berbew | a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe
Size

163KB
MD5

89e5839c1c4291b9af395c9e77a2f964
SHA1

25a517cf533f28b77b4d6337237b92ea3c059768
SHA256

a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4
SHA512

e644e9fac063c91c35ee44498778b81c75fb25df4df5f76d044de0c675f73e04ab46dc494d85bdf0a627bdb561ccebc087e1d2b78a30c01522433d4b9bd3f4e1
SSDEEP

1536:PhQPe+rhU4APZgHvVfXYgMoM1+ScLVRv2IlProNVU4qNVUrk/9QbfBr+7GwKrPAS:0bFU4ygPVfXuYVdltOrWKDBr+yJb

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohkbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idcepgmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akglloai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohghgodi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oldamm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmbjcljl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nihipdhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhoqeibl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppahmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akffafgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfqmpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpfepf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Injcmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihbdplfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlmbfqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkjnfkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onmfimga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihphkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohghgodi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcjiff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmhigf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikkpgafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Embkoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjccdkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpjmnjqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekdnei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjfnedho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goglcahb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idkkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Camddhoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnlgleef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idkkpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnpabe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dflfac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjbfklei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phonha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdgafjpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmgjia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efdjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbbdjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apjkcadp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblnindg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cioilg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikpjbq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkbfeab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moipoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edemkd32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

pid	Process
1132	Djfcaohp.exe
3320	Djhpgofm.exe
4532	Dfoplpla.exe
2276	Dmihij32.exe
3508	Emlenj32.exe
400	Edemkd32.exe
1088	Efdjgo32.exe
1860	Emnbdioi.exe
3592	Efffmo32.exe
1724	Epokedmj.exe
2296	Embkoi32.exe
3580	Ehhpla32.exe
4028	Edopabqn.exe
1004	Fmgejhgn.exe
3120	Ffpicn32.exe
3664	Fgbfhmll.exe
1940	Fagjfflb.exe
2108	Fkpool32.exe
4968	Fpmggb32.exe
3868	Fggocmhf.exe
956	Fmqgpgoc.exe
2704	Fhflnpoi.exe
4988	Gmcdffmq.exe
3484	Ghhhcomg.exe
1120	Gaamlecg.exe
2648	Gnhnaf32.exe
2848	Ginnfgop.exe
1232	Gaefgd32.exe
2460	Gnlgleef.exe
2584	Gpkchqdj.exe
3084	Hdilnojp.exe
2620	Hnaqgd32.exe
4200	Hgiepjga.exe
1672	Hkeaqi32.exe
1164	Hdmein32.exe
2780	Hnfjbdmk.exe
636	Hhknpmma.exe
2292	Hkjjlhle.exe
2480	Hnhghcki.exe
3588	Injcmc32.exe
4428	Ihphkl32.exe
4536	Ijadbdoj.exe
4736	Iahlcaol.exe
2608	Ihbdplfi.exe
5044	Ikqqlgem.exe
2408	Idieem32.exe
996	Ijfnmc32.exe
3628	Ibmeoq32.exe
4104	Ijhjcchb.exe
396	Jdnoplhh.exe
3332	Jnfcia32.exe
536	Jqdoem32.exe
4336	Jgogbgei.exe
3316	Jqglkmlj.exe
2656	Jhndljll.exe
3996	Jnkldqkc.exe
3076	Jgcamf32.exe
2116	Jnmijq32.exe
3612	Jdgafjpn.exe
4076	Jgenbfoa.exe
1612	Jnpfop32.exe
3948	Kjffdalb.exe
4708	Kqpoakco.exe
3240	Kndojobi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Okedcjcm.exe	Ohghgodi.exe
File created	C:\Windows\SysWOW64\Apnpee32.dll	Jqdoem32.exe
File opened for modification	C:\Windows\SysWOW64\Nemmoe32.exe	Nbnpcj32.exe
File opened for modification	C:\Windows\SysWOW64\Qlggjk32.exe	Piijno32.exe
File created	C:\Windows\SysWOW64\Hiaafn32.dll	Gemkelcd.exe
File opened for modification	C:\Windows\SysWOW64\Nnfpinmi.exe	Nglhld32.exe
File opened for modification	C:\Windows\SysWOW64\Akdilipp.exe	Adkqoohc.exe
File created	C:\Windows\SysWOW64\Mqnbqh32.dll	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Mahnhhod.exe	Mniallpq.exe
File opened for modification	C:\Windows\SysWOW64\Lddgmbpb.exe	Lmmolepp.exe
File created	C:\Windows\SysWOW64\Mjkblhfo.exe	Mglfplgk.exe
File created	C:\Windows\SysWOW64\Aphblj32.dll	Bnmoijje.exe
File opened for modification	C:\Windows\SysWOW64\Lmdnbn32.exe	Lgdidgjg.exe
File created	C:\Windows\SysWOW64\Kjmfjj32.exe	Kgninn32.exe
File opened for modification	C:\Windows\SysWOW64\Ejchhgid.exe	Epndknin.exe
File created	C:\Windows\SysWOW64\Gjfnedho.exe	Gpqjglii.exe
File opened for modification	C:\Windows\SysWOW64\Kqfngd32.exe	Kmkbfeab.exe
File opened for modification	C:\Windows\SysWOW64\Kgmcce32.exe	Kenggi32.exe
File opened for modification	C:\Windows\SysWOW64\Hhknpmma.exe	Hnfjbdmk.exe
File opened for modification	C:\Windows\SysWOW64\Lmgabcge.exe	Lndagg32.exe
File created	C:\Windows\SysWOW64\Jongga32.dll	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Pjehnm32.dll	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Ehhpla32.exe	Embkoi32.exe
File created	C:\Windows\SysWOW64\Ihphkl32.exe	Injcmc32.exe
File opened for modification	C:\Windows\SysWOW64\Kqpoakco.exe	Kjffdalb.exe
File created	C:\Windows\SysWOW64\Licfngjd.exe	Lalnmiia.exe
File created	C:\Windows\SysWOW64\Lejgch32.exe	Lkabjbih.exe
File opened for modification	C:\Windows\SysWOW64\Lmmolepp.exe	Lklbdm32.exe
File created	C:\Windows\SysWOW64\Pejkmk32.exe	Phfjcf32.exe
File created	C:\Windows\SysWOW64\Hipmfjee.exe	Goglcahb.exe
File opened for modification	C:\Windows\SysWOW64\Embkoi32.exe	Epokedmj.exe
File created	C:\Windows\SysWOW64\Mkfoeejd.dll	Opclldhj.exe
File created	C:\Windows\SysWOW64\Ijfnmc32.exe	Idieem32.exe
File created	C:\Windows\SysWOW64\Elpkep32.exe	Efccmidp.exe
File opened for modification	C:\Windows\SysWOW64\Iknmla32.exe	Igbalblk.exe
File created	C:\Windows\SysWOW64\Bnoddcef.exe	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Injcmc32.exe	Hnhghcki.exe
File opened for modification	C:\Windows\SysWOW64\Jlhljhbg.exe	Jkgpbp32.exe
File created	C:\Windows\SysWOW64\Cjmhfb32.dll	Ooejohhq.exe
File created	C:\Windows\SysWOW64\Pidabppl.exe	Pcjiff32.exe
File created	C:\Windows\SysWOW64\Dfkecidg.dll	Fipkjb32.exe
File opened for modification	C:\Windows\SysWOW64\Hlcjhkdp.exe	Hienlpel.exe
File created	C:\Windows\SysWOW64\Mnkggfkb.exe	Mkmkkjko.exe
File created	C:\Windows\SysWOW64\Pahilmoc.exe	Omjpeo32.exe
File created	C:\Windows\SysWOW64\Qedegh32.dll	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Dpofmcef.dll	a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe
File opened for modification	C:\Windows\SysWOW64\Dbjkkl32.exe	Cmmbbejp.exe
File created	C:\Windows\SysWOW64\Lgepom32.exe	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Nhokljge.exe	Nlhkgi32.exe
File created	C:\Windows\SysWOW64\Lciibdmj.dll	Hemdlj32.exe
File created	C:\Windows\SysWOW64\Gabfbmnl.dll	Moipoh32.exe
File created	C:\Windows\SysWOW64\Oboijgbl.exe	Okgaijaj.exe
File created	C:\Windows\SysWOW64\Cihclh32.exe	Bbnkonbd.exe
File created	C:\Windows\SysWOW64\Pfejnf32.dll	Iciaqc32.exe
File opened for modification	C:\Windows\SysWOW64\Dijbno32.exe	Dflfac32.exe
File opened for modification	C:\Windows\SysWOW64\Kjmmepfj.exe	Keqdmihc.exe
File created	C:\Windows\SysWOW64\Nbnpcj32.exe	Njghbl32.exe
File created	C:\Windows\SysWOW64\Nognnj32.exe	Nklbmllg.exe
File opened for modification	C:\Windows\SysWOW64\Niooqcad.exe	Nahgoe32.exe
File opened for modification	C:\Windows\SysWOW64\Ajggomog.exe	Abponp32.exe
File created	C:\Windows\SysWOW64\Ebejfk32.exe	Dpgnjo32.exe
File created	C:\Windows\SysWOW64\Dakdmb32.dll	Gbmingjo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2148	11388	WerFault.exe	602

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efffmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijhjcchb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdaociml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnhnaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgcamf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmingjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmpqfq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmbhgd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mblcnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqglkmlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnpfop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdmoohbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgenbfoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbgalmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbfab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndeii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lalnmiia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Megljppl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olicnfco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebjcajjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmgejhgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maeachag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidabppl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npgmpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagpnbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgiepjga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmnmgnoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idcepgmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbajbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abbkcpma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfjpfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnlgleef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjbogmdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Najceeoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcblpdgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdnbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikqqlgem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Micoed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bblnindg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgmcce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfgkffn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imiehfao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcfggkac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjjkaabc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaldccip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdglmkeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmmolepp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoaojp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlmfeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcnmin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phfjcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofkgcobj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghhhcomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flngfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hienlpel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcpmen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikdcmpnl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqkamhk.dll"	Bcinna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbjkkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmmolepp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pahilmoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chfegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbalagn.dll"	Ihphkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfjpfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eclmamod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocmcjb32.dll"	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eonklp32.dll"	Jcikgacl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfpph32.dll"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikqqlgem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhmmpnk.dll"	Mjellmbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlgdjg32.dll"	Ieidhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hicakqhn.dll"	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnbpqkj.dll"	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpmggb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olojcl32.dll"	Lghcocol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmdkbp32.dll"	Bblnindg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdaociml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdodkebj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kggcnoic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnfnlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omlokmha.dll"	Fpmggb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figmglee.dll"	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgjimp32.dll"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jghpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcfgpga.dll"	Kjpijpdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Malgcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elpkep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hemdlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okcajg32.dll"	Fggocmhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omjpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffclcgfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cammjakm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhilfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Majjng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eleepoob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igpdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikpjbq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcikgacl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epokedmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aogiap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcnqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmheim32.dll"	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdmoohbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjaabq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohkbbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Higjaoci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lndagg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkjnfkma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oabhfg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 1132	3416	a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe	86
PID 3416 wrote to memory of 1132	3416	a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe	86
PID 3416 wrote to memory of 1132	3416	a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe	86
PID 1132 wrote to memory of 3320	1132	Djfcaohp.exe	87
PID 1132 wrote to memory of 3320	1132	Djfcaohp.exe	87
PID 1132 wrote to memory of 3320	1132	Djfcaohp.exe	87
PID 3320 wrote to memory of 4532	3320	Djhpgofm.exe	88
PID 3320 wrote to memory of 4532	3320	Djhpgofm.exe	88
PID 3320 wrote to memory of 4532	3320	Djhpgofm.exe	88
PID 4532 wrote to memory of 2276	4532	Dfoplpla.exe	89
PID 4532 wrote to memory of 2276	4532	Dfoplpla.exe	89
PID 4532 wrote to memory of 2276	4532	Dfoplpla.exe	89
PID 2276 wrote to memory of 3508	2276	Dmihij32.exe	90
PID 2276 wrote to memory of 3508	2276	Dmihij32.exe	90
PID 2276 wrote to memory of 3508	2276	Dmihij32.exe	90
PID 3508 wrote to memory of 400	3508	Emlenj32.exe	91
PID 3508 wrote to memory of 400	3508	Emlenj32.exe	91
PID 3508 wrote to memory of 400	3508	Emlenj32.exe	91
PID 400 wrote to memory of 1088	400	Edemkd32.exe	92
PID 400 wrote to memory of 1088	400	Edemkd32.exe	92
PID 400 wrote to memory of 1088	400	Edemkd32.exe	92
PID 1088 wrote to memory of 1860	1088	Efdjgo32.exe	93
PID 1088 wrote to memory of 1860	1088	Efdjgo32.exe	93
PID 1088 wrote to memory of 1860	1088	Efdjgo32.exe	93
PID 1860 wrote to memory of 3592	1860	Emnbdioi.exe	94
PID 1860 wrote to memory of 3592	1860	Emnbdioi.exe	94
PID 1860 wrote to memory of 3592	1860	Emnbdioi.exe	94
PID 3592 wrote to memory of 1724	3592	Efffmo32.exe	95
PID 3592 wrote to memory of 1724	3592	Efffmo32.exe	95
PID 3592 wrote to memory of 1724	3592	Efffmo32.exe	95
PID 1724 wrote to memory of 2296	1724	Epokedmj.exe	97
PID 1724 wrote to memory of 2296	1724	Epokedmj.exe	97
PID 1724 wrote to memory of 2296	1724	Epokedmj.exe	97
PID 2296 wrote to memory of 3580	2296	Embkoi32.exe	98
PID 2296 wrote to memory of 3580	2296	Embkoi32.exe	98
PID 2296 wrote to memory of 3580	2296	Embkoi32.exe	98
PID 3580 wrote to memory of 4028	3580	Ehhpla32.exe	99
PID 3580 wrote to memory of 4028	3580	Ehhpla32.exe	99
PID 3580 wrote to memory of 4028	3580	Ehhpla32.exe	99
PID 4028 wrote to memory of 1004	4028	Edopabqn.exe	100
PID 4028 wrote to memory of 1004	4028	Edopabqn.exe	100
PID 4028 wrote to memory of 1004	4028	Edopabqn.exe	100
PID 1004 wrote to memory of 3120	1004	Fmgejhgn.exe	101
PID 1004 wrote to memory of 3120	1004	Fmgejhgn.exe	101
PID 1004 wrote to memory of 3120	1004	Fmgejhgn.exe	101
PID 3120 wrote to memory of 3664	3120	Ffpicn32.exe	102
PID 3120 wrote to memory of 3664	3120	Ffpicn32.exe	102
PID 3120 wrote to memory of 3664	3120	Ffpicn32.exe	102
PID 3664 wrote to memory of 1940	3664	Fgbfhmll.exe	103
PID 3664 wrote to memory of 1940	3664	Fgbfhmll.exe	103
PID 3664 wrote to memory of 1940	3664	Fgbfhmll.exe	103
PID 1940 wrote to memory of 2108	1940	Fagjfflb.exe	104
PID 1940 wrote to memory of 2108	1940	Fagjfflb.exe	104
PID 1940 wrote to memory of 2108	1940	Fagjfflb.exe	104
PID 2108 wrote to memory of 4968	2108	Fkpool32.exe	105
PID 2108 wrote to memory of 4968	2108	Fkpool32.exe	105
PID 2108 wrote to memory of 4968	2108	Fkpool32.exe	105
PID 4968 wrote to memory of 3868	4968	Fpmggb32.exe	106
PID 4968 wrote to memory of 3868	4968	Fpmggb32.exe	106
PID 4968 wrote to memory of 3868	4968	Fpmggb32.exe	106
PID 3868 wrote to memory of 956	3868	Fggocmhf.exe	107
PID 3868 wrote to memory of 956	3868	Fggocmhf.exe	107
PID 3868 wrote to memory of 956	3868	Fggocmhf.exe	107
PID 956 wrote to memory of 2704	956	Fmqgpgoc.exe	108

C:\Users\Admin\AppData\Local\Temp\a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe
"C:\Users\Admin\AppData\Local\Temp\a62fde6d179c54d139e4b76d0facf7c20164a558fcf2e776e431ee09b25dcda4.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\Djfcaohp.exe
  C:\Windows\system32\Djfcaohp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\Djhpgofm.exe
    C:\Windows\system32\Djhpgofm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\SysWOW64\Dfoplpla.exe
      C:\Windows\system32\Dfoplpla.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
      - C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        23⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        24⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        26⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        28⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        29⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2460
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        31⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        32⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        33⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        35⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        36⤵
        Executes dropped EXE
        
        PID:1164
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        38⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        39⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3588
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        43⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        44⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2408
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        48⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        49⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        51⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        52⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:536
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        54⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3316
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        56⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        57⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        59⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        64⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        65⤵
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        66⤵
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        68⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        69⤵
        Drops file in System32 directory
        
        PID:4124
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        70⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        71⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        72⤵
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        74⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        75⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4648
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        77⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        78⤵
        Drops file in System32 directory
        
        PID:1184
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        79⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        80⤵
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        81⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        82⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        83⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        84⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        85⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        87⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        88⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        90⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        92⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        94⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        95⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        97⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        98⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        101⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5984
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        103⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        104⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        105⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        106⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        107⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        108⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        109⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        111⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        112⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        114⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        115⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        116⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        117⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        118⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        120⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        121⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        123⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        124⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        126⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        127⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        128⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        129⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        130⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        131⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        132⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        133⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        134⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        135⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        136⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        139⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        140⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        141⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        142⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        143⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        144⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        145⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        146⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        147⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        148⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        149⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        150⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        151⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        152⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        153⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        156⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        157⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        159⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        160⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        161⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        163⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        164⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        165⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        166⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        167⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        168⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        169⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        172⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        173⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        174⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        175⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        176⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        177⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        178⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        180⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        182⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        185⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        186⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        187⤵
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        188⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        189⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        190⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        191⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        192⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        193⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        194⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        195⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        196⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        197⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        198⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        200⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        201⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        202⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        203⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        204⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        205⤵
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        206⤵
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        207⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        209⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        210⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        211⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        212⤵
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        213⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        214⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        215⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        216⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        217⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        218⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        219⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        220⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        221⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        223⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7224
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        225⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        226⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        227⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:7592
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        229⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        231⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        232⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7940
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        233⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        234⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        235⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        237⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        238⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        239⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        240⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        241⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        242⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        243⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        244⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        245⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        247⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        249⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        250⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7972
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        251⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        252⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        253⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        254⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        255⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        256⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        257⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8404
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        261⤵
        Drops file in System32 directory
        
        PID:8444
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        262⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8524
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        265⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        266⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        267⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        268⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8768
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:8808
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        271⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        273⤵
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        274⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        275⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        277⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        278⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:9156
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        280⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        281⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        282⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        283⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        285⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        286⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        287⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        288⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        289⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        290⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        291⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        292⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        293⤵
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        294⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        296⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        297⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        298⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        299⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        300⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        301⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        302⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        303⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        304⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        305⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        307⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        308⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        309⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        310⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8960
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        312⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        314⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        315⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        316⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        317⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        318⤵
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        319⤵
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        321⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        322⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        323⤵
        Drops file in System32 directory
        
        PID:9236
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        324⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        325⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        326⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        328⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        330⤵
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        331⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        332⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        333⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        334⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9712
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9752
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        338⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        339⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        340⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        341⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        342⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        343⤵
        System Location Discovery: System Language Discovery
        
        PID:9972
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        344⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10008
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        345⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        346⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        347⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10120
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        348⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        349⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        350⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        351⤵
        Modifies registry class
        
        PID:9260
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        352⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        353⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        354⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        355⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        357⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        358⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        359⤵
        Drops file in System32 directory
        
        PID:4164
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        360⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9740
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        363⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        364⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:9992
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:10068
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        367⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        369⤵
        Modifies registry class
        
        PID:9228
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        370⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        371⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        372⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        373⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        374⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9748
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        376⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        377⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        378⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        379⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        381⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        382⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        383⤵
        Drops file in System32 directory
        
        PID:10036
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        384⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        385⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        387⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        388⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        389⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        390⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        391⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        393⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        394⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10296
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:10332
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        397⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        398⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        399⤵
        Modifies registry class
        
        PID:10440
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        400⤵
        Modifies registry class
        
        PID:10476
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        401⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        402⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10584
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10620
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        405⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        406⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        407⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        408⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        409⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        410⤵
        Drops file in System32 directory
        
        PID:10840
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        411⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        412⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        413⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        414⤵
        System Location Discovery: System Language Discovery
        
        PID:10988
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        415⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        416⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        417⤵
        Modifies registry class
        
        PID:11096
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11132
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        419⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        420⤵
        Modifies registry class
        
        PID:11204
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11240
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        422⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        423⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        424⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        425⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        426⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        427⤵
        Drops file in System32 directory
        
        PID:10572
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        428⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:10720
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:10776
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10836
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        432⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        433⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        434⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        435⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        436⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11228
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        438⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        439⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        440⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        441⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10656
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        442⤵
        Modifies registry class
        
        PID:10756
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        443⤵
        Drops file in System32 directory
        
        PID:10872
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        444⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        445⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        446⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        447⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        448⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10764
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        450⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11212
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:10496
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11248
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        455⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        456⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        457⤵
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        458⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        460⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        461⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        462⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        463⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        464⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        465⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        466⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:11612
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        468⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        469⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11720
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        471⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        472⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        473⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        474⤵
        Modifies registry class
        
        PID:11864
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:11900
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        476⤵
        Drops file in System32 directory
        
        PID:11936
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        477⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        478⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12044
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:12080
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        481⤵
        Modifies registry class
        
        PID:12116
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        482⤵
        System Location Discovery: System Language Discovery
        
        PID:12152
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        483⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        484⤵
        Drops file in System32 directory
        
        PID:12224
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        485⤵
        Drops file in System32 directory
        
        PID:12260
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        486⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11344
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        488⤵
        Drops file in System32 directory
        
        PID:11416
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        489⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        490⤵
        Modifies registry class
        
        PID:11548
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        491⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        492⤵
        Modifies registry class
        
        PID:11676
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        493⤵
        Modifies registry class
        
        PID:11744
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        494⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        495⤵
        Modifies registry class
        
        PID:11896
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        496⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        497⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        498⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        499⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        500⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        501⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11384
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        502⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11644
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        504⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        505⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        506⤵
        Modifies registry class
        
        PID:12040
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        507⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        508⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11388 -s 220
        509⤵
        Program crash
        
        PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11388 -ip 11388
1⤵
PID:11788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaldccip.exe

Filesize
163KB

MD5
e726be5d869b6847f7ccbdf71856ba0d

SHA1
b5d2425e04741040ff6f842e5a6e785ffe1830c7

SHA256
b94cf7e83ff2467fde0220946b551579d15434ed8a0ad29c93cfb8e80690cbb2

SHA512
27e1ab7f94ccd30fef4250e2345a3d445b24391b4b76cd9db679776218c9ed6681591702747c8676e6ef8b65573560f714ca0bd40260620f30fbd3d861683bfc

Download Submit
C:\Windows\SysWOW64\Abbkcpma.exe

Filesize
163KB

MD5
1f918ea02f7eb7d70650c649013eb657

SHA1
b0048373d6dc49581e1864154d269be2e62551ff

SHA256
f26d7b362b820585a9688f95cb76b76f8d1ff6e424c73ec1e14d74142b61a4bb

SHA512
680445622a5b4e5f5221012b9da51dffa0f4dd90b06a766fc4246c24c078e38a11c1af925f88bbd42f04100a1aab1ac14ad43c2e0a40b3d8c188e09dc7f420d0

Download Submit
C:\Windows\SysWOW64\Ajggomog.exe

Filesize
163KB

MD5
5d714f1213fa76924a92b886b76a0e71

SHA1
f7654232b2ff6e985def23376e131c63b8e1ccf7

SHA256
6b9b93f642fb1f62b19b5f12808debc5c9446cf0ce72839aeca6361fc1701fac

SHA512
d65c32b50282a17f8684aacffdfd419ab682ea84ddedc1103f2ec2ea906ec8bd0b15b29adcc22e93ed81b9df1ce5ef196de79326aa4d195d528b7340ee9bc3d8

Download Submit
C:\Windows\SysWOW64\Akdilipp.exe

Filesize
163KB

MD5
3be36c3832fb6bc0b3e6a5d837d113ce

SHA1
dddc4bbfa7a4fac24ad226d050953b0e0f388c96

SHA256
7b10cbf3951101c9baabbce2b57f97c397660ecc0c1ed2654d6faf694feb985c

SHA512
15ef7b58bd93e0889e0f308b1546295d9346e615de1d160cef1955744b4a2f7479b9f3a7bc39f8f7bbd5a34f300be0b7ee2f796461f24e3d1fde4a82199c9f80

Download Submit
C:\Windows\SysWOW64\Akglloai.exe

Filesize
163KB

MD5
398b688e9b8a09f60ff67cbb8d0abfef

SHA1
91bd326c50fbd339d75bf30a4b0e4e449c46530e

SHA256
344dcbb444d7a3e61d1c7c625e029c79ea7005d5574799f2ca00a75a385c8e5e

SHA512
ae9707fa5c71ba9edd9e25d19b691c00014d9314050ae66a6d0b3c085a649acb456310a49692d11a6dec28be4d08bd1f90cf9b3f137ea097281043099cdd384d

Download Submit
C:\Windows\SysWOW64\Alnfpcag.exe

Filesize
163KB

MD5
3f016ae60ced83632ede1b827c47fe74

SHA1
2622844f990c03d81d03b278fb5bb8f7a2eabbd4

SHA256
ed2a84185ce6718e0da86e22fcdb471bacca0566766c836935c9ecb439f5dc32

SHA512
5562379545a546907bb9dd028be56282150c058cfb238afa571fc8578df19c6f07a84bd90541d57255c9b958c227f8dd23921cf64452d295109c6ace2c3d8015

Download Submit
C:\Windows\SysWOW64\Alqjpi32.exe

Filesize
163KB

MD5
69220422aad85b0ea75bf375d3ff079c

SHA1
4f81648d9a44ad8d9b2ae671ddb7a95437b9e8f5

SHA256
05bc31539bdb43a019e86d4a7f96db32f7d1d0a091f3f690357974e85dcfa6e5

SHA512
74f3b3245a508fc6d0af743d35c3ddbb8dc7160345b57e8cc649f65c5ae44779f11a6a75737e62f65eb3a90f5a509fda179416b428f9972d2a42ae3f810a82aa

Download Submit
C:\Windows\SysWOW64\Apjkcadp.exe

Filesize
163KB

MD5
201287d328bcc668f2218eee698ef067

SHA1
3a6346a1d89a5d42b4445f094ed3e4126c612b22

SHA256
8f4973136a45d3a8b8aeabf38e5e98542d2dc86ad6f38a30e180ea7dd8313931

SHA512
a888bae8ec991fe68501296930a741935160ce54f63be6d48166ffcd083d0049455dbcb1a3826df08d45a6b9bd143a1fefb079690745507a4891bc8dfd946c38

Download Submit
C:\Windows\SysWOW64\Bakgoh32.exe

Filesize
163KB

MD5
6d2a6163f979a7d401a530220e4828fb

SHA1
3e022b4fe80a65dae96e474729a3b1059233ce5d

SHA256
0d8c0d08e5e0fdfbdb969de77d38a33a02d8acd77a9064062cbb58d9c3b262ed

SHA512
8b6de3f6a7e402f60ab2e79cfd677d083b64d984aae10525f00d419066611ea5d22028e670d9685f0e5ddadf460a3ea36da79a9e1c9165e24290724baec26499

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
128KB

MD5
2a4d604d23139d14893ff4474ebbe362

SHA1
cd51f578339adf39d68e625165565e9751b775b0

SHA256
5d5fe6237ae499d5f8814240b038d8516c1939496e2251e4abd81cc50ef20559

SHA512
6957a8e0fb1a769fd4246f9e5967e0b034e5a6d75605b864be4a91c6d6de4187db5199c197ae7f7ab989328431447b5b195c8e4175476748eb16ab62a0aa1446

Download Submit
C:\Windows\SysWOW64\Bhamkipi.exe

Filesize
163KB

MD5
df5f42ac6c8c768ecc74215eca51b329

SHA1
55a164adf11f2d69f50aa0b1a2acd9f83098bd80

SHA256
c0cfd29d302342b5b23e6b6e96dbaf09feac03096197f00adbaa6c3e313f6658

SHA512
2be39ee244024e267a6f1a73e85ab7c4e1170e862235ccad507acd40cae7af90d01c3c6cb8f452bae318ab6d819b42dda7264bfc3b323fec0af1d5b7c2746870

Download Submit
C:\Windows\SysWOW64\Bhoqeibl.exe

Filesize
163KB

MD5
7e089113f665f62893253a00ae18a907

SHA1
4919a433a7ecbcba177bd2b5dfdf15fdc630274f

SHA256
a1645eed21ff51e93499f7d02add38e30d39492a52fbb75bbe7d270134aa95e5

SHA512
c0ecdb8e0109c7cea61dbdd334f251a5d58865c5fea2bb63895c5d5c4f894f60682e2cc3c2e3f2914c1ebf31fdf3330b16861d7359f0dc0ce33aa170b236a7c0

Download Submit
C:\Windows\SysWOW64\Cammjakm.exe

Filesize
163KB

MD5
f205d5f1440319697da9082cdece302a

SHA1
72ce7e75837919e6bf8ea40072b522b499c1151d

SHA256
b6227dff8b87c2211ada7f9fd9b35f58f8eb1f1a5823a9139e2156e9416fc7a3

SHA512
4369b4c063a32c52cfca15f536e394bd7d9270928d33c8b96abbcf96b3d56f9cebaf6b6eb7edb53f9f68d944802c9098b83202cc4793cd7be0d01ec90e078d60

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
163KB

MD5
7dc60f4ec7306ee396534c2cc51bec44

SHA1
7dc3743e4e25540ece389fe0acf19805e15f91bb

SHA256
34b29e612f83832c8a6093ed10922f7e4d299687dc439ca04e2b79592613f478

SHA512
17f6c135e561b3a1b56fda7e971ed90311fe78ef34f66baf9c831b5307e9dc6467fd1aad41630319eb1d137e6e61fb6aea5daf7d9d2fc80f23571bd25498d421

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
163KB

MD5
9f6eeb2746c3f2eb467f66d44f9ee0ba

SHA1
210a4f924607c7e67ad7676ff53c7ff4c9a3df18

SHA256
769627386513034f064f2d12b5f3279f277b59be477eb8aac0a77b565c64c86d

SHA512
3db91610c082865a761969cd6fc5baab9952427532fbc711a82caef0cdd180821d16a4c1f3675d0baf89c60a038d955911a991aff0a86688783043fe7e7a9d5b

Download Submit
C:\Windows\SysWOW64\Cgqlcg32.exe

Filesize
163KB

MD5
a475fc82ea8bc56262750a8706ae6658

SHA1
b590961a15692c51e7465f74e0a624e085302f1b

SHA256
14b8bac994bf0a8826712f323ff9769a9f1fe4f8cf4aed374923e05e582db9e6

SHA512
245fa682307c4537e3ceff26adb9dbf54cc0cd9b51f2672833a6c8110a21ed6a4e2f2f19d2c44f8eebc274fc73d5c113cf8fb420cc526f73b8fd5c10bd8ecfee

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
163KB

MD5
5ba4b979e1cf3fc27367e4a1cc9d5d49

SHA1
c53b779851b7c311298f148de571951d82713295

SHA256
e9ccd76984405bf29d8311aea2b2aef3ad6ecf0bd746b8581db82411d1a73aeb

SHA512
742c18033a3e350e043b031f78fdc001dae6b5783a8a95cf5cd8c2aa73321984537eb42d77aa88e8c3d56ec0bd699fb4b0395ee6927026d7cbd89cf0fd616d17

Download Submit
C:\Windows\SysWOW64\Dfoplpla.exe

Filesize
163KB

MD5
ac0c80378dbf82caef34913405dbae62

SHA1
0d90a4954d5c3bf8f94cb45cf6351a52c133e454

SHA256
d6a17aa6c7a53a4841369b0a4f5082606e4d29d7ae6c6bf73723691f53525330

SHA512
644c927b990fb0344859d9458f58ccda117ca66a68953b4a7fa5edf4180ee335037ebcbd383f8a8403ee5ddc313502c02d1f1b7de8a477cf728c01082394e7b3

Download Submit
C:\Windows\SysWOW64\Djfcaohp.exe

Filesize
163KB

MD5
29f82ae38800d8eaa0ed2908f38779c4

SHA1
92208557527264fdae4164a36466de4ee8b5f68a

SHA256
fcff0d34579435ca3df89b7f1e453d1feabed63f796e1638b1411e5ae5f3fad5

SHA512
f4049fa33004cb4331481f55ed2551b0cbafb869899dc656ce5891ed8246254724fac5728e6999ba02befdbc1e40ecc7a3221520d4edc1e83cdd1dbcab7f02c4

Download Submit
C:\Windows\SysWOW64\Djhpgofm.exe

Filesize
163KB

MD5
b8cd8efa1f3ec5c89e9a4c6873a04116

SHA1
77c5de1b625cf5555338d8bda890b41288e58281

SHA256
09f2bef926fd4ca2f17c0d44d515a0653b34a21f01ba6ef3edecf7a726d5001a

SHA512
00924b475c4bcaf63609bdf1e9004ce7ab8a26a329f6922054610a4490eb20244fd58fec158c1fc84c24caab68b41db58923ec4beef5846cb9f52821b8b11d23

Download Submit
C:\Windows\SysWOW64\Dmihij32.exe

Filesize
163KB

MD5
c202bf03ffeaa07385f0df42a0030a83

SHA1
8d541bff423b5a0418fd73dddcddd7611ebefc64

SHA256
afa6bb1be81cc4fca81e454108a31acf307c75f749a5ac20654b38b56de9115c

SHA512
40c380c9bb1a3303bdc77cacbf185c653ce0a624396a0de3e3ced983be676726436aa72f216974e5761aaee186d8da63098c39daf636619d18e31891ff1a06d5

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
163KB

MD5
f096200eefd3ee14355dfeb1f1acb5d2

SHA1
6c88c083dc1900c6324aac6a6fe3b086273c710b

SHA256
447f836c0bcb23022f53bf5e5b25226db0533fc75a677e71ac0bfef5b2f3a4c8

SHA512
ecda28e1d69c08fe8487bd32adb9dfb563a3e151c2f1b4a15bc0211ad68e915dc282eb1ea4ca87320f54031147b1649cfa17497ebe75497a3942b9a0a2d2482a

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
163KB

MD5
64575a362708d9d6fd079fe710b67ebc

SHA1
57b5c490f83544bdba54be4c80727d4a0cfc49fa

SHA256
6aa2205a0b46e65879dc3ea6bde4e2f89f4da0a95f2a3558640f0e59b530f875

SHA512
f2f3535bb01823ada77dfdb63399be6f15f027e2d0ae6759a2ab408c1c42941c2b5b24ae5cc08d685fe5129aa137a22a4243f39608ae167c007e5c5b7b9054ad

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
163KB

MD5
2479736e924e35845c43c281a8a276cb

SHA1
9acc251ec8cc112dece5abf7f5507d9d7621ec9d

SHA256
0261daf17d172124b1539f5b26b7663d5653a6f2b7077270bacd47e022363539

SHA512
218a82937f54ff3d9e37f2ceb0a5f36034722031f367f395942fe6565b579c85c7a5989a61d75f006bfb53d6b2ed088930506ffb069c3cb5bd0f604a15839f65

Download Submit
C:\Windows\SysWOW64\Edemkd32.exe

Filesize
163KB

MD5
e8af3f8e38c729fab2255251a5ac36d0

SHA1
5905e7be5bb65e2921f28cca5b808414accf0116

SHA256
6c106ef0a55bdc83895e0b3af079249e8493b17258d80a0986e6e7f70795933e

SHA512
35e9d3f1aabb093c8c27cb4a317ecee3c31a5d6cad18cc16acd32d68bfb7735eb89e217787875be3e38ca6da5988e93ea251de04dad51484861a6857cb1f37dd

Download Submit
C:\Windows\SysWOW64\Edopabqn.exe

Filesize
163KB

MD5
157e273397c65e14a69091cf23c4f37c

SHA1
b71cd6012b7aa582c14b8d3b4c91cbad5df86d73

SHA256
8fb8b8064248b89ac923cf68f965db5cd5f0c8a433762781df4b03980fced6aa

SHA512
897b7247c827e4aab24182f23899680e4b2112ac8401527febb7a51ce10f2ac9eee2e46c1ed538e99c6edce7676ad3a5029e9a40f0bcecce67c90f3074826d5e

Download Submit
C:\Windows\SysWOW64\Efdjgo32.exe

Filesize
163KB

MD5
81e0ba4cbe99a1a3339dfb1c1aba305f

SHA1
669e18366f1a806153e3c83bb6f8a5126a295ad0

SHA256
1b3079f82e8c35c514bb59f97e0767ee2ed07d47cb55ff8c42195b5a8436c676

SHA512
8e4c052874d304c32616dcce4af7e89a26b24e34e68148217796870059c7e6aeaffaf59fd44066c89791e22d67bfc4c8b3cceace2837e30625d2722210b8e244

Download Submit
C:\Windows\SysWOW64\Efffmo32.exe

Filesize
163KB

MD5
e6af8aac762e0965e31af1be71b8214d

SHA1
05b1d1b594fd9fb36f696826a95a3c7d6bdf391f

SHA256
81eae9a3fc0cc695ffd0397527de1d705349c6aae05856844cb1d714153161af

SHA512
6b1ba33d16ca3f11b37910133bfe6db380f914770f9730e222313189b9bff122a4ef0ab68c4badf2aa2177238644550d23d6909818224e9b03c41e70ad64d109

Download Submit
C:\Windows\SysWOW64\Ehhpla32.exe

Filesize
163KB

MD5
7e222cc2bb9d9d5f299899ca1232954b

SHA1
09dfe661a4959e2952aeb0ecb37dfc083e570d34

SHA256
bfd7d3b4f83f963088ba19e4204a1658c5ef042a8616c2118ca92b28b7ec63e0

SHA512
0144ae81c7d536c0bb3a8d4f6dfedc3d56c16bf6a96b167ab68550759150c90c850d9df3dfd2b8130a82539467ab00724baf926967b6fab6704f75da2b435ab8

Download Submit
C:\Windows\SysWOW64\Ekmhejao.exe

Filesize
64KB

MD5
faf60680d4c89bef93885e47c2cdffa6

SHA1
51fb56b57bcdd51e304dd580db78b38a25b715f2

SHA256
b41104d406d5f73070f2621596c9878c67df97237a399a75da8ffda5f9870d9a

SHA512
21a67b286f0a053708c4bd04d56e9de0dcc237372a775b12b6c020a4a46a3ebed70da0450a8d4c2c291b2f0a78bbf12ab6d2a17dc244d9c9ec2fa3b818d2d9b9

Download Submit
C:\Windows\SysWOW64\Embkoi32.exe

Filesize
163KB

MD5
10bbfc687e06097e253dbfbdc849bbc3

SHA1
06aa5077e08e350a34472256e6b5c157fb36e394

SHA256
b5306cbf48c42914bffe542225eb1ec07f7e1c2b7320e6747a4ab6279d2539aa

SHA512
33d81c7765135e011dfb97458bf5df2c44c807a7402a68c65154b41b1ee9aa4e9a135ac7c1ad55d3d7757bbdfb264c871603746a0e2b6d648f83d2c26f1805c2

Download Submit
C:\Windows\SysWOW64\Emlenj32.exe

Filesize
163KB

MD5
8002b7d95d5322ba647d71d41faa8d11

SHA1
9a5424f15ddd235c326daaa61fc33ba61fc6d4bf

SHA256
2477f3b327907f276221df081d44735ea3b0a515097fd0a7e11fee77ace11473

SHA512
b5668515c1f38dc96803eaddb8678e173fabe231945210b5eabbd2a7f53a965ba0e7f004dcb0d8e8a29a8f9c5bed8b4c6b23ebc3aac01c860f7d58b389a2e5e4

Download Submit
C:\Windows\SysWOW64\Emnbdioi.exe

Filesize
163KB

MD5
7e016a41ba9f37d28ebc3194560eeb12

SHA1
fc1d4a8c781b49e276c0496b0b2194222758c271

SHA256
df5098b2b0e6b255f8bc20e8987b0b65df69504febce0b8b0fe2db5f1123969f

SHA512
a53ff7307690f6bb342a8fa313161f8cc1673a7596567da88dabc680cb04c15b2522e36e5ae33d583283bd0d1dbe9f6554fd21fd0545b8b290955a5944277eb1

Download Submit
C:\Windows\SysWOW64\Epndknin.exe

Filesize
163KB

MD5
0ab373aa88dd5e07d357b5e072b08929

SHA1
9fc2c011d58bea4fd306afa11bd18b33c929c766

SHA256
396d7e6880dd8557502e02e7e8a6406b1e1a68cc2cd70d4475ee755b7fa74262

SHA512
72f68f446245893e4e9004c23cab64c05f1b541fd57bb9310732964547c1c76775842ebb2102052a9f37807a622d6f1934f5e0653731bb4abdea970301287507

Download Submit
C:\Windows\SysWOW64\Epokedmj.exe

Filesize
163KB

MD5
8fc6f705f64727d8ebe33cc5637c1af7

SHA1
9be04b6ac316f62c7b0b92d4a335f2ec818068a2

SHA256
e7bb5712bf2434c04e3928026088ca3ed12c4146d26584cf116ab8bb161606a6

SHA512
e522fc25d36ca94a7a1b5a44c5f9ea7a706eb1bbe4c3c9e27a412b1776d6e042d06d315d2d4ebc51f9a353bf78b4136b23b4a2fc6b42bd20a98988e1f6daed27

Download Submit
C:\Windows\SysWOW64\Fagjfflb.exe

Filesize
163KB

MD5
58a391b928b01d40cead034e6ed50946

SHA1
59a248ada0c6032d81d35beec2ee74772a445885

SHA256
5ba8e23fa376354be3656ae3e0ced94cf83aeae7b12630f7e1ffd9bf7094cda5

SHA512
c1cc284bf6bc1f0221e114f4da12980044ed2009b709e2ff842d4c701f331cb66035aa531e97d0825b6afbf6a2835801047104a0f41a67c27cb9dc913c089b91

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
163KB

MD5
42b41c1427d4c7c1996196f05a2e26c6

SHA1
2f7cbd991fa3cfcb81deb1def278f25e1452c4e5

SHA256
c2d65637493808b859cacf4477a1bab862c83ea24dfd0a540c0aa8874cbc04f7

SHA512
5aa980a437106ca0ab5fa8a895beb651f29eb6cfbe3d9a70bfd255e8934a34c8ec0437c688cb2da759abccd7457710e0b856eabb2abc1ce16b623a5d918f1cb3

Download Submit
C:\Windows\SysWOW64\Ffobhg32.exe

Filesize
163KB

MD5
f24a54e6d33727342b3e7babdf047dfe

SHA1
5565d16514153bd821f5d50efc3e4b2b450878d1

SHA256
ffd66662137d79015e797b57f8c307e590e86d0675c8fb8a1b01dd923d11b2ec

SHA512
6fa88c11d1ff74c94c5657db5c1e7e0fbcc361887094206f5829d76017db57e1e7044295a2a2bb5f1a6998d05609f59d99fac1d564e0df856b98a58f31c397f9

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
163KB

MD5
64debc3add32f624f93ce584ae69faf8

SHA1
b2ff418647876b72c9aaa6b8a3ef7fb8e9bf10e0

SHA256
a86b13c38f859599585bfc87fe807d1dcdcdbb7059e3b15f0ee902f9eea06bdd

SHA512
2109bb664876b24f30c1eea2b0683915b0a005af9706f113c5dab1f321db873ac0d429d4127159287c874a5e3eafef6c38a31c19629a30d6001b9daa24cc323a

Download Submit
C:\Windows\SysWOW64\Fgbfhmll.exe

Filesize
163KB

MD5
801cf5957927d9f897e640e5f30e82f5

SHA1
4167b7b50f736a6293c38a22d66cfd8a69b00a0b

SHA256
d94272af6a82c1d9c6f66dc1d0f7bc1e2ccc8f54cc11954aca66847df725e5a3

SHA512
80eb21db5bb3fcd48bb6885abaf9aa930d57692da804166bf0d388f8905c17068fd3e65c076148ce67946304242712a0350dfaec29da8ed059a23d918a57e716

Download Submit
C:\Windows\SysWOW64\Fggocmhf.exe

Filesize
163KB

MD5
176d199918a5cc6d1ebc579620416e6c

SHA1
0fb52ee09ba319691eb3b7e46d947323a57646a4

SHA256
782e4dcf707a5a00eb44620aae9d7d59fd3e4f860206d75edd0ed65049e8e899

SHA512
e0f1fe5348c692eaf03effe715c0c5eb757da93548c22a9980f82b4e3cb9c7e3ae430098ea0cc09d1df21191198c2d8eda7202c76761bff03e33733f47b3d3e6

Download Submit
C:\Windows\SysWOW64\Fhflnpoi.exe

Filesize
163KB

MD5
b57c7033f37dce8e3e1c3801071945f3

SHA1
5e6d4709d7a3ba701fbf01f04a2ca32e4aa0a042

SHA256
c656c899b8d8cb2bb930e25668f1e4cebeaacf5802835215e41f071119c79a99

SHA512
bcd72d541d12f561e73aa0f609e032b03c66b71f58316d039b9d0c3b3e0ba9ddb57739ce595e7fc2d9dfdefe418121969c88287ad471cec9f9d67719e4cc530f

Download Submit
C:\Windows\SysWOW64\Fipkjb32.exe

Filesize
163KB

MD5
90de84b0b7a64aff51193ab5d5fc95a9

SHA1
ece92222898debba198452462c41db1c22d63975

SHA256
cc4a90576c66b3349f5cfdd8a1fd0243e9fd6457fc7027075b77160534cf6ebf

SHA512
d5f2d4efaf7680c10bfa95901b5b617795e0ae9bb815ecc6b40c9811c5d25d7f4021df314d84b656a54ddd3767211e81e8814f3448666d63b1c98e94c9d4a498

Download Submit
C:\Windows\SysWOW64\Fkpool32.exe

Filesize
163KB

MD5
e7d123d22cac870926823f315be0e306

SHA1
1d54005eb1112b9bd2763075632081a52dc9c7f9

SHA256
8e0b212e8d2f054687b67229d5c7ae9c8730f31693b4cae69abff08a8dd8102a

SHA512
50cdec5390bb012c8211fd425e3999891b85db2dcf7f5d961d551de2e0ad4f971b589e238606a6093c8e637bada13c1d2d600bbd017643f2ad2027d315450341

Download Submit
C:\Windows\SysWOW64\Fmgejhgn.exe

Filesize
163KB

MD5
2de9f5ac00a8009d1c900daabbde9d8a

SHA1
0be89d073a279a8bef5b40d9ac5c25fbc24fa52c

SHA256
1013a47c099aeadbb49c9ae42c5fc57161cadc9b8de1b8be3511de2078f3897f

SHA512
2eb6e106dd06e91b22d8706c033ada3a570cb1726dbbea42040f5a9435ea6fb84e6468aa93a943aaa6f4776fc55a5d92d28e16577165f2b64f0717f3fbbd3e43

Download Submit
C:\Windows\SysWOW64\Fmqgpgoc.exe

Filesize
163KB

MD5
1a7cc57681b270894d0af3e7243b7fd6

SHA1
a2d2e2ce2f317f134cd15b7f1cb45d16d2540c58

SHA256
e65a636ff7053c86e9a5f44b20cd13e4736a44af71225390381620b476ffb443

SHA512
85cc5314cc05cb42dd11151504719a0673a2662dcffaf599f393152c012803e4880542db66e6c2c94c4c1a950d77986b32045f70836766bda1085034084a6ced

Download Submit
C:\Windows\SysWOW64\Fpmggb32.exe

Filesize
163KB

MD5
ae74602ecb000d5e94f02dd92e0f053b

SHA1
e62313f913dc1ee5924bb8f91055425387c9077c

SHA256
c245723788355c1357ee5e763676e784324f4097f68ad13b7ffe0b57abfacd9c

SHA512
5f28dcff7595302d86e7866f58354245e3c389ee61d75b2023036d28e08fe567ee0c923fd4e090fefe868b06a77ec9a0ee423c12442974ecbe9d6d0b1fa47232

Download Submit
C:\Windows\SysWOW64\Gaamlecg.exe

Filesize
163KB

MD5
4e5f6c8bf820ca07f194eb86064c1441

SHA1
2ded846599956883d4752a208da6971a42f4e21d

SHA256
e62c18d4f4b39014fa8c8ad09a8d20e438ebd3fa24c84c43b5e91704619c85a6

SHA512
898255ff5c30d20f7dd218cf2865ae337455f81240480fde4291a4288532f78fef96be77316a19778ffc764be5d2235f36c965afb1a1ec1c8a253ffc8dace0bc

Download Submit
C:\Windows\SysWOW64\Gaefgd32.exe

Filesize
163KB

MD5
9a0e06a802036b840cfdf4fd9ea1f1bf

SHA1
767473458b5a121bb9062f7d671410737988fcc3

SHA256
8c6fe350f9e6b6f06fa9eb6b02746d5cc4b118d8666b61fc3a0d391f5b2178d6

SHA512
4643e0bfd2778fb57699ab87ad1d053d496e45d811da6454c28435a7d93a12be751dda851e75bf6bbe036ef8a700701c85b96d92db6f26145e74b40c30069f35

Download Submit
C:\Windows\SysWOW64\Gbfldf32.exe

Filesize
163KB

MD5
7492dce7989b5415e5b85135b764d61c

SHA1
5f76f11c6fc4113492e2066d59df8bf2a261181f

SHA256
3ecf426d0e3720fcb48983eb3367b6c075d41fdd038a819579a545536a01211f

SHA512
7bef07b832061f2192f6342881312b24416ee630aa3e2879092038ccdc50abbd53350b4e1651febe15d89699ff7bb0812286431b236fcfcae5043ea81993cc9b

Download Submit
C:\Windows\SysWOW64\Gdaociml.exe

Filesize
163KB

MD5
6f963f3acd7a8328169dda88b50e90f1

SHA1
10dd18db706925a4427f770ff905edd48db22f1d

SHA256
7fef6aa3ee8760786fe531e490f09666cdcf3a29bdf4230fb969a949f37d4efe

SHA512
4dc0b55000d5abacfafcc76a5d52e31e3933e669296da06871f07e08fc4ccedf66e3cedc204d6cb6bfe03c732abe25b42e3f9a61ba99b878143d19c3c066ffac

Download Submit
C:\Windows\SysWOW64\Ghhhcomg.exe

Filesize
163KB

MD5
96dae22370c9ddfc1bd3a8a7ed7adc91

SHA1
a640bd25dcb4807bcf5df20fcac9b02a4a2adf12

SHA256
22f497ec81f387be185afca77dd22b0e2fe15ee90fcce384b6bf9ca50b0ffd3f

SHA512
68f6b91fa3c6127aab5dac4a3255ebc03066e765ac9423736f397593e6a0b9eb326173eb09127bbd97e4f6507656b98af79de4d24d69c1de133aecb2911e2940

Download Submit
C:\Windows\SysWOW64\Ginnfgop.exe

Filesize
163KB

MD5
dede1d686fdf301c7ddcad9de1cd9e11

SHA1
da971cced551163b7d84bfab74111f3c356e7fc7

SHA256
51154c49b4e3a9fb598d8c362764cfaf382e7bd716151acabd11308bcd8ca7f9

SHA512
4be90c2825d9f22f5d23cdd6a4c06bf2db4a80d48be28eb97748f19e6217d28576d644aea61ca693fe0f11400bb0a539d611f8475ca8449d666a895326c74507

Download Submit
C:\Windows\SysWOW64\Gmcdffmq.exe

Filesize
163KB

MD5
9ecabdc98bc9a8018a4899910ed8af0b

SHA1
cf6055f27da67218e4057f2bf949edc02e260cdb

SHA256
a3b2c80ba30432652a30d4e7fdc00c393e960c66aec8931c40e5fde408af009e

SHA512
b936417581d2eca3b4346ab92db1e11a431e1408941b2f356404bdbfcd1ad22a2cdc0cdfe80d689469ffa811ee936e6573a6f1fe8414edd94c723edbaffb5fe5

Download Submit
C:\Windows\SysWOW64\Gnhnaf32.exe

Filesize
163KB

MD5
6dbab5f9aa4445d2a4f37a1a614ae93c

SHA1
323e1fdd101b144af036e570ee662d3ecc44f095

SHA256
7c264c0b308da8f8a65e2efb00e3400c8452d8be9d4a0c5c7b0af7b28fbe782d

SHA512
313f469f33cd933b6f1d2b86f7b3cad7ebd128e185db4228c99563774f50647d6d0a6d5bd68ec0efbc583e34476db67eee5dabba273cb93386c6cfd959c91d21

Download Submit
C:\Windows\SysWOW64\Gnlgleef.exe

Filesize
163KB

MD5
77a9844a5aa8c3c93805a3bf7e19af90

SHA1
841db66d079540443808dec76efdbe6193dbdbe4

SHA256
b0175aab46dbdbb010ee6c579b03c8d2a1c03b3a88ab529ff0c0b02cbfb35c1f

SHA512
90eccc8a18ea3a374646a1902d2d53ef2227975b7be8a29128a069c6adfb77bea4f0e1db624b292642ddafc63d9e1bfece21d042bb97c39535af16447dcecfcc

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
163KB

MD5
3eb31bb5ed7f021e5f95524b8796fbf3

SHA1
fd515ed9eff91b1301edf4ad56b7f5813d3bb2d7

SHA256
5f489b9666a179a1f75aa00aa185d7077e722e9e29073a16154056821a77b706

SHA512
e0e5b14eaa5292753d0da284e4aad810151330e47abc15488c60a8cf236283824583f07f106c92d65381cf586fc6de18e4912aec899d7168f7362a2546f2c4b7

Download Submit
C:\Windows\SysWOW64\Gpkchqdj.exe

Filesize
163KB

MD5
98274376c7212f28483433bc99b248cd

SHA1
597433142a2ef908d35da25c694d27c856ae84c6

SHA256
1cd4127b212543a7b6b0ba220f9403c56d5ca0fa33a9ce44958f667cbd696fae

SHA512
878b415da605af01b95a2b55a5131fd26e1dab37b38a1dba5be760069eacfeee6eb298f402fd814b42c5a13b9fbb905d09613c70653decf5a760c4eadd2c3bd8

Download Submit
C:\Windows\SysWOW64\Hdilnojp.exe

Filesize
163KB

MD5
3d44e17373686ce366c653e28c58688e

SHA1
9482b2e274a6833933144337ca6d241f782828da

SHA256
0a22bc092357801a36de8726f2e12efb3c3b55552dd04634e3c192a428da3c77

SHA512
5eca3d3c4ef172aacadd7ab1ab03c1a1d35acbcee8142aca8708e1e28d2c50ced2259f7ac9e58b0f5e083a03b0aa076ce7b3adde80e13dd3aae778fd70a4a03d

Download Submit
C:\Windows\SysWOW64\Hemdlj32.exe

Filesize
163KB

MD5
0614950c95baa2c366ef7dc8866b27a5

SHA1
b5f62fef0693e0525b86ef8ab16f5eb3f3315eae

SHA256
8130beef094b6e7763db279d353b80ffb479f35afe3144b5d1e944ef2c0b8d69

SHA512
21dd0fba225a3bc26d73534f4d40f2d3a3e704d70ed00f1d320d7f9855d813ea9f8484cc0d6305d26362dc0dc80ca7bac568b9383b54bad049a1fe0fa880b152

Download Submit
C:\Windows\SysWOW64\Hmmfmhll.exe

Filesize
163KB

MD5
00f6ca204b57821ecda5dfe9ccab4b93

SHA1
730921aea0144e87ba058de2c4c8f586bed84760

SHA256
785a7a7d613010707ea281f58bf6510a4641a09f4221b602dc0d1bd202a32d8f

SHA512
2497dde278952bbd16864ad1149cc4dce75f0603116b8748f91c7b464a3f56a1c05aad311b52e7971dcc884367eaff75c26e750c25f43168a1f8acf41e29d760

Download Submit
C:\Windows\SysWOW64\Hnaqgd32.exe

Filesize
163KB

MD5
e43e46f189b5220795c4a1e86a8f714a

SHA1
2b33409e37c4b0a33f2a1cd3b5f18c93e95f923d

SHA256
1e1c26ccb04c8d02d0fa55a17a9b665b56de801f9f72a7bde89f8b40fa267946

SHA512
71749cd738a1a2316e9057ea66508e328ea842847dbe2a868b265ebf6b28887e17e7b3be48e18bce9770db2d8e0f465a24fb4a028a0edca64f034ab9d9d55bbb

Download Submit
C:\Windows\SysWOW64\Hpiecd32.exe

Filesize
163KB

MD5
a2080ef36635d7fcbd6a06c1c2ecc9ca

SHA1
eac62d654de4887b7df149b1dc7f34e2c2a5d1a1

SHA256
769f51c1ddd639a9234e662a99622595efc1476c1133008a0556de15a9d42d89

SHA512
3a6a2d191b96be692167bc8297d1e1a7ce3617dd1eec0afac7bf576257598893eedb9f88dc9980f1d566a3267ce9630a92e6c97a35dc95ecc48ad3a8e62e9b43

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
163KB

MD5
c0d137246f6c75b1a68dbb23b65ff50a

SHA1
4564c5d76c33067d19318b7da31cff55391e5054

SHA256
ff986a294a8722ca84ac532571020359bf46fb0ed1e0b22d0e0a8bc94ff4bc0f

SHA512
668cc2581001ec28d1848b836cf7bfc7a5ee648d3fc556c6430ed39c37851a0d6726e66b0dd94720dd979f87ad54ddfb5ec0ba105862f50eabab8a448b8092ab

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
163KB

MD5
b9701f465315c0204c2f822fc633a03c

SHA1
45ccb91e54c8b46bdf958387544dd1aeb5280055

SHA256
9dc88b407de2c32456dd1d62dcea05275e878e83ae61ee261de97216e7fae6c0

SHA512
08706871f4901b02ca9fd99774d26ff13c5f0f97228c101119ee82b59905e9bc996eed85f6d877cef6a7e24f46e7242e1688bc5ebe91d6e62340c23f74c11674

Download Submit
C:\Windows\SysWOW64\Injcmc32.exe

Filesize
163KB

MD5
8f40b9465feb720f4c478442f002a7bb

SHA1
4b1cccd72de2c4c6ee3fd4ad30feedfc31481579

SHA256
a780ce1a382018ed6c0420382da0642915513cdfbf3f2860f4f528fc3adde687

SHA512
058731920ed8877d89f82d034bd578852b0ebb8d329f00f0f154787924670f8df9acad44f0c84a6f205d5619fa8f27acb499011d4202b021bf4870b5a83e6f18

Download Submit
C:\Windows\SysWOW64\Jcgnbaeo.exe

Filesize
163KB

MD5
50f9af9d96d08dcefbb35057f3feafc0

SHA1
fa91a45a6b21f09559002ef493c01b42457ee4ba

SHA256
c11218e9800f670c218c267adeb30702aa11eaf3dc39ea3d3ef3a470e6ddd336

SHA512
15371366e5cc92d0b139bb258e4fd257f79c46363ed1408aa0cd7afa41b2ed3e7200feea17beff5b4521d9ddc54f0d03629afcc7e4af6a4efdecb0d8b28c53eb

Download Submit
C:\Windows\SysWOW64\Jghpbk32.exe

Filesize
163KB

MD5
e5dbca801da4339fe6ccae2fd3cad1b4

SHA1
93ed0d0a1b983eddaf73c276d09c0fa90f48b06b

SHA256
f4cf21d0f53ac21240a00c53b79cf4524f7cd08b28f32adf23dafa265062dab7

SHA512
7cfc9b33012248fc35b8c7a1add1af3dcb6be948522f4fe0acc78623565983482bcf2539d8bd1a58d0b4d917043acf0b9ad153a8d2b33fe3144bb3ae8a1205ac

Download Submit
C:\Windows\SysWOW64\Jkgpbp32.exe

Filesize
163KB

MD5
d3f439e6f2a9bcbebbc3e55860689e90

SHA1
156d56cf4d5fa4b8aa12a43f2dfa2db81d75b62c

SHA256
2d20b0f80263bd04df6ef80b3901c405436f919fd4a8fe0dac89fa6b723a5525

SHA512
0725daa9d6ccd7e22aab9387046b61ce96a790307ec936162593e8553e0d2b5febac6a5ed9f536316ae356be3f92932a10c58bfe15f5a57ef8a1009271cb5723

Download Submit
C:\Windows\SysWOW64\Jpfepf32.exe

Filesize
163KB

MD5
8ab6689bc3f621b018cd03dc87da24eb

SHA1
618488515f27014f6d3f827ccf9d2adfc9425c0d

SHA256
e88e6c9fe6de53ea5e30bda510b4a9137606d30f5d0aaed3e38185938e26fded

SHA512
023938d9412e5f4a8708234042761b96f4f8941842ebfb65f5d6c4e7aed70c29bb3f6b782f46aeb994e9de8a4e6d6dcfed89652cd6365336110f3e49bb405d3a

Download Submit
C:\Windows\SysWOW64\Kgipcogp.exe

Filesize
163KB

MD5
27db6bf5bd75ad9e70ca0cdc1cda9169

SHA1
fd6361b49a66673324746d5511bcfc8ccf01653e

SHA256
cbcc8d862fcdf5f9d147eac26f6c4ced33c1d684b80cd9f2fcc26db08bfdc24c

SHA512
994d6bb86b40dc42cfe57047e1525d555bd0384814c0d15af5537852ca592ee31346162d093a87a8154cb734d12e5a40a1169900070762dd6508cbeae91534de

Download Submit
C:\Windows\SysWOW64\Kgninn32.exe

Filesize
163KB

MD5
db665703750e06b0c11a52089a63b97d

SHA1
63dd0be9b8c9c0ed19cea8d71b231b1e3162315d

SHA256
a21c433487db9892c248ec9fd98df23115368bb85092e66e0e7ceb9cee8f8375

SHA512
7161e20fc714809a0bc9fca1a802729311b394300b4acbe468079eb042d7cb9a097b874ed19bff9856046cc0feaa88b6377603e7bd9fed2694094f5cc189a4d8

Download Submit
C:\Windows\SysWOW64\Kodnmkap.exe

Filesize
163KB

MD5
9ec760e07bf1a1635629b364dba38b1d

SHA1
e159ff42d9f3bbbb83561ccae57970debb8e1cb1

SHA256
daf5d0583a47d92624a75264872ede1d7791db44621a15d0f1693409b468760b

SHA512
7ea676f19ba9ec63dd08319f1d1905f49e92f52a336605f711576421674a8154d87813b5ae4abe25dae8a8ab4bf6498f2d41eda38d2b9cda0df01e7068a7a82d

Download Submit
C:\Windows\SysWOW64\Kqfngd32.exe

Filesize
163KB

MD5
8e438a5acd0cf1fc9db8f9e8eef6a944

SHA1
d8afccf90d1aa253624dd6b09f83bcbb73568ca7

SHA256
512376c53bf07e2b0ca8d6a06e45e7fa01618019587b19076e130d5606600632

SHA512
9c9495943ba3af5e4edf836d930c4807793c769ae8b73c83dff67f2526f30ea17e499f50621224f6e8842232e1ada1ad3e8c0aaa27ebddddfc4d0221674b73e6

Download Submit
C:\Windows\SysWOW64\Lcnmin32.exe

Filesize
163KB

MD5
ea3b06ef49399a09c930532f1ce8cebb

SHA1
f8cedc70a18279d9665be0a70d17f559292758b8

SHA256
09cfd81661d319e03ed7f24818000887741819094580f08847a3e597db2cb5b3

SHA512
fbf5f3ad607d732b81e4ffafc95ff635722d167466c28fb416bcb33b790e99d671f6b61e4824d85c6b26ab41974ccc39a8b03b599a049d05a2f55ef0ea6cff58

Download Submit
C:\Windows\SysWOW64\Lgkpdcmi.exe

Filesize
163KB

MD5
9fb312f03367e66eeeb20b87edb80eba

SHA1
07ea43287de021caf5f410c45e5af9943a6fd38e

SHA256
8b1f602ee071190ed560b2ab72899a28377288b137d403c982a5d9e698f6cf23

SHA512
319524ebba61190abb4e8c0dc67d14585ca89b14294895c7a2c131e8c98108d9134b467951df71451cccffca1b702f70201915e83b1e2bb00e2a54a13515a0fd

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
163KB

MD5
8d1a2dbc2584284ed925f2b336f40df9

SHA1
691cc703a031a6c0b2b238201db59cb96845d134

SHA256
4cb2388a6f3fb6b2adf4abde169681e18f1d1e52257af2a1f4ed5b019a4b9483

SHA512
32c93ead53345a8f5f2ce6351b90b1e1bece3b094f431d012eecd59031d0cbf9e3e6dce19bb9875c15ff525113f0f4651fe6504923d4e906acc98a8259e9ae95

Download Submit
C:\Windows\SysWOW64\Mahnhhod.exe

Filesize
163KB

MD5
980a889776cbe449e27149c79364e97c

SHA1
e0f7cdad9027432de9da2c936b64132c825ab526

SHA256
041ff19fa46be71c56df1530565b27c0b5210a231104eaaa84b19a2d86413ec4

SHA512
756a202e085cc4b6330ee0637a8cc8cdcd53f3dfabbb1446cec8eb41d6511d78570ee620a7f313b5e3a88c1ff792b62733bb23e904d5ae8370ca332272d27017

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
163KB

MD5
4c62e30978cd5b517a4f351b2430707c

SHA1
8f054192ee78274e0e083e4b76b7e95b225c00ee

SHA256
7a97b893ef9ae605746d8e47be48f480b5fb645ad181b8dc4995ebecbf011ab1

SHA512
899af0726ccc667c708108645fcbcb4b1251df1255546f306e7e2c32a75010a3d6e1e94d5037cb4ee808583f46704d5bb242ba13383eb78d6012575bd0a51f9c

Download Submit
C:\Windows\SysWOW64\Mhfppabl.exe

Filesize
163KB

MD5
1d3e193b740dd9a1153a091dda205f99

SHA1
7bf1b7a3d025311a295217e11726a37916635d85

SHA256
e4d2eed3f7fdc760e975082db83c198c462fab6e7545909ded5745d5a30ba42a

SHA512
9a212fb9eed7ca871bba65268510da4d1bbab05a96303c0e9a78bcfa8747e593c1453662c3718e2fe78fcd6944fdc65b05bec60ab39a23786c7fb780cfef55ab

Download Submit
C:\Windows\SysWOW64\Mjaabq32.exe

Filesize
163KB

MD5
269eb5f6c8423cc424db05c7abbd04bd

SHA1
861ca3e1ae758e0a1a899776764b139914209260

SHA256
6d62c50a624bbace58d2091f8d41011d756bf962cb203848df0546b870598d10

SHA512
10558b2a490daf3c436311e6366c574b50c97397d898055807bbf42d8aa9954b3f9c315c0dfc44d3160062275ade68b285244c7ea1da4d91395ef9bdd737bb1d

Download Submit
C:\Windows\SysWOW64\Mjjkaabc.exe

Filesize
163KB

MD5
1f9b028f0954f204d07f1638b8295a3f

SHA1
68a94ffe9cbe44479b4c7fe25c13543daacf4c89

SHA256
d86e4f80b35b6a29449e5c07c434a5ab96adcbdcb9edfceaa905e4f023a7736c

SHA512
6e18425451129c2dec40f5fa5948076ef1e051ad54cd3e07582e2842847a16e00e00b3b05a0a4cc925cc11f5ec83c8f12c792627e2841a9c9e906d59dde0ad4e

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
163KB

MD5
f60ce9f4d8dc687557f1fc1ada6b985c

SHA1
6555fac40e3b8ddee510be6731361495774fbf54

SHA256
23e8be9cc2ff9089fc9a3f9174a294b2b36c8fd60d5262a999f75f649b615c52

SHA512
a3fc867517814d393260a0d3c6cdf6bf84307e14be7d82f1d750421c95b7d06b1ddd508d977c8b06ab9b031bf42e6533ef0e65cf943f18c14454f7222f071ae6

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
163KB

MD5
232fc744538fcb6367cf41e8b5572d27

SHA1
44ede4c740574b5d8bb9215d0f5584db47de89e7

SHA256
c33352148cb65863ba18e6c24b327265a79a30e94da1471b7efa8761353e59a7

SHA512
d9e3dacaecda4bb5147ec0a7ea2e9c16e358c7a050ee6ec005c582f1eeed2a7ad602cdbd27bd64e00c95e5547dc32f35d209042d94f39e8c66bfcf9e80fe743d

Download Submit
C:\Windows\SysWOW64\Niooqcad.exe

Filesize
163KB

MD5
6feec02d391bb4943ac616b1b507fcb8

SHA1
de9308009aa5745bc93a6ffe31639a4a10f1dd98

SHA256
3a3d7d32afcc1c1017d4db4f4e0624955f668fb3947aa727ca87deef59ca2149

SHA512
9cd956170e8bd8cacfbeb23603c88e411e8533ccee618486d25c77451253465f331e7e3ecbf55e98ba220b18afc44334b36ac3b1b80ba0d2864e4c320dbfe67d

Download Submit
C:\Windows\SysWOW64\Nklbmllg.exe

Filesize
163KB

MD5
bcd7d3c1180e2482c520430266028c53

SHA1
7619bab62ea1048c012ecbc3a7b7b4d6cfab8c64

SHA256
1a5d810b19c85ae52885a313a5bb314ac7a78be72401f3a127ebfdf2805580e3

SHA512
0786f0dcc69ead379d5f8f3799a5bd65b59296d8c302a4671acc809e07f262dd94b6ff37f3792be1e1eb7a955fd71e05cd140e1a9671c62964b51482f2107641

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
163KB

MD5
e3416c268f4358fd32599e59b29d5598

SHA1
6e9998c4a833eca06ac008bdf3e55c1e54d6731f

SHA256
7a990bcd1efe8312adea9e95042ddf1b97fc72bf705634c5300ec06aa0404005

SHA512
76112f2ea7e09a8513ba3d712bf4775170eb17dd3f608ae08e3b6971ed33fc2bfa0313ebace3b144752cd2b5e9140e48ab00ec47059b2248dd324cda0d896aa2

Download Submit
C:\Windows\SysWOW64\Noeahkfc.exe

Filesize
163KB

MD5
ea8bca39e18a4d78741f4abc4988520c

SHA1
2301f171c982e80945138aab33462502da5d047d

SHA256
9e1132946f1b0124798e9834b25bed68fa6aa8ec1a02ecd788dcd739def967e1

SHA512
fb24345c3f5be07c86844bdaaa3aa58545fcd9c5c3de09dd7da8646cd6eff2f90ef9e84d5486c96b8f47d5ace17acd0c500c904ddabf2bd37c620c2bfe6168b4

Download Submit
C:\Windows\SysWOW64\Obcceg32.exe

Filesize
163KB

MD5
8f61dadabeaa3feb770037b2e4ef419a

SHA1
a7cc68624213feba2cc8b1855e3498fa1bdc64fc

SHA256
8d820cfb21769fb9876f27d808abaa85269a39520c30537ce1a5b21373242a8a

SHA512
60c8b908d93bb8777d97a17273cd0480e886dd2f9957724db1e19366c7f1be2f28cd265e24ed82ef6a9ecbd1b520cb6b8d7e40391e6ab6a42c38ddcd240f8130

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
163KB

MD5
62d5d977ae5993264d850fa31466232e

SHA1
ddef94dd4a90e738944297aa28b61aed463b8dc3

SHA256
41401cdf384cb097c4ed49223576403648cee646a19a73174b7e050e55a0ed91

SHA512
611529800e8fee26eea49bf106dc370dd8fa229b0495987e09ee73d8e5cd47c0ed6f740479de90c07b6f2dad8877ba1889c3c3920c4cfa614f628fa363f6170c

Download Submit
C:\Windows\SysWOW64\Oeehkn32.exe

Filesize
163KB

MD5
4c2de707bebe8deb7e1097e33848ff3b

SHA1
bffac84e975c5cdef1bcafd1a1af0412d05d02ae

SHA256
cece4697a6eca21338f66b9c3cd41bad3344b912ef39653d75d312f54702cf34

SHA512
004ff191eb548bcf708592c508f603782b499b8ea063637e8f3d40728b5d9021c95282770d70afa20e9f10b44a86b9ad3e6e7a35d44c2cf87ac98c535f2699c5

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
163KB

MD5
7475996003cae63ccd12f019ef785f95

SHA1
1bc518477854a6d89cc086ae2639c6c2c2cdb539

SHA256
c8a24c2bbff018e287829934aeaa4fbda3a67f837a885af4b70131bd9c5a37c3

SHA512
7e34e53919a3f1b8f376ea60cd8e6b26210c01ba93286cde03403474c8e8bea52b1be40cc19d02d1d0811c03e4c47b3a64abfc279eeeb40148804a3445373a19

Download Submit
C:\Windows\SysWOW64\Ohnohn32.exe

Filesize
163KB

MD5
3be48a8ef5f0a09ce47b8282de5154ea

SHA1
89856275df6095e313b30a12670127a2eb2903e7

SHA256
738f8b7b0f07fba60387e34b4cf67f219af97708363a9696ec116f82901d77c8

SHA512
a84958123853ff9c9420ebed1b4902abe0afd0e16aac9e1238d4d33d038fcdcdbe097d6527886068fbfb535a3ee1e7ccfb59c4fad456423279bac638d53e32f2

Download Submit
C:\Windows\SysWOW64\Omjpeo32.exe

Filesize
163KB

MD5
d454c74b48545f9afc091bbd5768a897

SHA1
feb69a32049180a385e78bc18d2b491661f4a214

SHA256
1fedca7360ef73b2846d57c647558b85a9f62ddd8356537ada4ef90aa9c38350

SHA512
a4dbbc0c43cc11fb466e8ace30a19695876302b335df843391654856e767eb9e787c73dbcb7d6d0de2c750e1f47d78b31fc161f9cca7e07b5af0d01008e0c028

Download Submit
C:\Windows\SysWOW64\Pibdmp32.exe

Filesize
163KB

MD5
83018ea62ad86c6b60802f6ae2da6d0c

SHA1
718f4136de20ff44c7e124a03b77a95929948fce

SHA256
7822e36dbf5e4e1e8d566789dfb1d5ac01f61bb87e32392d671101e835860f3a

SHA512
1e1d0e43d34f00aa8d69af4a14b7c35182f48b3446884975a584512c3bb7d7ede775746c8db3052b93dfbfc413c571ff7cbdf8a35ed44efe1f8094cb9576aeab

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
163KB

MD5
edfc02587ad4ab94e1c3b66cab18af8b

SHA1
6e3e0f363682a64a0568dbf3ac27814f3944f0d2

SHA256
7626fa0f83257e94812f3c0ab0b0d7c2a2de88ffaf64533ac0983efeba12ef9c

SHA512
ec1b5ddc441ea486580bed42aad782e40031b622901a1209e9ef9e255ce9f5ba1468d2883a5c229d01454332a89a4054458f27b7ccedcbbf22e0725c1df36363

Download Submit
C:\Windows\SysWOW64\Pnkbkk32.exe

Filesize
163KB

MD5
dee73208b1c2bf07ba1b0c784c9ceb6a

SHA1
3228fd3d72036d78c41d345cd34f70c0ee8618b1

SHA256
a31ee60e3f82392e7e8e0ac4b24f380de8dd29f8cffa1d097b56094b3a64e92a

SHA512
a40490b122574f3c8fba7bd59b0e25cdb42eae781d9e8fac04488477d5ef353b32d5e96662031a3b948bfeb6f3db5be4b45f7aac408718e2dd5e0577ce14b060

Download Submit
C:\Windows\SysWOW64\Qaflgago.exe

Filesize
163KB

MD5
bdf7d178029dd772ce834a3e1fbf6cca

SHA1
20571260c54bc8f461af8b2d9100cba5570f9767

SHA256
0cd1fd8f3f748531b883f03f731dbc5d4b5b09e27fc13b3800487ef4c2d30ddc

SHA512
157e819eeee8b318dd3cd5b9cf2ac2ba39ffe74e5311088cccd31c9ce069290acde40856bbbbf30883d0280d31b20ffe9df5a759b5c0c8c6bcd560c28924a401

Download Submit
C:\Windows\SysWOW64\Qlggjk32.exe

Filesize
163KB

MD5
8ec10932b84a57e4f1711e5f7bc20691

SHA1
2dd2980c01e9f584067b8343747bbd08ab88fafe

SHA256
77d74f87c18601ac93afc97f213d3e7df6ec331aad32f78f1724a6f2fc0fde9b

SHA512
1a57abdb87d8408a4450f9574fd2487211a6c3885bb0cea1a65060447d2b5acc73b2b1b8bbcd06a3d63451d297795da460512c0f3533860205fc6518046134e4

Download Submit
C:\Windows\SysWOW64\Qobhkjdi.exe

Filesize
163KB

MD5
45b8e98aaa3164743e827cc393cce47c

SHA1
6553666807a55b55c67016adaaf03445510f9591

SHA256
f1c7194c9127d7688273f267668b4150ddeafaf351397b42262d56674b137a59

SHA512
3576dae8eea3a7b8f0e010b00b81a32e02c8fdac61e606b3b3caf77c0664d13dee56b372ec17ddad3fe9073ee04f9eb1aa53af3e443908c038e644a58d9aa7c1

Download Submit
memory/396-364-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/400-583-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/400-49-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/536-376-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/636-286-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/880-520-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/940-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/956-173-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/996-346-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1004-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1088-590-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1088-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1120-3642-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1120-199-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1132-8-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1132-550-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1164-274-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1184-526-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1232-223-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1516-454-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1612-430-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1672-3918-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1672-268-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1724-80-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1860-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1860-597-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1940-136-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2108-149-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2108-3477-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2116-412-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2200-460-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2276-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2276-569-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2292-292-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2296-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2376-3184-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2408-340-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2460-232-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2472-484-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2480-298-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2584-239-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2608-328-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2620-255-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2648-208-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2656-394-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2704-181-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2780-280-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2848-215-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3076-406-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3084-247-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3088-478-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3120-121-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3240-448-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3316-388-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3320-561-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3320-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3332-375-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3364-508-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3416-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3508-576-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3508-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3516-551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3580-97-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3588-304-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3592-604-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3592-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3612-418-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3628-352-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3664-129-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3868-161-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3948-436-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3996-400-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4028-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4076-424-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4104-358-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4124-472-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4196-506-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4200-262-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4220-490-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4336-382-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4360-570-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4428-310-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4532-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4532-563-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4536-320-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4648-514-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4708-442-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4736-326-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4912-466-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4968-157-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4988-185-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5024-532-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-334-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5048-496-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5144-577-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5216-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5260-591-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5308-598-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6192-3622-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6460-3664-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6836-3600-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7116-3626-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7340-3531-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7688-3476-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7988-3501-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8768-3390-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9484-3203-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9524-3283-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9784-3190-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9852-3213-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10048-3268-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10120-3266-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10988-3156-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/11228-3131-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/11856-3056-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/12064-3063-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/12224-3078-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads