012a7ea916f03607cfe5489c44152755b2b10219417747c7784e45d86b23090e5bccf9d14946ea98c5cbe725

Download Submit
C:\Windows\SysWOW64\Kmfhkf32.exe

Filesize
88KB

MD5
c518749f0cfdef9ada5dea65e4309124

SHA1
152b014a63360b79ffeacbea231bc8d3a44b8930

SHA256
f7b9c60cecf6a91a30cc41a6ab7a218f3c6314ff7b555181de5dc5ecca00e99e

SHA512
6e91c89ea3ed80ac5fccfb728d575c1eac8b0a0ac856df0510191b70ce617e4df2037cd06b96f98bc36d36b047f10345b0c7b5e57b3d28a8301877649229aa87

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
88KB

MD5
75742dfd267400c26107bd0e377177bb

SHA1
8a48645d5fff4fde337c06ecf3e6ff8b5a5cdd8e

SHA256
595e2b2ca1959980fbbabfbad9c23453b6dd212036928ebc03534c29d00cc8a3

SHA512
4c0e88084b69db6cb19a74c7a776f20c93408761cbdeb3cf3ac038ae0009dda05cab05414d6cea0f2401d8ba29fff01abc33bbe38eb4af0cc5af1627301d0527

Download Submit
C:\Windows\SysWOW64\Kpqggh32.exe

Filesize
88KB

MD5
9933406efdd56a92aa0941e0b34eab98

SHA1
fd9681b24ee96ca3fe89c6ba913b91aa81aab910

SHA256
0586aeabca9aa096bdda66e989e2f504f6640094ba355f95cd8489c2e085a3a0

SHA512
ddd1aeb2638da3b8f485b1dbc8914465f0287445da2e22f5bfeb69bd85e3440d58bc73a649fa5d153bd27e9b754c6718f202528e13669e29cb028d8917482c55

Download Submit
C:\Windows\SysWOW64\Kqdaadln.exe

Filesize
88KB

MD5
f8aa51bb4ba1086a146e3c410b94b387

SHA1
bbe5ed076a613e4946058460602400683ad1f860

SHA256
35c45b3a2b70b0f5d8c5f59f1a7552f3efa837142538dee2de7fd29dd21b6604

SHA512
ebfe29720ddf061f478161c5c963506071d33b0ac4db21ad2fdff104e6794c991aaf55f489e732fd07a9a79a8824cc8241208327c65418351071a2f100610d3d

Download Submit
C:\Windows\SysWOW64\Ldipha32.exe

Filesize
88KB

MD5
29ded4490fefef14b6ba3c914f60d24c

SHA1
c7131d002bc732b5acd3153ac728f34d7605c369

SHA256
06089482f2bcafedb60efde227a488a1ec2b34ba898fd25620972bc3dacc855f

SHA512
6f33352f25f49036bd0f3cc6780ab06e061c85a01479143e0d0ad29f5df2bf1a722ef1a3dbadb8b32ea7290a92476b116775d5c7ac83ae35b818c27f6e5c60f8

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
88KB

MD5
e7225735831447a1bfc8a1536fd3185e

SHA1
6e57504a496f2977584b274d770e2208aca372d7

SHA256
7edc3d4509b7e59dba22e279e061f3f2139277a04112addfa5f511e2594d88fb

SHA512
84850df1238573a3ca8c468ed9d786182bff57fdac134c832c08ec4b177077bb4f67045f421938b066c4c3bea2b94a96bf56202d2100e1a576bea53bc317db7d

Download Submit
C:\Windows\SysWOW64\Lenicahg.exe

Filesize
88KB

MD5
bc240a9a014c0f527db79a1aaa4774d9

SHA1
72fc8a4cb4d92c238b2fb2876c6832b9384556b1

SHA256
2d679b11bc4b5a1cf26e2e56b5490f13e1acef9d6cadfec4f99e8102fe0068ee

SHA512
eed7a6081837f7a140c9915f4c4819da392c7d323f4beac7b3dc2abe56a9cf6a1952409403ff21cda547a9180d074eb45be69dba0fcdaede70120457edad0fd4

Download Submit
C:\Windows\SysWOW64\Lfbped32.exe

Filesize
88KB

MD5
61fdf0f5e66cbbc01a81945c770998be

SHA1
ed9cbd0d28a193b8c107df7d679660c488a60f66

SHA256
0eaa99f3985ee280951f253690a975c5227e993b4b482092337d0fb8657ebe43

SHA512
1829d4eaf37bb6ddb2d44fef792a3c9d036452add04e12ff8c2b71eebcef4401f2001826aaab3e5ccb12e68725b5181b520f790c28e29779f4397e8addc070f7

Download Submit
C:\Windows\SysWOW64\Lgepom32.exe

Filesize
88KB

MD5
437e9a9dcbeb81ceb2fd8e3848245d8e

SHA1
fead41a495f0c15354d6789f986630eb69acf1dc

SHA256
62a498fb8e9fa65ff6ead35376dd1cd3e8828240ccd3e4e43ec6ad4c91238b1e

SHA512
83d1c146295c1c027346c217c81d57034db8eaaeeb43e2506ae03954d9815737d73110f885e5df400778bf5e7985c87def1bbf034a9c9ea2fb23e500538c64af

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
88KB

MD5
49547bb11bbe98857336fd09b8873844

SHA1
564b73ecc86285b39c1c3e0b4b8792191c1e1781

SHA256
91e9df673a75e8bc0336ccdd224f59d52fb2aa51917b1c0a96a3ea0740a33b24

SHA512
b27601efd47aacb59dde5a5d9f8fb287aca4aa767bc12f80db013587c6dc6ba337e81f017ba84df3ed1e221b26528a3b451525d3707b7ad7ad0031ce555e7d26

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
88KB

MD5
cb9b0ec9d1306ba048effa7b2f62d24e

SHA1
d3e2cee6dbe34612704ee2d5bd8702a8a1a2e616

SHA256
41baae5ed0da852cdda7a0d546ca41162da4326097f8894dae82981aba0d7add

SHA512
4c706c85bfcbb05a7b1dee20c4854fd2d767648c3046075f6803afce225392ffc0a1cf0fd18555018181150432ad7e1158fbbee8b4e559310c790b2842bc5eb1

Download Submit
C:\Windows\SysWOW64\Lnadagbm.exe

Filesize
88KB

MD5
a8c6c201255562df78876347fd5ebda8

SHA1
4e6e89a69549b0ad0819ce0e4700c2c0f5437aa0

SHA256
b760e37f843d0c3c544b372cefd24946143519c5f9a1c08efd8da5b4edc7a1da

SHA512
3d816930a7c7358b11b6e6af64db58e8519ed773f3f0c8c1fe95552dfa9c967fa6bc2133a4e2fb50511c4dd350caa2335b96dd0a69a3f24c10544d724b0b59eb

Download Submit
C:\Windows\SysWOW64\Lnmkfh32.exe

Filesize
88KB

MD5
c40b53102b2d1b391d2ed58a1e07a753

SHA1
1816079bcadbbba831216c62e22dc9e2933956e0

SHA256
6244fdca2a5eb8c1eb8cc697797d36c5ff1ec9fca336be5e5d0a2f04a509cd3c

SHA512
03e54e2aeb05cb099be454ae2c553c3be9d287c9fa0fa24374d9fd8edb77ae8287dc6c3915a85d382a2cffebfea9bc5e265b384991185cf0352a3bb8e1b97e4d

Download Submit
C:\Windows\SysWOW64\Lqikmc32.exe

Filesize
88KB

MD5
ea9baf4fda2b0c9e0110c1a49bca9d8b

SHA1
8e35386e949c2db8bde84556868981406f1dab02

SHA256
f582e4a6afe6ff1a0f083ca86f25f7c700da9f719ea5437fc5a96e36d518a3ab

SHA512
914f617cceba8a72433fab37c3d9cf4d15b671b501fe906b72a050785d567462c799e79f070433aa96fb53c52676b361c66de69762e134326d39273474070816

Download Submit
C:\Windows\SysWOW64\Manmoq32.exe

Filesize
88KB

MD5
26a077b103af360a047e559555aca184

SHA1
1922982164abdfe486d2be06eddab884c8500052

SHA256
2cf43732be64bf73601e09ebd5adc5194bfaf913a03ff18eb99ed945d08ee4a4

SHA512
4983929c888924700a9536e6ff247ba8371ea620868df3483bf3a4898a4e1956dbce910d6437c30e9730024ee799556918b771c4b2aab6f58ca269c9bd332cb4

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
88KB

MD5
c865fa9b8f00775bd6e92e0a6dedbe01

SHA1
b33be6b22e6745758fd2013fda8858b69f0a9242

SHA256
6d46783c7f29b8541b05d7d7fd0f594a813eda828e8e392f6d8e447718aa9427

SHA512
705fb60fcac7596a4955c886b456b228504c279ab7aca8963a2e6065876cfa68e37cb5aed48c7a40b9bfbce573d11fc4b0073c2438a876c821d045b25be0c5e9

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
88KB

MD5
458ba27d7edb73934ad7b47863df749d

SHA1
0f955617d9fd5863fe86c5fba01affcee8902ba4

SHA256
c8e73d6417f18e5f844209916ea1b42e5926187f8990d8f99b397755ec619831

SHA512
bb1a1cc13384b4493291b85ffacca6e704844506f31a8c9a70d660b8a135a878dee8b370cb25f22582ecca3e4545564157d4fa7c8bb39f6f9312833949808cb3

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
88KB

MD5
5741fe531790036951c408a104e52cb5

SHA1
27ec88fb7ce6028088039fb5ecd0059b5978b315

SHA256
d058e9921bfeae06995a56301131c0aec4918bb7907a3204625fa5eb757bcf43

SHA512
b2e37d4c470f07544070a3b8303ca9c5caf63d2f36972b71899b2191f125115e94fc2bec65f73a2c63d52a47788562198376d2d59440d84ef7f0ddfa61aae28c

Download Submit
C:\Windows\SysWOW64\Mgehfkop.exe

Filesize
88KB

MD5
f23b5f37d5f5637ccac536e3b61eaeae

SHA1
6452686087c9e2d34d9dd79b418acd88ecf5778b

SHA256
cf4edb8435fe29996ccdc41187783bb27066bbc564afd801eb6e44ba9aa94846

SHA512
78588b5fb4f5fc4925644f3b3de5bd19a5bac348285627643ba5894f3c379681a3458daff7f500242bd4e2ead8f3e4ff4bd6d1d7d0bacffe657353877aeb6754

Download Submit
C:\Windows\SysWOW64\Mgobel32.exe

Filesize
88KB

MD5
6e5168e8bb706ed9bd2dad8a6948a52e

SHA1
126890b6e6566ddc0c3363a42b29f9b2077cb575

SHA256
f2e808432a3800a0f99fa1d314e9792e4eb30a5dc969038d0d7abc6f277ac4a6

SHA512
b370acb0676594c45f9e6514921b4f960a063586c037ee0287978223a8125fad5edba15994ee112b2c10398048e89407132f6796254a523fa4be62b58ea90e4d

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
88KB

MD5
16174afeff1ba8f5831768ea98c1e38d

SHA1
cc91190a4701d1fff57283d2ee28d1eff0a8aa3b

SHA256
d4a9fe6cb8fa7cc6bc1fd74a0551e07e29152ce0bd86a21f01344cf5fa56b3c0

SHA512
be2577e4e29efd38a7da133de02012442eb8dba36a6b81cc1256b0c896a38d8a6870f4963bdbebfbbb1611c27d6bc822d44a708b9b848281d403283e1ba41979

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
88KB

MD5
7ec5f8bc7039b275c3dd7dfcb5296654

SHA1
d7c49e3ef17f3003fc0a3a72d56eaf5adc069a67

SHA256
dc5540b29d4bcdcad1dbecfda8010115592fd9c6218382cf46a3e4167cb8f532

SHA512
26341caf8d55112565f76cbb6da78502a0350074d8e10fb6ac94047a9d40593827c86af71038d4007d95ebf30d80320d1593ec1b81255d598fd1d9fa020b652d

Download Submit
C:\Windows\SysWOW64\Mmhgmmbf.exe

Filesize
88KB

MD5
e0b4175c754aaf1a4749c5c9f4e7140f

SHA1
a6f73e16b2cff082229f5214fdac5e9a84f12d2a

SHA256
d74c14447af9a985e326228c410829ae9e52bea4f1bc13a87a2a4d8c07cf2d58

SHA512
664aaa01e3ee434645f8e3ce8e190b3f322ad6c2fd66dc4c2a892038e9e1d548470aca3777df4f03d87370734e37da3a889b66f8224d404e4ab5421147931459

Download Submit
C:\Windows\SysWOW64\Mminhceb.exe

Filesize
88KB

MD5
394286960cf6ac61153cf083e490aad9

SHA1
602d42e1503f17c1493ff2e61790969fb2aeca36

SHA256
4dcf5fdbe32ac036674fcc2aa1270a0f13eea78c6e9cfee4747e7dd15bd138f8

SHA512
e7ace268a04c5ee7ecde60a8635e63871f1a3107736257d4ba6c3a124d56e50f44013dcc764e04c5e0ff2c5e71e476fd29e51668f9fba71d5349e480de865c28

Download Submit
C:\Windows\SysWOW64\Mmnhcb32.exe

Filesize
88KB

MD5
9ed9a7b39ea054e38c85bab3da8afa44

SHA1
8150390e218248edb714913e19cd3acc30f1da32

SHA256
554c1eca4bfff172179742f587aefc149744744895fd55260e3cebe5f81be356

SHA512
a8c26896065b2a0c8b73e0315064c12cec63d3e9a9207c7e47c0453785b355eaa1c48c19d4326a49fb76ad911b59c706b48edd59b214df99676db1d3791de4d8

Download Submit
C:\Windows\SysWOW64\Momcpa32.exe

Filesize
88KB

MD5
1b67b547a9916ecd350907c161006c34

SHA1
4ac79d68c1730501aa504fc77ed95ec31ce2ce21

SHA256
ba07cd9d316d21421ee54ea482eefd47f9135b4cc8d18aec464c27eb82e874f5

SHA512
e726115019979d519481f2c31fad0b0e3d7fcce7d4e0066df0ec4fdf4da73a004ab8cd26a91e092e84fca18bc4baa8fe4d6ba7fe44fbec234165fa37d4ed4a35

Download Submit
C:\Windows\SysWOW64\Naecop32.exe

Filesize
88KB

MD5
884a534db849c892f336af27452fc3b6

SHA1
eccad89c48d060e2d393fc9ec28a59724dd231cb

SHA256
e023ef5ed7a436177bc739f79b40bfd26bb55801b5dc15e66732959135244979

SHA512
ec9f02904f82ac9a6e862fcfbea4645631d97607c580c05c727672e68346ec9559cda97ebfe53cc0eada153d1f9e993631a2cfdee709b20f2274b9fd914c7df3

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
88KB

MD5
f05b2a86648a272a02a27339170d82d0

SHA1
082402f10c6e35630d51a098aa3cccc7e1fe7771

SHA256
a60234ad551927fb78d4ae2eb9cd69ca745cdb8e43548ac99263c79a0278c725

SHA512
73af9f1c43397681d954aaae0fd13c625fbcb949efa017a9b659c75dda968552a351aea625dbccf22a45d89de89267fe14208b394c40fbfa3b196681af8983c1

Download Submit
C:\Windows\SysWOW64\Nbbeml32.exe

Filesize
64KB

MD5
a285202d85ec9781de94ea6f46bfe1ba

SHA1
9fb857b719f202c6ebb62835f6518ba094449f60

SHA256
e17736e16784f2ee61693b99a5e7a4522f108cf231a57cecd12caca25a6738ce

SHA512
26857df74f23d05c21a23c0f7ac7813207fad390125d879b7ae560ca3f59ab5a7b9678fffd87b9ac366195974372fd703d988dc81cf139801d033de076a48d77

Download Submit
C:\Windows\SysWOW64\Ndflak32.exe

Filesize
88KB

MD5
e78efdbbb0f3974bd88847ca6b602184

SHA1
b82fc7a1dd4a35481785a96c5ae55747552180b1

SHA256
f75c62166db07a8a6032864a28615188bde603c99ea50216542287388164f163

SHA512
7249f6bf2fb0b5f84d7bd00cec57ed2dff442c6cdb019c00e4b2dab2966ffafb5ad5ac80919796fdcd0f259417306ed24120109b37d9a06f331f0213a7b4a7f5

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
88KB

MD5
30c898b75ab4f25d82676254cafa7264

SHA1
bc0bbe5b6ebeae17dadf4789b1bd7072603e86fb

SHA256
6c40d9e9410ff945e1b13e3ef4f5882468501e47680cc4be7d35b33585ebdbb6

SHA512
c4c2d544ec241d688f3a75b99bc2a3a6286ef7bb4bec419953a58b479e4786b48779002b33426b031a618214df7b2c422958956f883cc12076f951476dc3cdc5

Download Submit
C:\Windows\SysWOW64\Ngqagcag.exe

Filesize
88KB

MD5
45a6142e2604c5c7ff0bba271267eec2

SHA1
8589f626cb60641be38138f1fc4ac562c689882f

SHA256
4f53268522d8e5a3ae4deb16f4710039d4ecb87c435326e87837fb7afb4abba9

SHA512
5b17f39cc4713bfb2698576bc65caaa786507fb33e90dae829b3d82c4e790d413a70722b0dd7cc4cb2f7ce599f20380e3daa76dfc8792dc4fd21b332c8815da7

Download Submit
C:\Windows\SysWOW64\Niojoeel.exe

Filesize
88KB

MD5
c96fbca9111ec566a1a5c5c8038b2877

SHA1
0a4a7c53048d42b58df5f599ddad91ae668264a2

SHA256
5794d8480cb20e9cab2c7b2fd5131867c74de7ccd403c44f3c04c8852637d87c

SHA512
edcbc5eb309e07c25bcdf177799cc6a61855fb5f3c3909ea37d6b43425dbf7dfb3b708505688eccd46b1923ee002afc60b0761758e29f12000e1944e2a46341d

Download Submit
C:\Windows\SysWOW64\Nlhkgi32.exe

Filesize
88KB

MD5
a53e603948aeb4b5a164d0f2a0187037

SHA1
f11c52372e53f7f77aaebb989e1b9131071c991f

SHA256
d5021f1a6ed8cb03c703a2d8940315d066b1fa47ddf2f5754941a287342dcfd3

SHA512
6821b628946596b25a2db508bc93f3c9f7e345d24708a24878c8a275ba6d1b89f56ea040763ef32aa847370367d05d7ae2a37f423e6b76e339b18d16e4be4408

Download Submit
C:\Windows\SysWOW64\Nlkgmh32.exe

Filesize
88KB

MD5
210477d22015e7ce9dad3c97e92435e5

SHA1
a14bac533a7dfc10d54d130ebf46d1e0e654243f

SHA256
a3328c62893a96402594750077e45d51abb5091717b4c7b0dc14a78294beaf66

SHA512
b5391ed6dac069d0352e9b55e4580b26b491f4522a757454e11cf45e6a644bc5a64db1884750b9193ce7a0c29504bf292bb8ed19c412df8f2217989e80846a1d

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
88KB

MD5
0abc9b3becdb03946185eba1a36bf7a0

SHA1
28bec6dca7b98fd6f1a40e9d6d284f47f3c6a0a9

SHA256
e17bd7e8f76592944b4d8c342a1d42a6b1e02d24533bd5cd3259b3aade2a9ef8

SHA512
21dbea79ef7656a7b4a63c72de38827823152ac10ebcfb252c322046f2e28a640771a1eac0b62d521ec9ee3e985b1d908e8e1d2363788af2257db3d0c5494281

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
88KB

MD5
299d81f5df708959c8304fc3e7a70bc6

SHA1
f32f866ccca5b836aa36ed8951cf92c54c6d158f

SHA256
0e65bb50bf696e6e7af9c51a7049a3232a6218e57402a873e9fefbe937db3c80

SHA512
17a1770998ab92fbbf9d9fd9cb47d2ee07a8aad03a254c9ce0e107a84520115e7b550d4d4b61dc7df51ea9d3c59a957e14dc2874300c3b9c18ebac70667eba35

Download Submit
C:\Windows\SysWOW64\Oblhcj32.exe

Filesize
88KB

MD5
e56797e12d4a9d8ce439309795fcc30b

SHA1
b346b40c0ab750c89af623c9f8c84b21e65e1bad

SHA256
a5699e3018fd96fa1400e0f13c806455691a83dd6b8d38f4d304396622e6263f

SHA512
2fe2d291ee0edf40e48b82b99f56236895c9992ebde2aaa00691cf62750430775fcc540a97b02768d1c16bf8d7c2659a5aec1a6d57283929c087c2ed8a9ea660

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
88KB

MD5
0471073101a3c73686c67aa94d539608

SHA1
56936d39b6d6a6ecb9b5d73b44c39ade99791b1a

SHA256
f655d70754e074fb8b3b35577de0038d6c81be4efc30b741ab5527555271f53c

SHA512
2f5d185bfa33aa787afd5520eae0b3497a4f24a45155d5d420563bafd230e2506c58b7c880536de87ef10a6cc415fc1e1208af1aa5ef1fd8ac6f350b96d2323c

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
88KB

MD5
76501704beaf958a092b0a51204e4ea9

SHA1
9950d9b2496c5a4b36aa669088d3b4aab3068cd2

SHA256
9e8f25581d774dd29c9eb86c77732a6ce5b9b017e6f02dd9c550982da62c7e78

SHA512
5fe77118117bbdcc61fd8754e3b56adbcde5a61c3f9c157b0ca7eb59d7774a7de0e583e3357b61618821e8fdc6ff1af80b9e5645fad1afa36391cd960136aa1e

Download Submit
C:\Windows\SysWOW64\Pahilmoc.exe

Filesize
88KB

MD5
80889171a60930973ddba8d1b0b6f52e

SHA1
a67352be975f21d1e82937f68e467646fbad3b9a

SHA256
5a7fd2381b8a8a5a9f6275ce7b78ddaa9588eb78e6335e08486d0c173ffa7c61

SHA512
553d5149ad267b27aba3d76e339deb806eeaf313cc28881e9a52f7b869d52358ccdc84ab113b38aba2abf6565572d45fffbe26721c0d85cfa8a4e5b09cf2eb03

Download Submit
C:\Windows\SysWOW64\Pbcncibp.exe

Filesize
88KB

MD5
0b9419f2d33239cd4128418aa6b26083

SHA1
ede9cebf8cd0776928fbd76feb37182cf88d55d9

SHA256
8754c8fe5d5ac285a7bbf2c5486ee6e127a0dfc2339daeebe4accb5314e04f71

SHA512
d1b04cfca645bbd953482b219f9cc7820fe5a0bf350bb3a32c6b76acb6e4c616511c764e9c16215fa7f01a4dbc945ca9d2a6e5654feb051067c23857146065a1

Download Submit
C:\Windows\SysWOW64\Pccahbmn.exe

Filesize
88KB

MD5
6352fb212aef5682f5c0f1e8fca594cd

SHA1
8af64a2e0ae95b0a5eb6707a08ed30a9246d9d6b

SHA256
5079e6af15d3bf781ca73d64e47e1c9cec43f4aa16543ecf3168d52d2c3bc784

SHA512
7d172815332b826540020360db8eb476d449e71f6500bb280a48a3b23a37ead8c008832094078c6a5dc59b0a4e0880726503d31fc042246e80663ef6dd422a52

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
88KB

MD5
f81d6ff2576b27ef5b6585aa002425d5

SHA1
e0a24b5ff14b67980d03fbe2f3eb7ba1d2efa6c3

SHA256
f8859f8015cd7541fed3f0d1597ddd8f7c62fd8f017eeaee3d215536143981c3

SHA512
7fe19ab0ba94fcc7471c2acd1da0f51599d55325e67a5ee9f7c7d039ac14e23340c8f5a4a67efc080b7f65b6ec41a43eed9f6a830dcb976e8117c97a990f141c

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
88KB

MD5
e640af68f3816313603e6226d1b9ba97

SHA1
f446e6354e1f7e41a7d460e8109066ef6d708b9c

SHA256
ef0d38aba565c09e67f2a1c0c8824dd060e2dec7d4ab313633160b1912e86ed4

SHA512
fb97a12ea2bce2638483b014a330865ed2220969aa3ab7709848e492adb0b0a05e714f1019abb6fb8f685bb850474b64b06d11dad26bdc1ff44d4d881a0e7b12

Download Submit
C:\Windows\SysWOW64\Ppnenlka.exe

Filesize
88KB

MD5
a55884feeda6f7c5eb98304ec50c5a65

SHA1
8acd9c8a878e3d671c534e5d199347cf4cc80076

SHA256
656297dcf19de98950f175253608526486053b178241d7e2b32a3ff8f1a48f15

SHA512
c8566e31d4a01a0603610e7a015f7016e96359010174c8eea18651d6133bf6be3903dbc31d0e493b7af6c567705999a36cab5cd2e5618ec5a9dc3d9d4188bf65

Download Submit
C:\Windows\SysWOW64\Qdbdcg32.exe

Filesize
88KB

MD5
40a66d6d5ce42e4b0b46c48df64c561c

SHA1
e737717823bb873d1362efaff67defe17827ca04

SHA256
1c92f0d89bce9af8f69ac1356d8c6a244f4548622ae32a5345278af023367e8f

SHA512
b148d0e8979741c348de8acafb8c78c7f93fcec847109211e29be9340106487d1d14a102b5b9466f4339d986b548c3b43d0bf1f9670c7329bc885931a0259c7a

Download Submit
C:\Windows\SysWOW64\Qemhbj32.exe

Filesize
88KB

MD5
4f07dea6efa6ec8d252eb1f410b63c6a

SHA1
689e472c6e9aa8fb19ad3511c8cc197a32f6c642

SHA256
043aba4f766a7a5c874d4533671a6cde3e866653b1c2a7c68f7142ceb9050e26

SHA512
781f79d847b75a95b4f67116ed113f53c59ed0e0a070870aa4a9bc47a2a9ba768b6ce9daf489f86be9e0e623830a62c42c949c49b68cc420939b3f39c4964f11

Download Submit
memory/208-111-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/516-452-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/552-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/556-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/624-478-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/628-508-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/920-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/940-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/964-159-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1056-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1056-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1176-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1276-215-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1292-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1300-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1496-362-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1692-231-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1704-127-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1712-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1828-543-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1828-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1908-151-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1916-87-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1984-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2028-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2084-247-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2088-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2316-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2408-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2512-103-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2524-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-442-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2600-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2616-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2728-460-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2808-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2920-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2932-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2964-496-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-586-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3056-302-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-262-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3324-274-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3344-516-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3372-412-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3412-260-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3608-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3692-119-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3896-454-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3992-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4076-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4164-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4192-148-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4236-475-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4260-207-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4316-502-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4336-545-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4336-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4388-466-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4408-376-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4412-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4508-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4572-191-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4576-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4588-493-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4716-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4716-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4732-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4792-39-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4792-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4852-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4852-556-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4864-183-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4868-95-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4952-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4956-486-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5068-520-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5192-526-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5244-537-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5284-544-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5332-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5416-558-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5456-564-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5508-567-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5556-578-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5600-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5640-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5684-598-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads