berbew | d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d.exe
Size

320KB
MD5

14694c44151240d44c7593bdec657d94
SHA1

722097869436c1f50e33b06766dbbf0dcbaab406
SHA256

d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d
SHA512

595382cf24baf0abdf830d950e4916cb8a0373daa0157de008f4fe6f45fe1b1fcfb015b7ba6bfe799543bebcc3037a3e7b22d6edd0d39ad4c963e3a7bca0216c
SSDEEP

3072:ePL9cW0FNZIDERpn8LDA5OaVfb0gmu0b+qSMJ6CereLjBP3mhg:C5cW0/aDEkDcOYfb0gmbLereLVmhg

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpabni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmdemd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mccfdmmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maiccajf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmigoagp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goglcahb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmnmgnoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkeekk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iidphgcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckgohf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aamknj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aoalgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilcldb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lggejg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idcepgmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcqjon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aamknj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hdehni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlmfeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Peahgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emoadlfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgiiiidd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpjmnjqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpjmnjqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bedgjgkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bheplb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmiclo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdemd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjahlgpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocaebc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igpdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imiehfao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iibccgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kofkbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncnofeof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aopemh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hplicjok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihnomjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgfapd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekmhejao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbloglj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4648	Eiaoid32.exe
2152	Eplgeokq.exe
2060	Epndknin.exe
1944	Eblpgjha.exe
4504	Efjimhnh.exe
5004	Elgaeolp.exe
1356	Fikbocki.exe
2328	Fjjnifbl.exe
1920	Fbfcmhpg.exe
4116	Fdepgkgj.exe
3916	Fmndpq32.exe
4336	Fjadje32.exe
4948	Gdjibj32.exe
1148	Gmbmkpie.exe
2972	Gjfnedho.exe
1596	Gpcfmkff.exe
3588	Gljgbllj.exe
4664	Gdaociml.exe
2236	Gfokoelp.exe
2212	Gmiclo32.exe
1064	Glldgljg.exe
1976	Gdcliikj.exe
228	Gbfldf32.exe
1520	Gkmdecbg.exe
1000	Gipdap32.exe
1524	Hmlpaoaj.exe
2160	Hpjmnjqn.exe
4316	Hdehni32.exe
2680	Hbhijepa.exe
2616	Hkpqkcpd.exe
4684	Hibafp32.exe
3464	Hmnmgnoh.exe
4604	Hplicjok.exe
3684	Hdhedh32.exe
4516	Hgfapd32.exe
4984	Hkbmqb32.exe
2724	Hmpjmn32.exe
4324	Hlcjhkdp.exe
2472	Hdjbiheb.exe
4744	Hcmbee32.exe
4232	Hkdjfb32.exe
3492	Higjaoci.exe
1292	Hlegnjbm.exe
3140	Hpabni32.exe
4676	Hcpojd32.exe
4368	Hkfglb32.exe
2704	Hmechmip.exe
3504	Hlhccj32.exe
3880	Hdokdg32.exe
3308	Hcblpdgg.exe
1592	Hkicaahi.exe
1052	Hildmn32.exe
1304	Iljpij32.exe
3532	Ipflihfq.exe
4104	Icdheded.exe
2064	Igpdfb32.exe
3584	Iinqbn32.exe
2588	Injmcmej.exe
1980	Iphioh32.exe
4100	Idcepgmg.exe
4920	Igbalblk.exe
3508	Iknmla32.exe
4860	Inlihl32.exe
828	Iloidijb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ieoacg32.dll	Aednci32.exe
File created	C:\Windows\SysWOW64\Jjdejk32.dll	Hkdjfb32.exe
File created	C:\Windows\SysWOW64\Aednci32.exe	Aafemk32.exe
File created	C:\Windows\SysWOW64\Jkimho32.exe	Jcbdgb32.exe
File created	C:\Windows\SysWOW64\Bajqda32.exe	Boldhf32.exe
File opened for modification	C:\Windows\SysWOW64\Gfokoelp.exe	Gdaociml.exe
File created	C:\Windows\SysWOW64\Ckhain32.dll	Gipdap32.exe
File opened for modification	C:\Windows\SysWOW64\Lnoaaaad.exe	Lcimdh32.exe
File created	C:\Windows\SysWOW64\Gbfnjgdn.dll	Pnfiplog.exe
File created	C:\Windows\SysWOW64\Omgcpokp.exe	Oaqbkn32.exe
File opened for modification	C:\Windows\SysWOW64\Bkobmnka.exe	Bhpfqcln.exe
File created	C:\Windows\SysWOW64\Kegpifod.exe	Jlolpq32.exe
File created	C:\Windows\SysWOW64\Ncnofeof.exe	Nmdgikhi.exe
File opened for modification	C:\Windows\SysWOW64\Ojomcopk.exe	Ngqagcag.exe
File created	C:\Windows\SysWOW64\Bnkbcj32.exe	Bklfgo32.exe
File created	C:\Windows\SysWOW64\Edhjghdk.dll	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Qobhkjdi.exe	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Gmiclo32.exe	Gfokoelp.exe
File opened for modification	C:\Windows\SysWOW64\Aednci32.exe	Aafemk32.exe
File created	C:\Windows\SysWOW64\Bdickcpo.exe	Bakgoh32.exe
File created	C:\Windows\SysWOW64\Qfoaecol.dll	Cgifbhid.exe
File opened for modification	C:\Windows\SysWOW64\Qkipkani.exe	Qmepam32.exe
File created	C:\Windows\SysWOW64\Omdppiif.exe	Ojfcdnjc.exe
File opened for modification	C:\Windows\SysWOW64\Cdkifmjq.exe	Cammjakm.exe
File created	C:\Windows\SysWOW64\Kjbhgf32.dll	Fikbocki.exe
File created	C:\Windows\SysWOW64\Mjahlgpf.exe	Mchppmij.exe
File opened for modification	C:\Windows\SysWOW64\Gbeejp32.exe	Glkmmefl.exe
File opened for modification	C:\Windows\SysWOW64\Gdaociml.exe	Gljgbllj.exe
File created	C:\Windows\SysWOW64\Phdnngdn.exe	Pefabkej.exe
File created	C:\Windows\SysWOW64\Ngndaccj.exe	Npgmpf32.exe
File created	C:\Windows\SysWOW64\Enbjad32.exe	Efgemb32.exe
File created	C:\Windows\SysWOW64\Fihnomjp.exe	Enbjad32.exe
File created	C:\Windows\SysWOW64\Enkdaepb.exe	Ekmhejao.exe
File created	C:\Windows\SysWOW64\Apodoq32.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Hlegnjbm.exe	Higjaoci.exe
File created	C:\Windows\SysWOW64\Neclenfo.exe	Nlkgmh32.exe
File created	C:\Windows\SysWOW64\Dgmchiim.dll	Gblbca32.exe
File created	C:\Windows\SysWOW64\Iidphgcn.exe	Ioolkncg.exe
File created	C:\Windows\SysWOW64\Elgaeolp.exe	Efjimhnh.exe
File opened for modification	C:\Windows\SysWOW64\Gdcliikj.exe	Glldgljg.exe
File created	C:\Windows\SysWOW64\Dojqjdbl.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Mgaokl32.exe	Maggnali.exe
File created	C:\Windows\SysWOW64\Ddhpmfbl.dll	Alelqb32.exe
File opened for modification	C:\Windows\SysWOW64\Gbfldf32.exe	Gdcliikj.exe
File created	C:\Windows\SysWOW64\Lejgpb32.dll	Gbalopbn.exe
File opened for modification	C:\Windows\SysWOW64\Aafemk32.exe	Amjillkj.exe
File created	C:\Windows\SysWOW64\Mmlmhc32.dll	Caojpaij.exe
File opened for modification	C:\Windows\SysWOW64\Jlmfeg32.exe	Jjoiil32.exe
File opened for modification	C:\Windows\SysWOW64\Lqikmc32.exe	Lklbdm32.exe
File created	C:\Windows\SysWOW64\Iafphi32.dll	Ppolhcnm.exe
File opened for modification	C:\Windows\SysWOW64\Adfgdpmi.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Gbdqegoi.dll	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Gfjkjo32.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Ppolhcnm.exe	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Ckjknfnh.exe	Cdpcal32.exe
File created	C:\Windows\SysWOW64\Ennioe32.dll	Hpabni32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdemd32.exe	Ljfhqh32.exe
File created	C:\Windows\SysWOW64\Gcedencn.dll	Qhmqdemc.exe
File opened for modification	C:\Windows\SysWOW64\Lomqcjie.exe	Lnldla32.exe
File created	C:\Windows\SysWOW64\Lqmmmmph.exe	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Leilnmkp.dll	Mcgiefen.exe
File created	C:\Windows\SysWOW64\Aaenbd32.exe	Afpjel32.exe
File opened for modification	C:\Windows\SysWOW64\Apmhiq32.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Jjjpnlbd.exe	Jkgpbp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9428	9008	WerFault.exe	459

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pefabkej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ennqfenp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqmmmmph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iinqbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peahgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkjnfkma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgpgfmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emoadlfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnnjmbpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jinboekc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnangaoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpmnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgpmmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eecphp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkdgchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfipef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmbmkpie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmnmgnoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmpkadnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjbaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhecmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fihnomjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gifkpknp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilcldb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epndknin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjfnedho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jofalmmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkimho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emjgim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iggjga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbdgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iidphgcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhdgpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpdhkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdfjld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idfaefkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkadfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmigoagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmennnni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emhkdmlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iibccgep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdaociml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hildmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdciiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoheakj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kofkbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omdppiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejopl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nncccnol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aamknj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inlihl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaqbkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbdjeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogekbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmechmip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ikdcmpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmpkadnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Alelqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljhnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilccoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gifkpknp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igcnla32.dll"	Hlepcdoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcnfohmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlkgmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahcld32.dll"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oonnoglh.dll"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iggjga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngjbaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elgaeolp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lkeekk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djiono32.dll"	Ekmhejao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipflihfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdobpkmb.dll"	Qmepam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilchfdgp.dll"	Dkceokii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmgnid32.dll"	Enigke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekpped32.dll"	Qlimed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hcblpdgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aafemk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbdlf32.dll"	Lcimdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdjofbi.dll"	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jghpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmggcl32.dll"	Jlolpq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oaifpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcjeh32.dll"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbeejp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aepjgm32.dll"	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgeaknci.dll"	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbdadm32.dll"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keiifian.dll"	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iekkfckg.dll"	Knalji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lgccinoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Manmoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckhain32.dll"	Gipdap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apmhinni.dll"	Jgpmmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcghdkpf.dll"	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occmjg32.dll"	Pdhkcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncgjlnfh.dll"	Kcpahpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpabibmg.dll"	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mkjnfkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpolbbim.dll"	Nmdgikhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnbpqkj.dll"	Boenhgdd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4648	4052	d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d.exe	83
PID 4052 wrote to memory of 4648	4052	d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d.exe	83
PID 4052 wrote to memory of 4648	4052	d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d.exe	83
PID 4648 wrote to memory of 2152	4648	Eiaoid32.exe	84
PID 4648 wrote to memory of 2152	4648	Eiaoid32.exe	84
PID 4648 wrote to memory of 2152	4648	Eiaoid32.exe	84
PID 2152 wrote to memory of 2060	2152	Eplgeokq.exe	85
PID 2152 wrote to memory of 2060	2152	Eplgeokq.exe	85
PID 2152 wrote to memory of 2060	2152	Eplgeokq.exe	85
PID 2060 wrote to memory of 1944	2060	Epndknin.exe	86
PID 2060 wrote to memory of 1944	2060	Epndknin.exe	86
PID 2060 wrote to memory of 1944	2060	Epndknin.exe	86
PID 1944 wrote to memory of 4504	1944	Eblpgjha.exe	87
PID 1944 wrote to memory of 4504	1944	Eblpgjha.exe	87
PID 1944 wrote to memory of 4504	1944	Eblpgjha.exe	87
PID 4504 wrote to memory of 5004	4504	Efjimhnh.exe	88
PID 4504 wrote to memory of 5004	4504	Efjimhnh.exe	88
PID 4504 wrote to memory of 5004	4504	Efjimhnh.exe	88
PID 5004 wrote to memory of 1356	5004	Elgaeolp.exe	89
PID 5004 wrote to memory of 1356	5004	Elgaeolp.exe	89
PID 5004 wrote to memory of 1356	5004	Elgaeolp.exe	89
PID 1356 wrote to memory of 2328	1356	Fikbocki.exe	90
PID 1356 wrote to memory of 2328	1356	Fikbocki.exe	90
PID 1356 wrote to memory of 2328	1356	Fikbocki.exe	90
PID 2328 wrote to memory of 1920	2328	Fjjnifbl.exe	91
PID 2328 wrote to memory of 1920	2328	Fjjnifbl.exe	91
PID 2328 wrote to memory of 1920	2328	Fjjnifbl.exe	91
PID 1920 wrote to memory of 4116	1920	Fbfcmhpg.exe	92
PID 1920 wrote to memory of 4116	1920	Fbfcmhpg.exe	92
PID 1920 wrote to memory of 4116	1920	Fbfcmhpg.exe	92
PID 4116 wrote to memory of 3916	4116	Fdepgkgj.exe	93
PID 4116 wrote to memory of 3916	4116	Fdepgkgj.exe	93
PID 4116 wrote to memory of 3916	4116	Fdepgkgj.exe	93
PID 3916 wrote to memory of 4336	3916	Fmndpq32.exe	94
PID 3916 wrote to memory of 4336	3916	Fmndpq32.exe	94
PID 3916 wrote to memory of 4336	3916	Fmndpq32.exe	94
PID 4336 wrote to memory of 4948	4336	Fjadje32.exe	95
PID 4336 wrote to memory of 4948	4336	Fjadje32.exe	95
PID 4336 wrote to memory of 4948	4336	Fjadje32.exe	95
PID 4948 wrote to memory of 1148	4948	Gdjibj32.exe	96
PID 4948 wrote to memory of 1148	4948	Gdjibj32.exe	96
PID 4948 wrote to memory of 1148	4948	Gdjibj32.exe	96
PID 1148 wrote to memory of 2972	1148	Gmbmkpie.exe	97
PID 1148 wrote to memory of 2972	1148	Gmbmkpie.exe	97
PID 1148 wrote to memory of 2972	1148	Gmbmkpie.exe	97
PID 2972 wrote to memory of 1596	2972	Gjfnedho.exe	98
PID 2972 wrote to memory of 1596	2972	Gjfnedho.exe	98
PID 2972 wrote to memory of 1596	2972	Gjfnedho.exe	98
PID 1596 wrote to memory of 3588	1596	Gpcfmkff.exe	99
PID 1596 wrote to memory of 3588	1596	Gpcfmkff.exe	99
PID 1596 wrote to memory of 3588	1596	Gpcfmkff.exe	99
PID 3588 wrote to memory of 4664	3588	Gljgbllj.exe	100
PID 3588 wrote to memory of 4664	3588	Gljgbllj.exe	100
PID 3588 wrote to memory of 4664	3588	Gljgbllj.exe	100
PID 4664 wrote to memory of 2236	4664	Gdaociml.exe	101
PID 4664 wrote to memory of 2236	4664	Gdaociml.exe	101
PID 4664 wrote to memory of 2236	4664	Gdaociml.exe	101
PID 2236 wrote to memory of 2212	2236	Gfokoelp.exe	102
PID 2236 wrote to memory of 2212	2236	Gfokoelp.exe	102
PID 2236 wrote to memory of 2212	2236	Gfokoelp.exe	102
PID 2212 wrote to memory of 1064	2212	Gmiclo32.exe	103
PID 2212 wrote to memory of 1064	2212	Gmiclo32.exe	103
PID 2212 wrote to memory of 1064	2212	Gmiclo32.exe	103
PID 1064 wrote to memory of 1976	1064	Glldgljg.exe	104

C:\Users\Admin\AppData\Local\Temp\d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d.exe
"C:\Users\Admin\AppData\Local\Temp\d7456feaaefd846c33fe6dbd601fb9868deae98b839e411064804c9028d3414d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\Eiaoid32.exe
  C:\Windows\system32\Eiaoid32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\Eplgeokq.exe
    C:\Windows\system32\Eplgeokq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\SysWOW64\Epndknin.exe
      C:\Windows\system32\Epndknin.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1944
      - C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        24⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        25⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        27⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        30⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        31⤵
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        32⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        35⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        37⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        38⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        39⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        40⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        41⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4232
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        44⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        46⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        47⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        49⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        50⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3308
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1052
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        54⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        56⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        59⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        60⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        62⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        63⤵
        Executes dropped EXE
        
        PID:3508
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:828
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:408
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        67⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        68⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        69⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        70⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        71⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        73⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        74⤵
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        75⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        76⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        77⤵
        Modifies registry class
        
        PID:3312
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        78⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        79⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        80⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        81⤵
        Drops file in System32 directory
        
        PID:3604
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        82⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        83⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:344
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        87⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        88⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        89⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        90⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        91⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        92⤵
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3296
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        94⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        95⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        96⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        98⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        99⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        100⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        101⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        102⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        103⤵
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        105⤵
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        106⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        107⤵
        Modifies registry class
        
        PID:712
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        108⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        109⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        110⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        111⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        113⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        114⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        115⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        116⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        117⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        118⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        124⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        125⤵
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        126⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        127⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        129⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5884
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        131⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        133⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        134⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        135⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        136⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        137⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        138⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        139⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        140⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        143⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        144⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        145⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        146⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        147⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        148⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        149⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        151⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        152⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        153⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        154⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        155⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        156⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        158⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        159⤵
        Drops file in System32 directory
        
        PID:3932
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        161⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        162⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        165⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        167⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        169⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        170⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        172⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        173⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        176⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        179⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        180⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6496
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        183⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        185⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        186⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        187⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        189⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        190⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        191⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        193⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        194⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        198⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        200⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        201⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        202⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6924
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        204⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        207⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        208⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        209⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        211⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        213⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        215⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        217⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        218⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7084
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        221⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        222⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        223⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        224⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        225⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7372
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        228⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        229⤵
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        230⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        231⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        232⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        233⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        234⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        235⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        236⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        237⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7900
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        239⤵
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        241⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        245⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        246⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        247⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        248⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        249⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        250⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        252⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        255⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        256⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        257⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8148
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        259⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        261⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        263⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7628
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        266⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        267⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        268⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        271⤵
        System Location Discovery: System Language Discovery
        
        PID:7404
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        272⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        273⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        274⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        275⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        276⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        277⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        278⤵
        System Location Discovery: System Language Discovery
        
        PID:7720
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        279⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        280⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        281⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        282⤵
        Drops file in System32 directory
        
        PID:8024
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        284⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        285⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        287⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        288⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        291⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        292⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        293⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        294⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8580
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8632
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        297⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        298⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        299⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        300⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        301⤵
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        302⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        303⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        304⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        305⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        306⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:8216
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8324
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        309⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        310⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        311⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        313⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8832
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9000
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        317⤵
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        318⤵
        Modifies registry class
        
        PID:9208
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        319⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        320⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        321⤵
        Drops file in System32 directory
        
        PID:8312
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        322⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        323⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7944
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        325⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        326⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        327⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        328⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        329⤵
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        330⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        331⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        332⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        334⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        335⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        336⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        339⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        340⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        341⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        342⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        343⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        344⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        345⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9400
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        347⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        348⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9548
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        350⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        351⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        352⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        353⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        354⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9772
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        355⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9860
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        357⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9948
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        359⤵
        Drops file in System32 directory
        
        PID:10000
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10044
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        361⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        362⤵
        Drops file in System32 directory
        
        PID:10132
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        363⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10220
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        365⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9008 -s 424
        366⤵
        Program crash
        
        PID:9428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9008 -ip 9008
1⤵
PID:9348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
320KB

MD5
0ae5a2792109f174eb141ca77a7712fb

SHA1
fb99a21f56d05a19ccbe1feef76b99159bb8a36c

SHA256
58e7ccf795360e801156ae30d6def32ba570beb0319f8f4131a3c26937596f45

SHA512
695e2ea6686fee52e9eb151274c90c06d1e47ea52a0e2e18cadd7e088829c8dca8d513b7eef4590423253f46d971dd783314622cf6e240563a9c40713d2e7fe2

Download Submit
C:\Windows\SysWOW64\Aednci32.exe

Filesize
320KB

MD5
dbab29897f7f75ed4ca25e19870bade0

SHA1
38efc7af2b58cbed3836d8bf9766da087464031d

SHA256
069540d6dfe590dc2806c406246303877d62c54a9bb8cb5c34b23795fefd7a33

SHA512
f8020cc958f8b0eb9711da772d81e3d60801dfe8fc5af405c225a5222fd5e5f678eb742ae1653844a7e8415a22742574f59768c83079af2ffdb2398e12d57c0c

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
320KB

MD5
e679fac1635607e94c9b27fbf64fa0b0

SHA1
41d33c0f427fe1c046b97b7c0a115f6e0e16ad9b

SHA256
bc8bf0f6b77cec3c5519f08e17ce8236a7f00162f70f85a1362344c4a2ca2626

SHA512
6db85a353b4dcb3f41da0c867a07ffa73d04f7efe79a909c41697e861f60a303c6d58f299fbfd9b2b426dd103035754ac7bfeaf7609133f211c912d6f88e1582

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
320KB

MD5
422306ff1fee40f7b4ea3bba045ada4e

SHA1
0110bd262a24bca121be0cf83f0e53f53da14c54

SHA256
e05eba9c97f4e21c804a5617753a6596d205916f1a454310eeefe622cf83c69e

SHA512
052812ccc371506e2c7d5dac95ad4cb581dc8fa3fecf3c383fb39928dfae0eb4b8369bcb46420a1103eee9103fc882060b259078138037cc8f7374dcd36b5720

Download Submit
C:\Windows\SysWOW64\Aoalgn32.exe

Filesize
320KB

MD5
82b0b368548086593747a524e89d13d5

SHA1
3c4ecc114ea916b08ccea1aba707e666ab85c352

SHA256
63af75720d1861373d9d8d1e5c55b776eea7867788a09ff0dd5050abc12c0b3a

SHA512
ffc275c51eb3760ea8bac471955b7dfce5765d5d50cc206994f2d4d1dd3b7663a6e78f8809ce1f8f8cbe10da4798c899cf7e9cbd659b87b90eebc6873d792cd8

Download Submit
C:\Windows\SysWOW64\Bgkiaj32.exe

Filesize
320KB

MD5
f0896a6da24cf5e5b42e0e4d926649e8

SHA1
b26bf52a7581253623e15466c8085db948d45966

SHA256
9cb4426f4a95f51032ec4e02a097463f2ca10705aaba1850ef5b03e591b5374c

SHA512
be3f30dd73ae87efb5d4b9cf4e37c7357360b1febd652d963fc7b565d9900a60b46b1e57e7250eeced737d5ab75469d5452577f5410d8e457b53cadffe8b0829

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
320KB

MD5
4c03e32ab4becc08e6cf0aa48783cde6

SHA1
975a83fd1eca86e6e6cc813562f7354e24009bef

SHA256
c357444c7f4e0014ea422b1f83149079123c689e259c4fe6c5855fc8e9d07dac

SHA512
7db49e22b3b669b1a7ab00214ab7849158e0b961588393b8e541d5277eb43ea9b4e5dacac7996ddfe9d709682673b2b2b5a74fd30a5bd136f95deb7f32205823

Download Submit
C:\Windows\SysWOW64\Blgifbil.exe

Filesize
320KB

MD5
1e1a51c2b5e8bc9d860a4ee8f78197ac

SHA1
3d6ad2cccb7f70956d9d72cd3042e8ee140fc778

SHA256
49b4333e8f47279206afdd1d71bef8582f16e2830ec5992318a40eeb4bd9a96f

SHA512
742e94475577172182d8a40e13b3a796911ffb441b99cd4faa3cfa1a3e512414be17994a9d31f3a2a777e865293b17a575610071cc23dfb0fbb6675ae76ffacd

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
320KB

MD5
fdbf4f0ea69496d48f3f8c4768bcd7c8

SHA1
88397ebaa7fcb213069e8c40bba721ad22cb1601

SHA256
8a2a2e83b9e8df529865d8f45d8cf44b431c6d1f1dcb878bb38785913d1ad0f0

SHA512
b6608e2808fd8778adad7d66871aff7698fcc7797131a9a6e49d2c9ab1a9593365d481cc93c7d1fe9f053447b8d80907e655178dfc54a499cca7bf38fc4d35f3

Download Submit
C:\Windows\SysWOW64\Bphgeo32.exe

Filesize
320KB

MD5
ad70cedd784027504bf5638cdea11d69

SHA1
7077951fc08044f8ca61497360741e90df92bd4b

SHA256
f34d716ece49b3fb2519daa69332415115c92ff262bd7c0280a36b3aa84c7505

SHA512
b605bfa1e7c490a0cbfed97d21b4a4ff32a81003fde1440820749744bfd8f586cb6034fad8b124b6dcc9bcc76f3a20e86a5788647f3e939fd0541e2cf01e1835

Download Submit
C:\Windows\SysWOW64\Caojpaij.exe

Filesize
320KB

MD5
1743794deaeacc1f0dc0fc58521e7be7

SHA1
79f8f109bfa75ad12e602359d78ef0f96ec372ca

SHA256
17189220ce8a66a863783cae628240916965f1302307c1a10f0fa848e5f7cfeb

SHA512
c111e6af3232581bf01e6b5fd45b2847c2f3b89e741bfa0654148a2642e7e46e3aef0b565817e85c6c53df0a064538064a04f2af82ee9d8fbe69fd59c993a974

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
320KB

MD5
43d73906dab8c72b3200d1bb6be6d2c8

SHA1
ceb559dbc887e629bf987f325d9979a716838300

SHA256
3ff96b13549676523a73dec087abbb5e2dfbb42bb265be049f5732f69aa996b0

SHA512
1d1d7bb96974316d58ab544d52e116863f76223883e03112d77925a36568e94d372ab25e4c59f3a27eb9ea7453e2369ac8554a619e70d868cf35a0b8f1937b64

Download Submit
C:\Windows\SysWOW64\Cdpcal32.exe

Filesize
320KB

MD5
8372164add5bb069676e157a0d87b9d2

SHA1
bf3f5af475d7fbb0343972eff3b8ca8c3cf8a85f

SHA256
28a3d2fd32010f9270e6a490321b92f74cd94db698ff9808dd5398c13818b77c

SHA512
64ba30d3a16e41cc1d437624b6de763a8c1b9d3d0eaa7244a110a4665860cd3d68a5733f1b77e8b08d2a76996457bb69a8b2ef86d42d1b4fc5e2a8108b4d2538

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
320KB

MD5
0882c2489a2d34f3309966d6beed9028

SHA1
ad3a250da4c518a2ff1374677b97b4f66345a261

SHA256
36f92a16ef72666d299e3528600d3783be38e12b6fb3da9b4f7dd5462ba03d07

SHA512
8169924edc3848b9481a01d707816596146d757d9628449f8915b5c46d349b780edda77e7c7d6abc3eb0386772d0b86feaceae6e15222c495aabb325cd060560

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
320KB

MD5
24174580f873ec03706f69f40cf10199

SHA1
c41e746451707201c8b2df42fb92a22c70721f06

SHA256
d3ef5f6015b485b368546c5430fda98e3d9545ca38593471f921a1bf6dfffbd3

SHA512
79dcad07b21b5177f98bbf2924fb3ebe36f063f89ec9e30d6d56602c21e06b1f893b684643de7a31dc16dc0f6e2a601f60f502e673947951ea6921708302e0ec

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
320KB

MD5
a698d336b91d4e3bba070ac919c56033

SHA1
88876df1bc9473c15c7952303fdb8b53c138527d

SHA256
d009502dfeb6dddc7e7f8b2418a337ab78ecb576e0513c1e65bcfe9868ff2b60

SHA512
774d11f8217d2e8189cb5e66079ad45e796c34025bb1b699b52781816667649ebbd7167a514acb3813031e59a200ff187c3ed845a98b799b157b222e90f8f524

Download Submit
C:\Windows\SysWOW64\Ddgibkpc.exe

Filesize
320KB

MD5
c56a704b891990f3dfd285d0b054f1be

SHA1
93b41e9bc03588dd71a6dc76a95063654b1859c7

SHA256
507e2e9b11f6038e30625b8d5142617d4b21bf3eb43c02646266f558684cbe4f

SHA512
1b50527a3c1c80944ea5ef4aaf9f6d496d0d6579ffbf0804cdcb1cd4607887a90e0ff3324b5f5272ff212b71383b351689a2641e6708921417c051e9f15bf908

Download Submit
C:\Windows\SysWOW64\Dkceokii.exe

Filesize
320KB

MD5
a3a9915919fc5d27c169bde2e29229b9

SHA1
296ed12d81521f43dc7bf7d77f8abbd3f90e3037

SHA256
729d09d030bd48ad08e2481c4647aaa788bafd567d13a41040930fb4541c60d4

SHA512
755ecdb6a8a165d205a7b7e42a8208e35ac547e7abfcdc75a11165c49eae86ea4a328aa3ebd87e41407ed6ea85b7e1edfd01c34aed83f54f7b398476c013ce51

Download Submit
C:\Windows\SysWOW64\Eblpgjha.exe

Filesize
320KB

MD5
ef391bda619517666376bc8ddf68db30

SHA1
83dc0a816b35bf4a42722ba88c27c369e596cb13

SHA256
b6623098ea3fa220004cb48edbf6cd68131201a08dd32553813a455ddccd1e0f

SHA512
54e6df3ea69ca1f7beae3c97f27eac48199047047ab4f38d881ffbe9cdbf80e186726d63bf7a704eec4ad0fdc80e25e64a73b7033831f4a37809f827c7eec280

Download Submit
C:\Windows\SysWOW64\Efjimhnh.exe

Filesize
320KB

MD5
551dcba035e8cee0b345658f664fc5cc

SHA1
1c4bb829eb8d971441d190fbff057c1a2c964948

SHA256
c8e05531830d0a67a372268dda9f84e197e0940b5f87df9bfba248356f8157be

SHA512
5478a8464945213a9ef82554e7ab6da0b8f144a06637817d695761a4176718cd769fca65cea6bb74c6192d958508576e68a3f88d1b72bf8aea1e4b5a6f4649fc

Download Submit
C:\Windows\SysWOW64\Eiaoid32.exe

Filesize
320KB

MD5
c3aed6ff1419aecce8e829733c8fdbbd

SHA1
0106d9b8d75cc93cc968b54955dbafe11b83fcc0

SHA256
83f57297056c54a102f6aa78bcfe11996074e468fbc7bafcea05c3a6daad4292

SHA512
525f17bd5b0cf61b5fef718355b673b1003654b59d9bf01f8fecd19ed1fc724d212bc955219bfd09faa5cf7bcf8166a83534ae08406894fc293fa17d1af93800

Download Submit
C:\Windows\SysWOW64\Ekmhejao.exe

Filesize
320KB

MD5
85ca41a9470316303e7b883b895c91a6

SHA1
e4277e6754f2a026600c5ffbec6379dc7709a153

SHA256
90670657d33b308ec23a32479dbef2e338dabd3e742576b0f3b776932c9e5e85

SHA512
dc6739f58eb9a96d3357a488717ebcfb7ee87b2bfa5f0d347bb5096ca5633b8e582a28ddbf0e6685a92adc490eb217efa9f46c81c79e8e44c8e176662e8ca19a

Download Submit
C:\Windows\SysWOW64\Elgaeolp.exe

Filesize
320KB

MD5
cdfbddf9803cc9b40d489c21bdffc6bc

SHA1
e23214a765a8751b55436a92b2fcfff256ddafb6

SHA256
af2c074d4c971dbdd4ccf373019221a2c282cbbea61ced3a763b07bd48cb55a2

SHA512
73f662f749221a92441dc92606b88c44f25f4c2d2e33aa729700c74a772cc4deef01bb29ab449cb7742adbd6fb0cebef674483a3a73e32e8549d99413695d6b8

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
320KB

MD5
f5936ba2006409c6688f4ae8744d0a0a

SHA1
943b4b584638f9e8244e2f546e464a5accfc84f4

SHA256
f0400ff18eb9cf454ebf0f4f7d83129f418008851fa9e170ac93ba07d69e9943

SHA512
9382075b53efc54ffee1c47ad27ee9df944afaf819d8cca813c3edd886481e40258f597513c40750b97777831a0d7223747dd6d84c3fcb58c494a30a97ff8ed0

Download Submit
C:\Windows\SysWOW64\Eplgeokq.exe

Filesize
320KB

MD5
3a4663f86cf2d82f8e732c29a87b62e4

SHA1
c29f94dc69c8ef912b3d310d07861e76ead6cb05

SHA256
9f42e1a93a8033d2f4e13001a013558e406f2f65706b40ea403e51c544446933

SHA512
dff1975e566fb73c4f57dfe0ed0988a85ce09d7b801e052772347473cd89b29b7affbf6d361e019b608b3e3c1932ea2e80b2a6170536140e6b5ebc9f66cc8d7c

Download Submit
C:\Windows\SysWOW64\Epndknin.exe

Filesize
320KB

MD5
d3e8dac6aa5bf87500551bc684813eca

SHA1
b2f223c3159a6311c7176922fab84cbe29d32240

SHA256
4ba5bb7b1017522cfa206929b81dc25836d82856dce7da4726379dde5586b734

SHA512
4976adb4cc488b32e1ea13ebf88d5600fa8162339edbbcb27cc836cf1e21bfe8874ebf677f85de9ba03015a5bb733f25641ea41df13226b61cf09dc7e9f3d2ad

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
320KB

MD5
c9d0481ee2dee48ca83a51840413ebd2

SHA1
e33cac2af360971a1e5b4e8a9b911235400ffcb5

SHA256
d6d1daecc07e27ac818f8aea088787768fea0cad220f1402e732c18dc932d34f

SHA512
22976505fd09bf39e0998094fa1e38eb024844a5162311d0aa64d00b501224d9c6ce9bdd86dee750939fa54386e337d0136bbeb2bcc5d953551e775c5b6cfe9b

Download Submit
C:\Windows\SysWOW64\Fdepgkgj.exe

Filesize
320KB

MD5
94d1f9ad84a71c084df8d5fec7460797

SHA1
a0189a0a64504f0bcf96fbafc47d5ca65c7a4c77

SHA256
d49d4cd0a7ce8e197041982fb7508a0340562ae225213dec6b70f89de7738175

SHA512
968104b65fae30fd2d9cfdc1e96f3ff00e8a3178e6cd04c28d5b3c6046984ed25804ebf5ab8c12d8fec29c29335085321837c0d05cf3e9174dd645f31cf6428b

Download Submit
C:\Windows\SysWOW64\Fikbocki.exe

Filesize
320KB

MD5
8e41a196b5e45231eacbdeaad775e772

SHA1
81e8d1066a74440df08903bd06b5b19cc1b10336

SHA256
2b5d9f994097141fca8878751834e7bf5a7b6d2eb94d337d89f075b3978386cd

SHA512
1bec69317a5bd497c62e270a55cfc83a5b92f0e3a90f30534410bc2290caf9b256d46713c43a2ea72c46c1f78ba941633af587ffbc875e98ff34437c8aaee93b

Download Submit
C:\Windows\SysWOW64\Fjadje32.exe

Filesize
320KB

MD5
570ccf2fb80feb866a05b43bff431dcf

SHA1
d2531181da2feb9e48a28209e08bf94eac7afdb5

SHA256
b4fc1d4cf0881baea18c2daa064554288eba8e2b736bdc92565bd5ddb3e54b5a

SHA512
786a648f0d1e75f5c1a54809f2852cf2b6d09a7d83a8986b586b2b24beb4374f0df2bcee229a5fa60a09f83a16d3bb6d98177fbbe0b537ba1840e6c6242f2b70

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
320KB

MD5
c2ae68a0c076b1d003463e77c3d2f587

SHA1
4d8c338c94e9a06c87c4fc07f5a2a87af9e38be1

SHA256
71074b4c2ec6eca4691808ec7308737901bb9e22a1369cbd16d807120533937f

SHA512
3fe1ac1a211bb8588b4a6deca938ffc3bca2b6d77b44fa8cd5ea4ea138b9bcc6530a42bd11d3106768181dc55a9cdae990d3445b8f5a7db26e3983f241e71ad2

Download Submit
C:\Windows\SysWOW64\Fkkceedp.dll

Filesize
7KB

MD5
8245d0181d310da1f60c47995159849d

SHA1
03d8fffa637e506e1c9f73f1d599b77980316679

SHA256
609df80808dd434e820f3cbba8dbfc691cecfedcfc0696ed3fa105481359880e

SHA512
e806ee944d1513721bca67d7d320ea30b4a55b9354f5c43285fb9de57f294ca033e8a129338d53b4e072219f7cdb9e087d5101fae20a994a9743d96440686611

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
320KB

MD5
cfc7c594df38181f0f41969e942b4b09

SHA1
20a37f6fb76d83b954c7e42a2313fa0254f9d922

SHA256
a744a9b172d9c72449942c75f53a770010c546fe857f6c24320ab6c4267e9138

SHA512
fb42e3fb413e4ab95829311ed4a0ae0ef935dccad3f769241664cdb5bf0bb1ef30b03d6dd356a46dbaa39fd88c1dc5a31d4982fb6646e116d030980d8d769786

Download Submit
C:\Windows\SysWOW64\Fnnjmbpm.exe

Filesize
320KB

MD5
c21af63733d7c2a23db21ddf7490087b

SHA1
53f73f4445d4da2de030795fac699922378c503a

SHA256
bf10c82be0bc5f3a67564d8ed4dd5873b0e0be693b57f4c1d68577c1e09007ab

SHA512
579eaa9e284a79814769e4ff8b6142d681e673570b67048fe103b870fa4a7294abd1c964620ac7f3759ddcc02ca935b716a5c19f282231dade1ee7e16b58469a

Download Submit
C:\Windows\SysWOW64\Gbfldf32.exe

Filesize
320KB

MD5
6c9db87554d6b3a89a9b325765d334ae

SHA1
4f1aef4d8e0af357480926b8d384e956181de5ff

SHA256
1c5e90511a986bdc05dddb294127267e4f4950a13e064d81e9791bf4b2739968

SHA512
ab39f2e5356b2fb7632beb56027429e4bb46c7264d02bf3888f83a791d783ef84686981a3b3494fe4de9e5c65a847d7f36d13f061763e8b9c80773e00b670982

Download Submit
C:\Windows\SysWOW64\Gdaociml.exe

Filesize
320KB

MD5
dea96e4feb6575b7e1c2c0a32b0cd93d

SHA1
83df294d5393d99649e3c8dc8ce698038b823baa

SHA256
522abcb9085438b2174e56351261d8e92f371dea717ce0304b85ecc9ea4214ed

SHA512
b417992ffde99bc290c72c5af99d328ee9b136fb8e176ed33e4fefd8708e1fcd5ecb07282ba402ac9fe7882a71cd54b8bd87d20bf3ad81baaf78bb5b00a2c6e4

Download Submit
C:\Windows\SysWOW64\Gdcliikj.exe

Filesize
320KB

MD5
248edfaf9dc3524f9bd0ae7c41901140

SHA1
93b096acd4bc98573bdc7ab089f9b9d56d855695

SHA256
da5e7c3f2fcb3e91498f185692a48da739315821062a17cf38550c378243dc4a

SHA512
44c56535eda6e81ed7090d7be9cacb1ffbd3c1f2708f2d8d14d3c9ddaa9b1a624880ffd4fccb612394c4c6a6c913338eba9a5367fb5d8217a9d3af1a63e05aa1

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
320KB

MD5
2d746922f44a7bc074da6528a2ee7b49

SHA1
a0dfd91595abe74fc553ed2b2cdb3e0d86fd70db

SHA256
1a227e782e3104ab48d9a4a458f18a2c3a0593a35fe47ed738b1a825944813fe

SHA512
41637d873444a6bf0970e6c4eaad0ed03d2a822623290e04e1716219a7b84e15a371ab7f17a48eb53180eb4a91d99a7ca299f5c005a966d134ae7c32656c8199

Download Submit
C:\Windows\SysWOW64\Gfokoelp.exe

Filesize
320KB

MD5
717a438cb8370b3ca9ad36e7a6513963

SHA1
d698db6e8dad149816fc9abf21fbf166f551aa43

SHA256
77e4a7515826f0aa83fa4807766f519d0bfa424ecdecb3fe205caf0df2996e67

SHA512
a1d23f91c485c87274e81774b367ca58dd89e22dc6da17d440c5c6c2715b5ef8f5a667520e217890c92226674c44e26fb232deaf28d20c3dde4fa9e8c0a23946

Download Submit
C:\Windows\SysWOW64\Gipdap32.exe

Filesize
320KB

MD5
75a2817ae2f6520b9a2a709bfb2d61f2

SHA1
3b30fa3cf15b1385edf626d08077664c875dbfda

SHA256
2791f225796e1e9a4323042541b6ef935b39ba63f9f96b6c98c641630dcbee7d

SHA512
a73ed9a93d4cb2b8def9dde7e5b1800cf359b4a170e8b007aaa92bd10931af8fb7d27ec7320ba413e79bfa182b9a8347bc8707007f74a394fdd1d6f536b9d86a

Download Submit
C:\Windows\SysWOW64\Gjfnedho.exe

Filesize
320KB

MD5
535c0e3ff1d942f5b49b6d6a631df2a9

SHA1
45a1b1f5ad13c94715c0f7f0a83edc70bb80a508

SHA256
431d886fa30591507cef28157e070573a3dca9c7c72de88502fa7753e6f709a3

SHA512
1ab10390a590259f21d5105149f83967f5569fb65a3271a07f9c1bf5cbcddf0e9898eaa14ad28b813ff981fb23f3317262fa208e297093e0f8bb4e5a9874be93

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
320KB

MD5
4df7ffc4b2168dda28f3d94226049ab3

SHA1
5d0fda4c748c3f61eae4b2bcaec6b036a3863aa0

SHA256
e2a2a5c17e848b620cc077c8ffee21ead7232b8f27deaba4afcd40a94c849f77

SHA512
9524e22b44c02d519df3856fa7e105a8a018567905e33fac0d87da8d52fbdd66fb61d87dd2e2d4c6489a0489b2ba8450639c10df2f4353940d4a7432f55b1048

Download Submit
C:\Windows\SysWOW64\Gljgbllj.exe

Filesize
320KB

MD5
c5147042eae0b802b113e7f1565f9bb8

SHA1
836d11de34540825e5394eabb4cdd051d07b2abb

SHA256
028d7fa524a4a346d0bae1870328c4c2986bc6da63e20b936a849be04799db0f

SHA512
437291fcc284db2795176449fb3bf2150ae364921af6961823452ffd370b0f3c36868a1036e1f00264e067ec45edcb070c3189fc26c34e82b3af8516de1b7d22

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
320KB

MD5
f3aaa2d5025bd99948a3b51f10cd7b65

SHA1
9b4241e884f6ef6e3e113d2576ec8991a04db5ab

SHA256
d300ff19df70890ff558d769616dc7df0d8b62da21164d29ed158bd13cdeaa0b

SHA512
6e958e63a7fff5937358611e980dc20f39f4c9f39f491d7f80645adc5eda4cf845fe289c02a06607d509346b252586568fcbf562d68c84d76d8d1c08164bc805

Download Submit
C:\Windows\SysWOW64\Glldgljg.exe

Filesize
320KB

MD5
ca3eae1b05afba174ce11b8230cb4ff7

SHA1
4d9b603479a78c979b9a38e43f6af8d4eb38dd69

SHA256
d73709a202b9df8fa364e7c4ae7b9b8f27517fd2a8b00116c908b0c33f33730d

SHA512
c482937c11c46a017a364f8c1847a3e0c71866aaa355a765488e87b335b6bcee7c1fa61691f0a067d719c15eb619d4788546af5d3b28a1536b62f232a2ec2e84

Download Submit
C:\Windows\SysWOW64\Gmbmkpie.exe

Filesize
320KB

MD5
400fe3d0b77f68f95354a798de541708

SHA1
56002876e5a54f1fec7e164da19c8a5fd7f31146

SHA256
4a0c715c11f49de199746b6ce03e9455b6d062c4eb48b6a61aeec2d0d2cede5f

SHA512
e35357db81ec7834e89cdf171cc9a2daa467518aab42f462c6ee9f503480874f902b2ccf469c8a184ca56a60f8b9354ce9e1f74e41453712ce765ccb2843f8e3

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
320KB

MD5
2c63d180ffa43361e3cb0f48ede94e81

SHA1
8f463e4e81912cb320e3dc6c19684e2697972591

SHA256
1acea99fd76d2853de4deb590b5f5d53fefaa9b07729cabe50caab1b760e8ebb

SHA512
b9fd2bf1857a6f5a3f1efd411493b346b6406230ba158ae82bb8cacf54136b60c051bdb5520a18c7b1dcc0ad48e6401b5a4b7857a3bed5373fada089027569cf

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
320KB

MD5
2671b821b18e06c2ffce8e2c639956bc

SHA1
d189de0aba078b245a7340340cb56cf6c87513ac

SHA256
a127ffc5bb3fea6c9bbf329ae49b66ed3cc282b270ea663e64a088863f463b5e

SHA512
1730ffac849b6d892413a5e039d36c976e77fbbbb8d9de630c5f85619958ff7a37769cff4b712c1b6f4d1a7b201ad904411c0b6393b56846be17b7eb6d686475

Download Submit
C:\Windows\SysWOW64\Gpcfmkff.exe

Filesize
320KB

MD5
7e4305748f4ff8cbfe06fd7fa64e4e82

SHA1
a2752e069b3b1311fdf187e47c0b4e8b519bffdb

SHA256
114cfaa931605f00fc9479ce7ecfc90932077a443d4fe6828be9339312f8a6e7

SHA512
8786ae165ed3c1a47500936d9bfb710e9c7d3c46797afb435ae0e3ceb2696edeb71882b49f5fbdbb873d3e3a1d2d929560f711c2cb860fc2b924ed5d3f5327ff

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
320KB

MD5
1648e26751519dc4fcc82e0f0f7b8902

SHA1
c1c1c4d8182729d6e2e0057109e355d033f59167

SHA256
450881ccc409402f4d0336a7f66ebb36a3d70a2399420efdb0fab2ed620ab1cf

SHA512
6b4ad13aace80e8687573ff2df2d8bed013f84c8d5e7b8cc05a4adb09fdb78935d0e83bb85f34c03d50c96f1e577a70e92fb992019c7f2f331252c003029e694

Download Submit
C:\Windows\SysWOW64\Hdehni32.exe

Filesize
320KB

MD5
f5f72cc3a27c67af3e6ee961c2da645d

SHA1
1f6bc841ffec714b79c54a7e144e09c4eff4809d

SHA256
a809c347a29c172a71c940a53a3bd47a7a0bcfee59c612826aa90f6bf5109b28

SHA512
c8875ab9b9325b989932ee3d842ed0713f735150a81bba64f61faa1cf982ed19a170e7474cf32ec26e9bbbaed3e4d0ba98da583c9ac1a7ac73ca703a28aea65a

Download Submit
C:\Windows\SysWOW64\Hfcnpn32.exe

Filesize
320KB

MD5
213fb703f5a000d16d22aba1a3a5056e

SHA1
b9692e63b212a35d91c2620a50285ec55a7ac12f

SHA256
82de1dc01ea8ec73eac4f9f1da4e44c18d0393c488f7f06bc9c45bb9717452ab

SHA512
633c3b6ce671c7cd43a1ba34b47b28502e556ed4229bd4c161bea846909767accede60e8510d40a0b2728a63bdb95c524edb808170824aca7ebbf8168068eada

Download Submit
C:\Windows\SysWOW64\Hibafp32.exe

Filesize
320KB

MD5
fb3a62f29978ed54ce1cbe247666506f

SHA1
bd9bfaa4a339905e440575c6b4b5ebdf11e75382

SHA256
38557276bfb4c333b36a5b7879ae97bbfdaecaea16852b87bea212e0ea85b568

SHA512
268708fb516d8bd2c14d73819348da3bda2037f039b9379c4b83b506485ebf71c27259d0a6958aa47ecb812a73d567dbd82c6bbf9cb120712332cea6f770b9f2

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
320KB

MD5
6eb2610046b23c60c01250566155215a

SHA1
cc4e2c490cccf547d1c1f014a3d3c1822958dbea

SHA256
7073a897f3a6e389a5801d1922f65cb0548daf6d88bf3c24e39b9edaa99a01ac

SHA512
ad32aad78d947e961e729782dcc76d96d0c30c5829c745c266d5e9068bbbb28739e88ff8152fb898d76766d69efa88be4e4024fb4e0b2aa30f55ee0cc186b532

Download Submit
C:\Windows\SysWOW64\Hlepcdoa.exe

Filesize
320KB

MD5
1e6d1e601177aaed1fad66d26a6c921b

SHA1
fffe98d8012627b009a1484951c02f8350e9781a

SHA256
ff87ae6f83a73b5845a995375db9e59a11d7fbabdb8f3cbdadeec33cb37248f5

SHA512
e5ddca490c89d94955055c4d6dba021a72bf03128f3a5d7aeb72dcee4efd61dac4ee1442ab2677f541d55ad8d9abf6bd29b6b4b9ce871272746feefd52ddfe2a

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
320KB

MD5
0ab9952344b7589e7833c0d29afc4ccc

SHA1
5b68a792a8c3699bfd295966f468015ecd8753b7

SHA256
af6132bc6b5276714b498fda1ee7bbf126a0bb97d3d977d8606d7ddab8b4dff2

SHA512
a0449d6ec6cc8677d666953054669c2a21adbe1f986406bed292e9e5d2abb7e6016d6a617d4b5c57f40613b97fad52a18398f7ae4999ea1b146d91fc86d757d5

Download Submit
C:\Windows\SysWOW64\Hmnmgnoh.exe

Filesize
320KB

MD5
d223a7d69e762bf9fce5570b55384b1e

SHA1
57c5714c73a6285a99b01b759bfb7e53e5d46faf

SHA256
9dbf95a79026ecf3c728f581b10cb813ae561c829c336448a565bee9f037f99e

SHA512
11b9defec08ae3980598a436ff01a0fb1d37222d6a81a4e15730c2eb1d09d3915c5ef28e96032229af47502ffa4d1fae64d1398f7d6ec2ee5a58f777bceab11c

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
320KB

MD5
d3291df4c2dcb3c290eb29cbe9358bd5

SHA1
ab0472072f6fb3cb6100f716baa2bf97c6d910d7

SHA256
b68ec49879baeb0bc9c543fe11bb924dfbeb7bc4b76aaf7be8387aa0fff46401

SHA512
c80b689d51acdcf6baab67effee39885dd01d45e3bd62d2e1038ce43af8fe3d6667f8a65a39d3ed1632fb2e983c4d14de2f35720c45d4e3ed4b3ac386aedf5f2

Download Submit
C:\Windows\SysWOW64\Imgicgca.exe

Filesize
320KB

MD5
332ca230c127ff027eb8470773a23507

SHA1
913ab44130ded4a65f0fd83c83eda5ae4d7464d6

SHA256
87cee2d729f7bf64c503562237913baab0f48d66356006b38644c15ebf1a5c44

SHA512
cf3c723c09c1f4fea6642b030aa583b478d1abbf3b3f463ac30893ac30cb33c17c06241e161021cd0739066da6862f16087784ee10cdd7afdd1bc5782cc9d5e3

Download Submit
C:\Windows\SysWOW64\Ioolkncg.exe

Filesize
320KB

MD5
f4241354acd9773ce860581a1d6d6d8e

SHA1
ccadb258660db59bc1189cc4431ef86868274ee8

SHA256
1a9c3b9adfcd919092a36f260ed4dcd1dfbaa3bf2f967f6cbb416f48efcce9f6

SHA512
38009fec023e000d968f45fc565f6d493f58568dc1197809755e2aeb6f48c6a2e96221ace81cb901d19efb07816b775ad12356cf127d85282cf7a3989986cfd8

Download Submit
C:\Windows\SysWOW64\Jenmcggo.exe

Filesize
320KB

MD5
3ab4109654861f0e72569ae96cb73e08

SHA1
7b947230237eac57647440fb09805c4219366adc

SHA256
f317a88bde74c55dd8c700d384292b94fd8c14abcbde4dce5a32aa3ed1738217

SHA512
1a447f9292e18a99e51ba1bc3a5d7737613970530c5a2d9bbfb90b58c3bc9de1ba996f8a73b522aa6dec38d8fd41f974b08de9d1c88ec3f2637f264b0950d134

Download Submit
C:\Windows\SysWOW64\Jinboekc.exe

Filesize
320KB

MD5
9716ffc566fc6739abc3ef0698a7bc6a

SHA1
5cf4a1df39a35593c62cd5eae704c841830c2084

SHA256
b1f23fad0b80f200cc3885d33787430cb95d2e0588c763337991caee53a3d460

SHA512
faff84a019803e3f78b5ae34034233616d70a1fe4b5d15a861c31c03dccc053d7a7083099e004d81aaba43b1f5646706a0d788470cbf31108667f9f57ea69a81

Download Submit
C:\Windows\SysWOW64\Jofalmmp.exe

Filesize
320KB

MD5
bbf2c516559f87c46704e20e00b52d3f

SHA1
7e3041732c635089ee9ba659fa3c58e877a7e703

SHA256
8bd0f82a11ec75b0398a8608090936c8ce6b325f43b3169688acc72f7b36eb96

SHA512
e252ed2f2de05fb3cd54e1a68ab000f14d3526d56ad9969825ef2b393f858c3cbd4f11e3285fa10aeb10bd45f9759642aa91047058626426bcc8d3b60e132248

Download Submit
C:\Windows\SysWOW64\Kcejco32.exe

Filesize
320KB

MD5
fa1ddc8ee85a93f71742329b925d3901

SHA1
d547db83447bef907706d892018042a1ccb8fff5

SHA256
2d64580b44a282b9cbe663579931ec9670f75678f6bd8880189ac821d97b3595

SHA512
d32e3bf1f1298717662e4dccecfc17c4f7ddfc796eac2cef1706c4ff5b3223dfe12c5e788f04c8d160ab5ddf3ac6098c8dbef660e48ce8c127e0a7cdaa86cc97

Download Submit
C:\Windows\SysWOW64\Kgipcogp.exe

Filesize
320KB

MD5
877ca3a3c1914b004c924840194a5c13

SHA1
4c1abd4eb282bf6e86fa5ecb3aa60b9539f0a286

SHA256
e46422d4693f7341a174e29093e2c97fda627541f945ce8e4589b9bf138e753c

SHA512
a00dcb71b69721cbdd014ff77bea3285b7cb40d096c221c8ded02e007d8baaa1ae80ac8e9f41c888b5d92656ee94fba98e6679f736573d16a3b1c95ede81943d

Download Submit
C:\Windows\SysWOW64\Knalji32.exe

Filesize
320KB

MD5
a29379e60c6248d54128574a792b437b

SHA1
c27312f57d82faf24a33e34cc4dc864e857f245b

SHA256
381b1644c414a242b3cae29f038dfccdeab5e776283d5ab6abd2b105305b5bf9

SHA512
17bb9cf7fa6391acc0a4ac1be116232b9ab0415f96bcdcd605c88abd4d98482f722b0869c2ab357e3aceadb961113440108f40e712acfdb6172b38ca209ec192

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
320KB

MD5
dedc383a9ec4aced2d8d1edea0a2c816

SHA1
43ece689817087c25cf77c8eb7e9697dae7d6d93

SHA256
e9fce4ae92bc5b10b501fabd1584c119da6fe836ed8c8a0e58cc07aee956e26c

SHA512
6bae4161d3bcc5a2421812a70817cb1e05f0b5b2cd65e4352e1363b6639510182fe4900706989aaf73ef7fdf7340381b4559363cd94d97904fd3113567c23a75

Download Submit
C:\Windows\SysWOW64\Ljhnlb32.exe

Filesize
320KB

MD5
e7a93dbbf0d52060dbbe162e5c9f8bd3

SHA1
e9c6548a80d5eab9c2683628629be39926da5125

SHA256
142ba441054c275d066dd14c287d9cff2bc47493661384bce509755a64088146

SHA512
5df26a2e7a9c0516d8107cba7f290625432131bb55906e319d6288b2ce35b359f5b4fe8020ccac0a223baeac5ea1cc7f6511b6beef6ea957d187ab2c1f119e6d

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
320KB

MD5
6d1295530aa6bb3b687936ce46eb6232

SHA1
9f812783b051fdc463d1fcc860b8739016a4675b

SHA256
818279770064bd0a30f6815e5d2a1e3adb0ae5f8e5662d569274789f66754fdb

SHA512
ba6d95e2e0841d61b2b616845cffc2d6e56be721d61bca4aac06fca7a3ec0522349364cc5bce7dbb7440ca25da453ce1c2bd21cc3502a9d54fd2f4a71eb57157

Download Submit
C:\Windows\SysWOW64\Llmhaold.exe

Filesize
320KB

MD5
25bf1cbe2a8905579b540fab81e4d538

SHA1
5c814fdc82871edb3f0f911e0890ddcbac95fba8

SHA256
824d632ba6683b9926b25baaa206d0c06ff39cc2d79bd95fd1395c4cfbefbd9a

SHA512
70a11d4f551b57163d3f5680abcb4def1390610223e8703009fe0c9fa0e9ad2da4dc1dd8411e58efdc1207aade97aca04d46d7549d1e466641033a6121395bf0

Download Submit
C:\Windows\SysWOW64\Lnoaaaad.exe

Filesize
320KB

MD5
bb624af9df311af4af7ea3d4c9705cd4

SHA1
971d75c7090e4461df39be8be59a0deeecd26e5e

SHA256
f7228176b734382640d24baa313b45ca503e263bf4e9b8dc9aeac0fcdffc7762

SHA512
97f713b7d123e37cd8adfcecb0dc9bcba88876a12922bf0f468b2bda2352cdaa82ee8170351b919cc05396c46591f60f8f21db6211f4c8c97b764c72b808945d

Download Submit
C:\Windows\SysWOW64\Lqikmc32.exe

Filesize
320KB

MD5
c1eeca6d6345c1c0e6a3894283cf1ccf

SHA1
a208d9c36df9e4fa5295c8df4ee5eb4c55b190f6

SHA256
de230f904100ae286ab170bf81ace202728c5fa98f2bd74a463bb29d3e700e74

SHA512
ce2befbbdca4127eea2bd046e75a8d9de6ee115722e3618aa9c0203219fc3589da0d5c7e6f28741fc75983875a7de7ac5678da1c822bf1b97f97993dcf0c636d

Download Submit
C:\Windows\SysWOW64\Mfnoqc32.exe

Filesize
320KB

MD5
1106fce624443b31a298523f9b20afd5

SHA1
f4a580e9b9a8043b63d5e0a6b8fc3b08e50805cf

SHA256
8b3d9504f2d0d7667710799f1e560885e678215463da991eec214d7cc422b96a

SHA512
af0d73b235d042d3eb34e588f234f569eb209f914da53b6230476f2f7a005f0651d0eca3184b0ca0492c80bc7c592e0a01fcde7299d1c1693ecdb6e0decb0182

Download Submit
C:\Windows\SysWOW64\Mkadfj32.exe

Filesize
320KB

MD5
25d1e4a256ede5eb4562a35f57c5a7e8

SHA1
df89b5dae4d989cb8efbbbff840ffb0f3c101ea8

SHA256
06d638fd579eae46e91f36e66f57a6e2fb29b438b464f63b9f356d3a7dd1aa8c

SHA512
8bda82e3d8dc7f1f886e382d29a217e52f858be744b174b39e5d8f8d229503d7e68c8e9f0986ea2da1e4c97404ee96498c427ba84dc4abada909a313d4bbea7f

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
320KB

MD5
cec48d816321b11cb3d453880ae40a57

SHA1
011b431b972f927f7da9b119331f71f13b82dab7

SHA256
cf96e2760433dea5846114a8b6be2b93807d1fad4fddd3d05025eac043581ca2

SHA512
74b9283f3e1e7bf43054e134ba14dee5ddc1bc8253fd03a0c2c2ea2a0c0cec1c3ea3d9525b3d94fcc218884b2a366d79053972752848989c1bc9df8f1020e819

Download Submit
C:\Windows\SysWOW64\Mnhdgpii.exe

Filesize
320KB

MD5
ed36d0ea3e7cc75489bb198fe58040cf

SHA1
e5feba6a77957c970ed92ee4fc3144ef0ebea56c

SHA256
1bc40d90e4f65a8521b614c84f09d2dfb220a3e3054ccd23884c9eb9ca2802c3

SHA512
2c2ccb49423cfe2c03ac5b31280fb502303a64a509bb684ecfd640b2796489d82878290235c94d578407a4b7868792c758c6589ca50145bc2c12b47e43e87eac

Download Submit
C:\Windows\SysWOW64\Ncnofeof.exe

Filesize
320KB

MD5
b58bff4f877ec9f009f7686ee1859e9d

SHA1
968906a375db4b07486830d853e9afce4b218032

SHA256
45dfbcd312ffe9c9bce4d1af1b63001fc42218238b05ecadeeab0f44e3862522

SHA512
7f50fcdb28c6b456ed414e519e247aa18685e984ada0d95a9ae1cbb4d13cef34c700af32e11230672e850bf0063589b0e0f311d61df70555cbe9849c858a86e0

Download Submit
C:\Windows\SysWOW64\Neclenfo.exe

Filesize
320KB

MD5
e204f8dd9941c1ef317de9c0d0ea9e32

SHA1
61f4341a32adb3b2205c1a2f9ca0c3b508de1507

SHA256
40e6247880251959074ffaa9e454c3b7850fbaccd6d06e267a2b402118568cd6

SHA512
13bec6cbd31c6089bd9f8c96cbcd8adc78e2159f170f1107c0326fe90465fbfbfb27cddbeb7bb04a6d841518dc8e967115876d45c2d8864acd26ec43ec93779a

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
320KB

MD5
a1760d88bf20b2f0f7715e29eede4317

SHA1
705cdc98dae5fd97521cdee62bf25f1ca6c05e79

SHA256
307d84551e40b66fbaf8c7e9124f85c43111660ef93b8767514a1e1a1fe8dbd1

SHA512
7d47e114e03e6073b1f5c8032b2a677626abf5b2b92b8ae029e7b1807bfcf68fba630c346863dd6b2020987e42c35333015bfce552063e77632df9ed4d0c04fa

Download Submit
C:\Windows\SysWOW64\Njinmf32.exe

Filesize
320KB

MD5
60d04b00d361becad30e2ae94eee67fd

SHA1
07fd6bfd24f1963c60c25250a93fc20162a583d9

SHA256
fee614ffeeb37bdbd3e7274bde6ec9f951e3e6c0ab867cedb229e2953b9cc886

SHA512
c3820beba0d1c8f598b0fe2b941b8317b99ad303bfb2931f03428b71f43d87701eb6bd6a7c93ab3426843a045487e729e6b269804897e7cb2dfd18e38d4f8a76

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
320KB

MD5
5137b6945fa86c9c818f8c7822152dea

SHA1
c87c6191e503ac3f968bab3b7dcab6a7998e8902

SHA256
c488ae0b5e3d756f939c313d3a9b26cb04b35ba9b0d786c4bad763d79f35b245

SHA512
a1284332e0afe29d1ccbb80cc7766e881f6e5cadb7a9fd7906132413d3d02f101c68ee0fcabd6de81719f320d8ab0a5be592dc269fbfc897684613a8a4df0ff1

Download Submit
C:\Windows\SysWOW64\Ogekbb32.exe

Filesize
64KB

MD5
0c0aede90ffd3e65bb2b7221ba6ce20e

SHA1
442186cb4cbd81760497e5025361bdca61a4ed87

SHA256
71c1b9625ce8ead47bd542d6ee8d47889c39ceb6ce8f4b5363d41aceea0fd260

SHA512
298a5d36afacc5b0c54484a167f28d329e8d2353d36bfab247a71346b73257171593e01c71739bcb9933b0174358193d91efef73b1416a6e2967a841b0eda849

Download Submit
C:\Windows\SysWOW64\Ojfcdnjc.exe

Filesize
320KB

MD5
df8da9a64b7c7b1d7f27f185665d8f05

SHA1
27dcf63670b77142fa61a5bbb807d0c65e37fb0e

SHA256
8e78dbacef6c0d1581971998e8026754edb319841f0b556382a4fa68ef17bccd

SHA512
577530debe3e7fba9dbb73ae43f2a426fff247249ccfc924b7001d839332f25b6c9cbf4c8d3fd5a90cfe28adcba6bd39d72ef4b81aca345a6332555d4df002e4

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
320KB

MD5
cbeb8f8c2756991e825da42c7ba4440a

SHA1
a74bdf4e8c7049133123a811b1299688a18ffd45

SHA256
191a77e2d86b1bf8ac89b26719e1395d329000b09b5f98e7fa0d2deb95a679be

SHA512
e2b801706311d7ba02cdadd0dd79ade8e62edc751755156b5f67d64a0fcb1ae66765bcdfcff2574ef9a54c999e0e20a2b6bc9e9418657162853d5afd8cb8cb8c

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
320KB

MD5
6b8ac3d5d0ac7c703e3140dab6ee61ba

SHA1
d1481061d76aa16fa5a8e3b713d15e333929dc7f

SHA256
f7e6dabb22cf1db82fdeb3a57600049ac7b8066bf6d2a4ad535c01ddc2b1db2b

SHA512
fe9009c6b997f46778af6f6753bbf428516b6af32da9cd935c3092cac88acbed5355e2d8a10f1e1c629f224cc4fee4d81e405236cd00d1ffa7b79c61d46699f1

Download Submit
C:\Windows\SysWOW64\Peahgl32.exe

Filesize
320KB

MD5
fdb099566e172757c5ba05f5f095750a

SHA1
c4498c5e97e7684903372aafa6058ea0ed79f9b5

SHA256
be0f42be61e0707f1a0d71e67a8b0b66f96ede07f6af04675fa8e8bc2c775910

SHA512
afdd14a9f2e9de61077e51c74167e72addbbd4fad2daf7b6663b7b055ae321d1e497e02aa4fd5fa1fabdcef72683b1d725fcbd088c0bc169e20e7297461a3a38

Download Submit
C:\Windows\SysWOW64\Phdnngdn.exe

Filesize
320KB

MD5
69d3297f29d32bcd2d622f5634a8d941

SHA1
ff92df44b5debb60b5ba7639d6a47097adefcf12

SHA256
9c213993a5247cace1533ddaf3c443d6c1f07d926005a95a391b7ad9b199b26c

SHA512
26dd7321e3014b9f7f76244090e232ad654141da12206acd059ef135c13932590e602ccbc6a181a9e0964620a39a618105de953d81d10f7517ea788f983948fb

Download Submit
C:\Windows\SysWOW64\Qdoacabq.exe

Filesize
320KB

MD5
01ac00e1888b0606a9b0ef688675cbd1

SHA1
905ea1c4f6f9b70e5df0d20e8ce87be8a9954087

SHA256
6b6fd0350948cd230ae6342d1e80baf59dbb4f8b9edc6fa2cdffca370299246c

SHA512
ad6824bafef0d0e6e405a0e4eb6d1aa69432e278752b2c8d13a5dca2422cda1f35f972afc88437a5b5a2ee08980c96629d44f3dc0b4a53a81077377236908a63

Download Submit
C:\Windows\SysWOW64\Qfkqjmdg.exe

Filesize
320KB

MD5
bef0297df048829bfaf115234313c2bd

SHA1
9e58df4b645f090f85f6b2b42dc5f940fe15e3f9

SHA256
a07a32aae4fbe4cc45a6862eafcfb7d106587ccb0ad837695fe16508222ac9af

SHA512
29c58ad32127e150e00fa3d982ad558d9491feb9f77c56fd29931fda8b7cf63773baa87e131d177baa45a52664b54314332289d9e45b442d50cd778eea1b91d2

Download Submit
C:\Windows\SysWOW64\Qmepam32.exe

Filesize
320KB

MD5
da386da64e210143a44e45fe3322b340

SHA1
210663fdd1c31af0429ad8f5fcf4ff48b0cda0f5

SHA256
7e02f7136cda2d4251adaa909a12f196b088b4e5093c305c388fdabb77680c74

SHA512
3d84dc2ebba498a1a561ff7ab3ab9281e84fb266e9a86cdb68f7deb7a7fb671459ec530fb4d2706469a706495453e638e6aa12f28ff4ffbcf515143ec0b13473

Download Submit
memory/228-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/316-519-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/344-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/828-453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1052-381-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1064-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1148-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1304-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1356-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1356-597-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1476-501-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1520-197-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1524-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1596-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1680-483-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-599-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1844-477-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1920-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1944-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1944-576-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1980-423-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2060-570-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2060-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2064-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2152-562-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2152-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-221-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2212-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2328-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2472-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2568-495-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2588-417-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-245-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2680-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2704-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2724-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2852-471-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3016-537-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-592-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3084-489-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-333-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3308-369-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3312-525-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3464-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3492-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3504-357-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3508-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3532-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3584-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3588-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3604-550-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3684-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-531-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3852-513-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3880-363-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3916-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4052-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4052-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4100-429-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4104-399-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4144-507-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4232-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4236-557-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4316-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4324-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-345-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4436-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-584-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4504-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4596-543-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4604-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4648-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4648-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4664-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4676-339-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4684-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4828-465-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4860-447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4920-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4948-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4984-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-590-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8300-2522-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8868-2528-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9008-2478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9268-2516-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9504-2508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9860-2493-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/9904-2492-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10132-2483-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads