berbew | c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe
Size

896KB
MD5

f1ba24090797edb7fe8590bf7c3a80bc
SHA1

b8f9865aef258eaa2a3d94f5882479da4212b793
SHA256

c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd
SHA512

4cb3f271173e156f8e0a3d4e6dd2247fda9e1b30c13ef9de9a6336c35decfc30587d4eb8b98ec3a3084e0cd4d88013c6a53d3ca0ff6b46e3d9e0defe9228757f
SSDEEP

12288:MHMTAQByvNv54B9f01ZmHByvNv5VwLonfBHLqF1Nw5ILonfByvNv5HV:qvr4B9f01ZmQvrUENOVvr1

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eclmamod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbdhiojo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkdjfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnepna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjblje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecgcfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fffhifdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Efpomccg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jocefm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbdjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcpahpmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjliajmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffmfchle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmdjapgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmggfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hiiggoaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjmfjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dckdjomg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efafgifc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgccinoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inqbclob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfkmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gnepna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jghpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdigadjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aogiap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmhgmmbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dikihe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecbjkngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdigadjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oodcdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kckqbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dlieda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efccmidp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Glengm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojigdcll.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
904	Acfhad32.exe
4804	Ajpqnneo.exe
712	Alnmjjdb.exe
2108	Achegd32.exe
2124	Ahjgjj32.exe
548	Bbdhiojo.exe
2276	Bkoigdom.exe
2988	Bombmcec.exe
32	Bheffh32.exe
1948	Bopocbcq.exe
5108	Cjecpkcg.exe
3272	Cobkhb32.exe
764	Cbphdn32.exe
1092	Cfldelik.exe
3008	Cijpahho.exe
4916	Ckilmcgb.exe
4812	Ccpdoqgd.exe
452	Cbbdjm32.exe
728	Cjjlkk32.exe
1028	Cimmggfl.exe
3528	Ckkiccep.exe
1044	Cofecami.exe
684	Cbeapmll.exe
116	Cjliajmo.exe
1560	Cioilg32.exe
4644	Ckmehb32.exe
816	Coiaiakf.exe
4556	Cbgnemjj.exe
4508	Cjnffjkl.exe
872	Ciafbg32.exe
3304	Ckpbnb32.exe
4304	Ccgjopal.exe
2664	Dfefkkqp.exe
3860	Djqblj32.exe
3864	Dmoohe32.exe
2800	Dkbocbog.exe
1972	Dcigeooj.exe
3868	Dfgcakon.exe
792	Difpmfna.exe
2516	Dkdliame.exe
1624	Dckdjomg.exe
4084	Dfjpfj32.exe
184	Dihlbf32.exe
668	Dlghoa32.exe
1168	Dcnqpo32.exe
1836	Dflmlj32.exe
1608	Dikihe32.exe
2992	Dlieda32.exe
2320	Dcpmen32.exe
3100	Dfoiaj32.exe
2012	Dimenegi.exe
640	Dlkbjqgm.exe
4248	Ecbjkngo.exe
4020	Efafgifc.exe
4400	Eiobceef.exe
4984	Elnoopdj.exe
4132	Ecefqnel.exe
4708	Efccmidp.exe
1164	Eiaoid32.exe
3572	Elpkep32.exe
4140	Ecgcfm32.exe
1692	Ebjcajjd.exe
4332	Ejalcgkg.exe
1736	Emphocjj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pgpecj32.dll	Kflide32.exe
File created	C:\Windows\SysWOW64\Dfkecidg.dll	Fipkjb32.exe
File created	C:\Windows\SysWOW64\Nbalhp32.dll	Bdbnjdfg.exe
File opened for modification	C:\Windows\SysWOW64\Hlbcnd32.exe	Hlpfhe32.exe
File created	C:\Windows\SysWOW64\Ehkaqc32.dll	Ifomll32.exe
File created	C:\Windows\SysWOW64\Pqknpl32.dll	Gbeejp32.exe
File created	C:\Windows\SysWOW64\Ddligq32.exe	Dkceokii.exe
File created	C:\Windows\SysWOW64\Eeelnp32.exe	Eoideh32.exe
File created	C:\Windows\SysWOW64\Imgicgca.exe	Ibaeen32.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jngbjd32.exe
File opened for modification	C:\Windows\SysWOW64\Dihlbf32.exe	Dfjpfj32.exe
File created	C:\Windows\SysWOW64\Gkhkjd32.exe	Gbabigfj.exe
File created	C:\Windows\SysWOW64\Bdcebook.dll	Albpkc32.exe
File created	C:\Windows\SysWOW64\Icinkkcp.dll	Dmohno32.exe
File created	C:\Windows\SysWOW64\Eelche32.dll	Kodnmkap.exe
File created	C:\Windows\SysWOW64\Amqhbe32.exe	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Epopbo32.dll	Bpdnjple.exe
File opened for modification	C:\Windows\SysWOW64\Kfnfjehl.exe	Kodnmkap.exe
File created	C:\Windows\SysWOW64\Afbgkl32.exe	Aaenbd32.exe
File opened for modification	C:\Windows\SysWOW64\Emphocjj.exe	Ejalcgkg.exe
File opened for modification	C:\Windows\SysWOW64\Omegjomb.exe	Ohfami32.exe
File opened for modification	C:\Windows\SysWOW64\Dmennnni.exe	Ddligq32.exe
File opened for modification	C:\Windows\SysWOW64\Hlpfhe32.exe	Hibjli32.exe
File created	C:\Windows\SysWOW64\Dbfpagon.dll	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Pipeabep.dll	Chiblk32.exe
File created	C:\Windows\SysWOW64\Dlkbjqgm.exe	Dimenegi.exe
File created	C:\Windows\SysWOW64\Cfipef32.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Efpomccg.exe	Dmennnni.exe
File created	C:\Windows\SysWOW64\Lcdciiec.exe	Lljklo32.exe
File opened for modification	C:\Windows\SysWOW64\Njpdnedf.exe	Nagpeo32.exe
File opened for modification	C:\Windows\SysWOW64\Cbbdjm32.exe	Ccpdoqgd.exe
File created	C:\Windows\SysWOW64\Jdqlliil.dll	Cioilg32.exe
File opened for modification	C:\Windows\SysWOW64\Lmpkadnm.exe	Lgccinoe.exe
File created	C:\Windows\SysWOW64\Obnbpa32.dll	Mepfiq32.exe
File created	C:\Windows\SysWOW64\Bkncfepb.dll	Modgdicm.exe
File created	C:\Windows\SysWOW64\Cklhcfle.exe	Coegoe32.exe
File opened for modification	C:\Windows\SysWOW64\Dcpmen32.exe	Dlieda32.exe
File created	C:\Windows\SysWOW64\Epndknin.exe	Emphocjj.exe
File created	C:\Windows\SysWOW64\Fikbocki.exe	Ffmfchle.exe
File created	C:\Windows\SysWOW64\Jphkkpbp.exe	Jgpfbjlo.exe
File created	C:\Windows\SysWOW64\Jnhidk32.exe	Jkimho32.exe
File opened for modification	C:\Windows\SysWOW64\Lljklo32.exe	Kfpcoefj.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Pdmdnadc.exe
File opened for modification	C:\Windows\SysWOW64\Kodnmkap.exe	Kncaec32.exe
File created	C:\Windows\SysWOW64\Aaoaic32.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Edmpgp32.dll	Dlieda32.exe
File created	C:\Windows\SysWOW64\Ooaafghm.dll	Hpcodihc.exe
File created	C:\Windows\SysWOW64\Cdnmfclj.exe	Cfkmkf32.exe
File created	C:\Windows\SysWOW64\Hlgdjg32.dll	Ipoheakj.exe
File created	C:\Windows\SysWOW64\Obqhpfck.dll	Mmpmnl32.exe
File opened for modification	C:\Windows\SysWOW64\Ffaong32.exe	Fdccbl32.exe
File created	C:\Windows\SysWOW64\Hpjmnjqn.exe	Hmlpaoaj.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Nlfnaicd.exe
File opened for modification	C:\Windows\SysWOW64\Jofalmmp.exe	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Enabbk32.dll	Efccmidp.exe
File opened for modification	C:\Windows\SysWOW64\Omdppiif.exe	Onapdl32.exe
File created	C:\Windows\SysWOW64\Qobhkjdi.exe	Pdmdnadc.exe
File created	C:\Windows\SysWOW64\Mpolbbim.dll	Nnafno32.exe
File created	C:\Windows\SysWOW64\Ojomcopk.exe	Nceefd32.exe
File created	C:\Windows\SysWOW64\Ahmjjoig.exe	Qpeahb32.exe
File created	C:\Windows\SysWOW64\Gajaoo32.dll	Fimodc32.exe
File created	C:\Windows\SysWOW64\Ecgflaec.dll	Gigaka32.exe
File created	C:\Windows\SysWOW64\Jhghaf32.dll	Ohkkhhmh.exe
File opened for modification	C:\Windows\SysWOW64\Fpkibf32.exe	Fpimlfke.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9668	9464	WerFault.exe	453

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmpqfq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdhedh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdbjhbbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcnmin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Madjhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkmkkjko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cijpahho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdcliikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikkpgafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efafgifc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmechmip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikbfgppo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohkkhhmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffaong32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjccdkki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maiccajf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmlpaoaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnjejjgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpdcag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibaeen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lggejg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmoohe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcnqpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dflmlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhiemoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmennnni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emphocjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgbjbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aekddhcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfefkkqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmpkadnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjpode32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdciiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmnbfhal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjdaodja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjmoag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jofalmmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlobkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjmfjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjkblhfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aolblopj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfgcakon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbabigfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fikbocki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnpdegjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijcjmmil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjnffjkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiobceef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efjimhnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfkbde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbgnemjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dimenegi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glengm32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdbpmock.dll"	Cbeapmll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Difpmfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hoaojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ifomll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhhlki32.dll"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binnimfj.dll"	Dckdjomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afdnfjpa.dll"	Ffobhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekbmje32.dll"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghndhd32.dll"	Mjcngpjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Elnoopdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbflncid.dll"	Hgfapd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Icdheded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inngdb32.dll"	Jdodkebj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjkblhfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ccpdoqgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnipccc.dll"	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ljclki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fpdcag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmhgag32.dll"	Hoaojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlgdjg32.dll"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfnikd32.dll"	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eiobceef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glmoga32.dll"	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcflijmh.dll"	Lmbhgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oodcdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckhain32.dll"	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chqogq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edmpgp32.dll"	Dlieda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ijcjmmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lccahg32.dll"	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajmdgelp.dll"	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hdmoohbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbobmnod.dll"	Mkmkkjko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efcagd32.dll"	Mnpabe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciibdmj.dll"	Hoeieolb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dckdjomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jddnfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kflide32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjijid32.dll"	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kibohd32.dll"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gedobm32.dll"	Bkoigdom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkkceedp.dll"	Eclmamod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ffobhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ibaeen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qedegh32.dll"	Onapdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cimmggfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdllgpbm.dll"	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglbla32.dll"	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ecefqnel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Knchpiom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Efccmidp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipjoja32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 904	2504	c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe	83
PID 2504 wrote to memory of 904	2504	c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe	83
PID 2504 wrote to memory of 904	2504	c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe	83
PID 904 wrote to memory of 4804	904	Acfhad32.exe	84
PID 904 wrote to memory of 4804	904	Acfhad32.exe	84
PID 904 wrote to memory of 4804	904	Acfhad32.exe	84
PID 4804 wrote to memory of 712	4804	Ajpqnneo.exe	85
PID 4804 wrote to memory of 712	4804	Ajpqnneo.exe	85
PID 4804 wrote to memory of 712	4804	Ajpqnneo.exe	85
PID 712 wrote to memory of 2108	712	Alnmjjdb.exe	86
PID 712 wrote to memory of 2108	712	Alnmjjdb.exe	86
PID 712 wrote to memory of 2108	712	Alnmjjdb.exe	86
PID 2108 wrote to memory of 2124	2108	Achegd32.exe	87
PID 2108 wrote to memory of 2124	2108	Achegd32.exe	87
PID 2108 wrote to memory of 2124	2108	Achegd32.exe	87
PID 2124 wrote to memory of 548	2124	Ahjgjj32.exe	88
PID 2124 wrote to memory of 548	2124	Ahjgjj32.exe	88
PID 2124 wrote to memory of 548	2124	Ahjgjj32.exe	88
PID 548 wrote to memory of 2276	548	Bbdhiojo.exe	89
PID 548 wrote to memory of 2276	548	Bbdhiojo.exe	89
PID 548 wrote to memory of 2276	548	Bbdhiojo.exe	89
PID 2276 wrote to memory of 2988	2276	Bkoigdom.exe	90
PID 2276 wrote to memory of 2988	2276	Bkoigdom.exe	90
PID 2276 wrote to memory of 2988	2276	Bkoigdom.exe	90
PID 2988 wrote to memory of 32	2988	Bombmcec.exe	91
PID 2988 wrote to memory of 32	2988	Bombmcec.exe	91
PID 2988 wrote to memory of 32	2988	Bombmcec.exe	91
PID 32 wrote to memory of 1948	32	Bheffh32.exe	92
PID 32 wrote to memory of 1948	32	Bheffh32.exe	92
PID 32 wrote to memory of 1948	32	Bheffh32.exe	92
PID 1948 wrote to memory of 5108	1948	Bopocbcq.exe	93
PID 1948 wrote to memory of 5108	1948	Bopocbcq.exe	93
PID 1948 wrote to memory of 5108	1948	Bopocbcq.exe	93
PID 5108 wrote to memory of 3272	5108	Cjecpkcg.exe	94
PID 5108 wrote to memory of 3272	5108	Cjecpkcg.exe	94
PID 5108 wrote to memory of 3272	5108	Cjecpkcg.exe	94
PID 3272 wrote to memory of 764	3272	Cobkhb32.exe	95
PID 3272 wrote to memory of 764	3272	Cobkhb32.exe	95
PID 3272 wrote to memory of 764	3272	Cobkhb32.exe	95
PID 764 wrote to memory of 1092	764	Cbphdn32.exe	96
PID 764 wrote to memory of 1092	764	Cbphdn32.exe	96
PID 764 wrote to memory of 1092	764	Cbphdn32.exe	96
PID 1092 wrote to memory of 3008	1092	Cfldelik.exe	97
PID 1092 wrote to memory of 3008	1092	Cfldelik.exe	97
PID 1092 wrote to memory of 3008	1092	Cfldelik.exe	97
PID 3008 wrote to memory of 4916	3008	Cijpahho.exe	98
PID 3008 wrote to memory of 4916	3008	Cijpahho.exe	98
PID 3008 wrote to memory of 4916	3008	Cijpahho.exe	98
PID 4916 wrote to memory of 4812	4916	Ckilmcgb.exe	99
PID 4916 wrote to memory of 4812	4916	Ckilmcgb.exe	99
PID 4916 wrote to memory of 4812	4916	Ckilmcgb.exe	99
PID 4812 wrote to memory of 452	4812	Ccpdoqgd.exe	100
PID 4812 wrote to memory of 452	4812	Ccpdoqgd.exe	100
PID 4812 wrote to memory of 452	4812	Ccpdoqgd.exe	100
PID 452 wrote to memory of 728	452	Cbbdjm32.exe	101
PID 452 wrote to memory of 728	452	Cbbdjm32.exe	101
PID 452 wrote to memory of 728	452	Cbbdjm32.exe	101
PID 728 wrote to memory of 1028	728	Cjjlkk32.exe	102
PID 728 wrote to memory of 1028	728	Cjjlkk32.exe	102
PID 728 wrote to memory of 1028	728	Cjjlkk32.exe	102
PID 1028 wrote to memory of 3528	1028	Cimmggfl.exe	103
PID 1028 wrote to memory of 3528	1028	Cimmggfl.exe	103
PID 1028 wrote to memory of 3528	1028	Cimmggfl.exe	103
PID 3528 wrote to memory of 1044	3528	Ckkiccep.exe	104

C:\Users\Admin\AppData\Local\Temp\c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe
"C:\Users\Admin\AppData\Local\Temp\c804856c64d31261304238fba2fb06e6aa89cd6de414dcac841dcb43668cdffd.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\Acfhad32.exe
  C:\Windows\system32\Acfhad32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\Ajpqnneo.exe
    C:\Windows\system32\Ajpqnneo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\Alnmjjdb.exe
      C:\Windows\system32\Alnmjjdb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:712
    - - C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
      - C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        23⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:684
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        27⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        28⤵
        Executes dropped EXE
        
        PID:816
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        31⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        32⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        33⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        35⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        37⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        38⤵
        Executes dropped EXE
        
        PID:1972
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:792
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        41⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4084
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        44⤵
        Executes dropped EXE
        
        PID:184
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        45⤵
        Executes dropped EXE
        
        PID:668
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1168
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        50⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        53⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4020
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4132
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        60⤵
        Executes dropped EXE
        
        PID:1164
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        61⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4332
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1736
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        66⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        69⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        70⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        71⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4324
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        74⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        75⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        76⤵
        Modifies registry class
        
        PID:1312
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        78⤵
        Drops file in System32 directory
        
        PID:3560
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        81⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        82⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        83⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        84⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5400
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        86⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        88⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        89⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        93⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        95⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        97⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        99⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        101⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        104⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:4192
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        106⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        107⤵
        Modifies registry class
        
        PID:1672
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        109⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        110⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        111⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        112⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4088
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        115⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        116⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        117⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        118⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        119⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        121⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        122⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        123⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        124⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        127⤵
        Drops file in System32 directory
        
        PID:3936
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        128⤵
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        129⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        130⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        131⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        132⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        134⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        136⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        137⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        138⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        139⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        140⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        141⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        142⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        143⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        144⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        145⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        148⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        149⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        150⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        151⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        152⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        153⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        155⤵
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        158⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2412
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        161⤵
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        162⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        164⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        165⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        166⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        169⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        170⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        173⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        174⤵
        Modifies registry class
        
        PID:2868
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        175⤵
        Modifies registry class
        
        PID:3408
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        176⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        177⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        179⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        180⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        186⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        187⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        188⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        189⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        190⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        191⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        192⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        193⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        194⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        195⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        197⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        200⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        201⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7056
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        204⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        205⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        206⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        207⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        208⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        209⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        210⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4952
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        212⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        214⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        217⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        218⤵
        Drops file in System32 directory
        
        PID:6204
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        219⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        221⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        222⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        223⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        224⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        226⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        227⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        228⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        230⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        231⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        232⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        234⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        235⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        236⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        237⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        239⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        241⤵
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        242⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        243⤵
        Drops file in System32 directory
        
        PID:7252
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        244⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        245⤵
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        246⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        247⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        248⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        249⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        252⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        253⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        254⤵
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        255⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        256⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        257⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7952
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        261⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        263⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        265⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        266⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        268⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7572
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        271⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        272⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        273⤵
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        274⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        275⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7936
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        277⤵
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:8184
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        281⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        282⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        283⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        284⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        285⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:7944
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        287⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        288⤵
        Modifies registry class
        
        PID:8076
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        289⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        290⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        292⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        293⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        294⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        295⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        296⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        297⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        298⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        299⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        300⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        301⤵
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        302⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        303⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8204
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        305⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        306⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8340
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        308⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        309⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        310⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        311⤵
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        312⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        313⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        315⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        316⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        317⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        318⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        319⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        320⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        321⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        322⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        323⤵
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        325⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        326⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        327⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8292
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        329⤵
        Drops file in System32 directory
        
        PID:552
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        330⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        331⤵
        Modifies registry class
        
        PID:8480
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        332⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        333⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8624
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        334⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        335⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        336⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        337⤵
        System Location Discovery: System Language Discovery
        
        PID:8872
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        340⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        341⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9180
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        342⤵
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8352
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        344⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8440
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        345⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        346⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        347⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        348⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        349⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        350⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        351⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        352⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        355⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8948
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        356⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8596
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        358⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        359⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8744
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        361⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        364⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        366⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        367⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        368⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        369⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 412
        370⤵
        Program crash
        
        PID:9668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9464 -ip 9464
1⤵
PID:9612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aajhndkb.exe

Filesize
896KB

MD5
8aa2a56e420cb1dc3d7c32a4cb49e9e8

SHA1
0deb4652d257290e14dcc54d6877bf3575fb2cce

SHA256
26deab8ce6f3ea3e055236ea039cd6e08d31c93cd692f00933c5a8b2216f4d41

SHA512
2fbbd4e887384f598a11ddf591cb08549b279def77df7f128adf8c646803c87f18d4030bb78fea5b0e837c58dff064905c02e4c32aa81b9dc975d336a17afb29

Download Submit
C:\Windows\SysWOW64\Acfhad32.exe

Filesize
896KB

MD5
c6060b9dfbd7e63367c595a32d9568c4

SHA1
7e9b398ec364de4b668a19d903270c4193526800

SHA256
96369ee5f91ba047d3ef561af672d782dd1d16a841090b042b55ba1205ca528c

SHA512
ee7c29e3b097a5d37c060c119812fe4051b3ee7f6401e898af641398c7f47dd9b3faeab6bcdc488650ddb794a27209a198b70343914d9d7da30750568c99f806

Download Submit
C:\Windows\SysWOW64\Achegd32.exe

Filesize
896KB

MD5
d1db04d2f998e5908233e7f6eb4d6173

SHA1
ab39aefcc6a74abe85ba9f603a17fb541bbe1dbd

SHA256
08e5c82da039e61d2ecb37c5d6df3c4711472ccf22501ece63dbc4eb733ebf8d

SHA512
c51d309cb9f561f7d516a1b4ee6e1751133ec9073beb7ca1adc429c8b76f30a9e1d570ce7b46e13cb52d728945ccdaf6492fee529a6b41da5c8df90c0e5b4255

Download Submit
C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
896KB

MD5
0190ab73f1ab96d85383123604b2963b

SHA1
65e2f6701cac9c88ef4d3f36b5ee96ba26a49f41

SHA256
82f2c04b9cbc0e7c1462518a35848a41cef00aa4f60877ffeab40530b6f71770

SHA512
40377eeb8f85d26fea26f39335f6a10952b39de22e2c871d9dcfaacb1b4bda59692bce3d491d28ea162d29323da1709132ee8aa3cb380b731e1b539f3a48ffdd

Download Submit
C:\Windows\SysWOW64\Ahjgjj32.exe

Filesize
896KB

MD5
bdfa5d97ef5758acdbc0e9439fa7af45

SHA1
a6cd783202842607827fc937b859b7703c185c4d

SHA256
9b48861ada21569685ff7dfcb119ef328ec2496f7de652379cf8101b4324aee2

SHA512
fa174903c03327fbc570e8e194d04228b58110b66ecda2559f084f640eb8c85c75b87eba650adc0e2e7028a1d457c2bd2b55950755537f6674bb7f6855dc6494

Download Submit
C:\Windows\SysWOW64\Ajpqnneo.exe

Filesize
896KB

MD5
95acb03f3dbc1748f5ff1ccb4f9d2acc

SHA1
931e74fda2241e8af39cde66bcc942b614cf827a

SHA256
4bc03fde59ab95f805b0f7197d627dce23ec898d0ccfbe10526aacd59acd9e97

SHA512
2a40f0ef5f2917e25696b471b41dca76c61b933aba7536da1499f8a0dc0b48bcdc9189d4c13308412d7d6407055c8dfcc68cf7394385637fe1043fbc31ca25a9

Download Submit
C:\Windows\SysWOW64\Alnmjjdb.exe

Filesize
896KB

MD5
bf2c42768c5bf29d6a6534f559cee1b9

SHA1
8eb3529f165f996c5eff156a17e8634d3ad58f32

SHA256
9ed52bf5b75da1949926d2afea98eacc298317cffc3c80e2284a5608d5ad29c9

SHA512
b885407e0014ef1589c5d707feb3974f31912e0ba055a61ab4b4179a2d5d6fa075b1e8cf4908caa0a0c910b1f245cf5d5e19b6bafba92edbcd7c853bdbf12071

Download Submit
C:\Windows\SysWOW64\Aogiap32.exe

Filesize
896KB

MD5
9422808247fff573fe811e02a7b49463

SHA1
ec200d3f3b59261e3f16c2bb477511e36a8ec0ee

SHA256
27418ec35e2f1dab25673a097d442d780b0f9bc4253f21c593f3160859e39d30

SHA512
096b4adf995ffacc2bfcf54018f49b6b7ced8375aa16471a8d6d9cc3f2b127a60e55fd2b8da7d5a43b5b27ec5b4cd989cf739d63e7303a80bf68885e5daceb5f

Download Submit
C:\Windows\SysWOW64\Bbdhiojo.exe

Filesize
896KB

MD5
53f965ae73a058e782442360b6d0e9ad

SHA1
20fcbea1af50998141a7d60ce5cb68a3e0373169

SHA256
d02bd4356cc94984ad4ae28034c034e829b8c376024271bc833dc73f84d91ba4

SHA512
53dbf04b87a062fd6581cb0cbf2d2373956fb4cf9bda858f1750bfa7656016e1558e267fa995d7cea10a90ca980d3e2ffd5557df65453aec3a8cb514b80d21a7

Download Submit
C:\Windows\SysWOW64\Bddcenpi.exe

Filesize
896KB

MD5
8896745a5adcc757454df6fed822556e

SHA1
d1a4ca6f7463d844377e274b57200ff27bbbcbc3

SHA256
a104cca571683b2638c05124e8db0aee7d0fe38544674206a4aad49035111756

SHA512
f795877dbc2552b05a7aa2a3a1a34edcc13066b1e5b38347f53c0bf42667cac3b2e3881623d088592f793058fe0b4664965b110bef3640624a1503bed6770888

Download Submit
C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
896KB

MD5
07348dad0c3bbc9c3fbdd4820992fe70

SHA1
84af586887f84365beffe3dc620535de9298c3a3

SHA256
be71e44a0cbfdcd108c8f22871c8986c06ce5c1f5d853f73860bb4641265aa2e

SHA512
f93b96353ad611c65aee4bb0e3ad0abffd873840ae2b3bf49c0ea04743eebe0d5abd5bbb190a953b9961d8265098e4b495554cf1af0602bd6863c5baf56572e7

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
896KB

MD5
4865c05973915fa1f366feb4ff661de7

SHA1
f11dab7ccae6e9031b6a439152bed31e5d608f7b

SHA256
bcb3acfee8eef55d63786e374183af8b5d409b8dd03cefdba010e5ccce0ef331

SHA512
f4ba8db9cde9ed7d19d8ad2a5e782b6e68ea6ddb26cad4c994f4dfb06563ddb07bf0783ed092aaba5cefd3878bf4a7a47fa2be080ef07c718a28e47555238da3

Download Submit
C:\Windows\SysWOW64\Bkoigdom.exe

Filesize
896KB

MD5
073ebbb44d4c7a6fe93e5d6b3971a7cc

SHA1
b8423c429436014d0af6720f1b53e95b166d0442

SHA256
dcad3b84472ea836978c0933a2bb910610734d35d02b1f29230cc2c8d8216498

SHA512
b46425664d33cac964461b08b9a130837ad524c4cdcb86c67748f98bf6837aa5dbe02cac7a579b8e4aad24272e2c7bd8061a8ebac668db4149e1e4115c431afd

Download Submit
C:\Windows\SysWOW64\Bombmcec.exe

Filesize
896KB

MD5
e96291c7541423a3421670cf8be294df

SHA1
cfc4093eeea593349b8b5db9133dc7cd26645d41

SHA256
4178b1df91d85fe8624cf2fa3c09403ffd484e26b609a6bcf6f66515fa43482f

SHA512
e3b743c22f018455364a94cfc6071f03423eef850227b5d6aebc068972f56910e0aa7f1d3f7429ce5a3e6e78d1f4c20d55d0fb3e7b29fcf2c393344e02fc809a

Download Submit
C:\Windows\SysWOW64\Bopocbcq.exe

Filesize
896KB

MD5
6cb4226c288fb0d3ab870bde341c73fb

SHA1
7d9429df095dd08e7b0bc53935b68a9f226593b0

SHA256
23443a45675ca87a1f5dc840f54a82b3b322f284b67c89618e0e3d433d023a10

SHA512
955efb0d32c48c418744481ff741db1d5e66815909cb8d026c2cddff9c706e7d0c0082d5220d86c0e81ffe7f4d27b51e16a064826b95ba965eaffb5a3795b125

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
896KB

MD5
36a11a25ae7699f8c3ebeb66dff4a028

SHA1
b1de1c8e0a91f594923be83aaedd1281d7db89ab

SHA256
74f68c7526191271fb4718ff3b0e8d517811d5700b3763569feeb623d48c4566

SHA512
1f32f3fc6aec1d202ee899d8edda3f387ceb903844bcfaa4cab36b92df5b6c11df6ce6f60903dbecd660029e61ad0e47a705e6c19aaee90a44b5508af6a4ad97

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
896KB

MD5
f81153a84f60d6dc8c677a85c07030c4

SHA1
717b9b1f3b5e224fa453094b6517932ef8184662

SHA256
1fc5b40012a0be89352d6e750c323c47b241ddbffab0541c2fb0df77556d992e

SHA512
b26a70af3f105c6de9cef85e50e034e500a6a452d5c2ce9957edfbf638e54394fdcf0a941dc03c5eacb373a346e7442d21327e5d59440e036e2ed8a72ba309fc

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
896KB

MD5
44b6f310fc0f91b8fe58b00c5eb294ad

SHA1
4ead962ff83d671fa1f78aa519dd8553cf2b7152

SHA256
11f4c99db48f4e1b78deb7562cb83413fcff7f196f8c2a9405831d4e3f1304c2

SHA512
ae07f0ef53978cf4dd8a87470be044a7a743263836c148ffb51233b1e0096b122f60af6261aff626e149f0c22f6bcbbeb431e7daea4fbebfb68bfc0aeed31fb3

Download Submit
C:\Windows\SysWOW64\Cbeapmll.exe

Filesize
896KB

MD5
ccf448be580badcc56fd17de7d264de7

SHA1
96b55db9f8f6c0fa4dfff14b46cb2630a1cc396d

SHA256
42a669581923d5ef7102d00972fb68b7590f468d0d792688edc0a77ed682060a

SHA512
3ed0a01f57134bd0821cab45ad472f015b3a835b254f9adde57275e6df6a3ae7cb8c2dac668e30348734a30a66d7082994d3393d721fcc0e949f5e3b40c14fd4

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
896KB

MD5
778c77aaaaa67ac46e3a5b31e4d0cd64

SHA1
b170680c3e5aecfe84196ef331be5d8e720272a4

SHA256
d9f38cabc7f25389e73e13f54a36ed349ff3e96d3fd90eb785832af17de4739a

SHA512
03cd3430596ffeffd9a4b1cc394289c8d5f8213d6e28e53e76c23c7653c3ed3fdcdb7a0a557a5219c23ffd933d2314e4a939aef93c9b22593597df638c075f93

Download Submit
C:\Windows\SysWOW64\Cbphdn32.exe

Filesize
896KB

MD5
3bf62d76524ceacf9a717693e9aedd33

SHA1
d6870fa725630a4c639351f91235d796143a3ea8

SHA256
42accad56355cc8d5be43d32f27057305c16cd9b1457bd522efd6b85d6299474

SHA512
0427fdffec6805091cab9bfb15cf7b0a3ce235605bb9ca34010694984c64825e69866276da4a1379585485db180243b5afa26a4ae1c34729d8d40c46c986c383

Download Submit
C:\Windows\SysWOW64\Ccgjopal.exe

Filesize
896KB

MD5
8d5645f0b3d39c368b0d527c5cb979bf

SHA1
2c58986117d333495a49ef8c93ad3b023f02eddd

SHA256
4500c5a6e59016f55961b6b3673e584bb7fddf8289a41d54eeb265ad47fc3e1a

SHA512
e8caa26a1ac9b3ebff44cacfe64a6361fbc375ec61041bc397bc25d067a4b5f15b07f581591575b28f3cd3aaf7b513247c2255f70f5a00cf5ede16b9509fdab1

Download Submit
C:\Windows\SysWOW64\Ccpdoqgd.exe

Filesize
896KB

MD5
1c23d91f0691fe5361d1ca0c81cc1040

SHA1
4b12ac6dfb7297a7cf5f56fee905cb65bddcd449

SHA256
c257bcceb6a1f16af8dad3eb72a36e515a27f1ee6ec37a550a4222d953d8b58e

SHA512
b4bc782cedc7f41b5fc22a039d855f78d280178001f2c8738086d12b4e1bdb45ce4e21d06e0c6047bf5fd5821c501cc8bbae36269c7629b14174a70f94fd6a8b

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
896KB

MD5
431d71bf7640473f4555868b1ba96517

SHA1
b7ce37143c026250e478e06dbca12fb6ea99b506

SHA256
0678fffdb1a9b4b8d4e34f64947a629fb01f9842c91c7f16ae799fc691a02050

SHA512
8711109cd04cd83ada3d720460e9d65cf03bb8e788c1538214a183200813ae4a5fdef5bd9e6fa26a2727a858972d1101b17714515ef926218c99fc0af2a34341

Download Submit
C:\Windows\SysWOW64\Cfldelik.exe

Filesize
896KB

MD5
ba5d40118ce719c91692e675c45bfc16

SHA1
f6cddf5285d5c5beecfdb9808020f35648c87024

SHA256
50de67f7f8efbd3c64bab563fbfc5a84af1e806da3ed26f22300dc5953d8e38b

SHA512
355579a2f3190bacb707b86f6a6a2be687416c361b0eacf5b5455f0c9ed0eb4e9f777dfddd87de9f4d4e9ae8e1a4897cac0e339cacbd21297b890c4c94641c8a

Download Submit
C:\Windows\SysWOW64\Chiblk32.exe

Filesize
896KB

MD5
79f895b5e65e5ac0c006330390445cd9

SHA1
93a61dd22343a2b3080b989944715677d8842f07

SHA256
1686ec006a4ae303c02bd3024e34c8c6521d2016d782cb97728074a3944d079e

SHA512
c6455a77dc1c76b4f10b92a98b6cd1fef2e9037c46bf226e35295d4b161be495898e6ad3ca2cc690f95c42dd58c340c30bdb2cae6007b364af170333c6911958

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
896KB

MD5
ea3e3888ea7f75d6a8ae708ae0085822

SHA1
41009f642e98c8c51fb05bfe7cce2d8576b6b16c

SHA256
cafa271dbb506a93c2c8fc1c5076da87d3aa7b2e4fb3f7adb99292684ea64348

SHA512
da91b5104ffd01b8e64a938b45b793373201b496c167363e557cc7d854ee9bc9022f17816391bfe77b50eb32fdbd8b6d5fe9639abb59ce6c8c467160d3c618cc

Download Submit
C:\Windows\SysWOW64\Cijpahho.exe

Filesize
896KB

MD5
91f684acd8a1e8297d2cd2e20f60f451

SHA1
e0095c4377eee4134cca4bdc234c54504ca6ccbd

SHA256
eacabb1bbda32e4cba1ce3fe0bb1acf7a612f86aea3c783b52bf46353d5ac5df

SHA512
3833373dbe2e19d38c350c803341e5c3b0af9ac27b9161467c6760ee8bc5ba4f0baf2653a6ff95351b610d011bdc4d02c83536b485e7b8e7d4a9acab917a84ee

Download Submit
C:\Windows\SysWOW64\Cimmggfl.exe

Filesize
896KB

MD5
cc130965e3834820b63e5a1e14390a88

SHA1
efe05eb6ce2466f17aaee20942cbe9530e48aa13

SHA256
0eb3a311e335e273c7a7e9aef86b68f8a684bdb6ec8aafdc0cdcc6abd55b89af

SHA512
f4f089cbefb423bac32db259acdeae8c9d94965d185dfa93bd9fa97a35b9cd7b8c85ae0a7b36ae1d2bac5281a0a398bc983c4d7063b81fc8eada0e93aef22645

Download Submit
C:\Windows\SysWOW64\Cioilg32.exe

Filesize
896KB

MD5
6f5930f203b0031a2a89f6541aa3d3fa

SHA1
90a658cb54ffd1ad081c87a90d229677f454a593

SHA256
261df4fa62e1105d8b8751c00a1ccf7a84ffebe6df90a24b40d5925855486d7d

SHA512
3eec92dd75c4499eae19ac9db81e2f19a8d86c06f9ca0aa23ed2ccd29e38c155eb26118947669266e0cc066ba68daf171e6305eca554727a702cbef0ccdf2123

Download Submit
C:\Windows\SysWOW64\Cjecpkcg.exe

Filesize
896KB

MD5
55279cafd085534e84533d38d61de90b

SHA1
5c2b829e69a0660fe263f3744fd6afad4b265ef4

SHA256
700ff95e0ebda89803f95c5d34187a0fb177ae2834fdc35cf7a01b964a296f31

SHA512
1ab4a20d31cb58855f6582fa15c37f9d4cf139eaa230c791c6590f1df58b93442339c2a851a3a7d0031d70203f9ef5ceb29217787863a408885c922fae20d54e

Download Submit
C:\Windows\SysWOW64\Cjjlkk32.exe

Filesize
896KB

MD5
00a711562247d0fe13e68ebf4a9130e5

SHA1
656a1e581d293b63e8bed4772d7ac62ddfe67e24

SHA256
2417045992662b7a4851da1afccebd9181f49f6b8a4c535bceeb3f4ae2f9fe03

SHA512
8facd34347c84ebf61abd9fd1a907f6c242aedb6a1ea5162f5a8d8bade3f094b8f4d372338601f2c37ba18457358de3f96cfd61a360355859cc151a6809b4d98

Download Submit
C:\Windows\SysWOW64\Cjliajmo.exe

Filesize
896KB

MD5
699eaf1566023f60b9ba18e3ccaaf487

SHA1
507dd885b55c014043238b84f6bc7b2969c2b7c9

SHA256
741e3e90e8a7794e05657eb62a58cbf5551bb989f0d3d5cb8e5cb4bd33ed11c0

SHA512
d4d61a3cc3724bd54af79e51fb25bf681e82c1c24b86a112f60ebf38fe8e4a5a441a34fdc15230c21202520f527a0ac5f5ec3143cb6d3c185aeeafef734c3232

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
896KB

MD5
2fdb87ff0cc5173fec9fd6e469d90aaa

SHA1
a98e2fc9876166492a4540f9831c866417616494

SHA256
1880323c82a94a19a08c2822665a8a6959ef7d48e3c57a2c9c46820c4de242dc

SHA512
e42184b7d69c76923debb7d05f2acec278e768c1adb8da947a8eabd9d36828ce155dd960c2977c2afe2a40c397dacc43e90da5eeb49c3899201dcb9b04a3e56f

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
896KB

MD5
aae940b4c42eac4d8a6f084cdc76608f

SHA1
e70753b105bb448b58b5c53ac0be4ed36f469905

SHA256
93a747f81550e62e286f1bb7fcdb2f0e934a05e74349becdc405bf1274ec7244

SHA512
cdb096ae94d913ce83e2bae195fec96c1b7cf8acf6de6ba60dff838870cdc1058ad2bc862122e63052725d3292a37c4e01acfd28771b24247137122dd743306e

Download Submit
C:\Windows\SysWOW64\Ckkiccep.exe

Filesize
896KB

MD5
59ec498767f900c9bc746dea8b16889a

SHA1
502f155101abe6b0d15bdddd5f6a7474378de07e

SHA256
f700e1f751a024e9359fbd5594e9dc6c5415577e52f1723945450f47dbc37867

SHA512
c4e80ab669dceae3b54332bf661423295f4ca86e6aea9f27f0dba3ffa968fd917a7e531aa1d26dcb024f52fe309b00be9344a799e4832f50cce2cdee5bc1fd28

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
896KB

MD5
9664dacab509a9659228d1bbbfc9432e

SHA1
f625d34fd776de2ccdfee008525e5f3ec6ebc045

SHA256
774b4bda0ed6d409e16bb4d17e6e9dc207ac5ce8feffec1795d078aea22ef3f6

SHA512
15a22ad07281b5cffe152579863f9a6758cb73ae9b1456216120d31b349b7b9eed0522977e3faf102d28d58cabfbe96d5f8c23f2bd40aa35638bd5173ff21af6

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
896KB

MD5
7f02b53f3205341b165a40de16461990

SHA1
7dd232d5b2b304aadc82dc91af2b0aa7a90b9f8e

SHA256
5ce2906c414db94666aae9d52a073e813184d98e04bf91f934d63b13115889a0

SHA512
ea1131da580ccf8aff6d24706db0c336ca48e565a01f7418b539b1a66d2a9f783856c250c5ad8e07a6dc96becc81fa0ea37ee2fa1fd170b903e5a07dca7faa43

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
896KB

MD5
f8e27e8a8e8ee7ea426746c60e2a7572

SHA1
5e25f9c7a5fc13a22ace597f485959dfe75b3f84

SHA256
7501dc434117ee6cec9c1f6b773ab94eaaece2f761580abd109779b7cb6ab61c

SHA512
0f52bd85ac4bb57e549dbe9667e1618d52b0dc9f556774aceb8770e9ae44c92fc4adb1394b0b0978c092f34fd6cd8673c8b2039d87d12fa4fced35dd65143ca0

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
896KB

MD5
f348fe36c214794e37c8a44fcdb71c11

SHA1
24b7889a14c47c5ffc00d80baadd21e939140534

SHA256
e9629ba9dc8e617bf2e45a82a081b7be7da688700fb6bccff6b1074d97c6383f

SHA512
391bcc5c1cd577d7e76a9f618dc7ba7f11fa97581bfb76c17de613f959178b273ba3eb0d0a588868f159f7af19c7ac599e7ff9bc2d12798932486da741ab8bd9

Download Submit
C:\Windows\SysWOW64\Cofecami.exe

Filesize
896KB

MD5
2b2a3123980381405c39e1551ba2bade

SHA1
3cb96635013f4cc520f9dac4b268f7c33100e2ba

SHA256
532ffc295e0fee81fbb0cd890a819aea7dca8172cc1a27c52f4a0741ad7665d9

SHA512
5dd13b25ace8a778d7428b21fdd372eb5f42ad749d0e8fbd34d9405814739cf744a164139fa225de8e2ef3f5368d2d6eb456e6808f3e84f92ebb1fbb26782270

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
896KB

MD5
b2aaf39496485c10a0af4cdd291e0dbd

SHA1
84f4f44d7bc13a6892294b6234fcd5f8be6b7e54

SHA256
496ab4878b1ecb1698bad7fa812dd5a09043f576f04729792983f69b7c0c5e6c

SHA512
49efe05610a2b8bf1605f110c8db3fdf396f4a0509d0bee498e7cdb6fded0992c9a5ebb5ce28d469506edb2e758be1c35df07fcb4e5bb48080b229ec60160963

Download Submit
C:\Windows\SysWOW64\Dhbebj32.exe

Filesize
896KB

MD5
82f46991d1bf2cbb1643d314622f6f84

SHA1
be0e8106e2b3fba6bcebead0e877e5a265ba2337

SHA256
808b3e73f57469a63a9bf7aa15ced00d952ae6286879da3e25017e62caeb9ec7

SHA512
c63f40f20c0e53a0679828b84eeaf7dde207d701ce4d7a894999cd1ceeacf1a1bb601b855dee30189ac55f9e962da75ada629b1e720ff7c6e46fc20ee960f38f

Download Submit
C:\Windows\SysWOW64\Dmennnni.exe

Filesize
896KB

MD5
a15e3bac88d79a4e7e9c6823df627a4a

SHA1
b617fe2ee622df5657ce0caf4661fe175ed16d24

SHA256
80146b3652ab67f599ac49affb1e23f3eb2f9fba979859eacd0a12dd35385dcb

SHA512
892663087d825f093158bf6be2ea4e83ab813e65d8a5492aaccd9f07ebf069d2e36a5001e06d617f106d8ea2fe0315fe5752abfd32709a63d0820dea9d13488f

Download Submit
C:\Windows\SysWOW64\Dnpdegjp.exe

Filesize
896KB

MD5
38fcbd731fffe8e652a1f305b8ceea6f

SHA1
409be211966444c921738560b3e5bce254ba33c4

SHA256
7ded2bb22ee9a7b8523523e3eb55fd4d345462d2943a46efd25188ca493be995

SHA512
90d86ed077982b3e41f5db6126cceb5c277e4615c6c3b38475a014d04bb0c4e79f2b4a17e441b9b80de5c47368e5f413baeaf4c4b4ec9b44193309ad4efc30f1

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
896KB

MD5
2d07b6db2093e890c281628b101d9558

SHA1
b51547a0b8dbb412d5b1997b689abe64a7c8695c

SHA256
26af4169be3ab4b8dab3cdc3b6cdd63b94d6bcfd4f3e5650f29fc863326b49b2

SHA512
555fed85e0deea1215f261b0203ade34b8caa1272daafef1352c0731adcfdc3a9ea7a527926fafed8bb49998409a211b1b87d7d2d9d392e7407044940a838440

Download Submit
C:\Windows\SysWOW64\Eblimcdf.exe

Filesize
896KB

MD5
5e77b14a9647150d8ea5d0e5dee64d46

SHA1
6910dfe96f9c1cebb2f1189ef4803296300f28ba

SHA256
1105264402d219fb9104d31fe5aa34cc97569f70e2199fda27b8a55895c89871

SHA512
3bffa4a253a0cc42d0348212d18e37483a5499b3a1a33ef27d49cda24a7aa48c6a588292075915cb8308602a4d84982b5fedd94e47f969794b18cca7ebbae714

Download Submit
C:\Windows\SysWOW64\Eeelnp32.exe

Filesize
896KB

MD5
0dfbb1c4d0c8589f5e7898edaeaf2818

SHA1
1baf1f51d96c967117768c77e09eaf1df1e68a60

SHA256
4e71bdda1a4a79401a559241980923c3f21aae1310076501898f3fcba118641d

SHA512
59841a38d2816956b7ec72d3e947243ebfd7b2528b88b42964fd23698697431b2a3f3c53fe4bac43368639e5b0c7aaaab74fb101a0402f1d7ef59fefbbc8f847

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
704KB

MD5
b58df3d70bb9cfca1dac7f7f33e2ba19

SHA1
39922e5ee70c57e85abe502e73a25c3161be48a3

SHA256
3ce744df36454767fdb000e4545a168d705fdbb95c522ce0b1f68aea1b1705c6

SHA512
9bf04a79d97773daa60178e72ce8a1bdf74b603131fe8b4f870a15342c522719a3fb6a8a7dd9ba16ecdf4f81a3d18c964b9ca0cc5de377649618f6f5e10181b4

Download Submit
C:\Windows\SysWOW64\Fpdcag32.exe

Filesize
896KB

MD5
1a41a68009c6b45863bc67b3879b2e06

SHA1
1e3b8f2694f33c7dea431708098500d2b581487e

SHA256
a868151750d30ff8feb30c35774a80ff81365185a4abe3a881a6ad561a11ad61

SHA512
6c9e8fc1c74fbe9875f9c4231b51877dd71b6c0ca28736b6a095ddc31339fc8d20418dc3a083e6e470acfbb8a08e9afd344fe3f7437dd4dbe22875fd7fa1487f

Download Submit
C:\Windows\SysWOW64\Gnepna32.exe

Filesize
896KB

MD5
21600c1030fbcd7bdc2354108e4fb5ca

SHA1
f42c7f2d47ebb0bcdca2866c02cdd94e32146145

SHA256
d940ce2a8aebeb37567b4a005a18bb98f45ad040d69c2d846112ff29745c4695

SHA512
92d9b150c5b29e9d86af0fe369a4029410f2fbe204630d584194a2f64a9ee53ac41406edb236d39022df3631365c9fe1b29db7afc30ce843b58f02e38ee91b65

Download Submit
C:\Windows\SysWOW64\Hlpfhe32.exe

Filesize
896KB

MD5
5c7c4a42fc98aa3a13b6592ce2a4c4b9

SHA1
24d91f9360ed0249e1145c9e87f7352c1feae9ca

SHA256
6814554576e6a4e377ebb1051dab60a7594bcfca7e76e5e20e4080125f2d321f

SHA512
6c621d87061761ed95e3d2164ffa3874983f3d694d99dde32f1f8b75920c8b9d820cb00ee0ba063208377f0ab642da5af74c85645b235e35c4c14333f63e9d92

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
896KB

MD5
1a0ba70be2c6d4e338d1cdc91feee88f

SHA1
efd8f9bc967cf4c05074eabe760d70e7abd88a99

SHA256
317d8dcdec2aff2024037081570b7bf54b2b5077cde377b0f2e542fd544a1ee9

SHA512
06497815662cc47e61479f03d66e8f6f7c8a88a978ee7e745e3179c698eacf8c8ab2df523ef764d80ed7ad2568ad521905ad495b9443ec674ecfa7e3eb2c58b9

Download Submit
C:\Windows\SysWOW64\Iahqoq32.dll

Filesize
7KB

MD5
90377f4fc7917eeec194979e7946ca4a

SHA1
573e692db479748409fdb15a6593eaba5d7e281d

SHA256
31412f9f83003a5f5f052d54cead6e8792db0b2bd15d41f062ee00489677d8b9

SHA512
205558e8c0344a5d8ff1a14169fc22d047181553d7311db3cee6a9136031b70618623b29579aae3644c3f2e2d15cf0f6aa2002899182208ac6419891f04c6c8e

Download Submit
C:\Windows\SysWOW64\Iefgbh32.exe

Filesize
896KB

MD5
9da0ebe524697304ac2ac103c888fa97

SHA1
f9aed8614dc7688b604e045e85557efc4ce9b1a1

SHA256
900f9ed23042f6d4990b9ba5e917cb9ecb1d9191b26b07430ee24749963b34a2

SHA512
e0d5d32518dae929ecc4374b8943e061742c19f4264942f6341ed85b6a9b6b60e4025842f5eaab756e0d32de77194e9d91e5557b9cc8b929e6e6c8611fdee7b0

Download Submit
C:\Windows\SysWOW64\Imgicgca.exe

Filesize
896KB

MD5
d745cd2fc48b2558e97e686f6fc831ff

SHA1
d1d2b812cb7cd2d4842ca26d7d96634255496374

SHA256
e1d1219aa9aedf8581253db8ae26caee1f808aa3be23878ad91f68ec1dfe697c

SHA512
8c63106275a17eef9e5c32e1ed9ac7b5f019ce09a5f1589b045bbd8b697719353acd14b50af318ffd4b2540c5fa51698e71cde9bc544144207bbeff549bbe66e

Download Submit
C:\Windows\SysWOW64\Iojbpo32.exe

Filesize
896KB

MD5
7b080954dee97b38a7c6b3e16763efe8

SHA1
a18baab60bce1f969c4e41e0efef46c4d686f7e9

SHA256
9e409db200b06f018a433f830ed02b7bd2afbc2a6b20cd14ec8714eccb2b415f

SHA512
d2f668e4d1003a9f531ca9dbbbae3f1a8bdabddd0509eadb5090bc73a76205da6a305fe1319d95f65fa4b08e93bcb63a82a74f6a52c2637597227326dfd42cb2

Download Submit
C:\Windows\SysWOW64\Ioolkncg.exe

Filesize
896KB

MD5
b023c9bd693a09d9fdb476c1c5b2c452

SHA1
a4d7651e3824a94e85d55233b689b0a178e18a30

SHA256
85f0c09aad3971493ff3290951f8f616a1d44457850bf28b3b0b69d91e927d8d

SHA512
bb7e8a940533a69928d043b0c3a99338f4df70eb026c898c150d51bb85a800d055fa74924250901d7b739d85db887170748fcff369be2d9626e26a12619e2d3f

Download Submit
C:\Windows\SysWOW64\Jdfjld32.exe

Filesize
896KB

MD5
2e0666d2b4fc7ea30f0ba224f9040682

SHA1
8b833b562a431df9eaa60a36eae3db64232ae28e

SHA256
8cb8cfab44e0713eb1cb438562086f18e844f5be5f7dc2f4952aed88f363d777

SHA512
a26315679495f20ff524dd73421528ffe592b715a0767533f6009fd48a79015a357d76df9b2c694c9d2bc4ae763f3bda02b6392b3b2be4e8d4963f08d1d62d1c

Download Submit
C:\Windows\SysWOW64\Jghpbk32.exe

Filesize
896KB

MD5
a7f435aaabf8af4baa29fbb196a4589a

SHA1
593f52d38f6f1b93261a20aebd365c2bc710b250

SHA256
93895658fcb6676fcfc0fc9aa8ed67a268a855440caa4b8cf8bdd264ab1de9ad

SHA512
a50ab421ee4f931f3bada3b71fc707af72bbee1e8e59ab556c30afc050ad628a97d91c10dbb9f1ed9b5ea2887577aad1c112d78948a3b0370210f04d73c61acc

Download Submit
C:\Windows\SysWOW64\Jgpfbjlo.exe

Filesize
896KB

MD5
b75d107cdb92d200c39ee579613ef5dd

SHA1
069a6c2409194bf8b9ac8b821d42fc8a1e92454c

SHA256
d76180e5e7b999bc8523f05626266fd513b5c2eda960195ca9fb3e12d8a35259

SHA512
5b7f6a22f0a24be30f7a4a9b84576648a8e153f6f339427600c114330b3c8110e0afdc40c1395b673703aa0197060a88e85ee132942b227e63e17e718f81dcdc

Download Submit
C:\Windows\SysWOW64\Jocefm32.exe

Filesize
896KB

MD5
cacd1d0e64f4a287f1d3a5f2c2589537

SHA1
071bfd8f6b29c8ad5f4c11b95ff3a9f280ff69e7

SHA256
c89059059ad86ca83229d21642ffe2e0b36bf2dad15a3ed93541e7bf4f4dfed5

SHA512
ad580b69c4f264e5281a529ad7a2c37a01ced36e1d21b73ab4bba46339e25094352e2d3522ab66828a1f3ac6f499f5bc7b81cab63dbb4f496aae2ae3220d2579

Download Submit
C:\Windows\SysWOW64\Jphkkpbp.exe

Filesize
896KB

MD5
ac993a3d611ff10d3b2e091fcd62fc35

SHA1
cf79564fb78aa097ca3fe78078551d54dc0394b9

SHA256
b881aed910678b31bfd9dc408124c6aa31f83ed84d3f27e0200f65bb2296ac03

SHA512
964496527bac9d2d89e3684b0a890ff822b6e679009808b4383de11eb71c83cb32395f8c7ace60fc05d278097d05ae1add4b409abac8fd4829337f7661ec83b4

Download Submit
C:\Windows\SysWOW64\Kdigadjo.exe

Filesize
896KB

MD5
a21e15658e5aa3ac7705206148037700

SHA1
4d6884ab82e405d9d434a653d9cc006590568c29

SHA256
29df33dfbc6dff79cc91dc5d30daed4b2cbda5e49cffc15dc4c6679167da7ad0

SHA512
10617cea15870924bfae9163a591093c51a9975f6656e0283cc990f6a2fd58d918045506505b8ea813d44cb995016bf3f5ac6da347cb18326d0c3d5d83b5492d

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
896KB

MD5
2d02bcfb9c603db0f0da4375b33305ad

SHA1
c5be92e579bcc35639bac4c11fc98e3359c17870

SHA256
a8503292d33c74a742ea023a6cbb4341e57f4827b01221ac55a13712cbaecf6a

SHA512
633f2ba44967895fe006a855dd196df33c8dc67a54d7fac2e8ef45221a9f4ec76882b7062a03d175abf0031e9941c8396c45638b2f3e2711fcbe594b588d4b50

Download Submit
C:\Windows\SysWOW64\Kjblje32.exe

Filesize
896KB

MD5
9f5833a1037a54c54f6b522a1d44f106

SHA1
997f8d1e03a8034ebb7e572200ccabea807749b2

SHA256
f8576a7bfe7d1b3ffe74034e24d38e69631d4aa1a62c4737857f0ccc003b901b

SHA512
9489ce9b39e9ad69e2c006f64ffe976e581ba1d0ef28f7ad1f47c628882a116ca7080020d761309476f2414d84ea0354e169c6c9dce93202b8b43b8a0fde9e55

Download Submit
C:\Windows\SysWOW64\Knqepc32.exe

Filesize
896KB

MD5
bd1c6f49d8474de72fec983028eeab8b

SHA1
93f50b35c1af661da54add0b374600696921d1c7

SHA256
cacea39d4c8ae3fb032a32490c167b7845c771adcf68027e74d4c8233b85afa8

SHA512
cb3445c54ce349e1182b4d0d9a55aa852da1148a47979ea5aecad8b985f3fde71f6e773c225bf33d39301c90f8335b3f8f21168f2960f377f369d34d11ed5ffe

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
896KB

MD5
6a4ba1e8c4c1f4f9ea091dbdc6b88760

SHA1
f7f14d2ef82943c3dff893f0ef32e26d5d83f758

SHA256
ada9ac5d4969ee6d4f890791d79c714933f676d806e77e8418481812a0692b14

SHA512
ca05fbf58080006ba38a9458282287fb3ad8cc40c499c8193f789a8c62cf5d2932e7c4e00fcb1d76332d62ebfe891163cbe56317b93a32641deb479810ae6240

Download Submit
C:\Windows\SysWOW64\Lflbkcll.exe

Filesize
896KB

MD5
931c3fed96b043e7529b0c3ff9b8285a

SHA1
29380016f53040341eced762986ec35c3781aa3b

SHA256
2a04968090468a5d4df03faf4d074e3e8af87777ae26be71e488748a73a458f3

SHA512
53f5b1bb9941ef6d4dc781a450a35c78f46ae1366faebf3cc604ebbb97045700ca8c3e3c1f84b3dc279184cd71a483258ad5ecf6959f1402f51211ba84a46c5c

Download Submit
C:\Windows\SysWOW64\Lggldm32.exe

Filesize
896KB

MD5
433456d358f15935be2a3af25df0620c

SHA1
c7f428139f0e53e9fc296cda29f7f6fce3b977ec

SHA256
7a81d29825ae6d6a68c0ce16e2995511b42209bb19b1c6566bc1a17ba27d71ab

SHA512
ddf738fe809d94de328d0eaf781f6e57ada3bf1465088761f26cd713ee21d4653fcaf0217005018b1237ef744130dbfaf80847805284bc778dafb794aa1faac2

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
640KB

MD5
9b89a66029461b4775e10779706e174a

SHA1
79704d3303a9d94b07863146d69387282fc28467

SHA256
6a2085a86648acb1dc4f169810bf0830d8d4e322d288a9fa048703823dca184b

SHA512
7bc71a433649f15945023544981d97c52376ab713cc33b0f1d06cd88773e9fcfab5127de6265eb0694e36b95aede29a5aefe5fe1c87eb05421ac47e8364c6924

Download Submit
C:\Windows\SysWOW64\Lnangaoa.exe

Filesize
896KB

MD5
16d315f51bc4bf608839dbacc45b7301

SHA1
dc3e8c0232e3d0e0197ff2e6ad58c0b0ec3546c1

SHA256
d28539e76a090fd2d30ce2f35b6f241f225f04caaf80160caed4346180fbf5a5

SHA512
c096e47a03fd70b1619ca3274d0d0a1d49c963b00cfeb8baff1dcbe7dbf5f13853a1efcd9f77e6be60f0975336d6a19180082883c32eecb420e0ba53a5cf35bd

Download Submit
C:\Windows\SysWOW64\Lnldla32.exe

Filesize
896KB

MD5
8f6e2ed4bc96ccd1b77d5a2acaf49145

SHA1
b09baf1e285100431b82f6c59ebf05178e025c07

SHA256
f714ad293cfff84387f250a096aa0b14be2a0aef27e9164331b49e756b7b3d28

SHA512
76b2b3ad853b48d9f403dc35cdd4f54353d7e6e201cb6e86e41235d62fe257c81c882c705e8f15275f86e8c9a34da4c921b574320ba8a08a53e9516459ec0656

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
896KB

MD5
d2cbb1417e6882cbfd3cb5b1cb37c494

SHA1
a1ede57d552575070beeb77cfeddff099ede8947

SHA256
69b0ed7992ae50eb89d55d0af4d2f88c457b06983b36b827d87934f50137974f

SHA512
a3a32d53824550785e4d9361d3dd5665a7defbdec5644a8c5781880b2582c3de94add046b6d586447d336aaf80cc083df6690e22f4d2a35235e415d95a4418df

Download Submit
C:\Windows\SysWOW64\Mkmkkjko.exe

Filesize
896KB

MD5
a1c331f53756eb3cb241f56841dc580b

SHA1
167573bb90beffdfab6b60a1f5324daa7b5228de

SHA256
8746912f20898610d5829a67c48f6c149ca69caac76de50a51f4b2e49ec3b443

SHA512
6d261ad7651af4c666aef9dc74c82e59cf9669155aebbd6c92cb777ac0b6b1e8be34245adcd5c25316f14133b3cb11e3fe4eeb3e368c0c5254e26e86e2fee6fd

Download Submit
C:\Windows\SysWOW64\Mmmqhl32.exe

Filesize
896KB

MD5
8bd5bca14f12148eec6a7aa1e042997f

SHA1
7990a7830c57c85ee68c60cee5172aebba5eb415

SHA256
4d478c50d0dc94f0ccc46d916370b20b257b354c66cf0ce7a5fda9b8c0ee659f

SHA512
4e5664245862b7abef7fb64302ef5d1a73377152ef3bda667c3c6005d4ea682f0f6b09421367c2f5eaeff3528b5f03d234c91c314501f64e9d996fd99d5f76a0

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
896KB

MD5
696cbc1e9ef00fde60fec43c81036d7e

SHA1
5578a9bb8f972a856975d45bcede2a9ae474c586

SHA256
05cc843d313a721de55d0680c8e5e720f3534da90f8c617bd99490393a852119

SHA512
438d2dd7a948f59df4732f36f8132bb98a5e839890a95f01c8a1fada484b06681f91bbaefe48fb458fe71cf5bd8da40b0cfa9a611bd59ee34360cf960d5c818e

Download Submit
C:\Windows\SysWOW64\Mnhdgpii.exe

Filesize
896KB

MD5
27cc2bfa930c20cf2c01d537ea278bee

SHA1
3887aa80d4569f39c0808e971cb017222d072d8d

SHA256
41dae464df12e56ac07d603fd262c48edd1b892104d3cbf97cd793ee704fa2a8

SHA512
8b3e5e36be2355326f6a11036974b345c06c6f97e1f99ba2ef7b86902ab4d74a0dfaae0d3e57ca6bab9113b2fa52cec9dc3ab84c3c41dc9c5a4a448074124e9e

Download Submit
C:\Windows\SysWOW64\Ncnofeof.exe

Filesize
896KB

MD5
05dcf94119f2964dd23c4aff04a9afad

SHA1
b058d3784346539b9c7e44380b47ea035234ebf3

SHA256
d480ea7f60f8f80c8a50ace6acb9ce45da6e1962229d778c1fd8946756fc51e4

SHA512
1a5ee48720e16888eee34d224aa7571e60cc7e54032f2f658816bc94b3e1282f74cc8af4da45a786024e997ac3c1824c5dba8e52d951b5f1a496537ef0bd0ab4

Download Submit
C:\Windows\SysWOW64\Nenbjo32.exe

Filesize
896KB

MD5
00f1d56cb31268b2b8c6bd078b835090

SHA1
f2657b1f0aeba3d44a1c8010ea5b57e724850d18

SHA256
9ac3485167ce3c5d78e7dad1714404f90b1a1c8d166cdd8c5381ca08794d5846

SHA512
524b49ae890e37d1d466bc6f660e3df88d51cfdbdfeddb321897b7bd1f3e397e32fa674cc4dcefa58afa82edd58b2709ae72d3b33f455a0314eeadd87751a6f2

Download Submit
C:\Windows\SysWOW64\Ngndaccj.exe

Filesize
896KB

MD5
a948802ee204a8232b76f592730bef53

SHA1
c651b3c5c277f2ea24db33551bf2dacf9a816ef6

SHA256
13cb614a9c3e3bfd0c5e08db3a8983b78087ced8bc6e254eb857085fd8f5d125

SHA512
2f46c101baefa30b02240611de34e8503ed0c9b2b8e37cd93ff01ce73ef78043bcdb20e4ae6e4f7e0d9e6abce131d43d429401eaa364fce0a182050062a21027

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
896KB

MD5
c64621cd3eb378cc26f38797a242669b

SHA1
5189a8ab114686697fb888b8aad2f7de02600e94

SHA256
c686ba606710f3cedb3316f99f209ce185cee06d54909cfafca86521426952e2

SHA512
e88e7dcd6767d5f6bc5133b60a2cfbb3bf54d9c94f116d3709cd7c63589a7057c4bc9c656064c177f024cc06286cae8c683328addc7761404212c8937fd26ab2

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
896KB

MD5
29d8c41e4d123b759d01482291394bae

SHA1
dba2e1808ecf4d471d5eb85ea4fc225d9e802e87

SHA256
dcc74d0b26d1b41c52ea0726a89848a68f56a1a2c0009e33694bb9722a6a6299

SHA512
a28ca00ad91dbc37440ec80f1244b0064dacc32540e351792de6bfc23ddd3452797b4a4484b646ec065471a1bd115bc1800d18b74155c28e3ca55edb505b7049

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
896KB

MD5
99a728c8409492df4fed4668508743fe

SHA1
4f2d2b76b5007755b915ecf26456aa226d553eb4

SHA256
8cad3464c0ba809a8e4bff7cf2973d9afd524a7735e182f03fc170a2213bf76a

SHA512
23399e2a38a0ed228126bdf7218e7d853d6a1c50ec823a53e56166169546f07eacfb5cfe61356bef85a35388c40b0b31c852fe1fb5e3688a87f7952835549db8

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
896KB

MD5
d0fb0f434020d19044f86991340d4298

SHA1
8daf656825336b37b029cd1171a63bf144799a74

SHA256
8bdbde0449a525f1887ba9462e52b211a57096c419b6fd0b7af046bc0adfd90e

SHA512
08d7b6d4ffbd2ea4e88f69a18e890eba608d42b094b14a0192c4f619664e22cc5bd3fed47dfdf473cba42b84d75562348b86be8d0d4d50630a9d866965ad6a3f

Download Submit
C:\Windows\SysWOW64\Ohfami32.exe

Filesize
896KB

MD5
d766b8464cbfb24ac5777db0e6d8d552

SHA1
d701e5107b7985205c21bec7487e6e75fb04eb82

SHA256
183b73721ab65c05bf15b6fe75fd9f9bd81c95085e58ba1668565b01bbddca6f

SHA512
bd0b95adeeed0dcfe57e97d5185460a86c9de183d7e50f46256dc617a86e1c80b69d54c66b2f4b1d5631546c34246396b3ffdd3102bed875966578240105904d

Download Submit
C:\Windows\SysWOW64\Ohmhmh32.exe

Filesize
896KB

MD5
8ab4f246e003ba9872eefe9d1fc9eda9

SHA1
fc09404dcf58d0ea7620951074c002a107058d53

SHA256
9f19c9aac7002a20b2fb55c6951aca730f23177bf195482fe02180931d1a4c03

SHA512
8cdb36e1d972b3daacb573e55bb2411f4016c48e88e0f688900a309e12b145885f09eec1ff8edd96d4874bc23f624ffa1dcb283ee360e0d0d8dd790066158161

Download Submit
C:\Windows\SysWOW64\Oodcdb32.exe

Filesize
896KB

MD5
10ee4db174e20276ac3d63ea2a82d7b4

SHA1
98e9e3dde12412ebd4f0285e768a748dd5388301

SHA256
532a50a7735c2a0d4f94c9e8303fddb40fff65b1a3dbad4284db9cee061336d3

SHA512
55e623bde576edc285c80557716a1fad62b31842ea2a5588511e8c9e1d77b87e002acc1e9a668fd4ce6d152621d162c324afe0ef946f375750fc98219a87b01b

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
896KB

MD5
1fffc5912e9cd574ef2edc30a267d7e3

SHA1
d6d899eeb44b5fadf49b09b24cb2e16ed43ce419

SHA256
3966393a377b14633acf09aa6f3544635b75085bd9cfc23d0e035f852d500615

SHA512
dd9d29f220ab2ac15eaf59e15c6ee57347fe044df23e2eafee962c09bddd8bd949dab605d27ff8fd7e22ff131f2fad38ab015457f06ec161891f4e64e0de330b

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
896KB

MD5
9c4ebe4fcd5e62301f54e99553066548

SHA1
7afa5bd7d5238bd586224951b12054be926e3c68

SHA256
ebd8b8b8e1981cec2abd08b29cf868d20f12171d337c6137965908e093b0efc7

SHA512
26340540057ac0c02ec25993c0ed0c58caf15ee3cf80a9a88ba1f06504ebd6a0873c652ca57b05666c23a2d4effeb41ba78a318795f32380a1c07342008c734d

Download Submit
C:\Windows\SysWOW64\Pkgcea32.exe

Filesize
896KB

MD5
182db186d5534327d7a853e97ea9837f

SHA1
2d9811baeb66c200198b2eed5a057edeeb5914da

SHA256
35a7bca3be71d62fa70f24c7c1b16394007b75d62a91a38f029f783320458242

SHA512
eabda02f2799db53d3d2e88df4ce030f023d0135505e16d734477f20edeb7908ed56fa5cb09b1a834f79284d06e35dbf7711e9d0dd063f7c49bf3243d93551ac

Download Submit
C:\Windows\SysWOW64\Qpcecb32.exe

Filesize
64KB

MD5
29d13308316efd57cdac6c501d57c4eb

SHA1
5a122d74c9ae09d76ee7c2f51962facdd3149825

SHA256
8fc73d96a9c643206465c89d872f4f686f5111dd4d7302c6493f098e246238dd

SHA512
14ca91988c81a32b817ee262fe7f3cf34186fb092007fcc7048700202900b3cce58849e7a553c18867d5adcb3fd9e23c1656424762f1dc2383ad04d69dbdf48d

Download Submit
memory/32-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/116-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/184-326-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/452-148-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/640-380-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/668-332-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/684-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-27-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/712-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/748-506-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/764-108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/792-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/816-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-476-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/904-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/904-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1044-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1092-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1164-422-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1168-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1312-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1608-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-500-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-440-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1972-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2012-374-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2108-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2108-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-596-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2320-362-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-548-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2504-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2516-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2664-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2800-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-603-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3100-368-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-100-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-464-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3528-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3560-530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-512-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3864-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3868-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3960-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-392-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-434-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4248-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-494-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-398-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-470-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4508-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-228-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4644-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4708-416-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4736-524-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4916-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4984-404-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5152-536-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5200-542-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5232-549-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5284-556-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5316-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5360-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5400-576-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5444-583-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5488-590-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5532-597-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads