berbew | 6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5

Analysis

max time kernel
135s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe
Size

204KB
MD5

142a4b8e86f910df408d43856f77fc0a
SHA1

8357bd4f0edd9ce0b597d7bbe0a12423d45e56ad
SHA256

6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5
SHA512

9ef51d2007057a6edc59887c6656d7478807fbe9f1cc959ae2de39f586060cf6681fa1ac310b3d7aaeb250a7eef0cdaa0ffefff9226848f6fc68690330d5ce52
SSDEEP

3072:LNjhpqlJUbSrpUc7ZFtpr/L3jXF1kqaholmtbCQVDrM8d7wMtLAj:XpqlJUX6FvfTXF5ahdt3rM8d7TtLK

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jblmgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibaeen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpode32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhdbhifj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgbdbqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjeiodek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjkmomfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Geldkfpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jphkkpbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcelpggq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opclldhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcaipa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqcejcha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlolpq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomqcjie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Loacdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbebbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpfbcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lohqnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kodnmkap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjodla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlmchoan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpaekqhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekcgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomjicei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbocfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jebfng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgdidgjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlhncgi.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2752	Gpgind32.exe
4444	Hfaajnfb.exe
1160	Hedafk32.exe
2312	Hmkigh32.exe
4392	Hpiecd32.exe
2960	Hmmfmhll.exe
3080	Hbjoeojc.exe
4180	Hidgai32.exe
1172	Hpnoncim.exe
1904	Hfhgkmpj.exe
2376	Hmbphg32.exe
1552	Hbohpn32.exe
4524	Hiipmhmk.exe
4612	Hmdlmg32.exe
2028	Ibaeen32.exe
396	Iepaaico.exe
3468	Imgicgca.exe
1772	Iohejo32.exe
2396	Ifomll32.exe
1748	Illfdc32.exe
4320	Ipgbdbqb.exe
3968	Iedjmioj.exe
556	Ipjoja32.exe
4428	Ibhkfm32.exe
2364	Iibccgep.exe
4092	Iplkpa32.exe
2944	Igfclkdj.exe
4308	Ilcldb32.exe
228	Jcmdaljn.exe
1544	Jmbhoeid.exe
2696	Jpaekqhh.exe
2736	Jiiicf32.exe
1824	Jpcapp32.exe
3536	Jcanll32.exe
3948	Jilfifme.exe
2596	Jljbeali.exe
2532	Jpenfp32.exe
4556	Jcdjbk32.exe
2764	Jebfng32.exe
3908	Jinboekc.exe
2476	Jphkkpbp.exe
3308	Jcfggkac.exe
1856	Jgbchj32.exe
2144	Jjpode32.exe
1056	Jlolpq32.exe
4380	Komhll32.exe
2940	Kgdpni32.exe
3904	Knnhjcog.exe
1136	Kpmdfonj.exe
3196	Kckqbj32.exe
1884	Kjeiodek.exe
3964	Klcekpdo.exe
1724	Kcmmhj32.exe
3004	Kflide32.exe
512	Kncaec32.exe
5036	Kodnmkap.exe
3424	Kfnfjehl.exe
2460	Knenkbio.exe
1900	Kcbfcigf.exe
2220	Kgnbdh32.exe
3056	Kjlopc32.exe
4280	Lljklo32.exe
4224	Lcdciiec.exe
1988	Ljnlecmp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Loacdc32.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Lfebfnqn.dll	Hfaajnfb.exe
File opened for modification	C:\Windows\SysWOW64\Knnhjcog.exe	Kgdpni32.exe
File created	C:\Windows\SysWOW64\Nflnbh32.dll	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Jhkbdmbg.exe	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Fqppci32.exe	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Kakmna32.exe	Jbepme32.exe
File created	C:\Windows\SysWOW64\Mfnhfm32.exe	Mledmg32.exe
File created	C:\Windows\SysWOW64\Cnokmj32.dll	Mhckcgpj.exe
File opened for modification	C:\Windows\SysWOW64\Oqhoeb32.exe	Oiagde32.exe
File opened for modification	C:\Windows\SysWOW64\Ibaeen32.exe	Hmdlmg32.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Bkgeainn.exe
File created	C:\Windows\SysWOW64\Ekellcop.dll	Eohmkb32.exe
File created	C:\Windows\SysWOW64\Hpnoncim.exe	Hidgai32.exe
File created	C:\Windows\SysWOW64\Lgdidgjg.exe	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Gpkpbaea.dll	Moipoh32.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Gacepg32.exe	Gbpedjnb.exe
File opened for modification	C:\Windows\SysWOW64\Mgloefco.exe	Mqafhl32.exe
File opened for modification	C:\Windows\SysWOW64\Cdimqm32.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Doccpcja.exe	Dglkoeio.exe
File opened for modification	C:\Windows\SysWOW64\Eiekog32.exe	Edionhpn.exe
File created	C:\Windows\SysWOW64\Clpchk32.dll	Jeapcq32.exe
File created	C:\Windows\SysWOW64\Opcefi32.dll	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Lqhdbm32.exe	Ljnlecmp.exe
File opened for modification	C:\Windows\SysWOW64\Nqmfdj32.exe	Nnojho32.exe
File opened for modification	C:\Windows\SysWOW64\Eqiibjlj.exe	Enkmfolf.exe
File created	C:\Windows\SysWOW64\Giecfejd.exe	Ganldgib.exe
File created	C:\Windows\SysWOW64\Mledmg32.exe	Mhjhmhhd.exe
File opened for modification	C:\Windows\SysWOW64\Iplkpa32.exe	Iibccgep.exe
File opened for modification	C:\Windows\SysWOW64\Ocgbld32.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Kakmna32.exe	Jbepme32.exe
File opened for modification	C:\Windows\SysWOW64\Mcaipa32.exe	Mfnhfm32.exe
File created	C:\Windows\SysWOW64\Nnndji32.dll	Ojqcnhkl.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Pccahbmn.exe
File created	C:\Windows\SysWOW64\Dmncdk32.dll	Bphgeo32.exe
File created	C:\Windows\SysWOW64\Ehojko32.dll	Boihcf32.exe
File created	C:\Windows\SysWOW64\Dqpfmlce.exe	Dkcndeen.exe
File created	C:\Windows\SysWOW64\Lfiokmkc.exe	Lckboblp.exe
File opened for modification	C:\Windows\SysWOW64\Ppdbgncl.exe	Oqoefand.exe
File created	C:\Windows\SysWOW64\Gokbgpeg.exe	Fkofga32.exe
File created	C:\Windows\SysWOW64\Paihlpfi.exe	Pbhgoh32.exe
File created	C:\Windows\SysWOW64\Komhll32.exe	Jlolpq32.exe
File created	C:\Windows\SysWOW64\Knnhjcog.exe	Kgdpni32.exe
File created	C:\Windows\SysWOW64\Mfjnfknb.dll	Mgnlkfal.exe
File created	C:\Windows\SysWOW64\Ocgbld32.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Opnbae32.exe	Ompfej32.exe
File opened for modification	C:\Windows\SysWOW64\Ocaebc32.exe	Ondljl32.exe
File opened for modification	C:\Windows\SysWOW64\Lhnhajba.exe	Kadpdp32.exe
File created	C:\Windows\SysWOW64\Ljcpchlo.dll	Igfclkdj.exe
File created	C:\Windows\SysWOW64\Panhbfep.exe	Pnplfj32.exe
File opened for modification	C:\Windows\SysWOW64\Qjfmkk32.exe	Qhhpop32.exe
File opened for modification	C:\Windows\SysWOW64\Lohqnd32.exe	Lpepbgbd.exe
File created	C:\Windows\SysWOW64\Lafmjp32.exe	Lohqnd32.exe
File opened for modification	C:\Windows\SysWOW64\Pafkgphl.exe	Piocecgj.exe
File created	C:\Windows\SysWOW64\Kjeiodek.exe	Kckqbj32.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qodeajbg.exe
File opened for modification	C:\Windows\SysWOW64\Bdfpkm32.exe	Bnlhncgi.exe
File opened for modification	C:\Windows\SysWOW64\Hbldphde.exe	Hlblcn32.exe
File created	C:\Windows\SysWOW64\Fhjnfdhk.dll	Hedafk32.exe
File opened for modification	C:\Windows\SysWOW64\Mcelpggq.exe	Moipoh32.exe
File created	C:\Windows\SysWOW64\Kofmfi32.dll	Offnhpfo.exe
File opened for modification	C:\Windows\SysWOW64\Bmeandma.exe	Bobabg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10696	10476	WerFault.exe	521

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpgmhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Illfdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igfclkdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqhdbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdhkcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhegig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knnhjcog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nclbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkibgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehlhih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlmchoan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofckhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opqofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqnjgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lindkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbekii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppjbmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapfiqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nblolm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iplkpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqiibjlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhdcmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loacdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmbhoeid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojfcdnjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fniihmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnkfmm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hehdfdek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbnajqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lafmjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llnnmhfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhjhmhhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojqcnhkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmkigh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdciiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfjfecno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgloefco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahaceo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkgeainn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbbicl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmdlmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjlopc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enkmfolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnlodjpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpccmhdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmfdj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afeknhab.dll"	Hidgai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcbfcigf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnocia32.dll"	Mjodla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkmjaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefklj32.dll"	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ondhkbee.dll"	Enhpao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Inebjihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lindkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchdqkfl.dll"	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gngeik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clmipm32.dll"	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfqedp32.dll"	Laiipofp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgeaiknl.dll"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inclga32.dll"	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihjoke32.dll"	Ipkdek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kadpdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqmfdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgjhpcmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fijdjfdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbbicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnebjidl.dll"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfcpgb32.dll"	Jcmdaljn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lljklo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfoann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmbdpnaj.dll"	Gghdaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gnblnlhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jacodldj.dll"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqaiecjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndfnlpc.dll"	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnfpnk32.dll"	Pdenmbkk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eajbghaq.dll"	Hbgkei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbdmdpjg.dll"	Jcdjbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jinboekc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijikdfig.dll"	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Filapfbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kcapicdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqmiic32.dll"	Iepaaico.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gacepg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmodnoo.dll"	Njjdho32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2752	4808	6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe	87
PID 4808 wrote to memory of 2752	4808	6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe	87
PID 4808 wrote to memory of 2752	4808	6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe	87
PID 2752 wrote to memory of 4444	2752	Gpgind32.exe	88
PID 2752 wrote to memory of 4444	2752	Gpgind32.exe	88
PID 2752 wrote to memory of 4444	2752	Gpgind32.exe	88
PID 4444 wrote to memory of 1160	4444	Hfaajnfb.exe	89
PID 4444 wrote to memory of 1160	4444	Hfaajnfb.exe	89
PID 4444 wrote to memory of 1160	4444	Hfaajnfb.exe	89
PID 1160 wrote to memory of 2312	1160	Hedafk32.exe	90
PID 1160 wrote to memory of 2312	1160	Hedafk32.exe	90
PID 1160 wrote to memory of 2312	1160	Hedafk32.exe	90
PID 2312 wrote to memory of 4392	2312	Hmkigh32.exe	91
PID 2312 wrote to memory of 4392	2312	Hmkigh32.exe	91
PID 2312 wrote to memory of 4392	2312	Hmkigh32.exe	91
PID 4392 wrote to memory of 2960	4392	Hpiecd32.exe	93
PID 4392 wrote to memory of 2960	4392	Hpiecd32.exe	93
PID 4392 wrote to memory of 2960	4392	Hpiecd32.exe	93
PID 2960 wrote to memory of 3080	2960	Hmmfmhll.exe	94
PID 2960 wrote to memory of 3080	2960	Hmmfmhll.exe	94
PID 2960 wrote to memory of 3080	2960	Hmmfmhll.exe	94
PID 3080 wrote to memory of 4180	3080	Hbjoeojc.exe	96
PID 3080 wrote to memory of 4180	3080	Hbjoeojc.exe	96
PID 3080 wrote to memory of 4180	3080	Hbjoeojc.exe	96
PID 4180 wrote to memory of 1172	4180	Hidgai32.exe	97
PID 4180 wrote to memory of 1172	4180	Hidgai32.exe	97
PID 4180 wrote to memory of 1172	4180	Hidgai32.exe	97
PID 1172 wrote to memory of 1904	1172	Hpnoncim.exe	98
PID 1172 wrote to memory of 1904	1172	Hpnoncim.exe	98
PID 1172 wrote to memory of 1904	1172	Hpnoncim.exe	98
PID 1904 wrote to memory of 2376	1904	Hfhgkmpj.exe	99
PID 1904 wrote to memory of 2376	1904	Hfhgkmpj.exe	99
PID 1904 wrote to memory of 2376	1904	Hfhgkmpj.exe	99
PID 2376 wrote to memory of 1552	2376	Hmbphg32.exe	100
PID 2376 wrote to memory of 1552	2376	Hmbphg32.exe	100
PID 2376 wrote to memory of 1552	2376	Hmbphg32.exe	100
PID 1552 wrote to memory of 4524	1552	Hbohpn32.exe	101
PID 1552 wrote to memory of 4524	1552	Hbohpn32.exe	101
PID 1552 wrote to memory of 4524	1552	Hbohpn32.exe	101
PID 4524 wrote to memory of 4612	4524	Hiipmhmk.exe	102
PID 4524 wrote to memory of 4612	4524	Hiipmhmk.exe	102
PID 4524 wrote to memory of 4612	4524	Hiipmhmk.exe	102
PID 4612 wrote to memory of 2028	4612	Hmdlmg32.exe	103
PID 4612 wrote to memory of 2028	4612	Hmdlmg32.exe	103
PID 4612 wrote to memory of 2028	4612	Hmdlmg32.exe	103
PID 2028 wrote to memory of 396	2028	Ibaeen32.exe	104
PID 2028 wrote to memory of 396	2028	Ibaeen32.exe	104
PID 2028 wrote to memory of 396	2028	Ibaeen32.exe	104
PID 396 wrote to memory of 3468	396	Iepaaico.exe	105
PID 396 wrote to memory of 3468	396	Iepaaico.exe	105
PID 396 wrote to memory of 3468	396	Iepaaico.exe	105
PID 3468 wrote to memory of 1772	3468	Imgicgca.exe	106
PID 3468 wrote to memory of 1772	3468	Imgicgca.exe	106
PID 3468 wrote to memory of 1772	3468	Imgicgca.exe	106
PID 1772 wrote to memory of 2396	1772	Iohejo32.exe	107
PID 1772 wrote to memory of 2396	1772	Iohejo32.exe	107
PID 1772 wrote to memory of 2396	1772	Iohejo32.exe	107
PID 2396 wrote to memory of 1748	2396	Ifomll32.exe	108
PID 2396 wrote to memory of 1748	2396	Ifomll32.exe	108
PID 2396 wrote to memory of 1748	2396	Ifomll32.exe	108
PID 1748 wrote to memory of 4320	1748	Illfdc32.exe	109
PID 1748 wrote to memory of 4320	1748	Illfdc32.exe	109
PID 1748 wrote to memory of 4320	1748	Illfdc32.exe	109
PID 4320 wrote to memory of 3968	4320	Ipgbdbqb.exe	110

C:\Users\Admin\AppData\Local\Temp\6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe
"C:\Users\Admin\AppData\Local\Temp\6974d8327de548675d15f53d55f559b809e069a131fe4cd5be048ac7610456e5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\Gpgind32.exe
  C:\Windows\system32\Gpgind32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\Hfaajnfb.exe
    C:\Windows\system32\Hfaajnfb.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\Hedafk32.exe
      C:\Windows\system32\Hedafk32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2312
      - C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        23⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        24⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        25⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        29⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2696
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        34⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        35⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2596
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        38⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2764
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3908
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        43⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        44⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        47⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2940
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        50⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        53⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        54⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        55⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        58⤵
        Executes dropped EXE
        
        PID:3424
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        59⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1988
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        67⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        68⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        69⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1584
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:932
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        72⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        73⤵
        
        PID:100
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        75⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        76⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4992
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        78⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        81⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        82⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        84⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        88⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        89⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        90⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        92⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        96⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        97⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        98⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        99⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        100⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        101⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        102⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        103⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        104⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        105⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        106⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        107⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        108⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        109⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        110⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        111⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        112⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        115⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        116⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        118⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        119⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        120⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        121⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        122⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        124⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        126⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        129⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5624
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        132⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        135⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        136⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        138⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        139⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6348
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        141⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        142⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        143⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        144⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        147⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        148⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        150⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        151⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        153⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        154⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        155⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        156⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        157⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        158⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        159⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        160⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        161⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        163⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        164⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        165⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        166⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        167⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        168⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        169⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        172⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        173⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        174⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        175⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        176⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7048
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        178⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        179⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        180⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        181⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        182⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        183⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        185⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        187⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        188⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        190⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        191⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        192⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        193⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7272
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        195⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        196⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        199⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        200⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        202⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        204⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        206⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        207⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        208⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        209⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        210⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        211⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        212⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8112
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        214⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        215⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        216⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        217⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        218⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:7440
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        220⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        222⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        224⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7920
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        227⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        228⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        229⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        230⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        231⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        232⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        234⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        235⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        236⤵
        Drops file in System32 directory
        
        PID:7904
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        237⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        238⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        239⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        241⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        242⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        243⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        244⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        245⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        247⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7996
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        249⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        250⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        251⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        252⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        253⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        254⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        255⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        256⤵
        Drops file in System32 directory
        
        PID:8300
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        257⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8388
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        259⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        260⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        261⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        262⤵
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        263⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        264⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        265⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        266⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        267⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        268⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        269⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        270⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        271⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:9008
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        273⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        274⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        275⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:9188
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        277⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        278⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        280⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        281⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        282⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        283⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        284⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        285⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        286⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        287⤵
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        288⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        289⤵
        Modifies registry class
        
        PID:9064
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        290⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        291⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        293⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        294⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        295⤵
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        296⤵
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        297⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        298⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        299⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9160
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        301⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        303⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8836
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:8968
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        306⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8604
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        309⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        312⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        313⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        314⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        315⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        316⤵
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9224
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        318⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        319⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        320⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        321⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        322⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        323⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        324⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        325⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        326⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        327⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        328⤵
        Modifies registry class
        
        PID:9856
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        329⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        330⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        331⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        332⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10100
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        334⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        335⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        336⤵
        Drops file in System32 directory
        
        PID:10236
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        337⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        338⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        339⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9596
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9676
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        343⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9852
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        345⤵
        Modifies registry class
        
        PID:9896
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        346⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        347⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10116
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        349⤵
        Modifies registry class
        
        PID:10176
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        351⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        352⤵
        System Location Discovery: System Language Discovery
        
        PID:9428
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        353⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        354⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        355⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:9616
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        357⤵
        Modifies registry class
        
        PID:9780
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        358⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        359⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        360⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:9288
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        363⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        364⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2528
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:9660
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        366⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        367⤵
        Modifies registry class
        
        PID:10044
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        368⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        369⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9544
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        372⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        374⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        375⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9116
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        377⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        378⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        379⤵
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10184
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        381⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        382⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        383⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10348
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        384⤵
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        385⤵
        Drops file in System32 directory
        
        PID:10436
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10480
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        387⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        389⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        390⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:10700
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        392⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        393⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10832
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        395⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        396⤵
        Modifies registry class
        
        PID:10920
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        397⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        398⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        399⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11104
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        401⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11188
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        403⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        404⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        405⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        406⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        408⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        409⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        410⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10560
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        411⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10684
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        413⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        414⤵
        Drops file in System32 directory
        
        PID:10816
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10916
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1644
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        417⤵
        System Location Discovery: System Language Discovery
        
        PID:11028
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        418⤵
        Drops file in System32 directory
        
        PID:11112
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11172
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        420⤵
        Drops file in System32 directory
        
        PID:11244
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        421⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        422⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4292
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2344
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        425⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10476 -s 424
        426⤵
        Program crash
        
        PID:10696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 10476 -ip 10476
1⤵
PID:10640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahdpjn32.exe

Filesize
204KB

MD5
0a9f611746949551808d7f1f0734c18d

SHA1
f74e6d41af9e27af939e495317cb37cebc025a9d

SHA256
ce2f8680691df9b750c54038ae67c69aa77eeeb1c8e61b2a69c285e2d692005b

SHA512
5a474a808b78773eb4e700d7af4abb7fb755106c5aad4d767aeb187bc32be093a3dbd205df9a5f32fdbc66ce23b0a23a75cd8f187f60c40cf3058e99b3401692

Download Submit
C:\Windows\SysWOW64\Ahofoogd.exe

Filesize
204KB

MD5
b83724449b9beafb7c9a255e49526f58

SHA1
4747eca2b4c3b9fe9e5c80cdbbe2c8ed51e03233

SHA256
839d31fb784fcddc0c6fd8cca6cd2ae4b0566897121e0132308d9e1072781e3e

SHA512
17264347c142b076970ccbc89953147bdd9f935b6016c98ea2baf97b3b9bf729abe963258fe808aca3c4de5eb523ebc06c79ec011331b9ad538afed8bfddc735

Download Submit
C:\Windows\SysWOW64\Aokkahlo.exe

Filesize
204KB

MD5
5b305777014030cbeeba276742d78f70

SHA1
a9c34b45a62e2fee6e76fc2e6b8d57a412df422a

SHA256
4699c91d074092dfabdd3b74161158665714819929c8aa51069a92e6265ffc7c

SHA512
6a8c6fe952d4c94cd600a31cfd7cdddeea05c81d3fbaac1ee14e9b01f222ca23797af8187bd3043b2a79ee78dcde401dfd0dcad286a64cab569ee9aae6eb0c8f

Download Submit
C:\Windows\SysWOW64\Bmhocd32.exe

Filesize
204KB

MD5
2d408d2708a316bd04cac84830653bc5

SHA1
fcdaf65ae2fb84fbbc5f09f342cb5ad5558426ec

SHA256
140e2e09678f967f2df92cff40c573308d3b73214825d7e25b5d0aae9156dca9

SHA512
2a98dac1535bc0d75530c6fd8db466c9dad5d08ad3a75bb2eea6584f3f775a555af059879978d953be215fba36e44703b4548bd3a60b77adf010fe64266df818

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
204KB

MD5
696b3c0978779b66f9cb929d9d6eff0e

SHA1
a8c050e3c3b17d6c66c81b290fee1168072c41c3

SHA256
f529f262ece332640bef8217af0ce3393b71953c4ee4bbc06c2f13ba300c7c4d

SHA512
e26b13c463bbcc1429c10af4f93a6b80450074c997177ceff6b7e2157f7d6c33df0f4c97d5a1dd8ee95b8506ab5e1b1a6ec7a9e3c80673800785f70e4e640c86

Download Submit
C:\Windows\SysWOW64\Ckbaokim.dll

Filesize
7KB

MD5
98896a1a9fdd492b5aff2bc7844de51b

SHA1
0ed3dfb3ae51cc9a6d61a4af3023ab6683264baa

SHA256
577ed0193f05ce00ec203392e6aff31063b7f3f309fb8cfbffaa2c2631a22897

SHA512
8c04228c85e1713de9510ba372acfa080100e9a32ea62ff0b12e7762b1a7de69dc102c1cbd552d71ac5cbd8b6503cab61d9e8fc93121b8ca7e882b91788c17b0

Download Submit
C:\Windows\SysWOW64\Dkcndeen.exe

Filesize
204KB

MD5
e1f476e00f14df5924da4330f30e0286

SHA1
629a1d3f1f865fd1a3454e679a2770a0472f2c45

SHA256
9137d20bc2a4d41cbd7cf6ac6ddca709a46cb558a38c39ef086b154147ae1e39

SHA512
8786f60a0ad6194746f6ef6c4fa8f10bf2c1befcb9091dd13015e0ce918227b5ee54eeecfe76a5d399e30a7ee907bd5db8b877393ef83bf2c3ec78cbf4477cba

Download Submit
C:\Windows\SysWOW64\Dkekjdck.exe

Filesize
204KB

MD5
875d46261c40420a6d515a55d82116bc

SHA1
769e85997fec4e9f6bbc6eae2d7157dc6353995e

SHA256
9047fc314eb7005422c287bd73f206ef8fd912a72e40fd8bb8722eaa70e518a4

SHA512
cbb28b77ff1f52190b9e067aced7a48e89fe6edc899888e3f1ff43fd10ff97144d44b4917fda05488cc424bf4d80f9b6c71d514c90a9aa84be19a0c6af2a7685

Download Submit
C:\Windows\SysWOW64\Dolmodpi.exe

Filesize
204KB

MD5
a1820e5d79fc4ad435b116f121051857

SHA1
1340f1e944658e57b845889cb19110a7c8240eb2

SHA256
8ab2a89652c471c9b0519c13671cad12590b6becd529a357afd53b0ebc87311e

SHA512
52b6ef0c0bafd255ca21448a4573a34a0479f80a248cc6cf563f84979af6da44d2cd7b4fbfb5a7a33950b00679f4c3eb8c39c088514dd54e01214595fa78e742

Download Submit
C:\Windows\SysWOW64\Eqlfhjig.exe

Filesize
204KB

MD5
a0cd7ba1d7b0ca48b0265622701b1258

SHA1
4c002fda8589654388f63a2362bef7324f7b0020

SHA256
9b0fd47f8d296092a34ead1dfe5ea182149534710cf8d485d5ea7869134f765b

SHA512
6319efed3f3d8baa0ccbf5204869e34ba57c27321734e21d92dc7ddd96a5efe2f9d7ace71f123f1cd22c33611361a3ea7e6b27411b91b67127492305ed35b121

Download Submit
C:\Windows\SysWOW64\Fnkfmm32.exe

Filesize
204KB

MD5
76e37af3bb62653f4eae891524a923da

SHA1
0f6777862832f76034f4d6b631bd70eb24b5adb4

SHA256
1dd9d75be20cf2c84e3b4ca30aeb9d3f50df8a36ce64ace7e0744378279b11a4

SHA512
9336c954a9d989b476b78f3c5be2c8c864ba1a332c1d622a7725f47a3f602329ef7af27c4d54869152029ae917c01bd19af7e39ab403f4fa6a7a924054c7043b

Download Submit
C:\Windows\SysWOW64\Ggmmlamj.exe

Filesize
204KB

MD5
26dab0e2b63080abcecdfa305cfb4ac0

SHA1
5d3800b077856881ed67d7eef75e0de3b55f923d

SHA256
826d27f091ad6f3813f85b047e6e26019d6b12900d2fc02660871208da9516a6

SHA512
105378f1e8bdfd5bb77301f60c5aded2a0ecd19fb6d19dbdb7f4d856c5e2755a5a15e30838fb52175fbfc9104ea875408dec70be4f730f62071325a29f6296c5

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
204KB

MD5
1b679e3c1c657c1fec273073896d023a

SHA1
d1af2d629af40389acec0cb90ee7c6cf35e7de71

SHA256
d41f9596fe76c899cf2b7776a75c89c7a8a2b92f380facdb43cebdc06ec2468a

SHA512
3bcd332b3e7652eb163b9738f8264328a86df75726063d73b3609b8069aad582b00f1ce4072e5b82f26541d29e12c6bd248fafe5607a206476fca4650095d8d9

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
204KB

MD5
11bb910d036b634e9f8d64da8312ef08

SHA1
e8f3e3c125669af4cbea7400474a308dc9b535bf

SHA256
d2a2ee60746fb12c2e87418582759975013d4fb30f0997b8e4feccc3e8732ada

SHA512
011d9747fd71aaa7c3006763a12d301f61492c7fdadb1d9787587ded4ee32df232bb4d4c8283950e6b829abf4c3a5f06a07a7002f3f02a9e0e55b6d5834b525c

Download Submit
C:\Windows\SysWOW64\Hbldphde.exe

Filesize
204KB

MD5
adfda2430a33e373da6965797dd88cf1

SHA1
b4cad0f637ce78739b426ad4e2625eecbf77f65c

SHA256
af837bb9c2c0c32189aee97aea221ae46734dd096d1b885aaa599a5ee6fc3c02

SHA512
8451abde8925e2da42e92e56b58e1038bfdcd2db7f14e61c665b6f5e7c3e3c48179e4bd227247c3575d0a4a07cd5bbe56c4877a438fffc19b923e45d66f302b7

Download Submit
C:\Windows\SysWOW64\Hbohpn32.exe

Filesize
204KB

MD5
bba94bc322bc43c1acf432b5f3af2074

SHA1
873c59b48e0113247c6072365c9b76315ef22fb6

SHA256
47db06e4710714e02b1fce17dcc8ac04a2a2f3371babde938fb0177a2fbe57cf

SHA512
3420398cab1c3687c00a7f0bd861a6b6ec4689aed5681da8cde045e1685ae4c3090f336ec628ed5daa4df461f4ee5617f73f9247552e45fe6fb152971f744f7c

Download Submit
C:\Windows\SysWOW64\Hedafk32.exe

Filesize
204KB

MD5
08abee85ca378c521a2e879c66243589

SHA1
39689ea0fc2da0432f593795078ce62e8f913111

SHA256
4502c47994a7e9323e0d320cc1bdbb15fa2ab0bcbfc4941117906695ae8c2c0f

SHA512
151e96e62616d40f5cb21c76380f7580397b8e62dbcb88314058d03b9658814078ebb97d1c27f0e2a2c201ed7bb104a142d855fc40b02aa5d79d9389d81cf5d1

Download Submit
C:\Windows\SysWOW64\Hemmac32.exe

Filesize
204KB

MD5
98fca19668b2a1ad3c3e7422741696c9

SHA1
f2eebb9ad28a34e1c2a80ef0ad6e6ca4b9041764

SHA256
63be3a05ad781d2f72027fa7956e1ce5c5e815ab4bd31939051322a61a3c7492

SHA512
fdc8305cc0a1e887f97852507af39650cbf55365bb710758456ac401941030b9a159fe4a7cd225910514b1cd94ecd9d7dcfc78e6451b1c50b449fb85abe28a09

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
204KB

MD5
785a1be27eaadab51353b0a1f9d3bdb0

SHA1
84158fb1d37a64de464dc9916e3c7360658cea4d

SHA256
e7293bac1948e98dcda61bfd65683b00f69cb12104ca4489abe41706cd5a396d

SHA512
5d830eb59ddc1c1db63b983d831d6d83d8d07b5da060ae8a743ca76993108a168c3e79a44f9b36102517ce0b609177403ae2982a246e307f28a9a4bfd24840a2

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
204KB

MD5
89589ef5dd8d8da9e00bb1e9487de69c

SHA1
69eb6a1516f03d1b4b601ac57bef1b3bac99444e

SHA256
d1b557eb203349fdd9e7f1c5a1b49e66738e5f75c32b850ea950bb07d33ca3a4

SHA512
78566c1554f1e0b6573d86f00a3524c405a0a0c2d035fcafb3b4acb5e0b4632866733cfee0d74c98d865c2546937ab0ac798c32eddd52f8041bb90f8be14f484

Download Submit
C:\Windows\SysWOW64\Hidgai32.exe

Filesize
204KB

MD5
47d76862a96ae4787c9b87df95c2fc13

SHA1
d953e30b6a95a59a5ef4829b2437514e32db0eb0

SHA256
43c999f3d5db875a45e92c22a8ea0d04cc549110a4171203edc44aac785b4168

SHA512
3e0e97009fe3f36c8ea6f65283a8b63a8576eb3562b9ab3a58429e54e4c8cb0d723d657bd1cbaba8ff85f6786e374aa76544c24954e23049077dab91e38a5292

Download Submit
C:\Windows\SysWOW64\Hiipmhmk.exe

Filesize
204KB

MD5
62a7f670c526d8321e49eb90d4c21049

SHA1
1007437d061c3cfa8210089b613ee4b5eebf1a34

SHA256
a9119ab1ff8f432d0675ea47b34697376614e42f3e356e9162426bc85089a8d2

SHA512
98f613d3e82f35052d525e7b611aeaad45e4ed5a54d494a2e749f6190027158bbcd1da9efdfd4c38c2017aade67e787f4ea1857f081b55ccb106cea21103d115

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
204KB

MD5
e9719f274461a78c22ca5514910edfa6

SHA1
a1ad40a8241c07a656295cafad6d2f0e5db4c860

SHA256
a5017b4d0e7757179563167d068609d902e1b218b74010e2ef1d7e2b4b1f48fe

SHA512
c9a96756f78fe95b52a1a2b8dce4bc45b9dd403af98fc9c70385fe124acd8b7cd45521c9cd69b796f360a457914d2ad28801f06f0ec8a6b63ab7582c494b8a69

Download Submit
C:\Windows\SysWOW64\Hlblcn32.exe

Filesize
204KB

MD5
4dcf878ddf6646ab5c3a1bf762575915

SHA1
168d1cba1c93c60d2bd8063ed15749b8bf155121

SHA256
a1a1914e2f7585316e961f206dc9d0fb77e21d9ca9297579d638b2f3cf33ecad

SHA512
332ded4947363ec3488589edc3d724e58ca3cebfb96998edc3a97fabe74cdb419203ac64f273c32a070a2bb16a810824578cabdce5e5f0967f80fbbed7463cfb

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
204KB

MD5
fad2342452de71305bdbb2a6b20f443d

SHA1
312f5131a7b1e95ce1bd58cb48c4392cccd95306

SHA256
3412c967b55fc748e6a29acd025dc1614aad9f76a4338e6bc18f0ffe8e2ed360

SHA512
7b463bfeb7af9a60f03ed26be67d6a1aa4732b2d9db623f512e83fef2893fca9fd94b29afd33fc5a308fd8076b98469f2cf5fc22ac3f4ec1fd348839281d3580

Download Submit
C:\Windows\SysWOW64\Hmdlmg32.exe

Filesize
204KB

MD5
8b8c832f12c39095d462f8e5d2da9fb4

SHA1
32946157efb93bd3f0f971c238855bc869f22494

SHA256
60919989116ddcefca282f8b27ee112f7d07183d70006b1fdf4a5e8d729631b1

SHA512
3dfb7cc5337fc2352b0960918f5170a521a4c0d6a92bae2e42f94d16071a27618caf7a327a813fc7675c6ea100b7ffcbdaff7f8d96c918453f9bb626479cec10

Download Submit
C:\Windows\SysWOW64\Hmkigh32.exe

Filesize
204KB

MD5
47632443500c949b714392b8179a118b

SHA1
c08859bad9ad48e2c3fbb96892bcb490dd5c9e15

SHA256
3fc16428d8206e6d415b45e816459795c3bb074d6a6d24f3c6340c89dba12e4c

SHA512
96d412c209d04cfa4a9b2e7d3de2d35b129848f8daae3cc7011e8f338f07fc7dd8f4fa70076a156c892ed2a9eee182a7b241b73cf0a4bbe1a19302abda9684a8

Download Submit
C:\Windows\SysWOW64\Hmmfmhll.exe

Filesize
204KB

MD5
fb341d5e0e2eb470972e4c1fb26cac93

SHA1
5d674138cb06680132ed983b47990d3ca7ba02bf

SHA256
44f0fab2edbbfcc54edc38a1544bb03563bfaf7b4c7384f6c6c3a784b23bba5e

SHA512
e52db33a832ef242c1cd4e0ffc93cafa5db59dca48959be09fe9a91f76511419e9fb4a5dbfcc60fc078a6bc6804071cdca9af4de4039313d1834f46dcc24cad1

Download Submit
C:\Windows\SysWOW64\Hpiecd32.exe

Filesize
204KB

MD5
f8e84eefc62bca7b4d58d7d5cdebd7dd

SHA1
a778bd38d360222512ba330be000a04882b410cf

SHA256
019e18cf0468b9664713657828463ce121376f15f387e9430e9adf7275282ddd

SHA512
f1b38ac76af7cef3e93f81d14abbf5d9b74723f7235614518dcf0ee0b230c8f1f75568bd4df56d2a105154b2ee7061535799b3ef8a344f54e02b0ecf3943dddd

Download Submit
C:\Windows\SysWOW64\Hpnoncim.exe

Filesize
204KB

MD5
c11a3318fba8bf51a638e22d035fdb92

SHA1
cf6b8daaf55ece52041dc5576f2511c1b5f7d14b

SHA256
890e787e9f11d064583ed1f049d066b6608e6ed1198c5089595aad4e1033ecef

SHA512
c0e687a32b44f46a3ab1160bcd62c51b9c3aded3be1555b2dda1853e599a79fe5e1ded6db7303e6b080f2103e32eb7a6ff8284ab3ab1769763dab9a5852d50a5

Download Submit
C:\Windows\SysWOW64\Ibaeen32.exe

Filesize
204KB

MD5
60b196ec3a5dc8e9ad3d162143b78657

SHA1
399a7902a4278130489293c03f10bb5424f0c977

SHA256
72f18c96122beaf4af4f7b69d2f1d418c505952029a08c77d21fc1a1057b9f67

SHA512
8b6ce01536a35c74c394216d6b06abb3bf3f49c92ffff3756de7cb921692d25b73dd08ad6643b45f092c7299ed8aeb70141cc643426669ce75e00fb354c1789b

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
204KB

MD5
60c13b505d89eeb241b0400b7dfef2d3

SHA1
571284f9ac3a1a7514c1d6cafd99dbfd35c04367

SHA256
36e71aed58d457c129278c0c01378bb72f13640199bb12df9bca431f43fa5139

SHA512
b88048c8875df708cbed3e2e1a5634bf47742982659023d1140f10de092d2f2f15995ff204e7b3770f7407c0a3938c1885cce503bfba1201ea55dfaf41db3974

Download Submit
C:\Windows\SysWOW64\Ibhkfm32.exe

Filesize
204KB

MD5
2d3180fe952214dcce8f2a94f790a3e6

SHA1
9bca70fad499a6dd68eb073b4ace60ac59fb020c

SHA256
07503adcead820c8cf6592db261442f1b05084b1fdd6a68d135465a84824b704

SHA512
47a538a6842c90929940774e0d87ce0ba440266898ab0ad9400f2872d5c7c682c5e663c833b48c6517b0e710f2e1b50cc93d892170095d1b4f96c16ffa1e12d8

Download Submit
C:\Windows\SysWOW64\Ieagmcmq.exe

Filesize
204KB

MD5
b5e28cd8753eaaa15db514e4d0b57061

SHA1
806ba670b4363216d08b18a68d8bc42ce6d5f321

SHA256
580bc5455ac52b22cc5324676111ff30cd447d0bef0bd6d15bfdecb5da3d99d2

SHA512
0d9cbbccdc3cc2b051a50ba9914be4f03afed6c8a40e5dcc2cd28db2372ed89a6908b75daa11c94289c52d2050d8270f63fc6e90868f440726f60c3e5f733f6e

Download Submit
C:\Windows\SysWOW64\Iedjmioj.exe

Filesize
204KB

MD5
b5c0647168460b75fdde33916a90c175

SHA1
6d61de2854a06dd664a85b475246fec0e19d4e81

SHA256
1ca308ce218a613a61f5f203daa9aae70cc5adab71ab98e2b4d9802b948aa746

SHA512
063e206dfef31f2adb541eb31d4410879625f5a0c0f28117bf894381e35531b4b4fcfaad49136f2c564943b076d8b20a7d151f2190f7bed59f836bcca2ea432a

Download Submit
C:\Windows\SysWOW64\Iepaaico.exe

Filesize
204KB

MD5
a6002e9f861555059eb15ce78fe48373

SHA1
72ca46f473b15db782c795d9e3d1bd38be7b9460

SHA256
831681652ceb5c60e395ca35a211b309aa643285d54f8a690adcd3b11086dd07

SHA512
1b94453f81d54ef1e0e5b484cd682ea7f2fc0ebd6fc7a086ff09663c61dd9b804a590507895cb333bf58ef2e61b57625a91c9199cf9bb0287115e1532dffe5bf

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
204KB

MD5
8e6f3d290e341deb7bb8b5f94e4bae2f

SHA1
21e2f132c056443d9aa4c181b1201ccadac9f6ea

SHA256
7f540e225fdcd0ea3aecd595e7c21b6e3b1e9ca8089228250061b383f85c68fd

SHA512
ca282a3d80c066c5484d52d9df4603b0d06f7046fe9a2936253ec9a148500b137a00b158152971fd048814b8e5bdb77ec12d38bf27fe145d0a3c04230c3020f1

Download Submit
C:\Windows\SysWOW64\Igfclkdj.exe

Filesize
204KB

MD5
ed0494d77d2d9da6ce3f3029e00949fa

SHA1
893cea5dcddaeae674fd53e4a82248990fbc3015

SHA256
3e17a3b5d82642d7d741a94bbcb119747aa579cb11f310dc5074b16664979eaa

SHA512
13eb285a5ee78db5813f99d3cdaaa6510f59f97a3ba9c24663d8da9fa1a378063655405a4336b29545968ec9b1a16c3a75d9d0750c9c08b882f50ce7eafc9529

Download Submit
C:\Windows\SysWOW64\Ihdldn32.exe

Filesize
204KB

MD5
e89ee356d11a730dd3c1e427d8813bba

SHA1
46450f8217c8e054a3db2a5a58356aacf9878e4e

SHA256
48cb9db292f51b7db08e5282ea0091fc6be9f1caaaff6c4b9edd5be5377a240d

SHA512
1e31339b8971fc3d633cd0bcc83db2465a3cb0ec75af98223a4e0fb3718e772fae65fb94f14f8fdc97beeb781ce10ff548569aa9796ca227ab14a1cfcee8ae91

Download Submit
C:\Windows\SysWOW64\Iibccgep.exe

Filesize
204KB

MD5
14bb3509f7169615679cbdba5b01c5ba

SHA1
678be0c0d43dab92e52fb9ef5ae4a3922a33b545

SHA256
57d79802cdeb117d90eb4c15cf12ed4af433805adad01715c8e420690b4294ff

SHA512
d26d6e4156453069d74e45ef16782f007b9e579c2e82ebaf18ae72bde02874bd07eb2625a8967993a3e6ef691f4826b32a04dc55e9b2e5423bee3f46e6e7d9f4

Download Submit
C:\Windows\SysWOW64\Ilcldb32.exe

Filesize
204KB

MD5
48e1f53f52cb55aa841c9b15b17f146d

SHA1
1ed73e6ea6913bacab1739780937913f5247d0a4

SHA256
84f818c0d1cc9033e2105e5eb83b7e006f52849a9bf16388bcc1d60cb0812cf6

SHA512
e00cd989b94698245ca5e5cb23d856407866e55a9935858a66873874cd88b02e0081db25ba4e5c1390df61c31073ebab50fd78c079f1876713050860dc1d400a

Download Submit
C:\Windows\SysWOW64\Illfdc32.exe

Filesize
204KB

MD5
79becc99aa37aabf5d0ffbf9840f0942

SHA1
1e993d46adc22ee128486c3a00e844a5e1ed51ee

SHA256
25c5fb76c1f76fa894d0b72b8668a90221bcb6d53a2d44222508a9204bd14d26

SHA512
88b922ceb05d153c488ff8b890634904eb93de23f17c717105a434cea359204b9c5519f6893679c070ec0e53d38e58528f4eb79cc38327dad3e760c3a27252d8

Download Submit
C:\Windows\SysWOW64\Ilnlom32.exe

Filesize
204KB

MD5
1d115519b90a4a08192f7c37a039e4cc

SHA1
775576306450d9373c41207e35fa3e4a50dc0e5c

SHA256
155060267a00518e0f5bf9da77363381061cf1502ab634a208e7576476a6d152

SHA512
46437daa45c196f61d3c3f40ad0e9a279e7dd87b6d31070706dac1382404ac44e9d22e712fd54fcd1fda11137a684d9acb3811e1759c07e37e2730c08386a15d

Download Submit
C:\Windows\SysWOW64\Imgicgca.exe

Filesize
204KB

MD5
278e5a7ad523f5d399a9f9f0cd03a8d1

SHA1
25019fef09472d58242b0efc6a87d3f5401b12c9

SHA256
eb0b862e15739b03456403c646bb59695f328644555f2ec147a026bbe04f3648

SHA512
93a76058626f60e7f541aa28642b13f81b95045857f9137b72b2d87784a1a63765df69f44d842c4864116ba63ef7a4eb35db7b4e8f04e20f64e6c44211048520

Download Submit
C:\Windows\SysWOW64\Iohejo32.exe

Filesize
204KB

MD5
c4273ffca551209d16934c92af8d8461

SHA1
8ca3481d9c8beafe22f23602849e9fd59253fbc9

SHA256
7781b565e1095264b3d7787275389bbb00b95a9aa0d5dc290c1c194a875b019d

SHA512
77bf2c0ee3f68da40de8bea8f000ac9d1274309f6449240cddc10e41ae030950a068185b7dbefca28e5f65b864af3f8faf0995e7914ab36f8a8d7a4a2183044a

Download Submit
C:\Windows\SysWOW64\Ipgbdbqb.exe

Filesize
204KB

MD5
fe93e52da71e849fbec81736934afb97

SHA1
a1379d51e90a2bc7139783b03ce1e3844f7877ea

SHA256
01f95b3ed1ce01a010893ffae0fbe384b818b2f4d63fd6ac4f9edbcc179c5bae

SHA512
ecd64c70adc6fa579d73f1be1e7dcd86613a5343d402d979d23bbb90948fbd69f045203aff4b96e1df93de7a0169d0e604c9a48064b32d0af16e235719e27264

Download Submit
C:\Windows\SysWOW64\Ipjoja32.exe

Filesize
204KB

MD5
5183930e99252a8ac376be5aef0acd0a

SHA1
54cbb4bef587439ef9b0964e04573bd8b071480b

SHA256
4008baf1eb9313307fe26d5339d5b3b404638f8bdaa0872877dd2c936efe4588

SHA512
9adac1818e538b2a8502333d11053cb5dcc61cd579b0022e04eaa3463f630d13b4da616545cce4b3fbe022c3f7ddd26b1658236711fdf09b0a5df8893cf0383d

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
204KB

MD5
b3e6b09c6cc01c320ba9b5c68a787d3e

SHA1
fd3237213553fd4e3beb914f927e2cae28b77acb

SHA256
fbe8a697619df876ed345834ba5e00cdbec5134ea38d787673b1fab035f805c2

SHA512
718d2932d2035cf67f8e3756783d9ea92f403f9dee0912caa578b86aa755df24ed5a50f6d608e15b6629f4279e3fb41ea0a7495a6592e18847de057a82798ecc

Download Submit
C:\Windows\SysWOW64\Jaajhb32.exe

Filesize
204KB

MD5
b30308cf89ecc41cd314da759c369157

SHA1
1d2137ac12df7ebf8a5513e9f3ea0eab058303a9

SHA256
b1bd3dcab7344c1af48fdb67fa2f00ec7af6a110d9da5296413146939d6f90cd

SHA512
ba39ce1b0022d4db5d37731dd593e44cec0b5c8a13004377182b058db6ab98c6b42f02391925011c96aca782b8ac5d7d948ffa994960435cb4e8b8d9ef420887

Download Submit
C:\Windows\SysWOW64\Jcmdaljn.exe

Filesize
204KB

MD5
56a8ac2f243d8dcfe26ce2daedc05958

SHA1
cf2a119206b5d3ffc51dd47163d7c7e28bace0e6

SHA256
bca56a3d4850048739a7b48b47902331c8e7b1fc6027bca2272f31ceaa5b2eed

SHA512
9ee7a04ff5bd2034cff73a41d9be76bd3eb2ad3b8d8f18b1e19fcfc4ee6eb34490fa10f959265f02470bfa403242167242655911d6b2e39380e93471f6ba0141

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
204KB

MD5
5613942dcea3e039fa7df2640c91a711

SHA1
4f5de27d089a42560f4a11241352a762f22a7258

SHA256
dbcab42f049a6847a6bb9ad97428e6c40bb55c9dbeeda732f1db49a2f47cd4e0

SHA512
790ffb265e10f5a424fdfa877c261def3e3757e7556c3cb7ea3b0f90db078e6f4a6b1f913173a1c15914ae810967459743883e905ab42ad6fd53872a83bd1340

Download Submit
C:\Windows\SysWOW64\Jiiicf32.exe

Filesize
204KB

MD5
5a0d5450d81a12ded0639711b35ff07a

SHA1
0bf032385a4bbbcd5b4cceff8033506861679acd

SHA256
708576d17dca9825da96ddbdc19ad9c990bab1f16d0d53247d46f8afbe00056d

SHA512
48b5e295960a648f070bdb6abb2427923f6d5c5bce15745097bf83be2efc3b022e82b1f4e3287ff0b51756243bf216854362580552427e46a5a5133a2e5a23c6

Download Submit
C:\Windows\SysWOW64\Jmbhoeid.exe

Filesize
204KB

MD5
dbe7f3ddaf988ac39a22993c5e1e2c5a

SHA1
0f772c2d0ee5b1fd5d9b03bb1b2f6e5f63ef015b

SHA256
9d2c60e156241c38b1d673306cd5cf59dcb1aad66fbc447c404fca873adf6d38

SHA512
f018226c2c5f5e7b5171082b5bc602789fa4e9f16bad58909b7faf07a3dd2c648a4af36af43a05380a981879d595a3985cb0c56ecee909401e09a608de66b697

Download Submit
C:\Windows\SysWOW64\Johggfha.exe

Filesize
204KB

MD5
f212634d8f78359df2a0f904ea5e7e24

SHA1
ca41b44240d3dcc63c3518623411d5444a60b0fe

SHA256
87ac2b77d0c0962c538319626d8d87f8b89d10ee784e2974d4508fa3d394fef5

SHA512
fd6785100f417f9f63a9aebb9b2b9b3634b47e99217566e30418dba0b7775f7999b59fbcbcf3ac4530666f68dcffafefdd5ff5e3d83d78ba3ca9ca4e288fa92f

Download Submit
C:\Windows\SysWOW64\Jpaekqhh.exe

Filesize
204KB

MD5
62b9a65b804a8d06350c45ccd0506c02

SHA1
8f22c106478d0c705cca86884f8f7d82a4742b88

SHA256
5618f4589178d4e867e4f88a23e300da5e33d03353a4bf656b73571bd7e7f607

SHA512
1ae31edfe35e0190ae3b2746d9af07bb9a46bba5cd47461d4c74df49bb87eff7d2403162a8b266de94663baf09a66b7842866dc222bda080cdf628060c4a0166

Download Submit
C:\Windows\SysWOW64\Jpnakk32.exe

Filesize
204KB

MD5
62d819189309f526b3a5ce7ee82c1a64

SHA1
64ed926ffc80feef2f3c85242429d7a1b4d83e6d

SHA256
b7401a02bffb6c73399a6fbeb67d209fffa4f8e08593b652506ccb078a7a3e3f

SHA512
4887377cb5c86650bb3e5cf3894e93f92b94f42e114ee48edf17dacb2e44122e6bd3f55d4aefe92fc62cdafb50a6bd353f8cc6a8c28f13cbd09b10418d22ff74

Download Submit
C:\Windows\SysWOW64\Kadpdp32.exe

Filesize
204KB

MD5
db1ff93f24576fa4a8cdef7960e517d3

SHA1
501e981cf000dcb6ec19577e961019400715b8e8

SHA256
b3c147e67b21328b21b35567bf2b2f31c3d6964f59e52f70292096d3b4246144

SHA512
2421098018f94010f980437fd32c8ac069cec2991ebd29c1e8295fbbbf1704e90ddcedc2aae1c400da361b20900fa36b98879ba839e5f05e847f8dd03676366f

Download Submit
C:\Windows\SysWOW64\Kjeiodek.exe

Filesize
204KB

MD5
cf3ee9aefcbd1e959231089e92db4970

SHA1
7b065049c65151b5aa2b1555b4835be0a5b12b8e

SHA256
108852843d5b707de7a81c9360f48fae11c571934d06c010f2655bca14fc6b83

SHA512
4dd38bb29de21d175e746d3ce1c81d1f4982a3b3447ebb94d1795032bf9807c64180b13aee6b758e9b152065402148f0f0afcf9eac1ec42fab80b89ffe066b24

Download Submit
C:\Windows\SysWOW64\Klpakj32.exe

Filesize
204KB

MD5
e34b076f3e67784c208e98352db82281

SHA1
1e6c86c676178e2c1734c1a2565d21713113211c

SHA256
cd582867e3ddc18850c868419ea3f55486de408dc12f8fc0cdd983607df945f1

SHA512
8d0126a1de36829036fcdf6ab9521574d019f6297ad9687a16903c0b6a0d57861bab967dcbf3f0caf8bd5363f87be5ca74f972d233f73f09301ba9dab9cf080b

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
204KB

MD5
9f00b68fa59cce609bc7c602f36ae040

SHA1
7b3e9252d8d12c8ab1977187a7636e036035a22b

SHA256
e473867373339022f48d3f17721cc8fe2138652840c178682aae096d071fe79a

SHA512
2c1ec3db118456a3b8cd2ae54e0ea8c5e4a8f89378ff5feddfba0148c123170aeec5b93b52c16b847dd9b2e39535f34b5817f3e0544b3549352be447a373aa17

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
204KB

MD5
dd60ce220908c38b4d00d821634f57e8

SHA1
3974982f63cc777ea60565139cabceb77ddc8b40

SHA256
a98355dd2c0e49824baa5353a5023cf1b2656cfbeb89f99c5994668814f7e6a1

SHA512
0c9aa249bcc51697423bf2a489fe5120189e93d10be68570250fe27401d45170232fc2806f3a30e2134f9a9cfbc16e7d97cc935224e68d772dd2279b0f87fa3c

Download Submit
C:\Windows\SysWOW64\Mfnhfm32.exe

Filesize
204KB

MD5
6e312ab84dd21c37fec75152bf97d8e1

SHA1
d4b9a5c3e19994a1c9c3ff73cf1da984195d9fd5

SHA256
d3303f5b2bee3b7c5ba25cf3c5d64004ccc87994199f3150afa7bf8b711bf310

SHA512
34572299ad65ec41387e7959c9bf9e183e5b358068b69e089b1861568c3b2385ce7f954d8e29c1ee4a6e13c2fe62c19203b7c9a987f0a290cf2ce30dbb360ded

Download Submit
C:\Windows\SysWOW64\Ncpeaoih.exe

Filesize
204KB

MD5
4645d57e6727e0bdc9ed908834a1d870

SHA1
c072490148cf688aef7281df52f9a5fc0357b2c0

SHA256
e0d6855fb6cc8d1987c8b00fc19bb0a7a7cd1bee0603b7d34ac6be5979389ebb

SHA512
5c27648057730d16fd1d8de01e6de3f1caa6fc03178d43426b5c74dc04df98022705a3208bc0bead65ce175da905bd2d8325544d0508f1672ac7300328e254dd

Download Submit
C:\Windows\SysWOW64\Nfcabp32.exe

Filesize
204KB

MD5
4cfffd549472dc687f23d960ccf82396

SHA1
ef8a717f2f214476ebf707fc65718bf286e730c5

SHA256
3629022042afe07879efa1c46fc18e8a5714a2eed2c209b610a4fd493b94315a

SHA512
15658c3fb04edc409aee3d72864ff258738be102364d801c261a62602ab886e6ca41eedb41fe8e91d62ed609f3fc49985d9a012bd57a428fe55f8d150bcbbbaa

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
204KB

MD5
d3622f0ad482f870dc0ff3b39fe024b3

SHA1
d398cfbf358fbe3ce55df02152a0e2a10fdb04b8

SHA256
9fce2b44a43317a0b0095b9e5fac47b0c56719ed24aa7b7fc04396cab4f4c46c

SHA512
20389369312331df9dc113ab0339dd3468267293b5a094cebcb44b45a17df608e57c0b8b0fcb44fdf16845754cc3afb3705cf61b7671190d8c8f8bd8db400449

Download Submit
C:\Windows\SysWOW64\Nimmifgo.exe

Filesize
204KB

MD5
8ea48b40817e8b0303d9920ae7fc1af7

SHA1
4136ed62bbe19a7e1fcc32ac9996f50d793e80cd

SHA256
3bd2d87d8c365b25f80870260f6d6b21843b432e74b22a4c1f8305b6f442b14f

SHA512
bd6427ec43936161f4f1b37fb72f3b982c1e85e3dc72437b56a28bb6a966ee6e8c34e489bdf973722bed89045e20c5d196c0277e47edfc17bf5bac7288c775a2

Download Submit
C:\Windows\SysWOW64\Nnafno32.exe

Filesize
204KB

MD5
f7593bb087b22fd94f712f07d0e45188

SHA1
f563cd23765e665a5b84e6d3ef61ca3f4c1b1154

SHA256
e4816510afd197bfeb72b93cbb5485e2514fcde93d31a47fb3ec49c5a8a68cc1

SHA512
505ae0dc2e0444559001b349815a455f12b621daaddeb847d7608422ad0a4d10ebdbdefedb70f92d08089a7c170782e198e81a07575bc6a2e6d7418953a039f1

Download Submit
C:\Windows\SysWOW64\Ojqcnhkl.exe

Filesize
204KB

MD5
3a01a8f243b1af0438be9a79b9a1771d

SHA1
a13bbe44e2b96e8011a19d66a53d8a151a88f424

SHA256
4fc91b270e18d72fc797e87381f86b29e9c693ea0585c04416c4bd2e4bb0bce0

SHA512
a145e84a9c3170314a48ac3b303b82ae1f282b9b11fedec22807dbd87d96c4f0926b90b2fb3d6a94682d0d8d6a9348ed6af3956fd7271aa6764d68c85c867568

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
204KB

MD5
af7f2a1c49bdbf16253525b56ca91922

SHA1
b20be77b386053b28585f727401aad3260a9a080

SHA256
83b55556bcf4ef04ef399c570ad6c15e8a3315036c78c426ea79e1d5b03f59cd

SHA512
e8f264afabefcc798e9b259e7c5aa5eb4f4d6a9d05160874751e479c6e00dd65c89e252bbb3ec8a968f860554e8318db1648cd5d0d4cedec28aaa3557b4aab63

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
204KB

MD5
4324fd7850092c7b96871f42e868b2bc

SHA1
c5511ba677098c1865c97ea290228ff3dba23a7b

SHA256
465d9b839a7ccaf01115430eddda9671d5d5071dcb838ef1bbdfe8570a119259

SHA512
d0e7564719c1c1bddd6e70156f50676d961bba302e8407d300a2f3cbac384a2d8a6d6ef266c494990c48c93566b8fd9fed3fc1ada3937b8e61447defba3b192c

Download Submit
memory/100-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/228-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/396-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/512-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/556-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/932-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1056-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1136-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1160-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1160-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1172-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1584-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1724-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1748-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1772-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1856-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1884-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1900-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2028-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2144-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2220-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2312-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2364-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2396-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2460-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2476-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2532-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2596-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2688-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2696-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2736-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2752-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2940-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2944-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2960-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2960-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3004-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3056-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-592-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3196-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3308-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3424-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3440-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3536-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3904-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3908-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3948-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3964-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3968-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-530-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-603-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4208-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4224-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4308-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4320-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4332-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4436-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4444-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4444-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4524-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4612-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4616-470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4780-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4872-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4992-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5036-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5132-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5184-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5228-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5292-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5332-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5380-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5432-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5484-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5528-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads