berbew | 19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152N.exe
Size

128KB
MD5

adf8527fd0cd380fb7f55d9eaa214700
SHA1

bd2fd5691bfcdfb5a7b46b7972c6c6569bdb7208
SHA256

19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152
SHA512

c1dbf8ac06fb7ab0f8783c8535847711d1c5eaa2b558b496b24cf918c02e1a50f582967b53a74c28af5f5c2a7f7cbb893b7e41dadd4d5a6d725db88ac1f462a3
SSDEEP

3072:+LCGvY2v2lSs2Mymz7E5AtiUF78NPBYBoBd9B9pax3FQo7fnEBctcp:+LtjvESs2My2uAti+wNZYBoBd9B9paxK

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blmafnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddfbln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdepkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbncfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmogopcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdlhki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kblphgai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdqncffd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odfqecdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmpmpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbcehe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opmakd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dffdcccb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekljdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nidmml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhckqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkffacpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qqadmagh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfolehep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagfooep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bbbphh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmjlfecl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hooncplh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncakqaqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofijckhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfjmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eeoalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foholc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afebeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjbcfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aejfce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Boiamiih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmdqjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ledojqhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbhocegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npcodf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkpjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ffmnmnle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlhbdgia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmimhpoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahffjq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddklgmeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdoclbla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcbeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfolehep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqfmhacc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odcdpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgdfim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkaemafa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbknjkno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifbifh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmaknb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbqplhkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llbpbjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqdqbaee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfoelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cakpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkbpda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehbdcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmadepao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfcmij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aedfnoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npoeif32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
2844	Anmaakce.exe
4520	Aegine32.exe
1512	Ahffjq32.exe
4128	Anpnfkac.exe
4760	Aejfce32.exe
4332	Ahhbpp32.exe
2264	Anbklj32.exe
5116	Bdocda32.exe
3956	Bjikaked.exe
1124	Bbpcbiff.exe
4556	Bdapja32.exe
2524	Bbbphh32.exe
3048	Bhohpo32.exe
404	Boiamiih.exe
3000	Bdfiephp.exe
3432	Blmafnhb.exe
1256	Bajjodfi.exe
3540	Bhdbkonf.exe
620	Bonjhi32.exe
5000	Cehbdcmp.exe
4364	Clakam32.exe
3900	Copgnh32.exe
696	Caocjd32.exe
5024	Cdmofoag.exe
4384	Ckghbi32.exe
2944	Cellpb32.exe
2508	Cdolkope.exe
3160	Ckidhi32.exe
4744	Cacmecno.exe
1708	Cdaiaonb.exe
512	Cklanieo.exe
1184	Cogmng32.exe
1752	Clkngl32.exe
3508	Decbqabb.exe
1012	Ddfbln32.exe
3016	Dkpjih32.exe
684	Dajbebhf.exe
3212	Defofa32.exe
1788	Dhdkbl32.exe
4312	Dkbgnh32.exe
2616	Damokbfd.exe
3236	Ddklgmeg.exe
5048	Dhfhhl32.exe
4888	Dkeddgmd.exe
1408	Daolqa32.exe
3216	Ddmhmm32.exe
4656	Dkgqigka.exe
3328	Docmjf32.exe
1916	Daaifa32.exe
2520	Dhkackjk.exe
1328	Dkjmogio.exe
2420	Eoeipeah.exe
408	Eeoalp32.exe
4020	Ekljdf32.exe
3528	Eccbed32.exe
392	Eddomlmm.exe
816	Ehpjnk32.exe
3632	Edgkcl32.exe
3500	Ekqcpfbg.exe
4308	Eolopd32.exe
400	Eakllp32.exe
3104	Ehddijaq.exe
1036	Ekcpeeqd.exe
368	Eamhbp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aqdqbaee.exe	Anedfffb.exe
File created	C:\Windows\SysWOW64\Kemhia32.exe	Kbolmf32.exe
File created	C:\Windows\SysWOW64\Mchhjbii.exe	Mpjlngje.exe
File created	C:\Windows\SysWOW64\Nfpgmmpb.exe	Ncakqaqo.exe
File created	C:\Windows\SysWOW64\Opmakd32.exe	Onneoi32.exe
File created	C:\Windows\SysWOW64\Mlibenih.dll	Cdlhki32.exe
File created	C:\Windows\SysWOW64\Fqehlmla.dll	Ckghbi32.exe
File created	C:\Windows\SysWOW64\Danefkqe.exe	Dopijpab.exe
File opened for modification	C:\Windows\SysWOW64\Jeolhdjj.exe	Jbqplhkf.exe
File opened for modification	C:\Windows\SysWOW64\Bjhdgeai.exe	Bgjhkjbe.exe
File opened for modification	C:\Windows\SysWOW64\Qqadmagh.exe	Qncgqf32.exe
File opened for modification	C:\Windows\SysWOW64\Anedfffb.exe	Qfolehep.exe
File created	C:\Windows\SysWOW64\Cfhdmdld.dll	Anedfffb.exe
File opened for modification	C:\Windows\SysWOW64\Ifbifh32.exe	Ipiajndn.exe
File created	C:\Windows\SysWOW64\Jmcgcamo.exe	Jempbd32.exe
File opened for modification	C:\Windows\SysWOW64\Kmadepao.exe	Kekldbpm.exe
File created	C:\Windows\SysWOW64\Kbolmf32.exe	Kdllaihl.exe
File opened for modification	C:\Windows\SysWOW64\Lipkkp32.exe	Ledojqhb.exe
File created	C:\Windows\SysWOW64\Iajphd32.dll	Onekoh32.exe
File created	C:\Windows\SysWOW64\Aemgbbfa.dll	Pfqpcj32.exe
File created	C:\Windows\SysWOW64\Acfpbg32.dll	Ipiajndn.exe
File opened for modification	C:\Windows\SysWOW64\Hbiadl32.exe	Hokdhp32.exe
File opened for modification	C:\Windows\SysWOW64\Jmaknb32.exe	Ifgbahhe.exe
File created	C:\Windows\SysWOW64\Ecpakh32.dll	Ampkbagd.exe
File created	C:\Windows\SysWOW64\Ajcklf32.exe	Ageopj32.exe
File created	C:\Windows\SysWOW64\Aeioio32.exe	Ambgha32.exe
File created	C:\Windows\SysWOW64\Bmfqcqql.exe	Bjhdgeai.exe
File created	C:\Windows\SysWOW64\Flgfjh32.exe	Fhljjiki.exe
File created	C:\Windows\SysWOW64\Hlncijdi.dll	Kemhia32.exe
File created	C:\Windows\SysWOW64\Qncgqf32.exe	Qflpoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bmddma32.exe	Bjfhae32.exe
File created	C:\Windows\SysWOW64\Dkeddgmd.exe	Dhfhhl32.exe
File opened for modification	C:\Windows\SysWOW64\Ekljdf32.exe	Eeoalp32.exe
File opened for modification	C:\Windows\SysWOW64\Fleidhfd.exe	Fekahn32.exe
File created	C:\Windows\SysWOW64\Nngonjqd.exe	Nfpgmmpb.exe
File created	C:\Windows\SysWOW64\Fikqmk32.dll	Dkjmogio.exe
File opened for modification	C:\Windows\SysWOW64\Fclelb32.exe	Ekemke32.exe
File created	C:\Windows\SysWOW64\Cndekieb.dll	Hmjlfecl.exe
File created	C:\Windows\SysWOW64\Icimdkmp.dll	Ifeflh32.exe
File opened for modification	C:\Windows\SysWOW64\Ipmjen32.exe	Imonhb32.exe
File created	C:\Windows\SysWOW64\Qqoggb32.exe	Pnakkf32.exe
File created	C:\Windows\SysWOW64\Gdphjm32.dll	Ekqcpfbg.exe
File created	C:\Windows\SysWOW64\Bagfooep.exe	Bnhjbcfl.exe
File created	C:\Windows\SysWOW64\Okhbpe32.dll	Ekemke32.exe
File created	C:\Windows\SysWOW64\Gedikbhp.dll	Hcmgin32.exe
File created	C:\Windows\SysWOW64\Finkejjm.dll	Jpgmkl32.exe
File opened for modification	C:\Windows\SysWOW64\Gomhgbmn.exe	Flnlkgnj.exe
File created	C:\Windows\SysWOW64\Qhbncj32.dll	Ngpcgp32.exe
File created	C:\Windows\SysWOW64\Kggeihia.dll	Olcbpe32.exe
File created	C:\Windows\SysWOW64\Ocmjlpfa.exe	Odjjqc32.exe
File opened for modification	C:\Windows\SysWOW64\Anhaledo.exe	Acbmnmdi.exe
File created	C:\Windows\SysWOW64\Dhfhhl32.exe	Ddklgmeg.exe
File created	C:\Windows\SysWOW64\Jdeikd32.dll	Ofncnkcb.exe
File created	C:\Windows\SysWOW64\Cakpjn32.exe	Cnmcnb32.exe
File created	C:\Windows\SysWOW64\Cdlhki32.exe	Cmbpoofo.exe
File created	C:\Windows\SysWOW64\Kngnfp32.dll	Dfakhc32.exe
File opened for modification	C:\Windows\SysWOW64\Fllpegpl.exe	Fdegdj32.exe
File created	C:\Windows\SysWOW64\Akfdeb32.dll	Mmgfgl32.exe
File opened for modification	C:\Windows\SysWOW64\Gkjomb32.exe	Gmgoaeeo.exe
File created	C:\Windows\SysWOW64\Jfcbmfnh.exe	Jececc32.exe
File created	C:\Windows\SysWOW64\Dkgqigka.exe	Ddmhmm32.exe
File created	C:\Windows\SysWOW64\Flnlkgnj.exe	Fcfhba32.exe
File created	C:\Windows\SysWOW64\Cjfqhcei.exe	Cdlhki32.exe
File created	C:\Windows\SysWOW64\Pkgfhh32.dll	Blmafnhb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8944	9204	WerFault.exe	436

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbiadl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpcgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agbbjkhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnopcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjikaked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daaifa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqcpfbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fleidhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkeddgmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieapgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leabdaje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfoelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ammnmbig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekcpeeqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoakioje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jempbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfcmij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccjlfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Docmjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfqegfpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgbfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfolehep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hchmno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddfolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcodf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adplbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcqipk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmifon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjemgal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blmafnhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lipkkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpcenhpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajcklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhagbfnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aegine32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edkdnkge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipiajndn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbcehe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcmgin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifeflh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lffhjcmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpgoig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfhhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fojlabop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdgildf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdepkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkdmia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nidmml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acbmnmdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjbcfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngonjqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffkleae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djpcnbmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clkngl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddfbln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifbifh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgmkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlefngkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmanaccd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopijpab.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kogfbg32.dll"	Cdaiaonb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfpcjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kemcdk32.dll"	Hmlhle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkcgqaog.dll"	Jbncfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnfclkak.dll"	Deckfkof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipmjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oloidfcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlfciocm.dll"	Pfjcji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcmnbpaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqjdll32.dll"	Njnpck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odcdpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odfqecdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Opmakd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gfkjolpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jliden32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fadobo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdegdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnlapgnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjahhilp.dll"	Pckfnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjddbcgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hklijm32.dll"	Cogmng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lghdockp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lemmfe32.dll"	Flnlkgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmfdiakl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbheqgmg.dll"	Qfolehep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pafndn32.dll"	Cjfqhcei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbaofa32.dll"	Fojlabop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbdgildf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kblfkanb.dll"	Mebkko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eanlej32.dll"	Ogkcbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkibbp32.dll"	Aefbcogf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdkhpc32.dll"	Baicdncn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmifon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmpmpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aegine32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gecqkjag.dll"	Bhohpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlncnbnn.dll"	Edkdnkge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdllaihl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbcehe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongbko32.dll"	Lipkkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oolbbjep.dll"	Ekcpeeqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emkhjjld.dll"	Ghgiegak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmcgcamo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlfhon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnopcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqahee32.dll"	Fklckdhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khfbdodj.dll"	Iecmledg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdqncffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocmjlpfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfoelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Copgnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fojlabop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imekbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llpcljnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lffhjcmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohneobmn.dll"	Mpjlngje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fppfio32.dll"	Gbdgildf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmlhle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkjllg32.dll"	Kmadepao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odmgfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bccfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dopijpab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mebkko32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2844	4840	19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152N.exe	81
PID 4840 wrote to memory of 2844	4840	19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152N.exe	81
PID 4840 wrote to memory of 2844	4840	19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152N.exe	81
PID 2844 wrote to memory of 4520	2844	Anmaakce.exe	82
PID 2844 wrote to memory of 4520	2844	Anmaakce.exe	82
PID 2844 wrote to memory of 4520	2844	Anmaakce.exe	82
PID 4520 wrote to memory of 1512	4520	Aegine32.exe	83
PID 4520 wrote to memory of 1512	4520	Aegine32.exe	83
PID 4520 wrote to memory of 1512	4520	Aegine32.exe	83
PID 1512 wrote to memory of 4128	1512	Ahffjq32.exe	84
PID 1512 wrote to memory of 4128	1512	Ahffjq32.exe	84
PID 1512 wrote to memory of 4128	1512	Ahffjq32.exe	84
PID 4128 wrote to memory of 4760	4128	Anpnfkac.exe	85
PID 4128 wrote to memory of 4760	4128	Anpnfkac.exe	85
PID 4128 wrote to memory of 4760	4128	Anpnfkac.exe	85
PID 4760 wrote to memory of 4332	4760	Aejfce32.exe	86
PID 4760 wrote to memory of 4332	4760	Aejfce32.exe	86
PID 4760 wrote to memory of 4332	4760	Aejfce32.exe	86
PID 4332 wrote to memory of 2264	4332	Ahhbpp32.exe	87
PID 4332 wrote to memory of 2264	4332	Ahhbpp32.exe	87
PID 4332 wrote to memory of 2264	4332	Ahhbpp32.exe	87
PID 2264 wrote to memory of 5116	2264	Anbklj32.exe	88
PID 2264 wrote to memory of 5116	2264	Anbklj32.exe	88
PID 2264 wrote to memory of 5116	2264	Anbklj32.exe	88
PID 5116 wrote to memory of 3956	5116	Bdocda32.exe	89
PID 5116 wrote to memory of 3956	5116	Bdocda32.exe	89
PID 5116 wrote to memory of 3956	5116	Bdocda32.exe	89
PID 3956 wrote to memory of 1124	3956	Bjikaked.exe	90
PID 3956 wrote to memory of 1124	3956	Bjikaked.exe	90
PID 3956 wrote to memory of 1124	3956	Bjikaked.exe	90
PID 1124 wrote to memory of 4556	1124	Bbpcbiff.exe	91
PID 1124 wrote to memory of 4556	1124	Bbpcbiff.exe	91
PID 1124 wrote to memory of 4556	1124	Bbpcbiff.exe	91
PID 4556 wrote to memory of 2524	4556	Bdapja32.exe	92
PID 4556 wrote to memory of 2524	4556	Bdapja32.exe	92
PID 4556 wrote to memory of 2524	4556	Bdapja32.exe	92
PID 2524 wrote to memory of 3048	2524	Bbbphh32.exe	93
PID 2524 wrote to memory of 3048	2524	Bbbphh32.exe	93
PID 2524 wrote to memory of 3048	2524	Bbbphh32.exe	93
PID 3048 wrote to memory of 404	3048	Bhohpo32.exe	94
PID 3048 wrote to memory of 404	3048	Bhohpo32.exe	94
PID 3048 wrote to memory of 404	3048	Bhohpo32.exe	94
PID 404 wrote to memory of 3000	404	Boiamiih.exe	95
PID 404 wrote to memory of 3000	404	Boiamiih.exe	95
PID 404 wrote to memory of 3000	404	Boiamiih.exe	95
PID 3000 wrote to memory of 3432	3000	Bdfiephp.exe	96
PID 3000 wrote to memory of 3432	3000	Bdfiephp.exe	96
PID 3000 wrote to memory of 3432	3000	Bdfiephp.exe	96
PID 3432 wrote to memory of 1256	3432	Blmafnhb.exe	97
PID 3432 wrote to memory of 1256	3432	Blmafnhb.exe	97
PID 3432 wrote to memory of 1256	3432	Blmafnhb.exe	97
PID 1256 wrote to memory of 3540	1256	Bajjodfi.exe	98
PID 1256 wrote to memory of 3540	1256	Bajjodfi.exe	98
PID 1256 wrote to memory of 3540	1256	Bajjodfi.exe	98
PID 3540 wrote to memory of 620	3540	Bhdbkonf.exe	99
PID 3540 wrote to memory of 620	3540	Bhdbkonf.exe	99
PID 3540 wrote to memory of 620	3540	Bhdbkonf.exe	99
PID 620 wrote to memory of 5000	620	Bonjhi32.exe	100
PID 620 wrote to memory of 5000	620	Bonjhi32.exe	100
PID 620 wrote to memory of 5000	620	Bonjhi32.exe	100
PID 5000 wrote to memory of 4364	5000	Cehbdcmp.exe	101
PID 5000 wrote to memory of 4364	5000	Cehbdcmp.exe	101
PID 5000 wrote to memory of 4364	5000	Cehbdcmp.exe	101
PID 4364 wrote to memory of 3900	4364	Clakam32.exe	102

C:\Users\Admin\AppData\Local\Temp\19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152N.exe
"C:\Users\Admin\AppData\Local\Temp\19029cd14895aecaaf282ddbf2aaa5e9f2fecc00f55d79bb73473c68cda8c152N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\Anmaakce.exe
  C:\Windows\system32\Anmaakce.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\Aegine32.exe
    C:\Windows\system32\Aegine32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\SysWOW64\Ahffjq32.exe
      C:\Windows\system32\Ahffjq32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\SysWOW64\Anpnfkac.exe
        
        C:\Windows\system32\Anpnfkac.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
      - C:\Windows\SysWOW64\Aejfce32.exe
        
        C:\Windows\system32\Aejfce32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Ahhbpp32.exe
        
        C:\Windows\system32\Ahhbpp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Anbklj32.exe
        
        C:\Windows\system32\Anbklj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Bdocda32.exe
        
        C:\Windows\system32\Bdocda32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Bjikaked.exe
        
        C:\Windows\system32\Bjikaked.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\Bbpcbiff.exe
        
        C:\Windows\system32\Bbpcbiff.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Bdapja32.exe
        
        C:\Windows\system32\Bdapja32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Bbbphh32.exe
        
        C:\Windows\system32\Bbbphh32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Bhohpo32.exe
        
        C:\Windows\system32\Bhohpo32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Boiamiih.exe
        
        C:\Windows\system32\Boiamiih.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Bdfiephp.exe
        
        C:\Windows\system32\Bdfiephp.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Blmafnhb.exe
        
        C:\Windows\system32\Blmafnhb.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Bajjodfi.exe
        
        C:\Windows\system32\Bajjodfi.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\SysWOW64\Bhdbkonf.exe
        
        C:\Windows\system32\Bhdbkonf.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Bonjhi32.exe
        
        C:\Windows\system32\Bonjhi32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\SysWOW64\Cehbdcmp.exe
        
        C:\Windows\system32\Cehbdcmp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Clakam32.exe
        
        C:\Windows\system32\Clakam32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Copgnh32.exe
        
        C:\Windows\system32\Copgnh32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Caocjd32.exe
        
        C:\Windows\system32\Caocjd32.exe
        24⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Cdmofoag.exe
        
        C:\Windows\system32\Cdmofoag.exe
        25⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Ckghbi32.exe
        
        C:\Windows\system32\Ckghbi32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4384
        
        C:\Windows\SysWOW64\Cellpb32.exe
        
        C:\Windows\system32\Cellpb32.exe
        27⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Cdolkope.exe
        
        C:\Windows\system32\Cdolkope.exe
        28⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Ckidhi32.exe
        
        C:\Windows\system32\Ckidhi32.exe
        29⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Cacmecno.exe
        
        C:\Windows\system32\Cacmecno.exe
        30⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Cdaiaonb.exe
        
        C:\Windows\system32\Cdaiaonb.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Cklanieo.exe
        
        C:\Windows\system32\Cklanieo.exe
        32⤵
        Executes dropped EXE
        
        PID:512
        
        C:\Windows\SysWOW64\Cogmng32.exe
        
        C:\Windows\system32\Cogmng32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Clkngl32.exe
        
        C:\Windows\system32\Clkngl32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Windows\SysWOW64\Decbqabb.exe
        
        C:\Windows\system32\Decbqabb.exe
        35⤵
        Executes dropped EXE
        
        PID:3508
        
        C:\Windows\SysWOW64\Ddfbln32.exe
        
        C:\Windows\system32\Ddfbln32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Windows\SysWOW64\Dkpjih32.exe
        
        C:\Windows\system32\Dkpjih32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\Dajbebhf.exe
        
        C:\Windows\system32\Dajbebhf.exe
        38⤵
        Executes dropped EXE
        
        PID:684
        
        C:\Windows\SysWOW64\Defofa32.exe
        
        C:\Windows\system32\Defofa32.exe
        39⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Dhdkbl32.exe
        
        C:\Windows\system32\Dhdkbl32.exe
        40⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Dkbgnh32.exe
        
        C:\Windows\system32\Dkbgnh32.exe
        41⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Damokbfd.exe
        
        C:\Windows\system32\Damokbfd.exe
        42⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Ddklgmeg.exe
        
        C:\Windows\system32\Ddklgmeg.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3236
        
        C:\Windows\SysWOW64\Dhfhhl32.exe
        
        C:\Windows\system32\Dhfhhl32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\Dkeddgmd.exe
        
        C:\Windows\system32\Dkeddgmd.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Daolqa32.exe
        
        C:\Windows\system32\Daolqa32.exe
        46⤵
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\Ddmhmm32.exe
        
        C:\Windows\system32\Ddmhmm32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Dkgqigka.exe
        
        C:\Windows\system32\Dkgqigka.exe
        48⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Docmjf32.exe
        
        C:\Windows\system32\Docmjf32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3328
        
        C:\Windows\SysWOW64\Daaifa32.exe
        
        C:\Windows\system32\Daaifa32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\Dhkackjk.exe
        
        C:\Windows\system32\Dhkackjk.exe
        51⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Dkjmogio.exe
        
        C:\Windows\system32\Dkjmogio.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1328
        
        C:\Windows\SysWOW64\Eoeipeah.exe
        
        C:\Windows\system32\Eoeipeah.exe
        53⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Eeoalp32.exe
        
        C:\Windows\system32\Eeoalp32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:408
        
        C:\Windows\SysWOW64\Ekljdf32.exe
        
        C:\Windows\system32\Ekljdf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Eccbed32.exe
        
        C:\Windows\system32\Eccbed32.exe
        56⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Eddomlmm.exe
        
        C:\Windows\system32\Eddomlmm.exe
        57⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Ehpjnk32.exe
        
        C:\Windows\system32\Ehpjnk32.exe
        58⤵
        Executes dropped EXE
        
        PID:816
        
        C:\Windows\SysWOW64\Edgkcl32.exe
        
        C:\Windows\system32\Edgkcl32.exe
        59⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Ekqcpfbg.exe
        
        C:\Windows\system32\Ekqcpfbg.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3500
        
        C:\Windows\SysWOW64\Eolopd32.exe
        
        C:\Windows\system32\Eolopd32.exe
        61⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Eakllp32.exe
        
        C:\Windows\system32\Eakllp32.exe
        62⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Ehddijaq.exe
        
        C:\Windows\system32\Ehddijaq.exe
        63⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Ekcpeeqd.exe
        
        C:\Windows\system32\Ekcpeeqd.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Eamhbp32.exe
        
        C:\Windows\system32\Eamhbp32.exe
        65⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Edkdnkge.exe
        
        C:\Windows\system32\Edkdnkge.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Ekemke32.exe
        
        C:\Windows\system32\Ekemke32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Fclelb32.exe
        
        C:\Windows\system32\Fclelb32.exe
        68⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Fekahn32.exe
        
        C:\Windows\system32\Fekahn32.exe
        69⤵
        Drops file in System32 directory
        
        PID:4488
        
        C:\Windows\SysWOW64\Fleidhfd.exe
        
        C:\Windows\system32\Fleidhfd.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Windows\SysWOW64\Fcoaab32.exe
        
        C:\Windows\system32\Fcoaab32.exe
        71⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Ffmnmnle.exe
        
        C:\Windows\system32\Ffmnmnle.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1084
        
        C:\Windows\SysWOW64\Fhljjiki.exe
        
        C:\Windows\system32\Fhljjiki.exe
        73⤵
        Drops file in System32 directory
        
        PID:1552
        
        C:\Windows\SysWOW64\Flgfjh32.exe
        
        C:\Windows\system32\Flgfjh32.exe
        74⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Foebfc32.exe
        
        C:\Windows\system32\Foebfc32.exe
        75⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Fadobo32.exe
        
        C:\Windows\system32\Fadobo32.exe
        76⤵
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Fdbkoj32.exe
        
        C:\Windows\system32\Fdbkoj32.exe
        77⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Fklckdhj.exe
        
        C:\Windows\system32\Fklckdhj.exe
        78⤵
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Foholc32.exe
        
        C:\Windows\system32\Foholc32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2432
        
        C:\Windows\SysWOW64\Fdegdj32.exe
        
        C:\Windows\system32\Fdegdj32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Fllpegpl.exe
        
        C:\Windows\system32\Fllpegpl.exe
        81⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Fojlabop.exe
        
        C:\Windows\system32\Fojlabop.exe
        82⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Fcfhba32.exe
        
        C:\Windows\system32\Fcfhba32.exe
        83⤵
        Drops file in System32 directory
        
        PID:2416
        
        C:\Windows\SysWOW64\Flnlkgnj.exe
        
        C:\Windows\system32\Flnlkgnj.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1880
        
        C:\Windows\SysWOW64\Gomhgbmn.exe
        
        C:\Windows\system32\Gomhgbmn.exe
        85⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Gdiaoike.exe
        
        C:\Windows\system32\Gdiaoike.exe
        86⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Glqipf32.exe
        
        C:\Windows\system32\Glqipf32.exe
        87⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Gooemb32.exe
        
        C:\Windows\system32\Gooemb32.exe
        88⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Gcjamqcd.exe
        
        C:\Windows\system32\Gcjamqcd.exe
        89⤵
        
        PID:820
        
        C:\Windows\SysWOW64\Gfimilbh.exe
        
        C:\Windows\system32\Gfimilbh.exe
        90⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Ghgiegak.exe
        
        C:\Windows\system32\Ghgiegak.exe
        91⤵
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Gkffacpo.exe
        
        C:\Windows\system32\Gkffacpo.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4876
        
        C:\Windows\SysWOW64\Gcmnbpaa.exe
        
        C:\Windows\system32\Gcmnbpaa.exe
        93⤵
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Gfkjolpe.exe
        
        C:\Windows\system32\Gfkjolpe.exe
        94⤵
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Gmebkf32.exe
        
        C:\Windows\system32\Gmebkf32.exe
        95⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Gocohafe.exe
        
        C:\Windows\system32\Gocohafe.exe
        96⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Gbbkdmfi.exe
        
        C:\Windows\system32\Gbbkdmfi.exe
        97⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Gdqgphem.exe
        
        C:\Windows\system32\Gdqgphem.exe
        98⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Gmgoaeeo.exe
        
        C:\Windows\system32\Gmgoaeeo.exe
        99⤵
        Drops file in System32 directory
        
        PID:4288
        
        C:\Windows\SysWOW64\Gkjomb32.exe
        
        C:\Windows\system32\Gkjomb32.exe
        100⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Gbdgildf.exe
        
        C:\Windows\system32\Gbdgildf.exe
        101⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Gfpcjk32.exe
        
        C:\Windows\system32\Gfpcjk32.exe
        102⤵
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Hmjlfecl.exe
        
        C:\Windows\system32\Hmjlfecl.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Hohhbq32.exe
        
        C:\Windows\system32\Hohhbq32.exe
        104⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Hcddcoki.exe
        
        C:\Windows\system32\Hcddcoki.exe
        105⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Hbgdol32.exe
        
        C:\Windows\system32\Hbgdol32.exe
        106⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Hdepkg32.exe
        
        C:\Windows\system32\Hdepkg32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Windows\SysWOW64\Hmlhle32.exe
        
        C:\Windows\system32\Hmlhle32.exe
        108⤵
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Hokdhp32.exe
        
        C:\Windows\system32\Hokdhp32.exe
        109⤵
        Drops file in System32 directory
        
        PID:2696
        
        C:\Windows\SysWOW64\Hbiadl32.exe
        
        C:\Windows\system32\Hbiadl32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:784
        
        C:\Windows\SysWOW64\Hfdmejhj.exe
        
        C:\Windows\system32\Hfdmejhj.exe
        111⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Hiciafgn.exe
        
        C:\Windows\system32\Hiciafgn.exe
        112⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Hkaemafa.exe
        
        C:\Windows\system32\Hkaemafa.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4832
        
        C:\Windows\SysWOW64\Hchmno32.exe
        
        C:\Windows\system32\Hchmno32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Windows\SysWOW64\Hbknjkno.exe
        
        C:\Windows\system32\Hbknjkno.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2956
        
        C:\Windows\SysWOW64\Hiefge32.exe
        
        C:\Windows\system32\Hiefge32.exe
        116⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Hkdbca32.exe
        
        C:\Windows\system32\Hkdbca32.exe
        117⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Hooncplh.exe
        
        C:\Windows\system32\Hooncplh.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Hbnjpkll.exe
        
        C:\Windows\system32\Hbnjpkll.exe
        119⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Helflfkp.exe
        
        C:\Windows\system32\Helflfkp.exe
        120⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Hmcomdkb.exe
        
        C:\Windows\system32\Hmcomdkb.exe
        121⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Hoakioje.exe
        
        C:\Windows\system32\Hoakioje.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Hcmgin32.exe
        
        C:\Windows\system32\Hcmgin32.exe
        123⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Heocaf32.exe
        
        C:\Windows\system32\Heocaf32.exe
        124⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Imekbc32.exe
        
        C:\Windows\system32\Imekbc32.exe
        125⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Ipdgoo32.exe
        
        C:\Windows\system32\Ipdgoo32.exe
        126⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Icpconql.exe
        
        C:\Windows\system32\Icpconql.exe
        127⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Ieapgf32.exe
        
        C:\Windows\system32\Ieapgf32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Iillgdoc.exe
        
        C:\Windows\system32\Iillgdoc.exe
        129⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ipfddo32.exe
        
        C:\Windows\system32\Ipfddo32.exe
        130⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ibeqpj32.exe
        
        C:\Windows\system32\Ibeqpj32.exe
        131⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Iecmledg.exe
        
        C:\Windows\system32\Iecmledg.exe
        132⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Imjdmcej.exe
        
        C:\Windows\system32\Imjdmcej.exe
        133⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ipiajndn.exe
        
        C:\Windows\system32\Ipiajndn.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Ifbifh32.exe
        
        C:\Windows\system32\Ifbifh32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Icfjpm32.exe
        
        C:\Windows\system32\Icfjpm32.exe
        136⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ifeflh32.exe
        
        C:\Windows\system32\Ifeflh32.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Imonhb32.exe
        
        C:\Windows\system32\Imonhb32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Ipmjen32.exe
        
        C:\Windows\system32\Ipmjen32.exe
        139⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Iblfai32.exe
        
        C:\Windows\system32\Iblfai32.exe
        140⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ifgbahhe.exe
        
        C:\Windows\system32\Ifgbahhe.exe
        141⤵
        Drops file in System32 directory
        
        PID:3840
        
        C:\Windows\SysWOW64\Jmaknb32.exe
        
        C:\Windows\system32\Jmaknb32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5160
        
        C:\Windows\SysWOW64\Jppgjm32.exe
        
        C:\Windows\system32\Jppgjm32.exe
        143⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Jbncfi32.exe
        
        C:\Windows\system32\Jbncfi32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Jempbd32.exe
        
        C:\Windows\system32\Jempbd32.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Jmcgcamo.exe
        
        C:\Windows\system32\Jmcgcamo.exe
        146⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Jlfhon32.exe
        
        C:\Windows\system32\Jlfhon32.exe
        147⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Jpbdpmlc.exe
        
        C:\Windows\system32\Jpbdpmlc.exe
        148⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jbqplhkf.exe
        
        C:\Windows\system32\Jbqplhkf.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Jeolhdjj.exe
        
        C:\Windows\system32\Jeolhdjj.exe
        150⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Jmfdiakl.exe
        
        C:\Windows\system32\Jmfdiakl.exe
        151⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Jliden32.exe
        
        C:\Windows\system32\Jliden32.exe
        152⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Jfnibg32.exe
        
        C:\Windows\system32\Jfnibg32.exe
        153⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jimenb32.exe
        
        C:\Windows\system32\Jimenb32.exe
        154⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Jmhaoqij.exe
        
        C:\Windows\system32\Jmhaoqij.exe
        155⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Jpgmkl32.exe
        
        C:\Windows\system32\Jpgmkl32.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Windows\SysWOW64\Jfqegfpj.exe
        
        C:\Windows\system32\Jfqegfpj.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Windows\SysWOW64\Jececc32.exe
        
        C:\Windows\system32\Jececc32.exe
        158⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Jfcbmfnh.exe
        
        C:\Windows\system32\Jfcbmfnh.exe
        159⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Kefbic32.exe
        
        C:\Windows\system32\Kefbic32.exe
        160⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Klpkemlo.exe
        
        C:\Windows\system32\Klpkemlo.exe
        161⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kdgbfj32.exe
        
        C:\Windows\system32\Kdgbfj32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\Kehonbbp.exe
        
        C:\Windows\system32\Kehonbbp.exe
        163⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Kmogopcb.exe
        
        C:\Windows\system32\Kmogopcb.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Klbgkm32.exe
        
        C:\Windows\system32\Klbgkm32.exe
        165⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Kdiolj32.exe
        
        C:\Windows\system32\Kdiolj32.exe
        166⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Kblphgai.exe
        
        C:\Windows\system32\Kblphgai.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Kekldbpm.exe
        
        C:\Windows\system32\Kekldbpm.exe
        168⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Kmadepao.exe
        
        C:\Windows\system32\Kmadepao.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Kdllaihl.exe
        
        C:\Windows\system32\Kdllaihl.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Kbolmf32.exe
        
        C:\Windows\system32\Kbolmf32.exe
        171⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Kemhia32.exe
        
        C:\Windows\system32\Kemhia32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Kmdqjo32.exe
        
        C:\Windows\system32\Kmdqjo32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Kpbmgj32.exe
        
        C:\Windows\system32\Kpbmgj32.exe
        174⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Kbaicf32.exe
        
        C:\Windows\system32\Kbaicf32.exe
        175⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Keoeoa32.exe
        
        C:\Windows\system32\Keoeoa32.exe
        176⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Kmfmpo32.exe
        
        C:\Windows\system32\Kmfmpo32.exe
        177⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Klimllcd.exe
        
        C:\Windows\system32\Klimllcd.exe
        178⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Kbcehe32.exe
        
        C:\Windows\system32\Kbcehe32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Leabdaje.exe
        
        C:\Windows\system32\Leabdaje.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Windows\SysWOW64\Lmijenkg.exe
        
        C:\Windows\system32\Lmijenkg.exe
        181⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ldbbbh32.exe
        
        C:\Windows\system32\Ldbbbh32.exe
        182⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ledojqhb.exe
        
        C:\Windows\system32\Ledojqhb.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Lipkkp32.exe
        
        C:\Windows\system32\Lipkkp32.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Llnggk32.exe
        
        C:\Windows\system32\Llnggk32.exe
        185⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Lbhocegl.exe
        
        C:\Windows\system32\Lbhocegl.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Lfckdcoe.exe
        
        C:\Windows\system32\Lfckdcoe.exe
        187⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Lefkpq32.exe
        
        C:\Windows\system32\Lefkpq32.exe
        188⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Lmmcqn32.exe
        
        C:\Windows\system32\Lmmcqn32.exe
        189⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Llpcljnl.exe
        
        C:\Windows\system32\Llpcljnl.exe
        190⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Ldgkmhno.exe
        
        C:\Windows\system32\Ldgkmhno.exe
        191⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lbjlid32.exe
        
        C:\Windows\system32\Lbjlid32.exe
        192⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Lffhjcmb.exe
        
        C:\Windows\system32\Lffhjcmb.exe
        193⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Liddfolf.exe
        
        C:\Windows\system32\Liddfolf.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Llbpbjlj.exe
        
        C:\Windows\system32\Llbpbjlj.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Lpnlbi32.exe
        
        C:\Windows\system32\Lpnlbi32.exe
        196⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ldjhcgll.exe
        
        C:\Windows\system32\Ldjhcgll.exe
        197⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Lghdockp.exe
        
        C:\Windows\system32\Lghdockp.exe
        198⤵
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Lekekp32.exe
        
        C:\Windows\system32\Lekekp32.exe
        199⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Lifqkn32.exe
        
        C:\Windows\system32\Lifqkn32.exe
        200⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Llemgj32.exe
        
        C:\Windows\system32\Llemgj32.exe
        201⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ldlehg32.exe
        
        C:\Windows\system32\Ldlehg32.exe
        202⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Mpcenhpn.exe
        
        C:\Windows\system32\Mpcenhpn.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Windows\SysWOW64\Mmgfgl32.exe
        
        C:\Windows\system32\Mmgfgl32.exe
        204⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Mdqncffd.exe
        
        C:\Windows\system32\Mdqncffd.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Mebkko32.exe
        
        C:\Windows\system32\Mebkko32.exe
        206⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Mmicll32.exe
        
        C:\Windows\system32\Mmicll32.exe
        207⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Mpgoig32.exe
        
        C:\Windows\system32\Mpgoig32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\Mgageace.exe
        
        C:\Windows\system32\Mgageace.exe
        209⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Mipcambi.exe
        
        C:\Windows\system32\Mipcambi.exe
        210⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Mpjlngje.exe
        
        C:\Windows\system32\Mpjlngje.exe
        211⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Mchhjbii.exe
        
        C:\Windows\system32\Mchhjbii.exe
        212⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Megdfnhm.exe
        
        C:\Windows\system32\Megdfnhm.exe
        213⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Mnnlgkho.exe
        
        C:\Windows\system32\Mnnlgkho.exe
        214⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ndhdde32.exe
        
        C:\Windows\system32\Ndhdde32.exe
        215⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Ngfqqa32.exe
        
        C:\Windows\system32\Ngfqqa32.exe
        216⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Neialnfj.exe
        
        C:\Windows\system32\Neialnfj.exe
        217⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Nidmml32.exe
        
        C:\Windows\system32\Nidmml32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\Npoeif32.exe
        
        C:\Windows\system32\Npoeif32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Nghmfqmm.exe
        
        C:\Windows\system32\Nghmfqmm.exe
        220⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Njgjbllq.exe
        
        C:\Windows\system32\Njgjbllq.exe
        221⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Nlefngkd.exe
        
        C:\Windows\system32\Nlefngkd.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Windows\SysWOW64\Ndlnoelf.exe
        
        C:\Windows\system32\Ndlnoelf.exe
        223⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Nconka32.exe
        
        C:\Windows\system32\Nconka32.exe
        224⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Nenjgm32.exe
        
        C:\Windows\system32\Nenjgm32.exe
        225⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Nlhbdgia.exe
        
        C:\Windows\system32\Nlhbdgia.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Npcodf32.exe
        
        C:\Windows\system32\Npcodf32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\Ncakqaqo.exe
        
        C:\Windows\system32\Ncakqaqo.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Nfpgmmpb.exe
        
        C:\Windows\system32\Nfpgmmpb.exe
        229⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Nngonjqd.exe
        
        C:\Windows\system32\Nngonjqd.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Windows\SysWOW64\Npekjeph.exe
        
        C:\Windows\system32\Npekjeph.exe
        231⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ngpcgp32.exe
        
        C:\Windows\system32\Ngpcgp32.exe
        232⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7208
        
        C:\Windows\SysWOW64\Njnpck32.exe
        
        C:\Windows\system32\Njnpck32.exe
        233⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Nlllof32.exe
        
        C:\Windows\system32\Nlllof32.exe
        234⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Odcdpd32.exe
        
        C:\Windows\system32\Odcdpd32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Ogbploeb.exe
        
        C:\Windows\system32\Ogbploeb.exe
        236⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Ojplhkdf.exe
        
        C:\Windows\system32\Ojplhkdf.exe
        237⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Oloidfcj.exe
        
        C:\Windows\system32\Oloidfcj.exe
        238⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Odfqecdl.exe
        
        C:\Windows\system32\Odfqecdl.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Ogdmaocp.exe
        
        C:\Windows\system32\Ogdmaocp.exe
        240⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ojbinjbc.exe
        
        C:\Windows\system32\Ojbinjbc.exe
        241⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Onneoi32.exe
        
        C:\Windows\system32\Onneoi32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Opmakd32.exe
        
        C:\Windows\system32\Opmakd32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Ogfjgo32.exe
        
        C:\Windows\system32\Ogfjgo32.exe
        244⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ofijckhg.exe
        
        C:\Windows\system32\Ofijckhg.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Olcbpe32.exe
        
        C:\Windows\system32\Olcbpe32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Odjjqc32.exe
        
        C:\Windows\system32\Odjjqc32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Ocmjlpfa.exe
        
        C:\Windows\system32\Ocmjlpfa.exe
        248⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Ojgbij32.exe
        
        C:\Windows\system32\Ojgbij32.exe
        249⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Oncoihfg.exe
        
        C:\Windows\system32\Oncoihfg.exe
        250⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Odmgfb32.exe
        
        C:\Windows\system32\Odmgfb32.exe
        251⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Ogkcbn32.exe
        
        C:\Windows\system32\Ogkcbn32.exe
        252⤵
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Ofncnkcb.exe
        
        C:\Windows\system32\Ofncnkcb.exe
        253⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Onekoh32.exe
        
        C:\Windows\system32\Onekoh32.exe
        254⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Pdoclbla.exe
        
        C:\Windows\system32\Pdoclbla.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7196
        
        C:\Windows\SysWOW64\Pfqpcj32.exe
        
        C:\Windows\system32\Pfqpcj32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7272
        
        C:\Windows\SysWOW64\Pnghdh32.exe
        
        C:\Windows\system32\Pnghdh32.exe
        257⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Pmjhpdil.exe
        
        C:\Windows\system32\Pmjhpdil.exe
        258⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Pdapabjo.exe
        
        C:\Windows\system32\Pdapabjo.exe
        259⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Pfcmij32.exe
        
        C:\Windows\system32\Pfcmij32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Pjnijihf.exe
        
        C:\Windows\system32\Pjnijihf.exe
        261⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Pmmefd32.exe
        
        C:\Windows\system32\Pmmefd32.exe
        262⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Pddmga32.exe
        
        C:\Windows\system32\Pddmga32.exe
        263⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Pfeiojnj.exe
        
        C:\Windows\system32\Pfeiojnj.exe
        264⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Pnlapgnl.exe
        
        C:\Windows\system32\Pnlapgnl.exe
        265⤵
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Pgdfim32.exe
        
        C:\Windows\system32\Pgdfim32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Pjcbeh32.exe
        
        C:\Windows\system32\Pjcbeh32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8032
        
        C:\Windows\SysWOW64\Pnoneglj.exe
        
        C:\Windows\system32\Pnoneglj.exe
        268⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Pmanaccd.exe
        
        C:\Windows\system32\Pmanaccd.exe
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:8176
        
        C:\Windows\SysWOW64\Pckfnn32.exe
        
        C:\Windows\system32\Pckfnn32.exe
        270⤵
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Pfjcji32.exe
        
        C:\Windows\system32\Pfjcji32.exe
        271⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Pnakkf32.exe
        
        C:\Windows\system32\Pnakkf32.exe
        272⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Qqoggb32.exe
        
        C:\Windows\system32\Qqoggb32.exe
        273⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Qcnccm32.exe
        
        C:\Windows\system32\Qcnccm32.exe
        274⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Qflpoi32.exe
        
        C:\Windows\system32\Qflpoi32.exe
        275⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Qncgqf32.exe
        
        C:\Windows\system32\Qncgqf32.exe
        276⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Qqadmagh.exe
        
        C:\Windows\system32\Qqadmagh.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Qcppimfl.exe
        
        C:\Windows\system32\Qcppimfl.exe
        278⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Qfolehep.exe
        
        C:\Windows\system32\Qfolehep.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Anedfffb.exe
        
        C:\Windows\system32\Anedfffb.exe
        280⤵
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Aqdqbaee.exe
        
        C:\Windows\system32\Aqdqbaee.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Adplbp32.exe
        
        C:\Windows\system32\Adplbp32.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
        
        C:\Windows\SysWOW64\Acbmnmdi.exe
        
        C:\Windows\system32\Acbmnmdi.exe
        283⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8028
        
        C:\Windows\SysWOW64\Anhaledo.exe
        
        C:\Windows\system32\Anhaledo.exe
        284⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Aqfmhacc.exe
        
        C:\Windows\system32\Aqfmhacc.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7536
        
        C:\Windows\SysWOW64\Aceidl32.exe
        
        C:\Windows\system32\Aceidl32.exe
        286⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ajoaqfjc.exe
        
        C:\Windows\system32\Ajoaqfjc.exe
        287⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Ammnmbig.exe
        
        C:\Windows\system32\Ammnmbig.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:7636
        
        C:\Windows\SysWOW64\Aedfnoii.exe
        
        C:\Windows\system32\Aedfnoii.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Agbbjkhm.exe
        
        C:\Windows\system32\Agbbjkhm.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Windows\SysWOW64\Afebeg32.exe
        
        C:\Windows\system32\Afebeg32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Ampkbagd.exe
        
        C:\Windows\system32\Ampkbagd.exe
        292⤵
        Drops file in System32 directory
        
        PID:7308
        
        C:\Windows\SysWOW64\Aefbcogf.exe
        
        C:\Windows\system32\Aefbcogf.exe
        293⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Ageopj32.exe
        
        C:\Windows\system32\Ageopj32.exe
        294⤵
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Ajcklf32.exe
        
        C:\Windows\system32\Ajcklf32.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Windows\SysWOW64\Ambgha32.exe
        
        C:\Windows\system32\Ambgha32.exe
        296⤵
        Drops file in System32 directory
        
        PID:8376
        
        C:\Windows\SysWOW64\Aeioio32.exe
        
        C:\Windows\system32\Aeioio32.exe
        297⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Agglej32.exe
        
        C:\Windows\system32\Agglej32.exe
        298⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Bjfhae32.exe
        
        C:\Windows\system32\Bjfhae32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Bmddma32.exe
        
        C:\Windows\system32\Bmddma32.exe
        300⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Bcnljkjl.exe
        
        C:\Windows\system32\Bcnljkjl.exe
        301⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Bgjhkjbe.exe
        
        C:\Windows\system32\Bgjhkjbe.exe
        302⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Bjhdgeai.exe
        
        C:\Windows\system32\Bjhdgeai.exe
        303⤵
        Drops file in System32 directory
        
        PID:8696
        
        C:\Windows\SysWOW64\Bmfqcqql.exe
        
        C:\Windows\system32\Bmfqcqql.exe
        304⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Bcqipk32.exe
        
        C:\Windows\system32\Bcqipk32.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Bfoelf32.exe
        
        C:\Windows\system32\Bfoelf32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8836
        
        C:\Windows\SysWOW64\Bmimhpoj.exe
        
        C:\Windows\system32\Bmimhpoj.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8880
        
        C:\Windows\SysWOW64\Bccfej32.exe
        
        C:\Windows\system32\Bccfej32.exe
        308⤵
        Modifies registry class
        
        PID:8928
        
        C:\Windows\SysWOW64\Bgnafinp.exe
        
        C:\Windows\system32\Bgnafinp.exe
        309⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Bnhjbcfl.exe
        
        C:\Windows\system32\Bnhjbcfl.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Windows\SysWOW64\Bagfooep.exe
        
        C:\Windows\system32\Bagfooep.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Bhqnki32.exe
        
        C:\Windows\system32\Bhqnki32.exe
        312⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Bjokgd32.exe
        
        C:\Windows\system32\Bjokgd32.exe
        313⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Bmngcp32.exe
        
        C:\Windows\system32\Bmngcp32.exe
        314⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Baicdncn.exe
        
        C:\Windows\system32\Baicdncn.exe
        315⤵
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Bhckqh32.exe
        
        C:\Windows\system32\Bhckqh32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Cffkleae.exe
        
        C:\Windows\system32\Cffkleae.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Windows\SysWOW64\Cnmcnb32.exe
        
        C:\Windows\system32\Cnmcnb32.exe
        318⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Cakpjn32.exe
        
        C:\Windows\system32\Cakpjn32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552
        
        C:\Windows\SysWOW64\Ccjlfi32.exe
        
        C:\Windows\system32\Ccjlfi32.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:8644
        
        C:\Windows\SysWOW64\Cjddbcgk.exe
        
        C:\Windows\system32\Cjddbcgk.exe
        321⤵
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Cnopcb32.exe
        
        C:\Windows\system32\Cnopcb32.exe
        322⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Cmbpoofo.exe
        
        C:\Windows\system32\Cmbpoofo.exe
        323⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Cdlhki32.exe
        
        C:\Windows\system32\Cdlhki32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8876
        
        C:\Windows\SysWOW64\Cjfqhcei.exe
        
        C:\Windows\system32\Cjfqhcei.exe
        325⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Cmdmdo32.exe
        
        C:\Windows\system32\Cmdmdo32.exe
        326⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Cdoeaili.exe
        
        C:\Windows\system32\Cdoeaili.exe
        327⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Chjaag32.exe
        
        C:\Windows\system32\Chjaag32.exe
        328⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Cjhmnc32.exe
        
        C:\Windows\system32\Cjhmnc32.exe
        329⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Cabfjmkc.exe
        
        C:\Windows\system32\Cabfjmkc.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Cdabfhjf.exe
        
        C:\Windows\system32\Cdabfhjf.exe
        331⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Chlngg32.exe
        
        C:\Windows\system32\Chlngg32.exe
        332⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Cjkjcb32.exe
        
        C:\Windows\system32\Cjkjcb32.exe
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
        
        C:\Windows\SysWOW64\Cmifon32.exe
        
        C:\Windows\system32\Cmifon32.exe
        334⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Cepnqkai.exe
        
        C:\Windows\system32\Cepnqkai.exe
        335⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Dhokmgpm.exe
        
        C:\Windows\system32\Dhokmgpm.exe
        336⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Dfakhc32.exe
        
        C:\Windows\system32\Dfakhc32.exe
        337⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9048
        
        C:\Windows\SysWOW64\Dmlcennd.exe
        
        C:\Windows\system32\Dmlcennd.exe
        338⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Deckfkof.exe
        
        C:\Windows\system32\Deckfkof.exe
        339⤵
        Modifies registry class
        
        PID:8228
        
        C:\Windows\SysWOW64\Dhagbfnj.exe
        
        C:\Windows\system32\Dhagbfnj.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Windows\SysWOW64\Djpcnbmn.exe
        
        C:\Windows\system32\Djpcnbmn.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
        
        C:\Windows\SysWOW64\Dmnpjmla.exe
        
        C:\Windows\system32\Dmnpjmla.exe
        342⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Dailkl32.exe
        
        C:\Windows\system32\Dailkl32.exe
        343⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ddhhggdo.exe
        
        C:\Windows\system32\Ddhhggdo.exe
        344⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Dffdcccb.exe
        
        C:\Windows\system32\Dffdcccb.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Dkbpda32.exe
        
        C:\Windows\system32\Dkbpda32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8344
        
        C:\Windows\SysWOW64\Dmpmpm32.exe
        
        C:\Windows\system32\Dmpmpm32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8612
        
        C:\Windows\SysWOW64\Degdaj32.exe
        
        C:\Windows\system32\Degdaj32.exe
        348⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ddjemgal.exe
        
        C:\Windows\system32\Ddjemgal.exe
        349⤵
        System Location Discovery: System Language Discovery
        
        PID:9152
        
        C:\Windows\SysWOW64\Dkdmia32.exe
        
        C:\Windows\system32\Dkdmia32.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:8464
        
        C:\Windows\SysWOW64\Dopijpab.exe
        
        C:\Windows\system32\Dopijpab.exe
        351⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Danefkqe.exe
        
        C:\Windows\system32\Danefkqe.exe
        352⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9204 -s 420
        353⤵
        Program crash
        
        PID:8944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 9204 -ip 9204
1⤵
PID:9116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aedfnoii.exe

Filesize
128KB

MD5
f13adbd43a7db8c41e5c06e452fb1d10

SHA1
5b52074fd5312cba24f86b21679d1e3970702871

SHA256
078299b1d23f26c9fc38163700efc385428bd98a4a733584cd904475235468bb

SHA512
6db01ea0f60dd73fd6881144a9bfd4ed460b9c45e8f56e2a4079ea5eb26a43d9b00a9e197a88063bd2488c54bff416995fa1bfa2e02b449711cdeef892e37455

Download Submit
C:\Windows\SysWOW64\Aefbcogf.exe

Filesize
128KB

MD5
72f4a54e57282bcc683b1acf4e217b85

SHA1
aa10f2665e0a44dc48c679aeb1c94c64f86b50f6

SHA256
646d38ec51b25b6af956249b83a41b099e4b29a87b59ba86b06fc97881ce5419

SHA512
c86fae421542e1c0e0be31492ece6f61c263fa59d2ea60c4e34dbeed9276192990403fbb4ad045173329ea4f22a04ecea48e20df9384c96ee09a81d78d290f19

Download Submit
C:\Windows\SysWOW64\Aegine32.exe

Filesize
128KB

MD5
5f2371ec1b3439f99d64bef0339e4348

SHA1
16698a2cbb734cdb0628a7d0f854c5fb0c7c7049

SHA256
522d8bacaa85b292eaa71ad6e448e1664b6f3740de1749599cad97ae38279a18

SHA512
e67da124a183b1f83ad5961d88eee63d049528d04dc084785f54e5ed68a92c28d5c2ccb4516af4becfe2cd80e010589191b89316d9d9ff2649cd18e219de8e1e

Download Submit
C:\Windows\SysWOW64\Aeioio32.exe

Filesize
128KB

MD5
0c6cb91afe3840bedbb66f4270d281dd

SHA1
426915f8fbd0751fa68de047f367f0806113a197

SHA256
06f1344bd533f5363406b3fbd37192ac1a9e5ceb96c95b7453230bf0e224a510

SHA512
af9de2a43b2ef7b49ff8a702493d0b1289c9aca64a0546d0424027a5acc18690463defa31bdaada50c31ccbe0b625a432cff935c183ae331079310e812711517

Download Submit
C:\Windows\SysWOW64\Aejfce32.exe

Filesize
128KB

MD5
e96f0d9e2b117c4ac08d579b1ca2942c

SHA1
cf83464683d9ad81ac0cf90c4e5f2fb10a1c6b13

SHA256
b453cffdd432b527e35d6db3a75039d6acaebd24a4321e6929811234116d9985

SHA512
ead280b07cd9920573a89cf9ec81f2a9460ed55637cd89f4f75665872fb2f569108d59507afcf6664d05718b0b9889d54d50e80b3709b225b4bd0892a65fe0fa

Download Submit
C:\Windows\SysWOW64\Ahffjq32.exe

Filesize
128KB

MD5
b4e9eeb4f72d69bd007e901d4653693c

SHA1
706e5eb8400dabf7aae5d31b261362e3670e7a42

SHA256
6d30d47770e71db7cf041c47a3d01bca06013daab703cb9937a298c3e0588fe3

SHA512
0bf51942241e44d1ef2b830fba11b1037da1cf042b04a274b5d46c261ac564fea168ddade17051b356c398a253f3954b5a72acacaba145dc81296e91899cff02

Download Submit
C:\Windows\SysWOW64\Ahhbpp32.exe

Filesize
128KB

MD5
d4a0f468c6327d63c2daf774b8ddb746

SHA1
3d4a0d8901ab0b1f4698080d8bd706d718b3e0cd

SHA256
c2dd2f00f225becab7f3af6c8314a7d7d6295e4a0e4f7c46d62a6297aa48442e

SHA512
39b70561a9f7bec76101ac7a1f07a561c3181ee75b9cb7ef5d51cc57d989b2e0628647077370f7a5259bca9172274926c6bd87ac8720e6545250922389767094

Download Submit
C:\Windows\SysWOW64\Akopddaj.dll

Filesize
7KB

MD5
a44f9628cf8c7e5c2e0c6397b109a171

SHA1
5a31c18bc534ff24412b94ac8be29908c667cc3b

SHA256
e00bb6729d659e181c1425d3de0ce74b778ef6edfcb34a13f9bb6da8c7611f79

SHA512
cb3c57d5fb2b1192040279ae2d93fcedb1baa570740e4a343b36f002aad7dd5a929fbc5451d16a62e58ef4175afa756c70fae325747e2b84283bc01d434af754

Download Submit
C:\Windows\SysWOW64\Anbklj32.exe

Filesize
128KB

MD5
45d66eae0077f215f3eae9a1063a9107

SHA1
de03eba354f3a5f919add0b096661c2cd253d3d1

SHA256
16a7d89fb4bd3054b05b2d0dae1dc8dd11e4ed9347bc5d72e8384b45ac7324c8

SHA512
6b5712aa29bd1cc2a03840fd646e2fa38c8f8b420eca8ccaadea99d18671b8df652d5a8bc4f139dca1b2d2fb72bfcdedb4ec81a4ad3c9bc10da3168f2e93dfa3

Download Submit
C:\Windows\SysWOW64\Anhaledo.exe

Filesize
128KB

MD5
2667df87b93b2eb8cc68e51929518664

SHA1
92719470c33ecd2da40f41910e4dc54b5e53adf3

SHA256
d98136460d6d0849293b40f889bc07cbad98a190ff4e7bb26ad05c97a523f4af

SHA512
1125fa946a4edfd6b68e238f62fe865ea8d6283f58116311c43c5b0362d39a95ac1299a12839557d30a3bb2a835f9da1dcc57dd9b012ea8949fd33bd64eb3fd4

Download Submit
C:\Windows\SysWOW64\Anmaakce.exe

Filesize
128KB

MD5
0508941c515aa61f3e24cfe78755c29f

SHA1
50db7f8123188a3708fd748f6b3b23301a1419f4

SHA256
6e6b2454ecde76373405308a6abb5d84ce1ee9dde49bef3df8436ef091a897f1

SHA512
26a064d234fa1c542b3841498add87188104c645a15e4859519c5e0540616c9781ba6565a9018ddbe45972bf9ed702b087f717f2f7238547e5d3869ce8f08357

Download Submit
C:\Windows\SysWOW64\Anpnfkac.exe

Filesize
128KB

MD5
c24abbecbdf1eae1be6130641c904957

SHA1
4df00eafbf235a0aaf87a321f89cee9b224784a4

SHA256
93cde94b01bcc98689dbf9b99233060b163511464cf4cb13739178105c8d6ec7

SHA512
7eb3f623e6a2964f9b5621cc0ea13d3c8747027ac37cdbe49e3ad597a5d3ac4ff6e9f39a2ed759b237b387293452115741febddf84fc773adf8561a5508cf1e9

Download Submit
C:\Windows\SysWOW64\Aqdqbaee.exe

Filesize
128KB

MD5
2d96760db99f942a9953bc374599fbfa

SHA1
583fa07c228ccaaf9f62889b5556d065d2bddf3f

SHA256
7569fe00c65b8e833f6d0153e0383eff1f36e8c3a60abb722324312f90969222

SHA512
2dcf3d2de3503e729e8acc1a2480746c5fa2dd929b1200d1f236a25e60d8d52e7bc73ea19b69e21b659e3ab23eb4b622452865f4f89e72f3596154c9879eb2bc

Download Submit
C:\Windows\SysWOW64\Bagfooep.exe

Filesize
128KB

MD5
e2cacd7a107795f912e362d46751a550

SHA1
913cd1e5bd144ac4f52cb1ede69ef02583b5ab08

SHA256
c79c228084a1bd70f2afc0ef157088338dba879b549cfa1f567cb2fc4309bb91

SHA512
c0503ce83a8395aad5e2fd1b0d28fa9bfd8e99ee0f84ff05a73fc597647c69a9ea2082cda6b99fff1c71a15b266a1da470e01438d93e68c4ca40723aad83876f

Download Submit
C:\Windows\SysWOW64\Bajjodfi.exe

Filesize
128KB

MD5
c059a0f01a41dce5acec27355db1145f

SHA1
746d806fb23c72e022b3f247dd4cc13e8e726350

SHA256
a5ad88aa9e48209f902c6460868d858bd99626566396c52ca6bbb27af5a71d5c

SHA512
58acf4c37d115a22123ed727eea83d0f7773c1d2b0e8e2ba253834e6d9fa12583e87f048a4e08fd4dcaa6d2a23f8b272e6710f2323b9a3caac0d68cc9358d2d2

Download Submit
C:\Windows\SysWOW64\Bbbphh32.exe

Filesize
128KB

MD5
a62589e1ef73b94192e769ab7f8bef76

SHA1
c8e60120753579b1ef117fe363ee8f114e85bca1

SHA256
7796a52061c9a29d88780dcea9d5fb05c1843d4efe7e5554abf612d43c2dde61

SHA512
1d0d78a7320afad5d5b9df0df8711551bdc3425f6dfb96857df398e9e6d5e5c4a59134de228c3455386eed376ca3489c12f9f1d1eecf7b51eb3f1f4332b475a3

Download Submit
C:\Windows\SysWOW64\Bbpcbiff.exe

Filesize
128KB

MD5
26f5c2ebf96017f477ce6acbeb1b8009

SHA1
572066ddeb9dddff05ee4a7b2015ee82d5eab13d

SHA256
b89f838af7129995de30187cd4e9813d79b45394c021ec5d010e5f5f0e602499

SHA512
e5660a6879548c87cca51d1cdb244113c22fc8acf2d772a0b600a6177be1620c6d3197a0d879584b7b0db3582aff9e7b6ee1562289721aa9924b14c5471f2ca0

Download Submit
C:\Windows\SysWOW64\Bcnljkjl.exe

Filesize
128KB

MD5
f943257a9eb02a2329c701281c21711e

SHA1
395e74b3ab49e217e2b71dde238b21043657d86d

SHA256
49e02011a75c1974f681c13cd16879cb701abc73a550c38ae3db3e2f9096fb7b

SHA512
8269765b5fd81746968ed9dbd22ce2e740ed5a42c64624f22ff0f30c3a1a6f43dea7e47605fc20608820a249140cd97252aeb923d79465872d8daf09d1097c4c

Download Submit
C:\Windows\SysWOW64\Bcqipk32.exe

Filesize
128KB

MD5
32b6860b7174414dd8c9ce570ac2d390

SHA1
d3181c2411cb9dd2b76da2b8452a3cb381a330c0

SHA256
00730907953f41e309e1179fdc3dd00b85a50af6206a5e4f81763835be48d28c

SHA512
9bba538f90690253c011ec2372f4904c81cc17b245eaeb11ef2530f12fe3e2ac8eb5f58973668a2ba6269c72fe905e23decf0a8cc089e1ed5027c6859493469d

Download Submit
C:\Windows\SysWOW64\Bdapja32.exe

Filesize
128KB

MD5
d51eb0ab199ad28d8bfd0f7979706f1e

SHA1
4371face9028a106c1c2108e4b3725d527bf037a

SHA256
6bffb95f42f45dafd45cf49c8e5db4a91d11507c65a532bbd6679393b799a63a

SHA512
78f7a6abfdbaeecb1cb2acb485c7551972f8d97d384eb0ef43cf5227e4ec425cb4062672e2025b0e5c142488afd26ab698181d5b205b2af377fb79494ad067c2

Download Submit
C:\Windows\SysWOW64\Bdfiephp.exe

Filesize
128KB

MD5
7dde7e7bb72a1555ac9a52edc8c12929

SHA1
0fba4b75191da98af5d519f94c9bb0e5c9862b5a

SHA256
59c7dd678cb169cbd0f252d1e9366c5dd01979a76f89c1ed870bae5969e3f34c

SHA512
b9883f598930d8f9031bf45413a024b31510aed9c0dc3d406411a567402c4d82bc6f7f9795bb170af35a6fce979023a09c595fec6a7efb8efa3a3a819fa74c15

Download Submit
C:\Windows\SysWOW64\Bdocda32.exe

Filesize
128KB

MD5
5c48b36c0cf09b37a021e0a8889cf531

SHA1
2540874996d9fe32386db142b73934acdb6a63ce

SHA256
4162b556e7f7178688fabe306e9568c4353c0bb5c45f4236f710b14ae6000e97

SHA512
8cb193027ce93733bc2d516e4a80166035cc99ab6bd7f3f5a166c843fb3eb2003ae311db035605ec93f6e1306005e93c2be5950940495ab6d49e27ffd1e81016

Download Submit
C:\Windows\SysWOW64\Bhdbkonf.exe

Filesize
128KB

MD5
77c3469ef6c82ba8991b60258ab0c7b0

SHA1
8734b7e54844d215b36dcc86f9a45883baad7a79

SHA256
3a8682e4158da72423324334a303faeb07c5de5ec77d2a3b4c257163077fca54

SHA512
dbfe175ca90b301e05797f8f2f8c122059498d92a1eb938b7e7c6ea35362cd02bdf256fe2f76890872beca1d4ecf621d1ed32be16e458702a9726b98355f3b60

Download Submit
C:\Windows\SysWOW64\Bhohpo32.exe

Filesize
128KB

MD5
d78180fdad484e6dd5fc9b07f1f4cc95

SHA1
3e299c9411bef0799327cf654fdf4a5a63f27ac6

SHA256
bca081df1bc3d56990a3aa8b1e7b43b664f070a9da22262e0f69972c7248f1f1

SHA512
912e827c0eca3a0d772c4b38e70993e451d41a453eff5b3e3c2202ef6bb4bd48d05d3b4f433b065f52ed25405a29c07f6e9dfbcae4d54a8319456c2eee3e6acd

Download Submit
C:\Windows\SysWOW64\Bjfhae32.exe

Filesize
128KB

MD5
00c038b3e9193734b5e6c669a561036b

SHA1
a96289dbbb341836aebaf07086359f68bc1740a0

SHA256
9858750b3813d2c634b86066a0aa5e6720ab04b4376a6f1b3691ecd76cdaf121

SHA512
a57ab11d00dfcdcbb61c773105accea2e8308ec337d100d154cca89ef389ecc9a355d44b99ff4504ed511916ca290a3d3b8f776ae1fdf60f45d69bc5eb08f315

Download Submit
C:\Windows\SysWOW64\Bjikaked.exe

Filesize
128KB

MD5
bacf241dd3b75da53a23322e010128d3

SHA1
9728a27a66a0292cd973676aed498f3c3c754c4c

SHA256
079eb7ae02d7a8f6c0ebe24adae039c34f758c374570bb8e4fa2bbb420858967

SHA512
e70b7de4cb61ceeeda01c816b6081584a2fbc2b86a69ff309ed34338d9ebc5a38df274db8dfb3b0d5316a1d6af8030222b5ba8176d0a754ea057c7fc70118ad0

Download Submit
C:\Windows\SysWOW64\Bjokgd32.exe

Filesize
64KB

MD5
3ea3022c6ca8cf319e91088d295c775d

SHA1
23f82d2daa84c79102a5d04b1d2a3c7153ad107f

SHA256
51954f0e3115a11793b89b0195cbe9ec03c6d58edd06c01f314b03df74ac5063

SHA512
d5cd14218bebba2707719130fbd14794f2703852debc70abc7cd51d44efe6d536a1c967833c81b244664eaaee327f4394256b93476296edbb3973348d5abf98c

Download Submit
C:\Windows\SysWOW64\Blmafnhb.exe

Filesize
128KB

MD5
79de8709fd7bd7e0ab580dd70f3fbec5

SHA1
4fd08804401104ddd97f57aebebdc3ba1de24b6d

SHA256
bdeb01eea87d89c1059df457ed64e5535d06013d17bec198cf65f9e8f66f2900

SHA512
06c687e3080bfb001db9a338d77f798dc5d99ffe632c06bac61e51cc2092d085e2b59dd2020e4e2f658a57d72ad03d73495c2fb854dcffc4efccf4fb7e7b0612

Download Submit
C:\Windows\SysWOW64\Bmimhpoj.exe

Filesize
128KB

MD5
3ff37293d89cda5bcd1b9db2e1d54c9a

SHA1
7233597b236c79077765e20c13181f58d3e63791

SHA256
89afde8a711cc76fecdbc41f3146a19f8c272737d38fd9ae85020c3c50d6b933

SHA512
5479d52fad74ee03d2672b85c776934b9482a253ebd0ef4716c1ebddbcf104a693188be496497baf0c1da044a0c63577016a7cc884a8a057b4a46ca13bcff6bc

Download Submit
C:\Windows\SysWOW64\Boiamiih.exe

Filesize
128KB

MD5
7ccf239de50a2376d414f3e8a14a0a56

SHA1
02ac1635bde0bffe0ed02fac955d883d4375c1c9

SHA256
38168b6ba4f3ae0dddecfc0da68836936478ece06dc7cba5b47c5c0e9bbc6914

SHA512
355a79425fc0be06a5ce87d35fa85135da32d01a620891115a701a3e12be73b5dba759beb4d121955e7f77a2024d49c2eccadded018bc857d22b45c1d7c9871f

Download Submit
C:\Windows\SysWOW64\Bonjhi32.exe

Filesize
128KB

MD5
bf2b86823620f03f563d15bb2c3544f7

SHA1
3613ec6f69a472bfbe71149a16be633277b1f085

SHA256
2d106d0fe9857fa550a8ed4bdedf2a8d293b6d1813790c71de7dc5187df59427

SHA512
3059095969f73fde2bb99f64a723633b2d2b47530d1524b9dbee75650a5129e6c5cb5c41045dab930a346771c4fc4c81fa6817fce464a126d7cdcf96ac6ffef8

Download Submit
C:\Windows\SysWOW64\Cabfjmkc.exe

Filesize
128KB

MD5
9ab0a72b72ec594f9189f345b025cd40

SHA1
c60476ee6704916fec7f6b6a19078537a5ad6dbc

SHA256
a07f5d89e0c2f2a3de3971842a079588667897dd6599f28c802233d1a9c0bde1

SHA512
2c25c972db925848325e2e95515ff217b3e535ba9616465ff2eeabd4484012ff5d258cef8edfab78e04bbb4992c825a53f3de1777462529f1a8d7aa4d0ba960e

Download Submit
C:\Windows\SysWOW64\Cacmecno.exe

Filesize
128KB

MD5
4dfcff7b5d5a7b8f6ea2551e35fc3643

SHA1
f042a2446cbe5ee5c940c136185709c3ffb6b6ae

SHA256
e9d186c56048b61460395c39341c71ca680af4758ec67977706205bf9d162716

SHA512
82f2ce2370ab405b88072a3a227f09881d528a173d74453696e8b6113fd57cb498f18e71a5b6c80cba4149f49c0dc443a608430142b1581c4c6bf2e619d1cbc3

Download Submit
C:\Windows\SysWOW64\Caocjd32.exe

Filesize
128KB

MD5
d0b888e3b852783594e870a502ab425a

SHA1
21f53d00f3f780e4faf46ffc14f434f7b7f5a780

SHA256
67bb21f2329dd37dfe6a93631f1c3ed904812cf06d7f6f40ffcd13ca64d0fb93

SHA512
d7e60aaf76081e0947e2cc25fe19ad0b24c5d61c6df25f916cc5a5bed2fe5188e65deab2acf1e99a50e88f6329f59c85b5b6522229213ec2a42f8625ca3a1860

Download Submit
C:\Windows\SysWOW64\Ccjlfi32.exe

Filesize
128KB

MD5
dbe735c733cda51165ef8c61ae7ef27a

SHA1
690661978a03fbad756c43f156ba261b8b8180f2

SHA256
d9f375f2c8f66b622c59bf0bb67d77ba36c9d0ce7fef89cfebabf640aeaac1ed

SHA512
56ab305e9fc20b573696e863258f4965c6e7aa903b8446bda9a432033a6cd989fff0122ca3b974be046c4f3f039fb7f42abf03682f3301f00b312361382d21c7

Download Submit
C:\Windows\SysWOW64\Cdaiaonb.exe

Filesize
128KB

MD5
4e48a84e1d39218aed8da7e6ec166a3b

SHA1
128b42ba29d89c3e8c466c976575fa40387e7f8d

SHA256
147864972422ecbaa250de1fa2b36e124d13fc0c623027a7505616589760b6f1

SHA512
865addb4d6cd0356b188c08dfa9e455c552d9ede2106e93319d7014bec33b404996cb7a60fcb2e17213d363a6e2a4dbe4124768fe70734dca0270029ec727060

Download Submit
C:\Windows\SysWOW64\Cdmofoag.exe

Filesize
128KB

MD5
e7cd9a2171a6ec1a327ead4fd99dc517

SHA1
c25b3575b8d987d55418e4e5289112aa893b5239

SHA256
fe02cb97d7c8952ebefd438fd018399ed38a7ed84829c677ce62ed1a75d1b820

SHA512
055467dee978a5af540fa96f0aaa57ee9470a9687f3249f82f046462851d19ce49472ffb4ea3c8667d2e623f93b79639651ad93bc96a0a0863ce271d7311ac63

Download Submit
C:\Windows\SysWOW64\Cdolkope.exe

Filesize
128KB

MD5
cc3193a4d4fab545280a678deba939cc

SHA1
df8728223a6293c694b355f29ff3000ffe2ccf11

SHA256
9673ddad0f3ce58165e09ecc25976b4b72d20234a3795e9036242d3c3fbb1e1f

SHA512
80dcc6b0845ab035928b7fef34b4b7982d19523ceedc7ae0e5274c8b4f3805a03899129eb809eb1e89ae6d147d125087ba62fd7106a6f3baead0f88eeea9108e

Download Submit
C:\Windows\SysWOW64\Cehbdcmp.exe

Filesize
128KB

MD5
9636abb1eeadf15c4cefd8fa1b56e5e9

SHA1
6e78ac639656b9dc2eb424d127d2997d500e0675

SHA256
ab1455160925defe824838c600b94302198203391cc467ebbade72cdfd400379

SHA512
fcf4e3a7e2dffb4dee1b4fdf5337ea2aaf6c6a71af2c1ca52916afc689e692509e9bbc7ef8ee34f577124506eec63775ec6ebad5c317d0437d43b845b3009cc0

Download Submit
C:\Windows\SysWOW64\Cellpb32.exe

Filesize
128KB

MD5
111f1e525c4a11f7478263bb8507b261

SHA1
eccd14165376d2ac57e5ceb0fe77921c57c591e0

SHA256
32273af21c3196caba4b6f86239ebbbf3dc678b9f07ee9097572d62e9152162f

SHA512
8b54b2e85d0afca355b5c6a3f2d58d4e43e5dbb18d793b74a89512f648db94787480030013d77a944f41af5d1b6240a4a9d6f1900dfec591aec7bb41bf9acc9c

Download Submit
C:\Windows\SysWOW64\Cjfqhcei.exe

Filesize
128KB

MD5
3f541f14a9bdfec01a6fa8e21386c795

SHA1
c1ed0e0647f49b594dd65ec70c10c5aaa5642da5

SHA256
d0a1060e523aaf0a66f816cf8dcdd5db557f30a0ba7f3a2f11f9fed4bbfd252c

SHA512
015def770c57de8314ba0441452317513817a9005de0c0d6586c2779466e4fffb60ab612954cf16c0d41049cd66e41c572f8e89bf11cc8ec37e16da41bae82d2

Download Submit
C:\Windows\SysWOW64\Cjkjcb32.exe

Filesize
128KB

MD5
9f5d3ab5f22d1f55911196cd2969a351

SHA1
403a7ca2efb184a865a5903447a4880405bc93b6

SHA256
a5b89fe5c201328268a2d30ee20ee372ee2b361bece3e608ef39063d562ce18e

SHA512
8e42a7ea3d2ff62c66c119cba0853f66d97dffd541371d0854660cfb44c35d9fe763e9ae697974f464ec6d1f038a78539988b1f4503dcc9501fd5bf306653479

Download Submit
C:\Windows\SysWOW64\Ckghbi32.exe

Filesize
128KB

MD5
bdb0cc9412b9f9a65679ef6a75ab6547

SHA1
2b35ff578bf3b07e017b9a2d414bf0aac7580077

SHA256
6c7abc6b355d366def7c57a9845f6400bd60a8bcf4678ed709e8cbb342de6d18

SHA512
f96cc5b966344a06767b8f170ca10d0f4635cc5fb125fdc52fae58200bb4cd855a66bcfe712467bb22e3562dc7f61d3e0dfafa6f67c09907b3201ba646f4b489

Download Submit
C:\Windows\SysWOW64\Ckidhi32.exe

Filesize
128KB

MD5
c98a7b22b214091020165149cc22333b

SHA1
bb9c8643acefc11f45e89e592aebd570a2808ba8

SHA256
13f69328c8ec2f1faa9f33c268c03da918838980a50656edf82e63104f9a08b8

SHA512
e8657e3f181b88123395da28777516f8de90f62d45ab47116fe281a6988caa73f0f6678143e2020c037abe6558352e0925bb770b20247c2d906367cccd620fcd

Download Submit
C:\Windows\SysWOW64\Cklanieo.exe

Filesize
128KB

MD5
c7701b562a29331c07d3cdd286d83c7b

SHA1
e398319fcfa7b7fb822dc31acce2493f6750010a

SHA256
8d4d697969e38912d3238536835edb1870745476f64fcb3697095b68e417d90a

SHA512
711346a8dd3c23802306ef855f41e877edf57ca93b28dcc0b06507d7937208ee83dc457d13a86e6c0e86cc09ba014e68a52e6ed1149b07ae0ea0deeaae9d23ba

Download Submit
C:\Windows\SysWOW64\Clakam32.exe

Filesize
128KB

MD5
0f8543a9e428ba4fca2c5c35f0683eeb

SHA1
d1575a956068a94318fe5a8c159a020874663e2b

SHA256
75c7dfd89406b9b0d07b5ed5f0f479c495148bbd1ff272795bdb78b170a48f1f

SHA512
09603a989ec523cca3d9849474e870c6588265f2a368110c1fee8041143c3c9cec0214d6ca6b8157279766c5342d6e68de054083b1dbead751a19d8f96c26bf2

Download Submit
C:\Windows\SysWOW64\Clakam32.exe

Filesize
128KB

MD5
1cb0f12b15b13957bfe54087028ba258

SHA1
e5dd784972cb0f93f07b76c8b7d6c4a0d139dda2

SHA256
87cf1fc27f2a4104e76c4fddc58cab088cb47d15dc5fb0adaeca64c0abf8503e

SHA512
17696cdc8baa3e2788e753a38cbab646f89219a93fd1841948c98ef768751e9e62846bafdab66e126e7bec0103fd5e64d83001fb273ad8298fcb5537c5f67aa7

Download Submit
C:\Windows\SysWOW64\Cogmng32.exe

Filesize
128KB

MD5
9b8d27a7c89d485dd04bf45aacf8c543

SHA1
ca20900d3fad2c3a3d672da8b43ecb151c2312d7

SHA256
55e62676f3fa59defa0c8295c5521e48c1bf6066735989933c26eeb16be6a737

SHA512
da832d4060e45bd099e1be9e7378297ab7e09728ac9ad59f538691e0f5e6554ab597a17982d722e6b59a4d925a716881c0acc518b73fd5b385e6ef6c417d19e6

Download Submit
C:\Windows\SysWOW64\Copgnh32.exe

Filesize
128KB

MD5
b1f08652e647a04901c4e001ada7eddf

SHA1
e113fc699d4717cf58937a53f727ad9071a02f0e

SHA256
4cf8b6155444d0dfadd82cfe23b1862803a25184bb1ff6e245c010d4ae0b33e1

SHA512
40f828ac6fe7bef06860e12555d2e652ac53bacd35aaa229e1ab6f6c037ee7321f2985fc5d1eb19f899e33d2e557eaeb0f9cd6be596881b637a44b02faa9e2f5

Download Submit
C:\Windows\SysWOW64\Daaifa32.exe

Filesize
128KB

MD5
8507702bb05147abc33ccd674393182b

SHA1
2eec049a7e48c5b234d1f72767fb11527fc190e1

SHA256
4b9d78438b9c965198bb24445a05767bbb01cd72edb22dd78d42fc1e0e057bb8

SHA512
d6f4d5217701b6c126b1f8c4e5a2c85713823702340c839480e558fa0bc97ab3c09fd41b24a6b8009d8e345772b2ade47fa12ea585ee00a628ddef78c8c449be

Download Submit
C:\Windows\SysWOW64\Damokbfd.exe

Filesize
128KB

MD5
b19e6e481e47452afd898c719afc4563

SHA1
f7706c2975b37ebeb3f0eed975a438d207f72512

SHA256
28fcb73f66caab9415fb36e5e31ea2a02f02e1796f19447f1df8595ef1859c37

SHA512
929deaf593cd92acf2582a96d99074a4b98f68cf31da531784f8aa71e7ada91af02cf617739eac5397c3207500f3ebf1302840819e6bce7f8a40d5cf5cc3e46d

Download Submit
C:\Windows\SysWOW64\Daolqa32.exe

Filesize
128KB

MD5
87c210512fcc15447f8c1ab7e8c65905

SHA1
1ef6f9abab08ac435d99ef18a2ce65d590292efc

SHA256
ecb6c4691e8397f34093b6223cb91407bfb36885366a1d33c551e0fcf2d4bb14

SHA512
447bda71e067d0990bcba27f6cce11523cb39851b199c09d7ebce5c186fb9dcc0a8bb70312a2c820f7a7c60df70899e6c079f47be46661fa915837ea312a2940

Download Submit
C:\Windows\SysWOW64\Dhdkbl32.exe

Filesize
128KB

MD5
2d95b996c2e46654768d9292eec65eae

SHA1
2aac4f2795ae3dcc0d8168dec3bef2200b7cc457

SHA256
94d768c2bb79c8a8a84988c926fbb356498467508299dd56c27bf4e3be9ac5e8

SHA512
6a8d12513f0b9b0b7a9c0785136fb4f1dbf5ea4fb3047330553b37b086b819971835806833727fe2606b3cb00a9907f15d03bb1536349ce6e6c28dc38a0887dd

Download Submit
C:\Windows\SysWOW64\Djpcnbmn.exe

Filesize
128KB

MD5
9788baa09b47ac3a21e0050a8539010a

SHA1
7d9921a704e4562c198cb88f77c405fc59e1ba09

SHA256
91ebbbf72b1da046ce49bacb4c3cea729f4c747b28dc400121471f2169dce63e

SHA512
532865e002fa0d87c58fe8b60ce05898020d1b57518259d18e90ad848b42b29855443134b427d49c7a8ef28c473f5c369659051c8b67532b39fe5b6387ff87ca

Download Submit
C:\Windows\SysWOW64\Dkdmia32.exe

Filesize
128KB

MD5
f3ec3fd57d3efa20b8ebf083f344ac7d

SHA1
3a68a578c6acd1c14f6799b28430fbd018674a1b

SHA256
c2c123e1e0f371ad7a3aaead8ff834ed6e7196fe2d3f67f7119540594a945044

SHA512
ccecb1853d1ae8b66cfde37ab1172809d1598b6d61f847b6ec464ec280689a17e32000f6b0f624e229b4fc944de2809d774a5e37c712db17b542c40fb91279b1

Download Submit
C:\Windows\SysWOW64\Dkpjih32.exe

Filesize
128KB

MD5
771fb97353af8378b3a8ea8cc70b15f0

SHA1
0094618627aeabe6bcb4486db1b8aa6ebd2d7f8f

SHA256
1a368cc152ae567944e7dba5777cddef3490d3659ee34989a4240f17cbcb814e

SHA512
f613904e2d0abcaa2620de14b0de8a533ccfcd996859a0734defc02468662ec65f031198d38264e747d5a47af6c58ce42f7aa194fed9b18228a993a41e6738f3

Download Submit
C:\Windows\SysWOW64\Dmlcennd.exe

Filesize
128KB

MD5
2d7c70a966f95028bba6837fee2b218d

SHA1
a5ee7ea63df9dc13d0829cfaeade36c88f562fcd

SHA256
0cf26b7ed6b8d614000824bf3cf6f14b17854ccb40abe21b68568c1bed7f0f60

SHA512
4c185fc990067ae45f36b5c984a7d3bfa98019eb7854c1bcd787fdb2f58899f9a44822743e7c7f98bf62d268be1d4a7edd89b41f89e41646861ed1194def4e16

Download Submit
C:\Windows\SysWOW64\Eeoalp32.exe

Filesize
128KB

MD5
dfe475d03b0ad276af9818f246e0d67b

SHA1
c0fb1b050a04d305553c9920778a1d61b5d4ca00

SHA256
67cea76ed0ca77c5b817edbe7c089222e8164c57d4ee6da3775b522599683a5b

SHA512
1bf914cb0bdc1d92c62ab74d7fb829526d220f38550c4cfdb72d2d1cc875c596f3519c23f3247faa0d01da1b48f91cd9abda1b46fc528eb5f6a4bca3479960d0

Download Submit
C:\Windows\SysWOW64\Ehpjnk32.exe

Filesize
128KB

MD5
54c2ef0ed0f39a8748f2ed75b51a7a98

SHA1
cf80662a914cd23d90d4703693913be080876e6e

SHA256
9b75887db7ab3c8a89a0250c37163b28df0ea72038e45fd5f4415008f528bd64

SHA512
6ff8fe923382640a11d59c9a588d16608f23033b9fc68d8ec3cadd98902c920c5809cdd2e75a6ff2f02e2776539d1efacc299ae189ff419c42bbdd8d270d87b0

Download Submit
C:\Windows\SysWOW64\Fadobo32.exe

Filesize
128KB

MD5
4a7e5d32187bf8c6171304f9947320ec

SHA1
1f70ef47278b4295cf37d942269c3e0e3d0dd186

SHA256
225a249e8caecd8250eabc0132cdd02d26149626780f38fff7d56cde21654d62

SHA512
0e6833a3454df8f29606927e2b6c50613122205a585481580a614ff29bc354dada3f44603e63573ec2ccac5a12601a605427d7e2c045f95f45745521cc7db878

Download Submit
C:\Windows\SysWOW64\Fclelb32.exe

Filesize
128KB

MD5
42f1bacd63ea9ff11a6d1e63bf9e1226

SHA1
88fb5b88919127b01c3920df3ce6b6011452fc9e

SHA256
2d9ebd3041ee47f350a28fa8f1a9edb75b92b1049cca766ba4f79c089843b828

SHA512
9c590a95db520bc27250d504b76d8244035cf1a041e160c692a1f48cdcc48c4157b44dc4b363ed02de10ee3c1ef157a8e8b324187a79e6c29c2440c6d40ad465

Download Submit
C:\Windows\SysWOW64\Fdegdj32.exe

Filesize
128KB

MD5
5b847b91847997e771656456a6b892bb

SHA1
c1e109ea12c60da0162cd21a3554adb7ebe61a40

SHA256
e1f566a12d81f785ac481a1cf9166436212fcd8a9c2b281096e6afb0f74f048d

SHA512
2c13d2bdf71a2c3cb4607a0827596a192fd39ebad807ee470e7fcf4a9e98c4a35be8f05274cbcdc4d8c0da71242a991d4acf50551085bdc2c9e06ab4919aa9fa

Download Submit
C:\Windows\SysWOW64\Fklckdhj.exe

Filesize
128KB

MD5
f8d0eda76446ff1317ba18f791e73580

SHA1
6a33348bc5955361e082592ac9b519c5784582ea

SHA256
b4e56ed93cdd21cfea28f805e735e94e0ac756caa9e9469d629d4157608fb2e8

SHA512
b1c23abccdf485aa9b6238164fb121a7780ddd8440d5ac8a24d586d23cbcf1174bf07f2dc9943585a6002c4edd8bfc563aee12d678e2612fa37b79fbb8e68dc8

Download Submit
C:\Windows\SysWOW64\Gbdgildf.exe

Filesize
128KB

MD5
625cf8e30dc4d236a71644aa95b62ac4

SHA1
091388b7d6a9d8051759ba362609895ab19d8b5d

SHA256
d9f2b8065cdcae51fab5de3f06386689baff6685467d96df5ed3ff2e6f3de0f3

SHA512
a97eed34f6f0b392f1be86c5d8e3655be229c82bdb3a780fd775bc1e9b46368d625d4a14909ddbfbf84b1378aaca2a23513077650287d95f1ac5ca039ff7378b

Download Submit
C:\Windows\SysWOW64\Gdiaoike.exe

Filesize
128KB

MD5
9a92288678a03888f06818468c6b125a

SHA1
80ab20b20be9ea000e555458e61eeb20e7ce0802

SHA256
61537c08aad58f161d0b4a55d258ea48484064e78681beadc620a97eca23e810

SHA512
61f2c8c254313b3423e1333a7e1cba1149ab75c6e9d20ff2f01949048db7dc6b904d7deabb4c47a2c92eaedcbcc7eea1ffcf1f1dee9d9a5626b943530105c61f

Download Submit
C:\Windows\SysWOW64\Gfkjolpe.exe

Filesize
128KB

MD5
3598328d285cb8147dbadb8598fb06b5

SHA1
8131eca5a1f1525b61f1b1e3720a61478425d475

SHA256
f2665d8cb4b2707359bb7a1ca8ad18a0e4178bedf07fd285694aacc345a34206

SHA512
708a79c8e514914b008174ab7b0179f3a8fec7d96e1e7b993d78cdca1f969abc2d97245536bc23d3810471e8a8d274a6ca56a7b88bfa1ed31a3791907b0da6d0

Download Submit
C:\Windows\SysWOW64\Hbnjpkll.exe

Filesize
128KB

MD5
ed1949d9719ebd3b5a3470915a9d41fc

SHA1
040e83d93714a2616b985e2dc9528a5ce508fe55

SHA256
291f3f242d6c1311c27e4abd66f9a67eb3ab7755d312bbc29584a297cec1356e

SHA512
9c4484b5a6c090571af19630f61f87ac35716065173114153a9b7bec0c76e0b6f2f9b27f3130160af84830b238bc0461b8899183ed350f6daa51437b9c574211

Download Submit
C:\Windows\SysWOW64\Hiefge32.exe

Filesize
128KB

MD5
da3d465cd9e23153547b792c4823b5fc

SHA1
47c576fddff428d6277d68705ff53826d1e9e6b8

SHA256
920bb31ee55a82095e6d9a963bf36aadb870b0190e14f18a8c2576a4887ab0b0

SHA512
16b2ad9eae0d7ec58459c3b641e18d8f3541f86291acbae0bde6cdd9e5cca3917a1e81cb8e10b156c8328706aa118813012a3ae36e9dd963a718f66cf04d20ac

Download Submit
C:\Windows\SysWOW64\Hkaemafa.exe

Filesize
128KB

MD5
1d4ac6cf176f93b4076530c86e11031f

SHA1
95c001339a2dbdb8c866212d705e81d74a620c83

SHA256
da0e48fdf24c4f0b20ee636da7d3d73d606ea5b61b0f03254c1e6f48209620c4

SHA512
e9533bb38ec4a90d0456c02bb0dca9b99b9359c066ed7842eca42fa543730edcac64a6a50d28d5b43e89f053b3941519467aca3186416777dd0b0faa26f0b9bd

Download Submit
C:\Windows\SysWOW64\Hmjlfecl.exe

Filesize
128KB

MD5
13b5887518e6bb553cf35e1f7c29f4fc

SHA1
e5b7f10b22659c6550ac4652d2f4ef4394093335

SHA256
9de093eb8edff5e290928d60daa905e66f66d84a5772da9809aeb36f2eb74cad

SHA512
709295e9dfeaf1af0fa28b004fe3a49493b735d3ad2833d76ed6a5ffd559593ffb64f5df51db52bafdbeb4480fe92006e4801c75503072436e4e07651befd924

Download Submit
C:\Windows\SysWOW64\Icpconql.exe

Filesize
128KB

MD5
1b8d4d09883a2982fe3ac6f4ad564299

SHA1
4b24847f4b6264c46159351907528275481e83a3

SHA256
da0a1287e5ffd539690cc643fafa7e2f1a13598344ad423197a52007c1100c11

SHA512
4b0f640f2f266f8e004f08a72bb75aa74b0bf7b22188bb12626054a6e52416b5a396d9b405eaceff6e87c52fc96312d94b92929dffbc5f09b18b4ea2e520fa51

Download Submit
C:\Windows\SysWOW64\Imekbc32.exe

Filesize
128KB

MD5
f75ee62c06725fbb9ee2f03e0ee15b07

SHA1
90af354883ba03a22586467983f7b0d00a721e46

SHA256
ed46e8c9001541b01845ea4af274e583d48b60c2afbf6b75c61149aa4ac99909

SHA512
b993b5514058c37144089f009450f75570223351de41a5caddcc3506fdcfc89946164db1032045264f6dca6d606f98f1000e6fb72a93a76aa1a10509c2d65bbf

Download Submit
C:\Windows\SysWOW64\Imonhb32.exe

Filesize
128KB

MD5
e97c9ca4d86ec97f0f10de9744664c76

SHA1
d6870446ae802f395c6ef8c6a575c2f0e85fc6a7

SHA256
a2aa4b5e716b58f6697c12a4ecaaca19f961bbbe0180b690c9bc8a40f5cdf03e

SHA512
8cc3cdd38e8165fc675b2eb4f35ad5fbf3ec0f4c5693ba36f43477f3c0566b5e86b12f185ea7e90312be96e61cecbcd47f51ae104d3432129a418f2a1528cf86

Download Submit
C:\Windows\SysWOW64\Ipfddo32.exe

Filesize
128KB

MD5
e666414d50f7edeae15088f405faccf9

SHA1
326c418ec7ed477513ad48d7056f4b2f8e27f990

SHA256
3993af3826997ef3eb60f35784f8c606c40542312a85bc103408d8fe97d99f3c

SHA512
a140d0078e4f4de07e8a58f81660565086e24ed2d96e290f63b07a0e59704c2c03e895baab981d2984b2090d1d74a0ea17d2a5773aec43a48b3ae82e1ff91711

Download Submit
C:\Windows\SysWOW64\Jbncfi32.exe

Filesize
128KB

MD5
f3cdee61efd1f892d459594552c30e29

SHA1
9a46486f093f1399c54120a5f1819e52ac5ad26a

SHA256
6e1a368868cacad39543a75a8dd54671d6a818fa0a89d243b2724d19675d5e5d

SHA512
001a2d3d70924252d5975f71812aac195e64a803ae35c249716f80692fd0bfa11f8c6d261e91cd45f8c2a00375288e5327df7be03dc9def0e917a4b9c93786dd

Download Submit
C:\Windows\SysWOW64\Jfcbmfnh.exe

Filesize
128KB

MD5
2da1d8993fecf1d1ce154005fd51e37e

SHA1
c2e70bdc3965ce04544e1f25d740930ad0d2d731

SHA256
118fdc9e26888700e637a273fac2406aad208fc60f00f3af84f8a0b165078f0d

SHA512
533e2f65e9ef13836d800f55301b50918f16c3165e776a4c00a56a01683995434ebc2bbece76031d464464440dd7c05260773fb49700fdff753899bc4a0c7db1

Download Submit
C:\Windows\SysWOW64\Jmaknb32.exe

Filesize
128KB

MD5
14f02c85997d34941e0ad0363d4a75ea

SHA1
1d54ae18ecba4deffeb700d614caaa07b941e215

SHA256
ac6073f94879b4e5acaa8193a72edfb4f04c52748637916e3abd91b6ddcb398c

SHA512
59a3bd3f146897e970ac1ec30b4c4e7519fe78b42fe310d749ecc39df4590fec2d14e9e1e673b301255a0bd0b5579f5cd2de89cb57ccbec6b94505b4ced7d443

Download Submit
C:\Windows\SysWOW64\Kbcehe32.exe

Filesize
128KB

MD5
9f8922ee91301d1d2de705dfeeb2abdb

SHA1
b001904594540259ed16acd901e633a0fdd65a65

SHA256
013de9c4dad0305a955bd9a5949d9b1a64cc9675647b55b51b2311bc15ef1228

SHA512
3f0c55f38aaf248566949bc68d1f2dfa1bfb9e760ce949107bedd89cae446cbb3edfe28e4518c64175f6c112e0a504ef1ea65cd7387d2a080c708f57d397abde

Download Submit
C:\Windows\SysWOW64\Klpkemlo.exe

Filesize
128KB

MD5
2dd3e06aee11814a99181e2f97555885

SHA1
171b27cc442a2800d90a517e8d146284ac657fed

SHA256
55952de0a5a8e8e716131f8fced37fce6b26e823aa7df5656853be475d625824

SHA512
ffda25ab850485da63ee632ce87edeffa604a57f71ac69fa0edfe982bbd288c04ef24ce1fcdf3e895fc493ded8ca30598e4bb50c28d74f17d0ff499c45298f17

Download Submit
C:\Windows\SysWOW64\Kmadepao.exe

Filesize
128KB

MD5
e4566172fa77c63f0f177d72406de04d

SHA1
da7a9a9f7481f401e59b7949a94a444796409d2f

SHA256
f1bbe8a540755f486506df86ba5bb6b635b6c9c8ed3d0a5fa45ad3ddcc171e49

SHA512
1677e945593b1e593d5f3213ee870dc121c9432cba04a9d22d51a69c8b6801db2c8d1da0365a4555cd7bf2980d17219b47578e5bd3e7ce7749e66294ed95a5bd

Download Submit
C:\Windows\SysWOW64\Kpbmgj32.exe

Filesize
128KB

MD5
53b5810237a5cec06f6e1ffa1e3ecf21

SHA1
2c40fed23aa02e60823a3db109cced093b675dc5

SHA256
59391a165b3c4e7ff487051c55a4abb0b65bf5800e2228606f069183882c8158

SHA512
5fbfaeb6da8bd5322e4214d1b24e020884b8681a5592e41ec0ce397220571fdfbe6102cdd99b8ed1e4e9d9ddacfb5dc23207906ba40da23062bcc07540a6f12c

Download Submit
C:\Windows\SysWOW64\Lbhocegl.exe

Filesize
128KB

MD5
32425c40a63a3a23f047cdb4cab219e9

SHA1
298b775685ca5b1a6bc117771b9b069139ddd8e0

SHA256
b737455a581bb064dc3934525ec990722f3048484b5cc92b9a135190ef0e3d0e

SHA512
db156b005ac6f7f8e59e18a9fffdc6a370acb132765d97dedcd30df4276925a0fce394fb0ae6b0cd8dca341f9a691027999c75b60c083059e5809a90611f0458

Download Submit
C:\Windows\SysWOW64\Llpcljnl.exe

Filesize
128KB

MD5
9d5b5292f6ed25894b6a785fc7c4b063

SHA1
6bfe558d28baabf76ce2837b53ae0f26f2fc94c6

SHA256
5bdf0f1926d9e312c457df57a44a5ccbbadb03ab995a3f7e39adcf3c0a643c99

SHA512
d306a9117511c8382d1f23a7ee7fb17454560b2e667e3ec843abb3adc5f68c89ff403cfcfeceea7cb293ee3b5c6da9626f56b45588e6a0e4f9845218ab76a1a6

Download Submit
C:\Windows\SysWOW64\Mebkko32.exe

Filesize
128KB

MD5
b9469ee49883442bfe396f7c3f15ffbc

SHA1
b725d7e374ea12a577cef6c9f5d98a6087a9c4ae

SHA256
edbea3c3af01b89d054e169ae729a68fc44b529ba5454d5bd20797dcaea16029

SHA512
e32b46bd66e6eff8fb5f391abc138d9fe853c9c3086e8f5a06dcd1316e5934c5b661b5b3619e51e2142e833762bc53f8c95f23ebd064563b2ea952c3483ef8e3

Download Submit
C:\Windows\SysWOW64\Mgageace.exe

Filesize
128KB

MD5
db420f0f8da257c4ffc6b445c1620f95

SHA1
ee8e08882fb693e3d06740b5b556904dc09eeec6

SHA256
b215c96a6b1e420e5a00c3f47013d3d1791ec64c51f430eb5a8b539663898001

SHA512
52a1eb20454721503b5e066eee7eafc447a2602a5bab54faddb0c27ff09c9f2ffddcdf980728873df2ce96db2327682bb7a560ab2fd7b41a7c695cf539fd22c3

Download Submit
C:\Windows\SysWOW64\Mnnlgkho.exe

Filesize
128KB

MD5
b6823bcec17f7247d07350a4c1eac85c

SHA1
268a565ab3d5de81d5a3ad0d766a2a35f47e5606

SHA256
35364263a7d1b4eb4e4edfa7e9a8f43f628b17f5768717831e6c59f35cced5ea

SHA512
11a89935d55c9b7d217c7ef26aefe694f5a4dd48ddafd85a653564d8f6ff33c368a6d14049eaa1afdc1325b7e4c145c3332e19256e9e4106cf28e04075dd4a79

Download Submit
C:\Windows\SysWOW64\Nghmfqmm.exe

Filesize
128KB

MD5
c5868dfd8f3d18b4166610f8034925f1

SHA1
a669756dcb7015fcdb369f840f892fa883e8894d

SHA256
77992a34b3ffe826a03cc3abaca30578f128a5a791aa2a12f387c101dc865102

SHA512
a6aec40203eebc441241bf8add9c9d7cec90c4421ce3c6a2c29aa056ccdf1c4a1adf78a29d8d0b7cfd6ba40fa6234120c4c0f2be652650687ef1371b21b595e9

Download Submit
C:\Windows\SysWOW64\Nidmml32.exe

Filesize
128KB

MD5
b257b90e9436e8580d26652a9e700daa

SHA1
13608d2985685df0f9aa1a006cbf3de0c1cb3c24

SHA256
c3e987f762a19de3fdb50ca04dab98a5f7d2dd6a3f9ee529f5dad19cc607b523

SHA512
41dd8d2ce77b994c7b780257b48f89aabf670f74c1e59e6cb4e50646b35d967a32233a4c7b85408908b60ec36bc63bafbe0e3e50b030502f676c9550b6ce4a17

Download Submit
C:\Windows\SysWOW64\Nlhbdgia.exe

Filesize
128KB

MD5
8ce08b3db2f48e5a101ab503d0ae575b

SHA1
18588eea7249c320b7a905926474da8f4d3bc1f7

SHA256
8b84b5c2997d89684c42bc22875a8eec514e0fc0c9c2328a0c89c66ee990e25f

SHA512
b827259f2d0f2e13cf4d3c9492cf6e847d228b2c2b71e8ed03bd85ac9f8f25b956b2402ec3bb3d4162981b63fc226d37e16e5d47088bdf20a25daa9dcc26e559

Download Submit
C:\Windows\SysWOW64\Nngonjqd.exe

Filesize
128KB

MD5
ecea05a76407d2bf39d1bc08c83d28ad

SHA1
15069622b128f9cbdd3640838481046fa3de0dec

SHA256
cfbe0dd3753fca07ae6b404b01c88839053116fcd1015684351dd4a369b639f3

SHA512
bd25f82cf98485ab3ed410ab33fa916ccfbee86f030e8e11076ec1638a0b75787db37c667abcf5bdeda38de983159987160d217b266cf351c247ae078403455e

Download Submit
C:\Windows\SysWOW64\Npekjeph.exe

Filesize
128KB

MD5
31c1950928ee939d6f2d28cf13e11b32

SHA1
d7d7503c79f6a041f8ddf1cf174723617152bb70

SHA256
3357d439843f344d8405573dc9d1efc22a17a3a07954aa121253d18a25ab233a

SHA512
3369a77d12c802875e30acd4710f1fee9b99c01e1f1b73dc0b6c7f681606727b2528b302966456e0aaeaa59f4e0a9046cebddbda553a6847c0381e6563bd5847

Download Submit
C:\Windows\SysWOW64\Ocmjlpfa.exe

Filesize
128KB

MD5
956651eb974aa55b99d46d7d862a6b84

SHA1
287392c73f246765e8f855efb20e14967aecce92

SHA256
c2ae5a5e6db76fb13270132a67c7d3d329888c5f91b5190ad4d662b51b232062

SHA512
f22f425b1f9712c1fb9f395b17600597be10784bf39c4fa59be61bbfc40a9eaaac6432d6319b2f5062bad6b35e70465a1119eb2cb41045f18d670509001dc0be

Download Submit
C:\Windows\SysWOW64\Odfqecdl.exe

Filesize
128KB

MD5
34046c65a30457ab487d1cdf7a648f28

SHA1
4686c8cc7f864936ca01e2159f9e8dc232aeaea0

SHA256
f45db8d814032f549edb6ba3e399bd0fb03d5cf8ca9622d28849f9fb494fb5b5

SHA512
d9fe60dfdd5a7c579ae32f5c5feb2364f3bfa0d1269991ff468540799cbfb7e2fa5cf7c4d3096ec3f87240b35e1673b4e5eab059e40a6f8a312f78b034a72aee

Download Submit
C:\Windows\SysWOW64\Odmgfb32.exe

Filesize
128KB

MD5
6ce6a72d8074f0101ac2d8a6a6877e94

SHA1
d23ddd4d6438e0048adab89954245f791f76144a

SHA256
2df4380fbe207f58c9d1656391e2f0b71334a428b839805498a4ef83e015208d

SHA512
d66fbd5a4ec6ff468c0134fd5c07ed6faaa9343b7bbeed7a9db9f7e86e0f97558fb7c2c878befefdf890bf94d10bc7d55f1c865d2341b9093e4b4946f4ce4fa1

Download Submit
C:\Windows\SysWOW64\Ofncnkcb.exe

Filesize
128KB

MD5
2a78f6b7d1c7064ba3ffa2ef3076044c

SHA1
4bde5bba0cb288db82633133f42be6ac3edf75f4

SHA256
5a54ceb1760aa941d08131616e8679c0a8e9cea789dfb6dda254c37b3111760b

SHA512
1afc0e54c4754122c22f336ee4915b40d3add033cb411ad2db9dbf3c7fb2aeaddb0851e5e44402493e98cd4ad35105dbd748dee960cf3e41d54f067adaddf361

Download Submit
C:\Windows\SysWOW64\Ogfjgo32.exe

Filesize
128KB

MD5
2c4b12745a8a5b09ccf95896a45c2319

SHA1
2be1b17d19dcf204dcb3b6e6581161590a8aa6aa

SHA256
afc7f969ad86bdf9e133335b27d8636878c1f98309018d60dad1ef202aa62733

SHA512
5105eff2fe41ffb060289b0e2c4f7def52f1819136f0881295f53168e6d7a9cde5d5ceaa15a00102ca87278c0d25bc975713c2b98436c2912adc936452ce7c4f

Download Submit
C:\Windows\SysWOW64\Olcbpe32.exe

Filesize
128KB

MD5
4717928cf9347bb3f93d3515d10154d9

SHA1
38d81fa57a4f2c4acfe9499d05c97e8ca636b6fc

SHA256
2120e94ce4416a5a1b766a15f998d3b5560ec380b957e266b09cd1ee58dc239b

SHA512
8f571d597f0fb4dca62cb9278eac57104c0c856b07cbcf4d1febb9c016e4f73efa878ddfaf642e6a1e2632607fb0ab0f05aeff1529fe0fefd9ea1b2ea6d815a4

Download Submit
C:\Windows\SysWOW64\Pdapabjo.exe

Filesize
128KB

MD5
8e41d2e7ee1904a616af506eb534f1ea

SHA1
7a49124065924a101afc4bd955936ea31d4ffab6

SHA256
8dc142cb00bfcaa3e68f43b1a0aa95ca047d22cacb8a1d9d3b053c26d13d700f

SHA512
2fcf5960833b4939891a502fd55c94fb10c3473d00a8bbf4954d59ac6a23f69e8c9fce9361c21cc2dc41cdb2ce67b58e0e25925b9f9760572b622f496db65fa3

Download Submit
C:\Windows\SysWOW64\Pdoclbla.exe

Filesize
128KB

MD5
0b3fbc6dfeac49fefb70d386c57fea75

SHA1
3e0f22a964f5d096f77c8c314b9880d1b4015f8f

SHA256
fb5def4fccc90011917f23275d369318b43c692896da48fbf306b251f93ee987

SHA512
f5cbdedfac40d1b529b5ce6e6a039818048eee39f12aca4e1512495977166b303fe7a41ab4f827895b4360e8a8ae752784e8f38ac588e76574a27ca76390bf8c

Download Submit
C:\Windows\SysWOW64\Pmanaccd.exe

Filesize
128KB

MD5
37210df4d605c2a41da1d45872060552

SHA1
1767d17ea0a4bbd358b63aa1a78d69d5e9c77b79

SHA256
4ec30b7863bb0730ee64ea818f2e6e1c45cb6080da235bc8e829004e6bf42bd5

SHA512
260532c0047fd2cc0fb10040b6d15f58445461f0844c65d6a65713782b6f3f5a14f016f768f2e7c593fec4f5c82cace844110ecf32de7d8761ae7cfee00d828f

Download Submit
C:\Windows\SysWOW64\Pnakkf32.exe

Filesize
128KB

MD5
58ac370d3c2578f899b2995b3c78fbc8

SHA1
677f88c5deb75d317724cf8262fe0e68a731d872

SHA256
8265335d00a662c38ce6cd225f83ff420cf6f65699bfd2f0fdc996e291a4e686

SHA512
b8990955b7c5e4aaea61129c6ce7cadfd3207cf150722291fc8b0cec6585400e388434a6db353af7106329e51ba41669a61b5c5f33818f42f84bd8fd68218dc1

Download Submit
C:\Windows\SysWOW64\Pnghdh32.exe

Filesize
128KB

MD5
f09de96a62b93865e26a2d72299c4f4e

SHA1
c5af85922e46b5cbb5770183aea46f52e6c3d0c8

SHA256
1f2d950a5363766d10e137911b4388ef22123c2700c2d88af5ba15409ce6a4fd

SHA512
8b33900e0201ec1008e50d57532313c3fcbef05ba29ca4c3067ff8e33d54dd138df22c373e418ff0d9c3a226cb2906ba8afca48dff5f77beea5c1e353af01101

Download Submit
C:\Windows\SysWOW64\Qcnccm32.exe

Filesize
128KB

MD5
085c7374037033ce19c9d8fc7ba9cc62

SHA1
5384fce3bf5623dfa4d43ec5d06c17d60591cb43

SHA256
31169a69af211097f8c1e5df19883cf8d97474b0da69142c4bcd89718e6f50d9

SHA512
be8fc12943c4af99b0fcf544bb716b3249ca43198adb7d682f145eb820ab80a2ce43a349b56b11e71729e8e66d6c09d130b3040e3920d4acc017a504468765d8

Download Submit
C:\Windows\SysWOW64\Qcppimfl.exe

Filesize
128KB

MD5
8f97ec4e31ea7ab8bf9428e5fa827625

SHA1
ef9852da56b205df8756678a03b67ed23b096868

SHA256
9c8454f0ec4b2caa3f7f43984b03f3d3d69531bdb1264cd8a47cf80e9ab74678

SHA512
e1921bb81d3e52bb4e5223a29659a08b7f3d12e006473640dda52562cb221474a035ad27ccbec5bb2cc36eda37425011ce255f222a5e4a2909276ebc07c732ae

Download Submit
C:\Windows\SysWOW64\Qncgqf32.exe

Filesize
128KB

MD5
ccb96035f682dbc70b6e2f253580285d

SHA1
8f2db4051259f12ef093a781f8e2d3fec61cb823

SHA256
9f338fe071061422fc4101da9318ff7a2b3dd10e2feeee1b968de030059ec84a

SHA512
24652781d5b66c99e360db65673b5cb0d8fe3ce377b0590bbdc998edf33f30c56ebc521547e6c223a0385794e45739479ffb84739c80b548d5dfb1e09befa9ec

Download Submit
memory/368-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/392-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/400-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/404-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/512-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/620-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/684-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/696-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/816-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1012-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1036-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1084-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1124-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1184-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1256-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1328-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1408-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1512-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1512-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1520-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1748-506-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1752-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1788-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1880-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1916-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1936-598-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1992-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2264-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2264-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2416-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2420-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2432-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2508-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2520-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2844-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2844-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2944-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3016-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3048-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3212-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3216-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3312-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3328-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3432-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3452-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3480-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3508-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3540-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3632-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3772-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3900-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3956-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4020-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4088-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4232-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4308-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4332-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4332-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4364-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-528-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4484-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4488-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4496-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4520-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4520-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4656-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4760-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4760-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4788-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4792-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4888-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5024-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5112-518-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5116-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads