berbew | 3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f.exe
Size

120KB
MD5

268ce52d7075c295fff130e87aecb699
SHA1

ede0830ef8ecb167ea5a4a5e5c864d34104f3fb7
SHA256

3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f
SHA512

2d9dd3f9f04e0bfaa5af1fed5232b1f33697eb2a7fe08780f3f49d691ac9443734f1b3bc2a6d7f632bf857033faae9ea1e6a90f8f827ecef61d8d631451afb24
SSDEEP

3072:JMCtSiS1R15zawY7ey203H/6TC+qF1SsB1bw4AVRrd9:C6StRnuwYCy9C81NBy9

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hibjli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpqjglii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glbjggof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Komhll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbmingjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gipdap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inqbclob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkhapk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnfnlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Paoollik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Efjimhnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lndagg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Popbpqjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekdnei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nflkbanj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fealin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fmhdkknd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kngkqbgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfmojenc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Efblbbqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fpggamqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlcjhkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenicahg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoalgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Epikpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bddjpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipoopgnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gdcliikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Olfghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gikdkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckiihok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjnifbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcain32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmfgek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohmhmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Klcekpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmbfbn32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2952	Ccdnjp32.exe
3620	Ciafbg32.exe
456	Coknoaic.exe
1060	Djqblj32.exe
4100	Dpnkdq32.exe
3796	Djcoai32.exe
2440	Dpphjp32.exe
2892	Dfjpfj32.exe
1404	Dcnqpo32.exe
2860	Dmfeidbe.exe
1260	Dfoiaj32.exe
2740	Epikpo32.exe
536	Ejoomhmi.exe
1648	Emmkiclm.exe
5096	Ecgcfm32.exe
4504	Eidlnd32.exe
1572	Eciplm32.exe
3892	Eppqqn32.exe
2600	Efjimhnh.exe
4792	Emdajb32.exe
3824	Fbajbi32.exe
4984	Fikbocki.exe
5092	Fdqfll32.exe
2136	Fjjnifbl.exe
3656	Fpggamqc.exe
4056	Fbfcmhpg.exe
4880	Fipkjb32.exe
4312	Flngfn32.exe
2088	Fjohde32.exe
4936	Fmndpq32.exe
1932	Fffhifdk.exe
3104	Fideeaco.exe
4380	Gdjibj32.exe
4860	Gbmingjo.exe
932	Gmbmkpie.exe
4844	Gpqjglii.exe
2260	Gfkbde32.exe
184	Gjfnedho.exe
5116	Gmdjapgb.exe
2512	Gpcfmkff.exe
2908	Gfmojenc.exe
2896	Gikkfqmf.exe
1988	Gpecbk32.exe
4260	Gfokoelp.exe
2468	Glldgljg.exe
1204	Gdcliikj.exe
2724	Gipdap32.exe
1480	Hloqml32.exe
4012	Hdehni32.exe
4976	Hibafp32.exe
4444	Hlambk32.exe
3992	Hdhedh32.exe
2360	Hienlpel.exe
2296	Hlcjhkdp.exe
1468	Hdjbiheb.exe
4548	Hkdjfb32.exe
4608	Hmbfbn32.exe
3168	Hpabni32.exe
2636	Hgkkkcbc.exe
3448	Inqbclob.exe
2664	Ipoopgnf.exe
3260	Ikdcmpnl.exe
4944	Jlfpdh32.exe
4272	Jgkdbacp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Afpjel32.exe
File opened for modification	C:\Windows\SysWOW64\Bklomh32.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Mcjmel32.exe	Mjahlgpf.exe
File created	C:\Windows\SysWOW64\Oelolmnd.exe	Ojgjndno.exe
File created	C:\Windows\SysWOW64\Cmpmfmao.dll	Aolblopj.exe
File created	C:\Windows\SysWOW64\Lpghll32.dll	Offnhpfo.exe
File created	C:\Windows\SysWOW64\Boihcf32.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Cjibekmc.dll	Nnbnhedj.exe
File created	C:\Windows\SysWOW64\Kbopqlen.dll	Paoollik.exe
File created	C:\Windows\SysWOW64\Lobpkihi.dll	Hlnjbedi.exe
File created	C:\Windows\SysWOW64\Momkkhch.dll	Fmndpq32.exe
File created	C:\Windows\SysWOW64\Nlfcoqpl.dll	Mcjmel32.exe
File created	C:\Windows\SysWOW64\Hhbdbmfg.dll	Palbgl32.exe
File opened for modification	C:\Windows\SysWOW64\Dngjff32.exe	Dijbno32.exe
File created	C:\Windows\SysWOW64\Lhdbgapf.dll	Pmiikh32.exe
File created	C:\Windows\SysWOW64\Agdcpkll.exe	Apjkcadp.exe
File created	C:\Windows\SysWOW64\Gakiqbgc.dll	Djqblj32.exe
File opened for modification	C:\Windows\SysWOW64\Gpqjglii.exe	Gmbmkpie.exe
File created	C:\Windows\SysWOW64\Klhhpnaf.dll	Gpqjglii.exe
File created	C:\Windows\SysWOW64\Cjelhg32.dll	Gpecbk32.exe
File created	C:\Windows\SysWOW64\Neiqnh32.dll	Blielbfi.exe
File created	C:\Windows\SysWOW64\Ibhkfm32.exe	Imkbnf32.exe
File opened for modification	C:\Windows\SysWOW64\Jgbchj32.exe	Jllokajf.exe
File opened for modification	C:\Windows\SysWOW64\Cpfcfmlp.exe	Coegoe32.exe
File created	C:\Windows\SysWOW64\Dfkecidg.dll	Fipkjb32.exe
File created	C:\Windows\SysWOW64\Ockkandf.dll	Pkgcea32.exe
File created	C:\Windows\SysWOW64\Cpabibmg.dll	Hmpcbhji.exe
File created	C:\Windows\SysWOW64\Jjpode32.exe	Jedccfqg.exe
File created	C:\Windows\SysWOW64\Dfjpfj32.exe	Dpphjp32.exe
File opened for modification	C:\Windows\SysWOW64\Nnicid32.exe	Nlkgmh32.exe
File created	C:\Windows\SysWOW64\Pgfcalbj.dll	Qhmqdemc.exe
File created	C:\Windows\SysWOW64\Mmjpbc32.dll	Bhbcfbjk.exe
File opened for modification	C:\Windows\SysWOW64\Gbeejp32.exe	Gpgind32.exe
File created	C:\Windows\SysWOW64\Onahgf32.dll	Apodoq32.exe
File created	C:\Windows\SysWOW64\Lmafqb32.dll	Mccfdmmo.exe
File created	C:\Windows\SysWOW64\Kbgbpn32.dll	Mgaokl32.exe
File created	C:\Windows\SysWOW64\Nlfnaicd.exe	Nelfeo32.exe
File opened for modification	C:\Windows\SysWOW64\Pddhbipj.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Olfghg32.exe	Oelolmnd.exe
File created	C:\Windows\SysWOW64\Hmmfmhll.exe	Hibjli32.exe
File created	C:\Windows\SysWOW64\Jgbchj32.exe	Jllokajf.exe
File created	C:\Windows\SysWOW64\Kcbfcigf.exe	Klhnfo32.exe
File opened for modification	C:\Windows\SysWOW64\Pffgom32.exe	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Ndikch32.dll	Bklomh32.exe
File created	C:\Windows\SysWOW64\Fomnhddq.dll	Coegoe32.exe
File created	C:\Windows\SysWOW64\Pmemlfol.dll	Hpabni32.exe
File created	C:\Windows\SysWOW64\Fngcmcfe.exe	Fligqhga.exe
File created	C:\Windows\SysWOW64\Jflbhhom.dll	Fpimlfke.exe
File created	C:\Windows\SysWOW64\Bdojjo32.exe	Bobabg32.exe
File opened for modification	C:\Windows\SysWOW64\Djqblj32.exe	Coknoaic.exe
File opened for modification	C:\Windows\SysWOW64\Fbjena32.exe	Fmmmfj32.exe
File created	C:\Windows\SysWOW64\Ajihlijd.dll	Mkhapk32.exe
File opened for modification	C:\Windows\SysWOW64\Hlpfhe32.exe	Hmmfmhll.exe
File opened for modification	C:\Windows\SysWOW64\Ocaebc32.exe	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Fkkceedp.dll	Eppqqn32.exe
File opened for modification	C:\Windows\SysWOW64\Cfipef32.exe	Ckclhn32.exe
File created	C:\Windows\SysWOW64\Kffonkgk.dll	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Aaoaic32.exe	Aopemh32.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Cdkifmjq.exe
File created	C:\Windows\SysWOW64\Mmlmhc32.dll	Coqncejg.exe
File created	C:\Windows\SysWOW64\Eppqqn32.exe	Eciplm32.exe
File created	C:\Windows\SysWOW64\Jmheim32.dll	Fbajbi32.exe
File created	C:\Windows\SysWOW64\Hhjhdagb.dll	Hblkjo32.exe
File opened for modification	C:\Windows\SysWOW64\Bajqda32.exe	Bnoddcef.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	10172	WerFault.exe	465

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llmhaold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djcoai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikdcmpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkgcea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efpomccg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjpode32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnafno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfjpfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glldgljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfgkffn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkahilkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmdlmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jedccfqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgdpni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlhljhbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdmqmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmmmfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgbchj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koaagkcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eidlnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjohde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkhapk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dngjff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaoaic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfoiaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoopgnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhkbfme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Moipoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nceefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hloqml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlambk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjepjkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjnqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njinmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkbjjbda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddjpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knnhjcog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgbjbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmnqjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eecphp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klcekpdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpphjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fikbocki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdcliikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnadagbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgpgfmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcimdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkceokii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbhboolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoaojp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hdehni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oejbfmpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlmkgk32.dll"	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiibaffb.dll"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Knooej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cocopa32.dll"	Ekdnei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjafgpmo.dll"	Ebnfbcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ahofoogd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkndie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nmenca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jddnfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbbhnma.dll"	Jlfpdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddipic32.dll"	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphihiif.dll"	Ombcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiapmnp.dll"	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eciplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fjjnifbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gpqjglii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgjbbcpq.dll"	Gpcfmkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpecbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Neclenfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nhahaiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfipef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmgnid32.dll"	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mnpabe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njfagf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Paoollik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hibjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kfpcoefj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmfeidbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hdhedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiocibf.dll"	Lmpkadnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Coknoaic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jkimho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Maiccajf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iibccgep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onahgf32.dll"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gakiqbgc.dll"	Djqblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnfgcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Olfghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmeddp32.dll"	Adndoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jinboekc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkqgckn.dll"	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmheim32.dll"	Fbajbi32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2952	3352	3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f.exe	86
PID 3352 wrote to memory of 2952	3352	3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f.exe	86
PID 3352 wrote to memory of 2952	3352	3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f.exe	86
PID 2952 wrote to memory of 3620	2952	Ccdnjp32.exe	87
PID 2952 wrote to memory of 3620	2952	Ccdnjp32.exe	87
PID 2952 wrote to memory of 3620	2952	Ccdnjp32.exe	87
PID 3620 wrote to memory of 456	3620	Ciafbg32.exe	88
PID 3620 wrote to memory of 456	3620	Ciafbg32.exe	88
PID 3620 wrote to memory of 456	3620	Ciafbg32.exe	88
PID 456 wrote to memory of 1060	456	Coknoaic.exe	89
PID 456 wrote to memory of 1060	456	Coknoaic.exe	89
PID 456 wrote to memory of 1060	456	Coknoaic.exe	89
PID 1060 wrote to memory of 4100	1060	Djqblj32.exe	90
PID 1060 wrote to memory of 4100	1060	Djqblj32.exe	90
PID 1060 wrote to memory of 4100	1060	Djqblj32.exe	90
PID 4100 wrote to memory of 3796	4100	Dpnkdq32.exe	91
PID 4100 wrote to memory of 3796	4100	Dpnkdq32.exe	91
PID 4100 wrote to memory of 3796	4100	Dpnkdq32.exe	91
PID 3796 wrote to memory of 2440	3796	Djcoai32.exe	92
PID 3796 wrote to memory of 2440	3796	Djcoai32.exe	92
PID 3796 wrote to memory of 2440	3796	Djcoai32.exe	92
PID 2440 wrote to memory of 2892	2440	Dpphjp32.exe	94
PID 2440 wrote to memory of 2892	2440	Dpphjp32.exe	94
PID 2440 wrote to memory of 2892	2440	Dpphjp32.exe	94
PID 2892 wrote to memory of 1404	2892	Dfjpfj32.exe	95
PID 2892 wrote to memory of 1404	2892	Dfjpfj32.exe	95
PID 2892 wrote to memory of 1404	2892	Dfjpfj32.exe	95
PID 1404 wrote to memory of 2860	1404	Dcnqpo32.exe	96
PID 1404 wrote to memory of 2860	1404	Dcnqpo32.exe	96
PID 1404 wrote to memory of 2860	1404	Dcnqpo32.exe	96
PID 2860 wrote to memory of 1260	2860	Dmfeidbe.exe	97
PID 2860 wrote to memory of 1260	2860	Dmfeidbe.exe	97
PID 2860 wrote to memory of 1260	2860	Dmfeidbe.exe	97
PID 1260 wrote to memory of 2740	1260	Dfoiaj32.exe	99
PID 1260 wrote to memory of 2740	1260	Dfoiaj32.exe	99
PID 1260 wrote to memory of 2740	1260	Dfoiaj32.exe	99
PID 2740 wrote to memory of 536	2740	Epikpo32.exe	100
PID 2740 wrote to memory of 536	2740	Epikpo32.exe	100
PID 2740 wrote to memory of 536	2740	Epikpo32.exe	100
PID 536 wrote to memory of 1648	536	Ejoomhmi.exe	101
PID 536 wrote to memory of 1648	536	Ejoomhmi.exe	101
PID 536 wrote to memory of 1648	536	Ejoomhmi.exe	101
PID 1648 wrote to memory of 5096	1648	Emmkiclm.exe	102
PID 1648 wrote to memory of 5096	1648	Emmkiclm.exe	102
PID 1648 wrote to memory of 5096	1648	Emmkiclm.exe	102
PID 5096 wrote to memory of 4504	5096	Ecgcfm32.exe	103
PID 5096 wrote to memory of 4504	5096	Ecgcfm32.exe	103
PID 5096 wrote to memory of 4504	5096	Ecgcfm32.exe	103
PID 4504 wrote to memory of 1572	4504	Eidlnd32.exe	104
PID 4504 wrote to memory of 1572	4504	Eidlnd32.exe	104
PID 4504 wrote to memory of 1572	4504	Eidlnd32.exe	104
PID 1572 wrote to memory of 3892	1572	Eciplm32.exe	105
PID 1572 wrote to memory of 3892	1572	Eciplm32.exe	105
PID 1572 wrote to memory of 3892	1572	Eciplm32.exe	105
PID 3892 wrote to memory of 2600	3892	Eppqqn32.exe	106
PID 3892 wrote to memory of 2600	3892	Eppqqn32.exe	106
PID 3892 wrote to memory of 2600	3892	Eppqqn32.exe	106
PID 2600 wrote to memory of 4792	2600	Efjimhnh.exe	107
PID 2600 wrote to memory of 4792	2600	Efjimhnh.exe	107
PID 2600 wrote to memory of 4792	2600	Efjimhnh.exe	107
PID 4792 wrote to memory of 3824	4792	Emdajb32.exe	108
PID 4792 wrote to memory of 3824	4792	Emdajb32.exe	108
PID 4792 wrote to memory of 3824	4792	Emdajb32.exe	108
PID 3824 wrote to memory of 4984	3824	Fbajbi32.exe	109

C:\Users\Admin\AppData\Local\Temp\3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f.exe
"C:\Users\Admin\AppData\Local\Temp\3559c02189e935472d9603d8f893eb3ab57b791d1ac218d2ffaa0d47337b1b9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\SysWOW64\Ccdnjp32.exe
  C:\Windows\system32\Ccdnjp32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\Ciafbg32.exe
    C:\Windows\system32\Ciafbg32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\SysWOW64\Coknoaic.exe
      C:\Windows\system32\Coknoaic.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:456
    - - C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4984
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        24⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        27⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4880
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        29⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2088
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        32⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        33⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        34⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:932
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        38⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        39⤵
        Executes dropped EXE
        
        PID:184
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        40⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        43⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        45⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4012
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        51⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        54⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        56⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        57⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3168
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        60⤵
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3260
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        65⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        66⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        68⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        69⤵
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        70⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        71⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        72⤵
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        73⤵
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        75⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        76⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        77⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        78⤵
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        79⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        80⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        85⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        86⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        87⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        88⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        89⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        91⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        92⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        93⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        94⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        95⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        96⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        97⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        98⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        99⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        101⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        102⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        103⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        105⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        107⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        110⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        111⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        112⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        114⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        115⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        117⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        118⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        119⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        120⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        121⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        123⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        124⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        125⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        126⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        127⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        128⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        130⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        132⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        133⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        135⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        136⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        137⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        139⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        140⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        141⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        142⤵
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        145⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        146⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        147⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        148⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        149⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        151⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        153⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        154⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        155⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        156⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        157⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        160⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        163⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        164⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        165⤵
        Drops file in System32 directory
        
        PID:6924
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        166⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        167⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        168⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        169⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        170⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        171⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        172⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        174⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        175⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        176⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        177⤵
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        179⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        180⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        181⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        183⤵
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        184⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        185⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        186⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        187⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        188⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        189⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        190⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        191⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        193⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        194⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        196⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        197⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:7404
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        199⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        201⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7540
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        202⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        203⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        205⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7760
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        209⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        210⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        211⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        213⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8128
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        214⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        215⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        219⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        220⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        221⤵
        Drops file in System32 directory
        
        PID:7724
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        222⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7792
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        223⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7920
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        225⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        226⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        228⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        230⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        232⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        233⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        234⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        236⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        237⤵
        Drops file in System32 directory
        
        PID:7704
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        238⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        241⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        242⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        243⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        244⤵
        Drops file in System32 directory
        
        PID:7196
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        247⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        248⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        251⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        252⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        253⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        254⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        255⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        256⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8572
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        259⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        260⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        261⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        262⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        263⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        264⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        265⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        266⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        267⤵
        Drops file in System32 directory
        
        PID:9016
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        269⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9100
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:9144
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        271⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:8292
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        274⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        275⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        276⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        277⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8680
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        280⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8876
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        282⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        283⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        284⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9136
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        286⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        287⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        288⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        289⤵
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:8748
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        291⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        292⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        294⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8344
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        297⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        298⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        299⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        300⤵
        System Location Discovery: System Language Discovery
        
        PID:8920
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        301⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8296
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        303⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        304⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9164
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        307⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        308⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        309⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        310⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        311⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        312⤵
        Drops file in System32 directory
        
        PID:9008
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        313⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        314⤵
        Modifies registry class
        
        PID:9260
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        315⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        316⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9392
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        318⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        319⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        320⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9568
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        322⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        323⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        324⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        325⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        327⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        328⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9924
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        330⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        331⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10016
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        332⤵
        Modifies registry class
        
        PID:10060
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        333⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        334⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10148
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        335⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5936
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        337⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        338⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        340⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        341⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:9580
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9712
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        345⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        346⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        347⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        348⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        349⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10040
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        350⤵
        Drops file in System32 directory
        
        PID:10136
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        351⤵
        System Location Discovery: System Language Discovery
        
        PID:10212
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        352⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        353⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        354⤵
        Drops file in System32 directory
        
        PID:9476
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:9508
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        357⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        358⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9772
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        359⤵
        Drops file in System32 directory
        
        PID:9960
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        360⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        361⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:9468
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        364⤵
        Drops file in System32 directory
        
        PID:9552
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9876
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        368⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        369⤵
        Modifies registry class
        
        PID:9428
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9696
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        371⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        372⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10172 -s 212
        373⤵
        Program crash
        
        PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10172 -ip 10172
1⤵
PID:10112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afpjel32.exe

Filesize
120KB

MD5
e9d1fd2f3daad834992d2f6d0992ac5c

SHA1
735800fbc3b38fa3ec7a9286f656fea8495b51ca

SHA256
6c332e3bea9e7bff0c875e654eddf4e7c9263bddf91e446280d69f79445473d9

SHA512
a25ef737c501b2bde9eb8d34e9b43cb4bfc50436d658571c52d1750b61b6c6482ccbc7dcfc12e6eeefd9cc243eb6889145b94361264b0c5cd20162259cc9298a

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
120KB

MD5
94a8012c28910dd8d5792e4befe05bcf

SHA1
ef4d2ef86de59a70746bde9b2277e6b7223e8fd9

SHA256
293d59d2b183ae7bf3bcf356f92a4a8854cbe9df00875d03c5e973b5cf1bafee

SHA512
d5c8a2fc7316f9d4705cd39981077a9bad73bba738d2d81ee4060db5085119e2c1987c2ad4f36edd3a8cf0a4db98cb250b91a9a6374d1aa963c26e0629f47cf6

Download Submit
C:\Windows\SysWOW64\Aonoao32.exe

Filesize
120KB

MD5
8ae0ac740b25e34ec19a05a32434f4f8

SHA1
3734dbd58e37d83d18b608b0019cc1eb97815f4f

SHA256
5fa127cf9613e21df1f3def4e268374c39004ce1d608f1b2523b7e65d6e9785a

SHA512
1b15ef32cc1412f7fb31d3b92a59f1e543e4006e8c208c11502223acb1e5fdf765137549f9b42dbdd1a8db56ec8a2e0e8916dd1b66923bb6c655c75f13b95a0c

Download Submit
C:\Windows\SysWOW64\Apmhiq32.exe

Filesize
120KB

MD5
d627c24f96fc5d21daab2af646f1068c

SHA1
7c5c78690d278fc86d8f4918d0e0459bf6c2ffc1

SHA256
53cfadb04c75446e83ecc90cca472663a95b18874c7f3e31da108a5ceb2b8262

SHA512
21b2e7c2ce0b7b7d3363a4d5f687c22faafc5757c0f74c08248d2b188270e9bad1605275a7bdf51b61890b4941a0195b01348b98deb5029815b3ec03d7783c01

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
120KB

MD5
b938bbc653796b2904b7fa3827b3490f

SHA1
40c9bbba7e9f0623cd943639239a09831b72756d

SHA256
f28cafa8901740265412580c656087f27b06985cf9375a9665d81b89336664f5

SHA512
18359fbeb4c22a157fb7755e0b8401e395c027d13ea5753654135ff9ee445c785959f61cc1692c87d1d8d8ca9890e90199d93768e80c6372b14beb8e3b089088

Download Submit
C:\Windows\SysWOW64\Bgkiaj32.exe

Filesize
120KB

MD5
738b5182c9856acaa17b589366081728

SHA1
0efa274c8ae4335e4b90cf9ff67c92539600667b

SHA256
2edd92db7dbe09749a9359f8625a79364b0a0267501b0fa65344cd47ab3cfe73

SHA512
500ff39267c2a458a810a78f19463fd3a7c738b6922d2c25c0845cf16c21646dce96a5aab576a0051e46bcb197cb76d9ff853055ec6e522145ef1eeb19a04ff2

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
120KB

MD5
846fd663760676279b665c5d1a3bbfc8

SHA1
c8393df974b6d1db87f6b3ef5a6d10ca8831dd5a

SHA256
f524b333f0015f5f7c8386117a80c21806c53a0291774a3286ee0d364bf0dd0c

SHA512
3992a20c108a8237b7cd51fc753797d1073fabd88bc5783200ec0526973bd901cab4bb487b32a77440071299be8a237622512a603770741cb9cc657c7fd07289

Download Submit
C:\Windows\SysWOW64\Bnoddcef.exe

Filesize
120KB

MD5
0e8a23f505d445ffa62cd117ff73caf5

SHA1
707513bac08a8ff27c542a5c7eddd0c7979bcb55

SHA256
855410cc51a052fcb4370bbc0c37933927beb323897b8137d4deea8c4a9a14c0

SHA512
a735555183469285c5e4180075feafc952ba8508d576df362964f8ca2de6ee6e6f7a6605b0b87ceded89a5c14d41e0cf72ef087217010391c5957dbcf373d078

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
120KB

MD5
e926fd8c56b757e1a57ac05b8a34948c

SHA1
5254dccf32da2ff5d97748b6bc5045f55102fe05

SHA256
a87fe4f4e909c291ef28fa8d301577776b8ba51ed2d876cceebbbd388948413c

SHA512
9204fb0f6e2c8166876ec036033583e9a607706df66a3943ba41af21de4fec7188a3c43822e860b37c07d9bf69d9f147da65421431f1cf2e73371b7bfb15745a

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
120KB

MD5
13010bc00b72802d5e31d1fe6c496b58

SHA1
5cd7f97d9d8d675ea3846323bf3591ff79e0fcaf

SHA256
dd591cd72a1a83d2701a549550868ea53e9e20c2965dd125a1b0800d1a8ba583

SHA512
b8f967c58980176c5a419e40f7167a62bb73b282a64d81244e3bec340086e0b134924a86edf967267b065e37b2368320abf10d1301498bae38431fa800227dbe

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
120KB

MD5
3f0a361b61a9a9b3db5392921a452936

SHA1
66af958e047a3b6dbdbe4dff095697685074fb97

SHA256
1e9673bdcefc0e25430a97c1ff498445982aa1d8bf2f6629c568b270d3e7b85a

SHA512
a4ae309aea2cf16a85a78e996c834ca65146c776d0b5c9e8b02102fe12c2e23ef7ebd6f315651f65586200a8e7475357c8cbb2e81b64050e1d5ab8bd09460f87

Download Submit
C:\Windows\SysWOW64\Ccdnjp32.exe

Filesize
120KB

MD5
eec455a7b267e01e5d1c3cdeca7d18a2

SHA1
5958c4c0cd730f1ce30f686a85f06d5d1a20dc3d

SHA256
e12f93e100b9fca34babe2a4d6c7b134606b2360fbe7017431421581c8461a3e

SHA512
99ecdaedeaa59c15d3a0b706faa842e32873fbef0c32bcbb438b772547fad19359f16cf243cce9a7b9cb74a58ade89d688fb9b82bbedc61fb8c070ab237c5473

Download Submit
C:\Windows\SysWOW64\Chkobkod.exe

Filesize
120KB

MD5
e61f660b3adc700b5d51725174ef3538

SHA1
7103b9b7469cadc23442b32f89ca324e69f7bca8

SHA256
34f469d34d00327d89781d8e0211755874d9c97b6c5b2095dbdca8bcb39ca4b1

SHA512
f4067da392a183dba856b7b577b60d565ab3ea68df4bb026aa5e4cb1b27a26613c319fe82f22063b78d5ddb72fa3504ea469d2fff1f99102e5126e41a41dfcf1

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
120KB

MD5
da0cb38582cfb8d115aca7ac8747e9a9

SHA1
38fb240a965f8f6f773f50a29c195e2d69b19145

SHA256
e9aecdc5ee8e84e26fee92b40ff714ce654631f5262bba97808057be94552d5c

SHA512
891b3e2b7915922cdf5ffe64879af038a24affc79d34fe5f44a02dc456016a87f5247bee5954728510a689d558b555cacbbf0d4c3ae988240a74c52c7ed07658

Download Submit
C:\Windows\SysWOW64\Ckbemgcp.exe

Filesize
120KB

MD5
57571b110b740d99cf9488c0296cdff9

SHA1
673350162c32358abc751e27ec61cae4e4a67818

SHA256
9bc29ee1b61b28c96c9dc1214ffd9d3d87870208aa340182cecad94994297bfb

SHA512
205c6ae0ad9aeb87cfd2bf8c40ff00a28a7b87f466906fb21303fb2bedea1cb3b98cbdc7ea3695aa390ee3b99b26248249ecd4d50e0215ddcd58566745083a88

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
120KB

MD5
ae68737f6aa16a5c1f60871e242aa084

SHA1
2184a55d3ea6b1e2ef4dc93f6944c5cd21e50b3c

SHA256
44691487febcfafb0548d96e14f015c34c75b2214695764f4a432e04ec769b42

SHA512
881ecb1c48788cf971d018df67de277d35b4623774a2c7998521ab6cd725533a4d96337e89fd3fd4e1f133583ff76f84090684e9a340cd2fe808aa64d605f629

Download Submit
C:\Windows\SysWOW64\Cnfkdb32.exe

Filesize
120KB

MD5
7111fbd01f356df913c9f4734d6a4e16

SHA1
f27f2697c9787e6efb6618f246d5411f874efc49

SHA256
549fc87538e8af1f6fbc6c4de576b04a2ba3e9817d404aed985a7015c93d1ae7

SHA512
a3e74c4173e9ef19a10981ce18616b8f909346432a99eeba246c0cb65ab870640c504e6a914715abe2c0ed6391b55fea69d770bc46cf360140a8d346aa04a021

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
120KB

MD5
da974547fdd86a55a3fde7603eb8e739

SHA1
02c345ba52c5d49552cabdb9f928c98aeea4e74c

SHA256
a4bc2e58e32afc766a7d13545839a54e8d85f4502d85edd3d21dc9a6c9c9748f

SHA512
b09044ed48d74e23271bcda458efdb9b473588a67ae20f87ad686d7c39cd49b4e05098217208edffb7c5be528d4f58587739b0b4eb4e8563ecb71b4050c05f48

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
120KB

MD5
c96c8cfbd25e53a116359d2cb93d5f46

SHA1
ff924c1c8ed57e7d777e0039bb05d55c1c93ab18

SHA256
eddfe22b5bb24b182f6fe6c7161da93bc36bb5b92fe0167caf9351cdc3b8899c

SHA512
fbb5ae4465eb95b4c8673484d212d94cfcf15762ade60097252649690a9f923dae48ec6a8c63d31ad3c122f4eac1413d5ab72a7fe343a82413e32de3478111b9

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
120KB

MD5
ef866bdc5f04ca9e4ea464cd6e6f09af

SHA1
ec8e85367cb5781f83f046cbaeb6f7f512a6fd5e

SHA256
7c8ed03fec09bb5a5d6905e5a3fdd3a03363b17f60d24c869aa647ebec6fc0c6

SHA512
c77d5f49b3c1230a18fd65580f8e656b92c57fa82c438739227d92135ea506b965885e73e8018901de9c9392e828fa3b4da376fe73871bf66e0bfede2344934e

Download Submit
C:\Windows\SysWOW64\Dbnmke32.exe

Filesize
120KB

MD5
b5896eade5adbc402e91b97a7d395cef

SHA1
fcf5884959fcde4be1cb2d3b13975e6a1bde8f8f

SHA256
64fac8dfa76422a8bf1c0ca3ee5b83368cf9e0f2b90991b760f9f633c09650f5

SHA512
db9d11a1174e12351e932ee0fc4a1d124ede4f2434b3bd5d54aacfdae472638a0164da10db32d2375b134106841febf8c8692cae0449aece3f91a87f35ac2db3

Download Submit
C:\Windows\SysWOW64\Dcnqpo32.exe

Filesize
120KB

MD5
25093f6f833621ce734909798f9d90b2

SHA1
3e7eb42a6b2c4a1876acd788dd513e89c8e4e48a

SHA256
388968710c442f5247d0817b135dddd4a6eb677558805db5d972641cac13c3d8

SHA512
1a5a6ab38f97ced528ae0852b6031543806c17efdb6b9e46ee67e2ec2f87c7790b3c053afa90bb4298a5c85ac2f3bf943a390a6f987667e9e50caeb65b159092

Download Submit
C:\Windows\SysWOW64\Dfjpfj32.exe

Filesize
120KB

MD5
9b85524b8aa9162fd61d46bcb9490449

SHA1
8ed5580af7096c6cde0810d5efea433667135846

SHA256
1517bd6a4aa5fcd1dc8c688a94eea7e7a006da7a7d34cc588f5eb59524da07b8

SHA512
9a7120e958ff79219b720f7a69b3dbfa7eccf2b5c028e3709ad442f437d0b1cdde2c0e7263b4373edf8830948a9b53514d4b5cbfc899ba893893b46a94b8169b

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
120KB

MD5
6c02dbd83f5b1097c65ffce0845be3de

SHA1
d67ef5bb48c0a24d317c6de36959c2c7512a01e3

SHA256
8d4d769b90a5fba6b81da7912c3584f9586119a811a26cf5e01b75405a5065e1

SHA512
05a93e4c3ab119f5efded38d02c0fd35a0d195eab3ffdb6f717f28206b30d9c687e6ace5c3e706ddfc04f25f05e4a25a302550ac3ec16a7e17fce866ef8799f1

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
120KB

MD5
8ef6016188342a6f89501f5e99807098

SHA1
fe82a84eac24b43552a7e92c1292eaaa1f17c2aa

SHA256
bde34a1faaa2db665fc90c34e2c907ddc9f6903f079c574295bb12e9229b9c14

SHA512
0fb666edd5517950c4591459b041ec59866f0898df115c005854ead5f01992d7c235d74a222c90985f0970dd2c562a64dc96f450513af844f1f84634b200abb4

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
120KB

MD5
cefffa745a64b997da35af96efc61b64

SHA1
a57f7bc6f8017aabab5acf4c070b739c6f100ff4

SHA256
143a6ebae3e3e274eea83d79d09e885557a9f6299eb63b3174a69cc2335383bc

SHA512
e393d40a1d74f10e62eb3d52fa7a221a20614923f10c47ec0367770f03f6655b94049e74a12e0590bee795653effc425802dba118515f3f3b9b6f0c96c9bd6ba

Download Submit
C:\Windows\SysWOW64\Djqblj32.exe

Filesize
120KB

MD5
14f450fa8c4d447a5e2568ddeeb8a1f3

SHA1
1a665460306d6f72a8716fbc6b2db8c9e50d79be

SHA256
e2739662abe1c59c4c1bd249db9e954b30a292249fd9ab72660030fa77690b70

SHA512
e54c969b0d418954f4b0410900010a8be3998fa3b445dc3091681e639d65ad8f649a72408101744e9ef3e22dce929695b999ce6072c56a9c2634f3626ceb1d84

Download Submit
C:\Windows\SysWOW64\Dkahilkl.exe

Filesize
120KB

MD5
e4228f3be4241691f5ee4c81e9c5241e

SHA1
f37a49eeecff452f85c07828c44200d714d64f9c

SHA256
90ab84799bf061f7f820bc499070c602ca71986782e20ac74328cd9543c9d164

SHA512
bd313db7b4980825b2ab041c1527e46fa852a831c9c1231253ff5a788bf274a11bb67c73ea38d19b5c69f3b8f78485dea093e4154b6c04c9c2174e9909f0e2d0

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
120KB

MD5
97bb778e1591b39d1ca4498622d7b674

SHA1
a6c07bd8565a1205955ce1a5f7732c0856b2e3da

SHA256
ee2299f53b2327532bf119552af6062fe414ca5a9960e2b60866b4d401f5ae84

SHA512
ab4184f4c2bafd7e544e6680fc50693714d8e50fb777f32763ea8f2a9d7f0012eacc3eae464ad9da135bc0da4f2cdf5f4d5ef0ffd98a613ef90f31fb3e501781

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
120KB

MD5
f2b3a9d23d0090a3661b10cf0a027c98

SHA1
24fc578fed6518cd4f626e81161c6b3f9f4a3829

SHA256
4603624e9e61c6dde0d09d1aa577a03094569f1cffc75e990e8cf80740bb670f

SHA512
1012048a0efa22f39da5238bfe55991d050fa65a2d48375ee663fa0ba0fe6ab150b61491735ce79605d18a0f19be62b31bcdce3bebd3dcf69d9ec24a513b74ef

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
120KB

MD5
07788e495441712d00448a583a00eb83

SHA1
b0bfc807832f3e1850823907d4e1328af735182c

SHA256
8d455bd1d9d25a09a15cc3bd44ccbaae31aacaa5e7880359fd89e33f9c6db08b

SHA512
cb6bf2fc44462f8d7e20a00e6f292e4b08a39ed95237523ae891ef3cd70a782603c3e99a187a98aa29e8acdfd3fb83b355534956866c754e60c42445f08a642a

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
120KB

MD5
9e98438d2cfea9551dd40ee9d319b556

SHA1
139e2dded175706418bbad9ccc5388ab0c6ed84b

SHA256
2aff23688dbfa3d0ebd9cda2ace64f95eed2ecb5a494fead985fae2e50d23cfd

SHA512
e9aadcf3bc102eedba5e7efa5ee9f9a4e3da34088e5285feb87d240e3dbb7aad6cf2388d201dde79a624b6148157b1a8541240a97e6d426b275938f026dff611

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
120KB

MD5
c99e07c2ac52773dc3072334922a331a

SHA1
132d8d467dc4b67b2e521d67b9f7d498fc4d1ed6

SHA256
7526c4314351e8d0fe53715008a44b8901fb87636cc79d50ce47e5563907bf92

SHA512
5ebfdfb8f9a6abb1ed413db1623042bfc6e8089246932b16a5d275908599a1c6f71b9ac4ae4cdf1dfe30b4e4d671c35521b8b9b359b2a03d6ff08d7158ef500d

Download Submit
C:\Windows\SysWOW64\Ecgcfm32.exe

Filesize
120KB

MD5
a7131a062c7e9c4b0b4445c8f253f9e4

SHA1
6f0bdcde2522e38b498ac48a3dce8ac3c1d28f08

SHA256
66b31303ee95d97f4564c817d73f588d233f53fd082673e7f7d486ae82ae24ca

SHA512
dce78f4c588b96e5cfcb92ccaa80f6ea62f5223ff19bd120a695208acdf70c4b0fcb5356eb17fb51d1829846221d49e6c2ad6018941995045f9d729da214ca55

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
120KB

MD5
f61e26f4008d188fb0611e0cf25d3990

SHA1
27d650bb84379415193429b38fa58236b0874965

SHA256
f2cd05a5f4f92d4622460a7f7f2a618e6dde76b76d5eb4ebb4c09edc28933c11

SHA512
e606248b1765d8463827cfd08848ea5a99e14087c56f5ad4429b50f352db2b809eadf80b62f6e3fee4e754b30097f168781879b2d882210c0ea68d316d03c6a3

Download Submit
C:\Windows\SysWOW64\Efjimhnh.exe

Filesize
120KB

MD5
a7fece007afd216e9bad3f463e1e18c4

SHA1
84bb892388e90539fe5a590e0a975a357448b089

SHA256
213da6b02182c49d101036130a6f2f0e5d29cd3aaaf7c37a85655ee63f3594c6

SHA512
86f80647d59e7bf183a36bd3c2114aa62c48c07be84fdebce3c374fc46a985b777d3085f3767874faeda75052c280d7c4b49888a4db6e147bb542154e1fc6105

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
120KB

MD5
d8746cc22d50b4e27b59cd59d05ca1e4

SHA1
58338bc4c1115c6d9978c78ff5719dfc8fb9f0e6

SHA256
1c709f8ccb58b40cdd0a7c2971072a1dda5d1a26cbbe12715dfb017ac1531bfd

SHA512
9cc4c002e32e96c7d930a533749e1bb76549f0ef794a101b1800aab7a3d86155d42821938263e77ec10e6154a9813bf6e24de7c90de22792deb17b6105a19218

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
120KB

MD5
990fb51187def529bc41ec2707366607

SHA1
76c11ab5fc831844c00b64242690e9f4a5ec634e

SHA256
68007e6d3d59ccd8cb53197b6afe259f5ffee77bbf1fbce25d062f69241014da

SHA512
b984cd8ce42880318a40da6d95f8967497741222f8965364fdd790d23a121807905ed40c182af0789de943fbed87c735be9ffc864276e71ca96e2a376b1767b1

Download Submit
C:\Windows\SysWOW64\Ejoomhmi.exe

Filesize
120KB

MD5
228366c81a36721db9432bc8cad9bd71

SHA1
f410a2208ce10fb1c823f38f38d67d19e7fbdc4a

SHA256
3be2f412b16258b639a903cd9ae47558030ae322244fbda3ad8a564e5439cf48

SHA512
6a205222b91241f6d0f0c0e384e88b6d8a3f652e9efdf3d4920500fb4f82c1959989191ffe5b2af825a9a3ee7aa6017c141bc7fc4f20c58757a8200db47c1494

Download Submit
C:\Windows\SysWOW64\Emdajb32.exe

Filesize
120KB

MD5
02a12848da8c9bfb3572fa74f7b59106

SHA1
45e9694afa578be17fd86ea584d2adbdc7ef5d11

SHA256
cdbc99ac5c97de13597e1ae808ae8468f9ebb92da8c984416eb01579452d44b9

SHA512
cf420871ab391cd096eb6ee8abf83e53b12dca4960b56157905f5a21a40b6b72fadc7225b865be852f0bf3cebace746019b6a00908854ab31236581eeb1e3aca

Download Submit
C:\Windows\SysWOW64\Emjgim32.exe

Filesize
120KB

MD5
aad10e355df7b202a2f5b5a10c07b1a6

SHA1
4bb3be196967dc1f83242748a8cf9db7d9810d97

SHA256
4271be744de0cf9e053b0db4c58620202983a8863ba41c65ce43218d045844b9

SHA512
4f8dffc1dd3f7c60d0a8c4ab11eb5ae8a984c07faaac7b90b12177ee622a5f3f0d04de0e2ff2470c955459fd63c3790d0f2ae86c5ea75c5ead3687893905e802

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
120KB

MD5
7362bd8eabe14fbfbd4fc97cc3dd9dff

SHA1
44a341353b062e13ff0a2c962c70fabd7bb0c35b

SHA256
259f30ee6b8f04827487619b665989316d34cd59f953b1a393f908a5a635f41c

SHA512
0f38818f9169d10cdbb98a1b58d0b05c78b3aa2d021f556cc287f6827907237cadafcee2044ced714eacdd8279bbb511f651008dc320585fc527a3502fad693c

Download Submit
C:\Windows\SysWOW64\Epikpo32.exe

Filesize
120KB

MD5
c25c12f90ecf00685feb1810b4a41162

SHA1
f665d2ee95f88a2d62666d61626d78601e6b30eb

SHA256
9c44c4fb8a61f09970515e59be4a35a358db5656704b591bcf865a9d4a247329

SHA512
b1a1445a910183dac56d89e0c62e333754cef008fca6b7d5377d6d0603ce8d2111899879da63713fae8efbd056fd30a5c9083cb4394a81a148333780a6dd0c2d

Download Submit
C:\Windows\SysWOW64\Eppqqn32.exe

Filesize
120KB

MD5
50bf2a5d47eab9abd7204f0a1f11724d

SHA1
7e1abee66979b5145c51a289b2d02d82c8b19c2c

SHA256
8414ef00ad365a5bfe33941173c959f994b2651914f6f4ffa115434e8d9879b2

SHA512
a6912d935d4bbc4d0fdac3020d1dd523e01354f95c9b0febdbbd98de45c948e666ab9d916ef92042dcc703adef9c3e7ac90d0fcd0a18f0c0ff4d1a09b7eeb4d2

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
120KB

MD5
41db21f45d260f4eeb50b4b355d62212

SHA1
d6890a44eaea0a29b5f856d4457ac21892d28243

SHA256
8935c3613547b49f9cb9b386ecbfe8e36ad923ba47be6dc228d0830540ff8ea8

SHA512
c2235d30c4bfbfb9950fb400b8e6adb49736254090ba42a6da78dfd89997e75e57f5b9693e8f6ff9dc7dcbb579498054db2dac417db3430712a2fc7ca43ebb1f

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
120KB

MD5
6820d8d5375eec635e9174bd7a21f3be

SHA1
597413fd61cdde2b2cec91d99f28517e343542da

SHA256
d520809f5164001f48a2c08bb11a2103934baa316624b4d282dcf4b40fd06533

SHA512
b24f21de721d8d47a129316dea1f47bb5b03c37cabc64c65d48021fd99db1dc44a501adf6886550fe5d5375921483c61eabad7bab99a40428ce2282486a2d4e4

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
120KB

MD5
b55c297893bc723348e987b0aeb6eecb

SHA1
0e13feb9788219a6cb679f71095f808de0f74346

SHA256
a62e79e600cd7c1580434a6c9b9b185145807fc5545358de605e31462a70336f

SHA512
64c15536ea07448f35b92e17f0ebc0eacdfdf5a9e35ed90257973b724c01c4c024273457d43f5a7a781407eb5e09aedde5f7e3cc7265014698a1a11e31d89cfc

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
120KB

MD5
7625171e84d48179815b69bbdad1c6e5

SHA1
051b777acb4027b0b3665e35e6dfadc6bb784280

SHA256
72d4d332660f7da2c904d32bedf25eba31b961ea4410b3ba7a4b3221a11fc74c

SHA512
58504d6655c5bfe8508b848d8a9a1bbfa3f208f49d4503d74fe9657c9a0a46eafbcb4f27b64d9f997b7e3538e704113d7c66eb99b89ee772b1a9c2e59d53f928

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
120KB

MD5
1f17b77de48e0195d57ac77140232ffa

SHA1
4e92387c0d751bab1efb68923c039436d7e418b3

SHA256
c838ea46984d9a5d4696292c5f8610286ca7b81e10885677033189c896e0489f

SHA512
8a0a46effeac3c0c6ada28cac75ada78850071cdee349257d1a68302cceb295cf3194a68d2f58264d4bd85865b9af7501f9f556c24d0387fc1b1baad4776d8fc

Download Submit
C:\Windows\SysWOW64\Fideeaco.exe

Filesize
120KB

MD5
b132f27c94d3b50650b660ac07fd478d

SHA1
cc5eab8c1efeb396426d6c2b50454e9c7ab04c9d

SHA256
898efc57d375d16bbda0f40d3883138ad1b776cdda7e6e4adcab573dd5dedcfa

SHA512
c3f2d473113589f21b00774ff26bbf881c11b2515e0a6f70ebabfc472ac23a2c37aa4cf0a69a419986dccf7237f2f55e749e84642d77cdb6e2005e355f23d02f

Download Submit
C:\Windows\SysWOW64\Fikbocki.exe

Filesize
120KB

MD5
316b0b2efabe5de5537fac9d85a0d45f

SHA1
7bebeec7ff3e29aee814988809cffead6915d2b0

SHA256
825c06a3086716616919a583fb9a2c36af08414dcf592cba23c463de0877a917

SHA512
88fd6aeec93d6e1dc304a3cd3c11cc3080c344ff88d4ecccf7c7b05a9e83019c8754fb7869413824725051921cafcd9be598f2a42c85cddb47574d979fac809f

Download Submit
C:\Windows\SysWOW64\Fipkjb32.exe

Filesize
120KB

MD5
83b1c59cf38c607d7880aebfbacedc20

SHA1
25c25c8a6b33e84b985089d711da0fbe3ce7b338

SHA256
c5c15b239728bedbde3c36c02fefc06228f531e7765ae078f9f87f376c9df4dd

SHA512
bb9e9c2b55e8891e136807632b8165e513d02b069cccb1e6b322a975feb2f36049b4e68163a4151b0909d70475fc380a2afb3bd48ecf03b299a62f0d49f0b726

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
120KB

MD5
75ceeb0e7e73eebc1a0086eb013c0719

SHA1
ec863b05aacd18979bf80470fea18cedfb9bbfb6

SHA256
401e4225c2ce54fdf9201d6902331dbe459d4d45f7277b936ff54f64be7ae6fb

SHA512
9e39e44afc804069cb8b190d956555e6851a66b8eef0ce6c2001e3711088aa4782de3c81a510295c168e89f6a35af269feb6d9d8420faa517b10a864a0cb3353

Download Submit
C:\Windows\SysWOW64\Fjohde32.exe

Filesize
120KB

MD5
53598d260cf5a89608c2d1415e3cdde7

SHA1
708aa5f2676c4d5d12547269a907cef7221fab62

SHA256
890a8500860552094f960a5d5c49b3b16bc9ee3646734d7ffd91a202e85e50dd

SHA512
91781bfee249d65e73ec9e891d7145a5eb52028e355d2ce40ab8196b035aaacb08349c1505f8aef341a5e8bb5d5dd01f87f2b26bc9b792cede37505d69a53529

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
120KB

MD5
19a66fad08d934f4bbef093b58b345de

SHA1
96744ee4f3f7b4bb97980e37b9a956cffed25e7a

SHA256
2329db33e3fe38bf8ced50c30cd5f379755463a4fddbb6f68170d06ffda17a5c

SHA512
db862e0cef53fbc484c343f5a93436e8564a1bba830f2e9b99744a1a40ae7bfcb1c0bf14523ffcc1fba4da550a1ebac3daa7b4b2e5dcf27932d852021b18afab

Download Submit
C:\Windows\SysWOW64\Flngfn32.exe

Filesize
120KB

MD5
621d4a689b448a9648b4035c98d4c965

SHA1
e15babafc78ca6be5897e497f9f26203bbe2aeba

SHA256
f3561dacd27dc1ec826f00f7dafe3c15ca1db19b1e22c9425b2f0bcce088bf2e

SHA512
ed7cc99fb0bda08b02aceaac0dc6ae169eebccf5807a229d18f0a98b4b104614c50de3b77821e761f0cba59164dd7b7d0249985ff07c4ca46d012071c90d42d8

Download Submit
C:\Windows\SysWOW64\Fmhdkknd.exe

Filesize
120KB

MD5
6c2215b143079befef58b6c9fdede240

SHA1
42c1381077a69898b69da785a206d6f30b74e65c

SHA256
2104c84262233d4fc6b3fd8a565c5dcf708c0c38dd570a197fa8ea998c36bba8

SHA512
780e06260011c72c1e9e8fe4aa9de6927f76067ff7a55ffd7ccd2d169e33f1cc464aeda5e9b45d4a25a009efcb74a1295486b18ca7008328916ed3ec49619c3e

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
120KB

MD5
e86d3a33f1b1f0d702924b9730d761f7

SHA1
b79d1941aa39e6b7e9f73f9a62f1142f2e28bbd5

SHA256
5f1a139488a38381bf706ee35f2968e4e75fc810dbf0cb9600b184a9a550eaae

SHA512
0413dde0cb2d0269762618604c8b2ddb0a24f3f3f4090118d4c3a446b62c79d61125f1146c22ed45fe241a982046bc00d212de8b06a58ca664c317ef0785c96e

Download Submit
C:\Windows\SysWOW64\Fpggamqc.exe

Filesize
120KB

MD5
48b9bfe85ad621dbbc37a877ba52f859

SHA1
5b01f35b49b1c33a27d6fe98ecd6a0b9dc44c2ad

SHA256
dcd77425072e109d2f6486da6700db4d43d63953efbf72a959ca7965c01f874b

SHA512
1577a9700cd865e1b83be3c051ca44bc889ad52e5d668cbe03ef6dd1eafd4ccb59e4b06ad4d7d0d6fe4e617a807d620c26c560a0410dade5922cf5f6e23d3bf0

Download Submit
C:\Windows\SysWOW64\Gakiqbgc.dll

Filesize
7KB

MD5
ba84d83e38a9b4af366a7cd083f99064

SHA1
879d14a487f41812b22157d495913e06c4060d0f

SHA256
cd3a52c9636f6e80875503d3dfb5ef89b725a5c6f3573c34f48e914556ff8572

SHA512
49a2df948a34455059c12b932f4874bd03051b2736cb5a128c35c559d568112e96572a82c8fc21e5e9a8d5e0c522ecd55c6d821a086343425259a81d5b849abb

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
120KB

MD5
c3dae331dd36940dd433c3af0e93342c

SHA1
47d88feaac99e5e313d4beef3fcee585f0c53ced

SHA256
a288446c2551952fbdd9a940003edecada56960e83e6b3b56ad7dfcdf9bb5a87

SHA512
cb9e9347ebbaa7dd88e3d09613a0b5d38e287d0a9e2e639f5e5a7d91d707656e88d8037da8ed86de59845baa02ddf706bfc4bd37d9ebe93ff29d47c8fec9c83c

Download Submit
C:\Windows\SysWOW64\Gihgfk32.exe

Filesize
120KB

MD5
75bf24a8504011814f17b64107682719

SHA1
d870f0a17d28199c230de35d35a0f92a489cdab7

SHA256
88b32f1bb93e4e4035af3201ba56d1a816af09c2e4fef62074bb05812c9b1951

SHA512
47527759a53cd57d47d4128a136c8ba95b4e7f1edc0dc195a918b8619e88ae657fda21eef2a5eec1f627e4c655d7436bf9171d20d256b6664924abe3ed8ce273

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
120KB

MD5
e10d7fe34b03c2a63a8946c8d72467cd

SHA1
aa94e31e0c9048fed69292f15351e698a382af90

SHA256
426a369bfae635e5336dd5a5552d01e72e5fe03337c1a3646b98ddbba8b3b54e

SHA512
b1da1b361f6438a094b5e520fbd4f30a12dfc08869c9d0923e76bed695a505768ed5e717543df9bfde2ea1cc6934d29dc15498014aed28db0032a55e6cc37ac1

Download Submit
C:\Windows\SysWOW64\Hblkjo32.exe

Filesize
120KB

MD5
cc535b78f2230b56d77f4ca1e4baf91b

SHA1
35a715b00028eaa3c2d25d2224b81240959a0aac

SHA256
1c97db08dad31e50057e3a02d82f0f1b49a9ac0757b9285cc03bc226d28d0b6d

SHA512
2a98deef4824486ba14b05f58fba381ae4d6a8d86723d7f12b4d48d70da56c71e77bce6d477f3a7a26de947674c3eccdc2fe76c90fe9753e32e29c0e8ad9ebef

Download Submit
C:\Windows\SysWOW64\Hiipmhmk.exe

Filesize
120KB

MD5
b5c6c252b62f469e71c5005e8503f8c5

SHA1
11f2b5a6aeccdf7ec076992d1007e47bb5684af4

SHA256
4fecfbf5e39d0b318988c600137239ab23526bf14da86ded17b28bfe75bec308

SHA512
490d351f5993667d92aa79cb68a998ee2b7562ae6f51fe4ae8525354188dc869a80dc8e584ba7ca6492b202b88ae4d9687535e28c074c572a06d80ce0aa515d2

Download Submit
C:\Windows\SysWOW64\Hlnjbedi.exe

Filesize
120KB

MD5
5ae4abd4451d60d06b95e5c1a760d772

SHA1
73e107934783fee0018cb617a2656330f44d1bf0

SHA256
f0095844880db8416f3f3944567dc342bd33f0c26bc0ebd9b98994f5fb8973ed

SHA512
a4b173d91f9558469298470aabe70231b9a2b7f7166a58b786158430402034f391f1e8244658722323c93d5972ead42a0336aa58169c6b3bc3c435f26d7956a7

Download Submit
C:\Windows\SysWOW64\Hmmfmhll.exe

Filesize
120KB

MD5
a0bbec7203d84bc9032add700aee4145

SHA1
0f8e746842ebbc30c7481e2cbdfe83bc2be3378c

SHA256
6e0a41aad7e44fadc6b6c8af93fb7284831e3149f3adf1a04872cc4955ce288e

SHA512
d17a9062dbab627886ee154356bcc1f139c6faf449897ad54df28b14a432cc3ef9bea6bae5730345f477d128f00616748ca946bf36c43cf646ee18c8cf8df188

Download Submit
C:\Windows\SysWOW64\Ibhkfm32.exe

Filesize
120KB

MD5
b986bbd2df4f512816a67d2bb3302580

SHA1
378331f57942b40398c42d95834cebf2242f5b07

SHA256
3bd9ffb30a4a5d64f749536bc7a7f022ef8281751685f76675d48c43d971d21b

SHA512
a80daddd76b0dc6c2147219aa20390dec3a5eb767151d891cccc3a84b2e5d9a8507afcd6ec056d8898fbe9b297f0be5a64a8ff5799e74baf73a9351c925c5b64

Download Submit
C:\Windows\SysWOW64\Ickglm32.exe

Filesize
120KB

MD5
bd905dabb4ae57bb8a4233f08be54d57

SHA1
62dd10682fe79ace722a694555d3e346e74bc9ac

SHA256
f62db4a5ec1a71637534aaec8496d2e8abc02a7bfe28ad69f6ce21ea41dd72f0

SHA512
3e23b61f8e6018275f67c728325710ec280e7529724cf1ba7110f63c8d38658a10b54dec944600d65468d4d9ae70515eb59fea5d6710275364ea75e6bc919fec

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
120KB

MD5
45d05f12209232c46cb4b0d1e37a8cf2

SHA1
e12ea0f2e043c2834037edd927713e2bb02035b3

SHA256
56ba5245a6db01d81a3a2d04a2e38fc8f9fda2dc500da756c1ef436bb35709a7

SHA512
7e22240a2fb1e32a1404ea2dce202460136861763483dcf2c60a114ca5315da422733c8383b3ca0758de71ddd646be2c67c19e83e05d9b428001e1a5dc29b291

Download Submit
C:\Windows\SysWOW64\Ilqoobdd.exe

Filesize
120KB

MD5
dc9d614a30db0b96862a18218d6be88d

SHA1
1c7dee7bf319bda399b37c4a1add8ff26ae488a7

SHA256
9243e1844a9ef95bb3e19401462694eb63c7faf51aeb93e5be020eaed99d585d

SHA512
44f41786f621225bc39cfc9c4806cf473882a2a1097c98d0c11f2e807227e783e9ae65f99c46e14150a8da94e2373f5ca74ea1998fa59f8dd3ff93f77303acfe

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
120KB

MD5
c78ad618554289b5f6be219bb66da87e

SHA1
9e2e6705e1f1bba158a248528d9db5cc4feb2cad

SHA256
a8694f81952fcbb566bbb6df6f49d275665b401dba2a149c234fe7b189b5171a

SHA512
e5497d28639d165a6dacd3446ea0467a6aa32a8a5ea951c0731cce89bfb05b1a29966075c6a86328a877947e9609e7a60b973865770bb155c646ae90ab9cc667

Download Submit
C:\Windows\SysWOW64\Kdkdgchl.exe

Filesize
120KB

MD5
e1797efd50a23bacd26b1434e0563a64

SHA1
c9442fa21173dc7e3dc062ee716d2fe3c54dd546

SHA256
364c25fc87956c21948186836a4111831457f6b4b4eae69edcd8c1466edc8891

SHA512
f508d251666e400421919f9f3569111120eb4312ae407cde94002189a29fa7e33468a9a6a4e13bc9ff7033bcd35f67649b818a5e72a6ce4ddc47e89a7a224aa0

Download Submit
C:\Windows\SysWOW64\Klfaapbl.exe

Filesize
120KB

MD5
946b8c78df40f7b3dc1c100b76834233

SHA1
70696d3d557c28d20ec67460e4d43ebab0b1d5f6

SHA256
3bc28ab5d166f88bd7b15eb3c33241b614fa23f8246047ff643734a109ff8c5f

SHA512
7cf0b180df8167bd749d3eed4f3eed5ff8537526de25c3b16a880c2fadda0198b1596598fd0bd7e4cf2780c39fbcd36ed0ca1414971b7a4209effee0d58c692e

Download Submit
C:\Windows\SysWOW64\Lckiihok.exe

Filesize
120KB

MD5
a78abba13de3b426faf3996848cf4075

SHA1
ac77fd3924cc72c7b658d546b34432e494069262

SHA256
4a602a2262de44be0194e2faf722f7c0d22e8e0faf932a87768afbe15e39df85

SHA512
6f57925c02a93b055089cac4fe1e0144f4a64e9f4f2d7fd3a4cd499bf55156f29c2a7d7912af3695422cad0636505ce6d5f2678952c300a42e77a1b0f3097462

Download Submit
C:\Windows\SysWOW64\Lknojl32.exe

Filesize
120KB

MD5
d26469ed5ba24d456f0e29b8ef8d4737

SHA1
81663597ae66a3d2fe81c90d4f65de81ef258dde

SHA256
bcb345a1d5ddab80579895b0a5d714b59edf55e3441b2c6cc3f5e083941f5e0c

SHA512
ad77c4f3eb984ec1c8cd091f715958a42883136dc3e91dc6e107df55710fed54cb0e99234ad9545859df7aaf859a2e142d611ad6618ae63304783845f5ea1c14

Download Submit
C:\Windows\SysWOW64\Llodgnja.exe

Filesize
120KB

MD5
9b7885b7bb3a557943c3b9e1535031c6

SHA1
f5f9d319bfc87c76b853a8a4a3e38806524002bf

SHA256
6334beb4adce463d79e522b20159ba0bbaf4eba0318506f1064b381bfecf5674

SHA512
161ab4fe1ba3b244016d5bbc18e4b1da3a81437ee145909615c20f41f09a153478c46d37b931c0ad54e547dacfbb2b7b4dfadcbe1a28049c67558a2fac5b2f8b

Download Submit
C:\Windows\SysWOW64\Lokdnjkg.exe

Filesize
120KB

MD5
64655f61802e04b58164ae74f5d92817

SHA1
3a343409fdc67a77058d2874a7d256ab3fed94d2

SHA256
a544fabbf35f39ddd35f016e30d2e5e37cd8a7322eb87b957dcaee3e8dc20558

SHA512
d222cc794985fd939fae2f9c35382c78c46de674fc58543d090bb24a41bfc7e54eb0ce114eafd2ee0e281bd1a950c05ed3e34d03e3b4a8b14d9ad9e96043ab15

Download Submit
C:\Windows\SysWOW64\Lqbncb32.exe

Filesize
120KB

MD5
b0dd4e6ec8c598d69c403dabc2827be5

SHA1
ebba2b0529e4eafe6481ab50e44407541c16ea2f

SHA256
88db2e2b1db257473984deb760d5a5f32457bb8ed6d1a9a228cb9c62aa37f53f

SHA512
2841183a7c8c178c6590465a21be9a9b3f11fb9dbb1c40cfc15c725ac2c9a062d2e12dd0ebdcae7ebc1791ccb27ec906195fe4dcdabb80998410661237af6962

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
120KB

MD5
fc4309d8e0cb39350cc3872094e30e3b

SHA1
becd75fbec64ec2bf825c1f939d09987fedd8b93

SHA256
7e1c96cf9ca96583a65f9c4f724d9ad36684927e1703e92bb149e60a540ac0a7

SHA512
4e8032e87a7a56fbbac2ef7ae5684c0804063b618594cdbf68b2dc155f0c90e2b90e6435dd94161cd9a57e4c9b161597f524e58dc9d30a4f04c245288767421c

Download Submit
C:\Windows\SysWOW64\Mgehfkop.exe

Filesize
120KB

MD5
d7780c5b92c5d321bc57d0cc07aaa5b5

SHA1
2c09e0d28d8cf250f2368d3bf81bf1c0e10af51b

SHA256
4e6ae7cf7e0a9127ceba05d7fb0ea84d32e82a5291a52b96b50f515fcd51c6a0

SHA512
0f01f79eecde86ad9a60b771f4a01a1830f5c3760ef898a9445862d31b435afa281fff373fadf9ce7293df8a4d5ea3035910aff7ba89369a92464ada355da5fd

Download Submit
C:\Windows\SysWOW64\Mjmoag32.exe

Filesize
120KB

MD5
990fb80375579af60b35e4f7be42d8fe

SHA1
ef24008ba62ef69ea117f2b417363c5cd89ec3e0

SHA256
198ae5ff0e2c3450b6d23d7412f80267d2a7234edcb6483ed4663db796fd0f61

SHA512
f523f44be7d6a9082eee168c6dd479e4655418e5e259d17d0ef07bf616d988c674886fa97b1ecb34d70fed60a2831fa869e37aa179db90f7d0c6ef7ed0b0e89a

Download Submit
C:\Windows\SysWOW64\Mqdcnl32.exe

Filesize
120KB

MD5
19fd70d8b4554cdee8a5a469c0b31fd2

SHA1
3dcdb1ac0f4b9f88a98f05c797dfe52f3297b15f

SHA256
94fbff6bbef86d58539a321aa061c8024b80c7c569472fa56c96ea7185b8a6b8

SHA512
35aae85bd7133617c35c57cb374342c423e828d5cdc57df0001fbb4b0c9101dcd2acd5010f75672023de0957bf9b0988e2a96ccc1d79745f0718e2e33f842dba

Download Submit
C:\Windows\SysWOW64\Nlhkgi32.exe

Filesize
120KB

MD5
0c7034499a2d779f78dc9223313523e0

SHA1
1f80d92021eca3c20a0925e5b237e3ade78fb401

SHA256
23cb382f9f45141a1e406f4e84dcca00e0fb36b36c36f644f8efabe5ab491160

SHA512
dad528648dd05ceacd214f670d78390c4bb7bac1b9ba927182680e952d2b8e2ee373755b120d63aa47c9c169ce0a411e460d8fed94ad473afe21a0caca9c1ffe

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
120KB

MD5
0bd05035ab0e1d18c98bb5e220e524ad

SHA1
326d491aa80a30b424cef5df6988d96067b533ab

SHA256
4f0e7d540cc7cb328996b87ee51b5887804a9466697a3a5485e39e671b729e3d

SHA512
e2817c42ff43e723df6dc04abb39689d131ec174f6500dba1cb49c9e11e0176f349537c04a0f10dbd8af1d51bfc5f2cc73e4f1c45cfc9429fa25b53a7b80a18c

Download Submit
C:\Windows\SysWOW64\Nnafno32.exe

Filesize
120KB

MD5
3dba5266cfc5d282dc7f0709743ea0db

SHA1
5bc6254cb4b2f006628d20310235749d2584f14d

SHA256
1ccb934d3639b177f14fe0f7f02c72c882e286adeff91d974bd39e6d17a6fa3a

SHA512
f9118e0358813b1a2de5f05573561c1d2181ee04fbed5be2eb5bd6371cd3e4a792e8e8847126b428a7897858149a54a7110d817219f74421d449694a7f8fbc61

Download Submit
C:\Windows\SysWOW64\Nndjndbh.exe

Filesize
120KB

MD5
f2135e4a7a54486180f2cee037ef70c0

SHA1
97363cc194fd227aa6749e384bca2ae22eb87c3d

SHA256
7a68df390b1ffa4020c4b209ef2f97402e194d93b337063cf5884fa16cc8c3d4

SHA512
db235244b3c01606abad8258684657cccefb942e5bf692aeb0e4731eb5935a205674ae38506be7cffb74d6212af1c78d8bc1add5ef7db3bb9f73d6105db71e30

Download Submit
C:\Windows\SysWOW64\Nnicid32.exe

Filesize
120KB

MD5
9b40ca6fd30831c0aef31ffacc8b594c

SHA1
d7a9d5e97870506f43e3dc1a0c43ab5d44d26f0f

SHA256
735f893c2802d6be3fff37df7703db2b66d8b11be505ee21b41a49ac6d71e8a2

SHA512
4b79b692af72a23765cb57f8c3b1d0e3072bb2aa13101bf2170761aba94b861649b97acbcc78ca5ea349d65e02f6ef34823ef1e07a5a88fffa4edd6e7c3cbc03

Download Submit
C:\Windows\SysWOW64\Ombcji32.exe

Filesize
120KB

MD5
f29f71abc639853a82bbe91c1fbcda05

SHA1
d8d41b26375880c721fc64a54e5fe78ecd93deb0

SHA256
42521781b5a6bb29015b94cd64e033603131d6e969a4305630f1b7179d74d781

SHA512
0fdee858139f6c55d33bd0abe6591f77703068c4353930938232140095845057be429dfd283353a20c87bf70de30791198c10c2a490b653f7bf878f46e7eca58

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
120KB

MD5
fd83b88d521265b1732bc3aa4b04730c

SHA1
96d988582b90a435102d3a485df6cad00ff9d52e

SHA256
643ddf104ddb80e33663aaf1ac53c0ee84a8b98ca808b92d496359ef5e8de772

SHA512
c1c7dc30304d3131e4b66b54e650860c8a15eda2e142df28e4dd436d1ce526efb6484a5d5520aef11c5d2259920a8975877ee499889ff01fa8717e6dcc1616e3

Download Submit
C:\Windows\SysWOW64\Pdfehh32.exe

Filesize
120KB

MD5
897da19b281a47715ff9f6789483e93b

SHA1
d758bfd9d413c32ee95940aebe0036ea0551b1f9

SHA256
0d184b7d420fba0aaad8c0a2ff41b80114f6f74b0f76a54cf422d05779f6117a

SHA512
013758f2e132e4ad4358941f5fde1c8636770428263cbcaced4d510110c7176dab76ca781a0bbb37249029596c59051210b9bfb7d1641da0179d7702fe75a3f9

Download Submit
C:\Windows\SysWOW64\Pdkoch32.exe

Filesize
120KB

MD5
e5ac5a041b5932c77f7e8cfba7c077d3

SHA1
1eb5ddbe09fb04ee1e2a3c92ee55a4824f6bd268

SHA256
033caa54cf0dcdbf92efd0ae5bb8bcc70679cd80bd683bd4dbe925baaf36ad10

SHA512
f22c0cd3c36b1f6c77b58c36bc8b3ce8a3968cf866a2c9caf31a1009b1f2c15be8c7d5df6894b12d904e3a69c60df368bf89bc376e13c85fcf420753b5135c4c

Download Submit
C:\Windows\SysWOW64\Pjpfjl32.exe

Filesize
120KB

MD5
4bf59c2d9e7de7f54595c85dbb10a3c8

SHA1
5a7f0ae28f143f6de379ae1923a3a97d276b694e

SHA256
3caf89acffa54181e226bc946d3d6ebc0bfa537aa4a4c3e1d7bd5e49436e2715

SHA512
e45fcdc8b90ebcfe19d3a8fcbfd383483a8c44ccf57e2b31bd60cfd076bbe95ea9e50e40d3d2f032430cacb0c2e591fbdeadfebd9395c37d2744d6daf99b4ab9

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
120KB

MD5
1b0ea5b30e1b2385a85203edbe959538

SHA1
7b2441f03cbf16d2a07e8388493865f597b5bd88

SHA256
fdea10026a4fbb396848ce1e43de838c3d217876bf7f2291fb90f04855339fa2

SHA512
58246cf90232c9c0730c3df43e66e428c38def3aff25d89177952208ca2d57511ab4a9a07393034591e46817c4c12e7b6735115c823ab87d8f88e7418914e97d

Download Submit
C:\Windows\SysWOW64\Pnmopk32.exe

Filesize
120KB

MD5
e312c2bc9008384a2f01007230dedd81

SHA1
d4754ef7ed387031585fc8cf128743fa584a557c

SHA256
e2c3a3a028da0e0a4396ad0fc1418294a760f3e76f9ff89bef3a75e454c88f21

SHA512
0419be490cda274a12e5aa8e8e910f571d53590ae2ee463fc1c7588409e5322fe5c688bb09c5c64ba07d5d3b4ea899f0e00704f6871bff44a9e71f350abfd094

Download Submit
memory/184-292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/456-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/456-565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-104-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/764-476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/932-279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-577-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1204-340-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1260-88-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1404-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1468-394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1480-352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1572-135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1648-111-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1932-248-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1988-322-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2136-192-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2252-496-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2260-286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2296-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-490-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2360-382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2440-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2440-593-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2468-334-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2512-304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2600-151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2636-418-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2664-430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2724-346-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2740-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-80-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2892-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2908-315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2952-551-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2952-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2964-484-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-255-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3168-412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3172-520-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3260-436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3352-544-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3352-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3448-424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3456-478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3524-508-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-558-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3656-199-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3796-47-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3796-586-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3824-167-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3892-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3992-376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4012-358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4056-212-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4100-39-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4100-580-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4260-328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4272-448-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-224-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4380-266-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4444-370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-127-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4548-400-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4608-406-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4772-454-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4792-159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4836-465-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4844-280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4868-466-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4908-502-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4936-239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4944-442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4972-526-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4976-364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4984-175-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-514-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5092-183-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5128-532-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5168-538-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5212-545-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5256-552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5304-559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5348-566-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5392-578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5424-579-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5488-587-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5536-594-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads