berbew | 4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe
Size

163KB
MD5

a53263b540c6c4c6ce4f3faf39c0b140
SHA1

44a91a977fcc8b79f1708276cca5bc3651e2d4eb
SHA256

4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62
SHA512

a725ebd4167ab2ab5ad283760ca61cfae781ef0e1cce8e394b9996675f90179ac4d001809de0fb255b44c04e48f11c27a708a2f7625665a326481251c7c1f736
SSDEEP

1536:PVIuw9kp7+MxGLOBF2v04boIXZ4x0bClProNVU4qNVUrk/9QbfBr+7GwKrPAsqNy:9I/9E7/GY2v0v5x0bCltOrWKDBr+yJb

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfbaonae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djjebh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hildmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikdcmpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmdemd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpiecd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlhccj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhokljge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akqfkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aefjii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fealin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boflmdkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcddcbab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlegnjbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnmdme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcndbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpqldc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmkdcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nccokk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohkkhhmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfipef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feoodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiaael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijqmhnko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlobkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljfhqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkceokii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgdejd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdigadjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qeodhjmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgpfbjlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnmkfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcblpdgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijcjmmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjmoag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igfclkdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofkbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acfhad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjmfjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcjmel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfkbde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdpjlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Modgdicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emdajb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqfngd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nclikl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbeejp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loighj32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

pid	Process
5080	Oeoblb32.exe
2840	Olijhmgj.exe
2464	Oimkbaed.exe
1616	Pojcjh32.exe
868	Piphgq32.exe
1248	Pkadoiip.exe
4240	Pchlpfjb.exe
2980	Plpqil32.exe
4948	Peieba32.exe
1232	Papfgbmg.exe
3100	Plejdkmm.exe
2384	Pabblb32.exe
4760	Qlggjk32.exe
1268	Qcaofebg.exe
3700	Qljcoj32.exe
4844	Qohpkf32.exe
912	Qaflgago.exe
1012	Ajndioga.exe
4432	Akoqpg32.exe
3168	Acfhad32.exe
2368	Aeddnp32.exe
1624	Achegd32.exe
4256	Aakebqbj.exe
4752	Ahenokjf.exe
396	Alqjpi32.exe
3772	Aoofle32.exe
2180	Aanbhp32.exe
4612	Ajdjin32.exe
4344	Alcfei32.exe
264	Aoabad32.exe
3536	Abponp32.exe
4332	Afkknogn.exe
4804	Ahjgjj32.exe
2060	Akhcfe32.exe
2572	Acokhc32.exe
4300	Abbkcpma.exe
3320	Bjicdmmd.exe
2940	Blhpqhlh.exe
4120	Boflmdkk.exe
4904	Bbdhiojo.exe
4500	Bfpdin32.exe
4496	Bhoqeibl.exe
4224	Bkmmaeap.exe
1952	Bcddcbab.exe
4200	Bfbaonae.exe
4232	Bhamkipi.exe
2228	Bkoigdom.exe
4460	Bcfahbpo.exe
4556	Bfendmoc.exe
1360	Bhcjqinf.exe
720	Bkafmd32.exe
1976	Bcinna32.exe
2308	Bfgjjm32.exe
1820	Bheffh32.exe
1636	Bopocbcq.exe
2616	Cjecpkcg.exe
3252	Cmcolgbj.exe
2904	Ccmgiaig.exe
3256	Cjgpfk32.exe
2252	Ckilmcgb.exe
1256	Cbbdjm32.exe
4940	Cimmggfl.exe
2280	Cfqmpl32.exe
4148	Cioilg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Iphioh32.exe	Injmcmej.exe
File created	C:\Windows\SysWOW64\Kcndbp32.exe	Kqphfe32.exe
File created	C:\Windows\SysWOW64\Knfeeimj.exe	Kjjiej32.exe
File created	C:\Windows\SysWOW64\Emhgcipb.dll	Pejkmk32.exe
File created	C:\Windows\SysWOW64\Ckmonl32.exe	Chnbbqpn.exe
File opened for modification	C:\Windows\SysWOW64\Domdjj32.exe	Dmohno32.exe
File created	C:\Windows\SysWOW64\Cimmggfl.exe	Cbbdjm32.exe
File created	C:\Windows\SysWOW64\Gbdoof32.exe	Gpecbk32.exe
File created	C:\Windows\SysWOW64\Gldglf32.exe	Gmafajfi.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Bogkmgba.exe	Bdagpnbk.exe
File opened for modification	C:\Windows\SysWOW64\Emoadlfo.exe	Eicedn32.exe
File created	C:\Windows\SysWOW64\Fbgihaji.exe	Fpimlfke.exe
File opened for modification	C:\Windows\SysWOW64\Chglab32.exe	Cfipef32.exe
File created	C:\Windows\SysWOW64\Gblbca32.exe	Gnqfcbnj.exe
File opened for modification	C:\Windows\SysWOW64\Gmafajfi.exe	Gejopl32.exe
File created	C:\Windows\SysWOW64\Bhhqlkph.dll	Jgeghp32.exe
File opened for modification	C:\Windows\SysWOW64\Bochmn32.exe	Alelqb32.exe
File created	C:\Windows\SysWOW64\Gahamgib.dll	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Ekodjiol.exe	Eiahnnph.exe
File opened for modification	C:\Windows\SysWOW64\Kfnfjehl.exe	Kncaec32.exe
File created	C:\Windows\SysWOW64\Eleepoob.exe	Eifhdd32.exe
File opened for modification	C:\Windows\SysWOW64\Pahilmoc.exe	Poimpapp.exe
File created	C:\Windows\SysWOW64\Mfhpakim.dll	Lmdemd32.exe
File created	C:\Windows\SysWOW64\Oodcdb32.exe	Ojigdcll.exe
File opened for modification	C:\Windows\SysWOW64\Badanigc.exe	Bkjiao32.exe
File created	C:\Windows\SysWOW64\Lielhgaa.dll	Aggpfkjj.exe
File opened for modification	C:\Windows\SysWOW64\Qohpkf32.exe	Qljcoj32.exe
File created	C:\Windows\SysWOW64\Inbhocbm.dll	Bfendmoc.exe
File created	C:\Windows\SysWOW64\Oelolmnd.exe	Oobfob32.exe
File created	C:\Windows\SysWOW64\Enkdaepb.exe	Eiokinbk.exe
File created	C:\Windows\SysWOW64\Fmcjpl32.exe	Felbnn32.exe
File created	C:\Windows\SysWOW64\Ibaeen32.exe	Hmdlmg32.exe
File created	C:\Windows\SysWOW64\Fqibbo32.dll	Jphkkpbp.exe
File opened for modification	C:\Windows\SysWOW64\Eiobceef.exe	Efafgifc.exe
File created	C:\Windows\SysWOW64\Fjcgfjdk.dll	Napjdpcn.exe
File opened for modification	C:\Windows\SysWOW64\Gdcliikj.exe	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Aednci32.exe	Anmfbl32.exe
File created	C:\Windows\SysWOW64\Domdjj32.exe	Dmohno32.exe
File opened for modification	C:\Windows\SysWOW64\Ekdnei32.exe	Eifaim32.exe
File created	C:\Windows\SysWOW64\Lfebfnqn.dll	Gbeejp32.exe
File created	C:\Windows\SysWOW64\Loighj32.exe	Kngkqbgl.exe
File created	C:\Windows\SysWOW64\Klinjgke.dll	Achegd32.exe
File created	C:\Windows\SysWOW64\Kdigadjo.exe	Knooej32.exe
File created	C:\Windows\SysWOW64\Oddfcg32.dll	Aednci32.exe
File created	C:\Windows\SysWOW64\Elkllcbh.dll	Dngjff32.exe
File created	C:\Windows\SysWOW64\Lfgipd32.exe	Llodgnja.exe
File opened for modification	C:\Windows\SysWOW64\Oeoblb32.exe	4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe
File opened for modification	C:\Windows\SysWOW64\Pejkmk32.exe	Pmcclm32.exe
File created	C:\Windows\SysWOW64\Gmdjapgb.exe	Gfkbde32.exe
File created	C:\Windows\SysWOW64\Hgkkkcbc.exe	Hdmoohbo.exe
File created	C:\Windows\SysWOW64\Gehcdm32.dll	Ncabfkqo.exe
File created	C:\Windows\SysWOW64\Mfbjdgmg.dll	Deqcbpld.exe
File opened for modification	C:\Windows\SysWOW64\Ennqfenp.exe	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Epmmqheb.exe	Emoadlfo.exe
File created	C:\Windows\SysWOW64\Plejdkmm.exe	Papfgbmg.exe
File created	C:\Windows\SysWOW64\Qlggjk32.exe	Pabblb32.exe
File created	C:\Windows\SysWOW64\Iojbpo32.exe	Imiehfao.exe
File created	C:\Windows\SysWOW64\Bnoddcef.exe	Bknlbhhe.exe
File opened for modification	C:\Windows\SysWOW64\Efgemb32.exe	Eblimcdf.exe
File created	C:\Windows\SysWOW64\Eklikcef.dll	Gflhoo32.exe
File created	C:\Windows\SysWOW64\Jjjpnlbd.exe	Jcphab32.exe
File created	C:\Windows\SysWOW64\Ombnni32.dll	Loighj32.exe
File opened for modification	C:\Windows\SysWOW64\Offnhpfo.exe	Omnjojpo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11568	12272	WerFault.exe	587

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndflak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peahgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahbjoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmlkhofd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iedjmioj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdoof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmiclo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmlpaoaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgfapd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iljpij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjmba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpimlfke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qohpkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjkblhfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklbdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgobel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omqmop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjillkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebjdgmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckilmcgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Naecop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abponp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idahjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnpabe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cimmggfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdjibj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ennqfenp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifcgion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jphkkpbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nagiji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Achegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hienlpel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijqmhnko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efgemb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejopl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icfekc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdigadjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnbnhedj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkmec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlggjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhcjqinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Malpia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknifq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoalgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eofgpikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akhcfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bopocbcq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfcjfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdepgkgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkadfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncabfkqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbeejp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjepjkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qeodhjmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnangaoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgninn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcalieg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adndoe32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejljgqdp.dll"	Jlobkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gicbkkca.dll"	Kmfhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdpiacg.dll"	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilmjim32.dll"	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahjgjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfcjfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akqfkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Felbnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ombnni32.dll"	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fimhbfpl.dll"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqlhmf32.dll"	Hpqldc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plejdkmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmpjmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Injmcmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mebcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqmmqg32.dll"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciibdmj.dll"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnlinml.dll"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idaiki32.dll"	Pmpolgoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejoomhmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oobfob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cndeii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpqldc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oghdfilo.dll"	Ecbjkngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iljekoej.dll"	Eleepoob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eiokinbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ennqfenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjecpkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binnimfj.dll"	Dckdjomg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpcfmkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmnqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkchlonc.dll"	Cofnik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcinna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igdnabjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljclki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfkegm32.dll"	Mkohaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kngkqbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Conanfli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qlggjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfcfimfi.dll"	Pagbaglh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohhnbhok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcphab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khoana32.dll"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnicid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aknifq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbgihaji.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 5080	2028	4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe	84
PID 2028 wrote to memory of 5080	2028	4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe	84
PID 2028 wrote to memory of 5080	2028	4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe	84
PID 5080 wrote to memory of 2840	5080	Oeoblb32.exe	85
PID 5080 wrote to memory of 2840	5080	Oeoblb32.exe	85
PID 5080 wrote to memory of 2840	5080	Oeoblb32.exe	85
PID 2840 wrote to memory of 2464	2840	Olijhmgj.exe	86
PID 2840 wrote to memory of 2464	2840	Olijhmgj.exe	86
PID 2840 wrote to memory of 2464	2840	Olijhmgj.exe	86
PID 2464 wrote to memory of 1616	2464	Oimkbaed.exe	87
PID 2464 wrote to memory of 1616	2464	Oimkbaed.exe	87
PID 2464 wrote to memory of 1616	2464	Oimkbaed.exe	87
PID 1616 wrote to memory of 868	1616	Pojcjh32.exe	88
PID 1616 wrote to memory of 868	1616	Pojcjh32.exe	88
PID 1616 wrote to memory of 868	1616	Pojcjh32.exe	88
PID 868 wrote to memory of 1248	868	Piphgq32.exe	89
PID 868 wrote to memory of 1248	868	Piphgq32.exe	89
PID 868 wrote to memory of 1248	868	Piphgq32.exe	89
PID 1248 wrote to memory of 4240	1248	Pkadoiip.exe	90
PID 1248 wrote to memory of 4240	1248	Pkadoiip.exe	90
PID 1248 wrote to memory of 4240	1248	Pkadoiip.exe	90
PID 4240 wrote to memory of 2980	4240	Pchlpfjb.exe	91
PID 4240 wrote to memory of 2980	4240	Pchlpfjb.exe	91
PID 4240 wrote to memory of 2980	4240	Pchlpfjb.exe	91
PID 2980 wrote to memory of 4948	2980	Plpqil32.exe	92
PID 2980 wrote to memory of 4948	2980	Plpqil32.exe	92
PID 2980 wrote to memory of 4948	2980	Plpqil32.exe	92
PID 4948 wrote to memory of 1232	4948	Peieba32.exe	94
PID 4948 wrote to memory of 1232	4948	Peieba32.exe	94
PID 4948 wrote to memory of 1232	4948	Peieba32.exe	94
PID 1232 wrote to memory of 3100	1232	Papfgbmg.exe	95
PID 1232 wrote to memory of 3100	1232	Papfgbmg.exe	95
PID 1232 wrote to memory of 3100	1232	Papfgbmg.exe	95
PID 3100 wrote to memory of 2384	3100	Plejdkmm.exe	96
PID 3100 wrote to memory of 2384	3100	Plejdkmm.exe	96
PID 3100 wrote to memory of 2384	3100	Plejdkmm.exe	96
PID 2384 wrote to memory of 4760	2384	Pabblb32.exe	97
PID 2384 wrote to memory of 4760	2384	Pabblb32.exe	97
PID 2384 wrote to memory of 4760	2384	Pabblb32.exe	97
PID 4760 wrote to memory of 1268	4760	Qlggjk32.exe	98
PID 4760 wrote to memory of 1268	4760	Qlggjk32.exe	98
PID 4760 wrote to memory of 1268	4760	Qlggjk32.exe	98
PID 1268 wrote to memory of 3700	1268	Qcaofebg.exe	99
PID 1268 wrote to memory of 3700	1268	Qcaofebg.exe	99
PID 1268 wrote to memory of 3700	1268	Qcaofebg.exe	99
PID 3700 wrote to memory of 4844	3700	Qljcoj32.exe	100
PID 3700 wrote to memory of 4844	3700	Qljcoj32.exe	100
PID 3700 wrote to memory of 4844	3700	Qljcoj32.exe	100
PID 4844 wrote to memory of 912	4844	Qohpkf32.exe	101
PID 4844 wrote to memory of 912	4844	Qohpkf32.exe	101
PID 4844 wrote to memory of 912	4844	Qohpkf32.exe	101
PID 912 wrote to memory of 1012	912	Qaflgago.exe	102
PID 912 wrote to memory of 1012	912	Qaflgago.exe	102
PID 912 wrote to memory of 1012	912	Qaflgago.exe	102
PID 1012 wrote to memory of 4432	1012	Ajndioga.exe	103
PID 1012 wrote to memory of 4432	1012	Ajndioga.exe	103
PID 1012 wrote to memory of 4432	1012	Ajndioga.exe	103
PID 4432 wrote to memory of 3168	4432	Akoqpg32.exe	104
PID 4432 wrote to memory of 3168	4432	Akoqpg32.exe	104
PID 4432 wrote to memory of 3168	4432	Akoqpg32.exe	104
PID 3168 wrote to memory of 2368	3168	Acfhad32.exe	105
PID 3168 wrote to memory of 2368	3168	Acfhad32.exe	105
PID 3168 wrote to memory of 2368	3168	Acfhad32.exe	105
PID 2368 wrote to memory of 1624	2368	Aeddnp32.exe	106

C:\Users\Admin\AppData\Local\Temp\4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe
"C:\Users\Admin\AppData\Local\Temp\4f95d757903db03ce729e8208767809dda7779143e72033b6dc9d068bf5eac62N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\Oeoblb32.exe
  C:\Windows\system32\Oeoblb32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\Olijhmgj.exe
    C:\Windows\system32\Olijhmgj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\SysWOW64\Oimkbaed.exe
      C:\Windows\system32\Oimkbaed.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1616
      - C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        24⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        25⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        26⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        27⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        28⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        30⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        31⤵
        Executes dropped EXE
        
        PID:264
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3536
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        33⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        36⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        37⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        38⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        39⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        41⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        42⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        43⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        44⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        47⤵
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        48⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        49⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4556
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        52⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        54⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        55⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        58⤵
        Executes dropped EXE
        
        PID:3252
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        59⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        60⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1256
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4940
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        64⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        65⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        66⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        68⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        69⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        70⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        71⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        72⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        73⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        74⤵
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        75⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        76⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        77⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        78⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        79⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4236
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        81⤵
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        82⤵
        Drops file in System32 directory
        
        PID:4084
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:760
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        84⤵
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        85⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        86⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        87⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        88⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        89⤵
        Drops file in System32 directory
        
        PID:660
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        90⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        92⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        93⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        94⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        95⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        96⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        97⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        99⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        100⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        101⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        103⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        104⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        105⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        107⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        108⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        109⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        110⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        113⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        115⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        116⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        117⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        119⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5728
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        121⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        125⤵
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        126⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        127⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        128⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        130⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        131⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        132⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        135⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4688
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        139⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        141⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        144⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        145⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        146⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        148⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        149⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        150⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        151⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        152⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        154⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        155⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        156⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        157⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        158⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        161⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        162⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        164⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6180
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        170⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        171⤵
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        172⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        174⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        179⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        180⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        182⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        183⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        184⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        185⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        186⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        187⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        190⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        191⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        192⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        193⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        194⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        196⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        197⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        200⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        201⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        202⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        203⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        204⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        205⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:7524
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        211⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        216⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        217⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        218⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        219⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7928
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        220⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        221⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8088
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8128
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        225⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        226⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        229⤵
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        230⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        231⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        232⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:7676
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        234⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        235⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        236⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        237⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        238⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        240⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        241⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        242⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        243⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        244⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        245⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        246⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        248⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        249⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        250⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        251⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        252⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        253⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        254⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        255⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        256⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        257⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        259⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        260⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        261⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        262⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        263⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        264⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8252
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        266⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:8332
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        268⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        269⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        270⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8588
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        275⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        277⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        278⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        279⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        280⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:9052
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        283⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:9152
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        285⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        286⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        287⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        289⤵
        Drops file in System32 directory
        
        PID:8456
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        290⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        291⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        292⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        293⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        295⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        296⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        297⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        298⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        299⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        300⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        301⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        302⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        303⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        304⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        306⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        307⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        308⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        309⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        310⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        311⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        312⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        314⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        315⤵
        Modifies registry class
        
        PID:8904
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        317⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        318⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        319⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        320⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        321⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        322⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:9340
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        324⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        325⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        326⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        327⤵
        Drops file in System32 directory
        
        PID:9484
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        328⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        329⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        330⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        333⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        334⤵
        Drops file in System32 directory
        
        PID:9748
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        335⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        336⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        337⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        338⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:9928
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        340⤵
        Drops file in System32 directory
        
        PID:9964
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        341⤵
        Drops file in System32 directory
        
        PID:10000
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        342⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        343⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        344⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        345⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10144
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        346⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        347⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        348⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        349⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        350⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9372
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        351⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        352⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        353⤵
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        354⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        355⤵
        Drops file in System32 directory
        
        PID:9740
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        356⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9844
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        357⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9916
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        358⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        359⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        360⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10088
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        361⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        362⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        363⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9404
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        365⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        366⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        367⤵
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10020
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        369⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        370⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        371⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        372⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        373⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9952
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        374⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9396
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        376⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        377⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        378⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        379⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        380⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        381⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        382⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10356
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        383⤵
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        384⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        385⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        386⤵
        Modifies registry class
        
        PID:10512
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        387⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        388⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        389⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        390⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        391⤵
        Drops file in System32 directory
        
        PID:10696
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        392⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        393⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        394⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        395⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        396⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        397⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10956
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        399⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11032
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        401⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        402⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        403⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        404⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:11216
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11252
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        407⤵
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        408⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10308
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        409⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        410⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        411⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        412⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        413⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        414⤵
        Modifies registry class
        
        PID:10692
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        415⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        416⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        417⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10844
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        419⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        420⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        421⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        422⤵
        System Location Discovery: System Language Discovery
        
        PID:11096
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        423⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        424⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10300
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        426⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10412
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        427⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        428⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        429⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        430⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        431⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        432⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2960
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10876
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        435⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11088
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        437⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        438⤵
        Drops file in System32 directory
        
        PID:10400
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        439⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        440⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        441⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        443⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        444⤵
        Modifies registry class
        
        PID:11076
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11240
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        446⤵
        Modifies registry class
        
        PID:10472
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        447⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        448⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        449⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        450⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        451⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        452⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        453⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        454⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        455⤵
        System Location Discovery: System Language Discovery
        
        PID:11320
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        456⤵
        Drops file in System32 directory
        
        PID:11356
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        457⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        459⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        460⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        461⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        462⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        463⤵
        Modifies registry class
        
        PID:11608
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        464⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        465⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        466⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11764
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        467⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        468⤵
        Modifies registry class
        
        PID:11836
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        469⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        470⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        471⤵
        System Location Discovery: System Language Discovery
        
        PID:11944
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        472⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        473⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        474⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        475⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        476⤵
        Drops file in System32 directory
        
        PID:12124
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        477⤵
        Modifies registry class
        
        PID:12160
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        478⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        479⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:11388
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        481⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11452
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        482⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:11564
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        484⤵
        Drops file in System32 directory
        
        PID:11636
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11692
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11732
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        487⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        488⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        489⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12000
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        491⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        492⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        493⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        494⤵
        Modifies registry class
        
        PID:12228
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        495⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12272 -s 408
        496⤵
        Program crash
        
        PID:11568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 12272 -ip 12272
1⤵
PID:11380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaenbd32.exe

Filesize
163KB

MD5
6274e685e6b6ca6a5174b14d71692123

SHA1
655eca76e30ad906ae0bd6d83d81dcac28809446

SHA256
8d94c2984a141a913c53404d28b5993cbc9a6629023faf5bd05d57f4b91ce4ee

SHA512
3b54f0cf894cb921eb5478d641ef3943dc6962f69ab211c0d6ad34146040b2a042522f28d9ecc9e4e8c9c783d4581f1fde47c835b0f6105e77aedc3d1aa142c8

Download Submit
C:\Windows\SysWOW64\Aakebqbj.exe

Filesize
163KB

MD5
b01239d099b4248ddc5cc23dc65c9e18

SHA1
8b12572faddeff080d8bc8a16503a5576216e703

SHA256
d638fec3afa35f34969bf4851ee179dd8f218144bd1358909e8de1685541ce87

SHA512
1671af4e6d6338068d86174607bba10351bd2abdcdffa6ab57f173a0ae0ac48e62803de209f6c409f003323ecb81be06a5b9b9aca2e4b20db0b4b76b33f4782e

Download Submit
C:\Windows\SysWOW64\Aanbhp32.exe

Filesize
163KB

MD5
9046f75b9a147b4be4fb72c145c5fbe1

SHA1
8e6d25d62d8181bf7b087688eb042086acefee78

SHA256
adfd68e58ef475319704f381f5b1d34954d942442167947978e69ec2a88ab285

SHA512
7e1856cc40acac8ac3b661d686b31f6c228d1b1eaf1907f560e14c9667f3f69d46a618e78b3f6da1da891ddbbcc57a74132946a0b764c0a5a6bed849890a6065

Download Submit
C:\Windows\SysWOW64\Abponp32.exe

Filesize
163KB

MD5
b6f595cf999c904da823a9e033498b1d

SHA1
0ac4714f57b4ac553e7787d7f697e46fc0c90862

SHA256
fbbc384d248efd1f4b598ade90729fdc4cc6e3cf1e2682700316e204cb2e9dc6

SHA512
2501172437efe1864c9479e63a1ea7f794b9c9dc6fc22105c7821615aade17b19c864ba6de1662ebe3b9a41246f6859c4df654ebd495f6f590473fb088512de7

Download Submit
C:\Windows\SysWOW64\Acfhad32.exe

Filesize
163KB

MD5
615ba2d0875737d970539ad9422c888b

SHA1
846298b3d55a03eb28f82c77c1a5def436375505

SHA256
07fa7ce5217434ef57653df707d941f0f57d7dc555884d26d9c4444bb6a27594

SHA512
33d56957dcfc648788370597ffa74dba5d400f4e269972909b7b537af23f82456b07a38ed2a144e131f8bad7808468874ed4449271f74652c23cc544e1d68756

Download Submit
C:\Windows\SysWOW64\Achegd32.exe

Filesize
163KB

MD5
f1ab55fe8c814f1d1e1669b9b1734aa9

SHA1
e8045fa2c1c943d668d6c7d60c737c059887878f

SHA256
3ea32e8fc7207552c72b48b5fd751fb9c1ef29fbb2938915e7ce7cd6dc87b678

SHA512
4f4362495c5aee6c108068225690d8483e18abe7aa2475d859eb28a2a75c40b58440e99fbf54f928ccc5505a6b3527a56617302901b0c5ac6e85ff86e3901cbb

Download Submit
C:\Windows\SysWOW64\Aeddnp32.exe

Filesize
163KB

MD5
5318100f6c52a1ff2efbf747da9f93ba

SHA1
32cdccfc455a659c6d3c3def8b438bf371cc9bb8

SHA256
ee0d248c7c6e21bfc6ba0001ab1f9b3201de787be373aa80d2b3a6c439234de2

SHA512
9e5c599cb4ba22d0318b340d17c67804bb432cb69310bb36193098e1e0e2cde5f822261577e6cd6556aeed2aa1a8072405b69521f213d711bc68a2434922c9d8

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
163KB

MD5
72e3752b322be3167ec4df48675c19d2

SHA1
53d0ce992399873bfd0ffd563904366032404779

SHA256
adeed33842a98a300a8a25ddb56f742c303f36f61a298e7ca2e9c5a106a294cc

SHA512
adddca73bf7cb1fe9ffa10a6dcff36b35222e8ac43a71a7b2b259216f7739990803db6c2ed8fe5cbf74b18f092008ae27e4fcb04c54285c9b23a11431f7e93f2

Download Submit
C:\Windows\SysWOW64\Ahenokjf.exe

Filesize
163KB

MD5
9934c6fd1aa2a0401e1980bd2b5943c3

SHA1
cdbe961e5c3080133908c1a24515b89760498099

SHA256
8cd97af5139608e4b04ca16553b455517626dcb1e48be95c3c5e3cf3c5080804

SHA512
3707aa9473033ae2888c6c792ea5e2931146afe1f4e3a42b519e8abdaf6fc2c3f02dcebec6603e1573b2c108ee795995c33aa9bf851de956b22a956441efb546

Download Submit
C:\Windows\SysWOW64\Ajdjin32.exe

Filesize
163KB

MD5
94861513a8ee023f16bda8e929364a20

SHA1
75c3068fc5acd382cc4c19a38f64b12931e3f9b2

SHA256
f0883c2e18d6e63b2357b1b6a17478332a9528c5026b365befd52bdef0a0f8d0

SHA512
0f8eae3eec3f0f24853467b96737afe5bce48775e2ff6b45fabb5d4f998a702e82a428f971366dc367401d078cab568d72332f3a826b0d710539746660f64e87

Download Submit
C:\Windows\SysWOW64\Ajndioga.exe

Filesize
163KB

MD5
24a700ef60cbd5a7d301f198ade3d003

SHA1
56ff75921450a0f3231303c07851d99417c23e6f

SHA256
77d9df79e6485d5b3e34098263395db4d383591f03855a11abc971fc14d78aa8

SHA512
1291a8cefb5435e4b6ae51c43c567a8bfe538c4f6088b47a1d50ea0b31744515c83f8335135c222f88f60329a011d6303d5c1c1209de851fa59b2893c3d4d46d

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
163KB

MD5
f39192d3addfc93448156c2d40a144fb

SHA1
2c5317665f4d3a50cd53fc5fa89f19363b8204e1

SHA256
bf13a23aee0549b66a77a90ae9e89e60239a8807646dd3f8d91a4e57ff1b9fee

SHA512
56042e8de48d6b40d7afcd8998962852e67b146307b5bbec15f4e082ebf4335b5703c3f56fb5d265732fdba94e52224c36986485575dd9f6d9c0c3167a6b668a

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
163KB

MD5
90d071c2a10ae6ebc9c4676e0ec53e99

SHA1
5bc0ab5f0abb7a57e0db21d1917b5d3a8c924c3b

SHA256
d1f45963b68aa1e5e40bb8193ae6a4565328ec22632c4949d530ee38b7ad6ce7

SHA512
437fe425abcd0e7527a5e9b4881eb8f1fb1b132f43e617d3d17ba3e4377e9fdd64343e25dc6f3e1b9f8d56fe595af338781d4efaaa47e098adb52a98f12d6ac6

Download Submit
C:\Windows\SysWOW64\Alqjpi32.exe

Filesize
163KB

MD5
4f9e435e921399b6535bb8a40aaace32

SHA1
f2bf28cfa36a0a570098bbb6dc90efebbcb6d58e

SHA256
d86e653e0670abb9310d2b04d190203bb36044124a94a93ba7c7a0877d386acc

SHA512
ba8e500bda690fb58888a0ef789f2e00e4d265ea395b98560d37527c2c1abe9a8f7c5aa2a2dcf177b8e32defbc7afe87a97f0574aded4a76c0080c34c3bb9df8

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
163KB

MD5
6ef32315c12ef6331eadbbe19086b0d9

SHA1
006acc7db3d3766ec00fab3a54fff38f2d3bf097

SHA256
65ccfafc1798818b2f4355204d5183b7ce8e058cd2bce98457e9b595857e97d7

SHA512
941d938273a90baa5393b908d4f16f5ff7dca382d915e37076c9b7e0a43f7ab8db79778e7d8e56fe641a042e1d3de08df6c9eee94a9c39cc907002edd532a628

Download Submit
C:\Windows\SysWOW64\Aoabad32.exe

Filesize
163KB

MD5
1bc1894f7e4c456a560dffcb37894834

SHA1
9310753b5b0078a22f511f793cc37bfda0d14647

SHA256
dd5ee5c7c3bc0b68be5606a4e6bc4b1f10fd7254175833e569e231a421c85bed

SHA512
cb50fc396c0165150175b7d843f697a041e6b14a7b0f34b3d5e8e10c254f6273e46d88d3741d6ccca90a804fda76a70d3a5c3f03c248341011df7478634cb548

Download Submit
C:\Windows\SysWOW64\Aoofle32.exe

Filesize
163KB

MD5
02d459326b148b65b44fc8ba12a22f04

SHA1
b4630f34aa70ed8fa9a57e51036c90f7e4e69e27

SHA256
9501b5ab94c76552da126f76277228cf2d5ffa141bd37b9384dec21bca2ea6e3

SHA512
4de1d2b77135b3612e8bb51185699c5db590c6b233e46c72906719819b13f2db733854f34080df39d69c37425f6c2bf6ed508083598fc8043181936fbd2988ad

Download Submit
C:\Windows\SysWOW64\Bknlbhhe.exe

Filesize
163KB

MD5
06fd86ee884fb7ec368551ac777939bb

SHA1
630ad039e96f5a8dee5749a19d07a8e1cbba673f

SHA256
aeb39cf46970449881bce413a739851d5aa4b91c1f1821a946eb706edcc6e922

SHA512
da8bd05a3e15078e3d8ff688ea9f4f5fd07b32599463303e02b367b874b9ea3a103440c998a455a14d4eff8ff6e200cff62e55ad6b2a9affd97607768a8de392

Download Submit
C:\Windows\SysWOW64\Bmeandma.exe

Filesize
163KB

MD5
e7f5d0f097a0902251229f9792f668ef

SHA1
b30a08886b25b52779bc4c9d4f4f09df95962d5f

SHA256
6d30a587fc366075296b57621d8cc4c4f03034c53c5a68ba2993dfbd9d3c2e62

SHA512
9b54a67e5c3ef661dfa8501e1fa1a0d469820d07b91d08c8e9853c4455900b156b726daf67339293843a5c6fa4245b4211faef99c87365715e4b720bcd900f92

Download Submit
C:\Windows\SysWOW64\Cacckp32.exe

Filesize
163KB

MD5
2975a0de873eb913a45bf225074adef0

SHA1
a4212d4c80a5c381126c12b77ef6969bc6265477

SHA256
cb922e8aac6a810c767d9a88f58aa9c0cb82cb6c29cc23f244d9ffa612d45ecc

SHA512
5ee20b32542936d49f439a2e3b1e56111d3b32013eda2148c9bac2ffac7dfb989f117076cd66eebd46af9aaf937c0a45609edf56ea22a25f5e177ad98ff6fae9

Download Submit
C:\Windows\SysWOW64\Caojpaij.exe

Filesize
163KB

MD5
f81a5b625b3f265d72b62332e93bb8be

SHA1
21c76acf82aac59bbbb5c558b27569661dabfc96

SHA256
0a0105aea2cb3168280ef90650e1a75aa5b1d528a7d0aa1280a6609619085e3b

SHA512
752ba3e6c72efbb16195bb8177e1c61e600bdc463882caf6ab4196ccd04bcd3c8647371be094d42abf1dbe27cfb93f5e071b43d418ba4d8d645fd48bb5d8b67b

Download Submit
C:\Windows\SysWOW64\Cdecgbfa.exe

Filesize
163KB

MD5
59ddbe73a7e06c92091dc4adb7500dab

SHA1
5989a9546fef20c8eb6bc3fc62320f327aa94a5d

SHA256
6b27233e9782e46216eb9aeb18bc553fd8e3ca09064714c359176ffe8ed801d3

SHA512
115b3a3f9d8d5a1d1a1681bbf18e626883e424cc3bcaed755ebf05cf9e778b07d6a6616b8d3d61d6dc1cea8c4900805555f822c638411630fa90202f1bc86c8d

Download Submit
C:\Windows\SysWOW64\Cfkmkf32.exe

Filesize
163KB

MD5
46af96a2dffc1d824f6e36a1a4a23463

SHA1
752820cc076c392de066390a1aefe93e07f534a1

SHA256
c78a02e7444a5a11d46c9044f977c8d5ed19a6b994064c66974782a9f514e2bb

SHA512
88987c6d0e3c03cf9c37b8f4d74330a04e9a982e56eb522c93f2fc2b0fd6a2a165000f39cd598f0f6045510d24ddb7638c422fef631a65ffbd005cfe3d9fdb16

Download Submit
C:\Windows\SysWOW64\Conanfli.exe

Filesize
163KB

MD5
c4b67d7475a56232c8081dba705cdfcb

SHA1
3486710759ec50f062d7aeac895251f29e9b32a8

SHA256
0e9d27ade973125899f7be0b5b1189d88de9b2981dc351fd035f46f7031c6084

SHA512
780d8888a734b403d08b14c4f46f2037ca9dc87ccb49f98763e45257a1c70e694a544d48784f590fd9d3a19b4c605749b87ae78ca101471213f9e166020e0f33

Download Submit
C:\Windows\SysWOW64\Coohhlpe.exe

Filesize
163KB

MD5
6c795153555cbeb344d77bec658b8c30

SHA1
9013b415f97d9204776a0ba9678befb369db5f3e

SHA256
3483fdd0864ef08f98f8601f25ca5dddc9920ebe0ce944f2e5df2ee8aff71da2

SHA512
0122d242bd22c3ca8d302eb2cb31cfe2b18904f06a27bccd1433b740f7cc8cf13be13403a56138beb66b396d3330f11b3ec1511288ad3a285d167d4f06ce32bf

Download Submit
C:\Windows\SysWOW64\Dijbno32.exe

Filesize
163KB

MD5
52176868447323cf5882c16788a44442

SHA1
ba50c869678636f394406b80a66264b204da64bd

SHA256
dfbef37dda791e190d0590ab1e588b4c04af224d664fbcd1b0dfc9769358ca3e

SHA512
9c7c98fb08367cf3b92c0917438d55a3e32872b3c6e7c0fa098ef6090621b7bd0994e651ce4497e3ee183cb1475d2bed249fdfcba4905d1c0cf96c2fe3d1233c

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
163KB

MD5
cc8785ab6bb3e4d6f5f42144f2f1f76f

SHA1
b9ec50929f5398137d36608d70a06ab6c31aaa7e

SHA256
5cfbda8f4fa57285c630a2df6a1e22bee29e5e40409c7ab8a71cc3d3f23b5a70

SHA512
f5d186dcb18807f33651b7879cbf3bbd82f0de980be85b13353661fefb0212f23a2c1e9a161384e89fd74790a46536ee59061b91d38fe416c8a47f85726c6218

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
163KB

MD5
dd76d04307fd454314bddd5f6423b398

SHA1
bde602354f206ba70dc952398bcce4fecab3d35b

SHA256
c05aa73c5425ca2a6ae0a6fee0adf7caed516ecc04b01aa1a2a109f6bf17ba9f

SHA512
a51983b23439af702a16acb6a549d7c8b9497e03f29d9321d017412cc37c7025de7f3ab1ba6b0127a77b1db27d47930fb832662dcb6cc6e95354a3737515c7e8

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
128KB

MD5
14bdf3fbb84b63725acaa15e1640cd4f

SHA1
6478f2d040006e242771808b1016f5a892461d5f

SHA256
dd92cbcfa436203a387629d3cef6a8a143efc2914c2e2dafa9e6896dae19360e

SHA512
734491b95511d5450b873c8af969dfc7d0881ef413e3b94000a6ca1d3d7196f4eed29b1419ad4d4cf0f4eba76c8ab3f280c98bad25918a922c65e8c8ffb72f20

Download Submit
C:\Windows\SysWOW64\Fechomko.exe

Filesize
163KB

MD5
6be52e00ddb6771f20255a42f6e4da0d

SHA1
2418a031b3b05d03a622cf7a0b25b3938f711cbd

SHA256
64be0e6b92ff2aee52d1a502ebcbd7650691ad6fc980cba82ea1f09c7253e137

SHA512
b89408351fe11d907b0c4b54fbe804240a72067998dcfdb11d060c9c7de11d9d5ced14ddfed05d776fe0041159ed15d4127199d5fc5de708daa39fb903a6be0b

Download Submit
C:\Windows\SysWOW64\Fiaael32.exe

Filesize
163KB

MD5
adbc4d453b0c96b19da40d4e18e715c1

SHA1
32a8afa5393e67218366ad26f571c9cfad7d12f6

SHA256
305a76d5eb2bdb4c42127ae5b042c6a9110af2c4413954da37fbb6060b97c317

SHA512
1ba69689b402029f5ca25b719dfd62348d3bde56bbfeb123aec977a172460a50d3dd232f724bd31ad8581001568fd7235c5d0f2ab6e2117dd744b42c26c278d7

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
163KB

MD5
711b7a17c9067fbfbc804248b2d243c3

SHA1
d022b61af66700afe16a644f218dbbd1c68f731d

SHA256
64c29917b1c80cee51a84baf1769aa9858b7b314ad35206afd03f44da93011cd

SHA512
fbd01779df40d862fdedd3de262215689860f14f0b64b9181c3b02d4e61fc5dadf593ea1a33d43b821b01f1c00b284edaa74f2e87620a65b941337063f65d617

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
163KB

MD5
446db6d88aaed21188988b4d8c7692b8

SHA1
9fd1c4ea04a69364a465cb42af8d5441fb790846

SHA256
ca823848ef623b1c505d2d2ae5d2945650b90a10d34d297abe1a51941cf6bf36

SHA512
d5371ade96b2d37befa48d69470eed6b522bb265545563080a586539e96a9901c89ef7565f7f6d5747b2b6060d0fb37d01b1ecaeb865597053659b6ca156c947

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
163KB

MD5
5b93dacff494a39dac140ba35bc75163

SHA1
25e365e05d5fc0c67022cda24c01ce990614a121

SHA256
f8acca8942113d17454e19af8ff34efe497fe619d80e81ef66571ef3b9733718

SHA512
2d605c61a0c38be1894947af823a1c675bf87dc9a2d424252c007fba524ad12d1d466b08e1c1b7515bbef2de6eac469d02a52cbbf111b45f215d5a06e7f74368

Download Submit
C:\Windows\SysWOW64\Hfjdqmng.exe

Filesize
163KB

MD5
b9c110b62e8d97f5c82249ccadd584f2

SHA1
6136e0d51cb77181239865a35e62e306d5229586

SHA256
af434fbf206fbdad4d61e7d577f6f36f5eaa762c1416c0c9dd0475dbe8e0a223

SHA512
7d71004bc9fa6fded3fccc377e5bf870892d28527f44f95ae64960edda7dcd6be59a46198d881c5c1fd5b1ee1c5f1add22550e6751c9e65997e65bf243efcd54

Download Submit
C:\Windows\SysWOW64\Hibjli32.exe

Filesize
163KB

MD5
67ae3c8dcaf1f91228fad23fbd9e78db

SHA1
5fc6f8f9c378ebfacc05da295a9d5ac25ed03929

SHA256
b7f1efc772f3a7f99e33af4f511ad061dfadc20dcc3f0ef0f5679429d87bfd0b

SHA512
5d026100963ffb69b73605b1f6c51d34b09b1cd11a4570baea655871a80c16fc34de694ee7bc1e25b52cd36080dc2aac32feca9c845f11fcf912ba76d7238dbe

Download Submit
C:\Windows\SysWOW64\Hifcgion.exe

Filesize
163KB

MD5
63a40c3c80b1cbd172b031c230d69273

SHA1
476cde2e725cd566938e2d91f8607f31f8989ae8

SHA256
522cdc791606cbdff1dc5d0d482846edb0829fb4f44b7a5cbbcde77009c0d5b8

SHA512
5ddb9660602258907cb599ef3ac62405dd00755fd5eb6c1e64875520d3ed5d85d405317ada566e516fb8ae3d799475ed75d8780fc66e32dc3e0a514778b7eaa9

Download Submit
C:\Windows\SysWOW64\Hlegnjbm.exe

Filesize
163KB

MD5
af0f1fc0496975d7fea5e4e90a431b2d

SHA1
b25bf8adf10d5ac6e7837f680b426259e7c483ee

SHA256
a168e95a8f2476283a860728f76ca8a227f16c1d3a433daf612b74cd11908413

SHA512
7bef25dbb4348973070a551b4929bcc3d11e45c5134b8d8b8bde9c1e0d15bac591b009294b83d794695f0fbb499312b1d9efe084c6bd7b62d1dd665c2dca8411

Download Submit
C:\Windows\SysWOW64\Icknfcol.exe

Filesize
163KB

MD5
9b5475f0427bf9428b3240d9b83ee0c4

SHA1
b18dcc8ebda8f1aaeb8ec521c956a8205fb7849c

SHA256
aa4a9f26bca15b5c4cade1cb0c2114fe5bb8baa4c80a40ee9993cf09bfff47dc

SHA512
4a37d8cb85dde4b01cd00bc77eb5bc408a18d7454e8a5751c129e1a889d4e7c1008655a5425587443436ea7169276f3d9b9a0873fb5cca4963f31fd829d74de8

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
163KB

MD5
53e82ddf1f5051aef848a4302e240cb3

SHA1
6fa82616e9f0c1132bf92a95f416b23d4ee606ad

SHA256
badc223a7e03642d49df3cf2b0c65e14f3d8439af9b79ba6fab180f2f6d16be7

SHA512
5f342752643dfa1804abb802cb52aaf2f11668e2019db5a1a93fe462f5cceea074a16db6c5c2d7b9395e74f59b36f82ddc934280b875bd65e6902aa58e187f59

Download Submit
C:\Windows\SysWOW64\Ilqoobdd.exe

Filesize
163KB

MD5
bed4025eb2a2b90f4aaa8d7fd06ad4b3

SHA1
d86211d9bad2e5daaac5284bda2ad4a63afbb065

SHA256
19089f16beaed0155c4abb29fbe4a3d0d64755400682ab596368961f277fa59c

SHA512
d1dcf344b9eb85f4029a93715fb971b56021af460bce04a94bcc2ea1e51f7c23ca65765c5807783b32f1663e32d753e1485701079c3caef66427b1423284b4a9

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
163KB

MD5
10c884671da52678448d483ef45e2352

SHA1
b05b581a84903ac3eb230444ce995fb05a3bc119

SHA256
26753381700e687b64a21fca147f5058f6e0aae9998a4513d6a3db25b30b6119

SHA512
a2023b687f78f30ed610a64a27409cad53ad7d35c6879825b54670416bd69ad907efcfb4a9b9b06ccc29e2e69d0a427dc8003a5dac60da5363459d8b1da8e8b0

Download Submit
C:\Windows\SysWOW64\Ipeeobbe.exe

Filesize
163KB

MD5
668ed5f677ac399cb582a4869e463d56

SHA1
ab0829ae6ea64964d155c6da21a2a84df2bd98c8

SHA256
898ea50d2c79d56fe3b0823276fb8c62c391b32d4d682d5488ba8588a9a51dd4

SHA512
777e9b19e8ca0d00c57c49413a1cc03867c5bd05c2daaf8cd287fa3ae4ddabc9a876b38f0a37ebdbf41478f6e7f5bd7b2500a96b949ab9bcf1fd388f9fb251ae

Download Submit
C:\Windows\SysWOW64\Ipoheakj.exe

Filesize
163KB

MD5
32cd65821ffe442c0563b66a7ce3474e

SHA1
92c399b83c91c4fb7f532923f66194546b122052

SHA256
f5907b0a781226a53656f32dcc936ac683e02e9b480671fec0700632eaa4581c

SHA512
6b3622fb119f0d0d3fd297fcfba6c13eb5ada3f005dc49edbbd3a060328eb61c1acdb2fd30d1e4632df5e5b1ad71c0e07d11a0781362d53b8f55e43e619f3092

Download Submit
C:\Windows\SysWOW64\Jenmcggo.exe

Filesize
163KB

MD5
386890ca7bc1a8cb678b4d6483ab8bb8

SHA1
27bef8d02410a0550201cff16a64236c8e678fbd

SHA256
1a8c89308e277a1b48917c20dfca10893b6e89af527cdefc4b7b71f8f3440841

SHA512
d7aca1dccb4c6acfc4b188f9a21f2c27b39b45ed53f3cf098801e07b096a2d052ea45c7c9b7ebad493e4d50b9ccaac051f44e3aeeb4b4fbb121a95826b347514

Download Submit
C:\Windows\SysWOW64\Jjoiil32.exe

Filesize
163KB

MD5
4a2d92747082e3f039e4b27e7374dbe7

SHA1
035729466626fab482702f21334ac891538dc475

SHA256
e2cc2b99ff293d4218c9639f642b258c5c295f4f6dce8a79bf3fb8bc9dbf4b01

SHA512
c8150a226a2789b086ee30088782f87d2f898de5036ec317c338e9b046e16063e827c5aa66ccef39c0dc1937e1bf322938c75cb8d7249b9d36902b9a622b322f

Download Submit
C:\Windows\SysWOW64\Jknfcofa.exe

Filesize
163KB

MD5
3bc69edc08d3228ebb0a6829c1ba4ff5

SHA1
477bf767f2509bb1dc071473d0edd08232305403

SHA256
8a6c800fc382670605f339c41514eba34b994ad65a79337cbf281b013bf307f3

SHA512
fe64369a5d5c4789c6f62136c08e118d5619ca845d4b66056a9d854f3ab4191fa5668cc42e992ed4932c3d1277fac304a15a598f191d7fef73009c48735fc73a

Download Submit
C:\Windows\SysWOW64\Jnlkedai.exe

Filesize
163KB

MD5
ebdbcc4cfdbcd950233cbfda0b81b051

SHA1
b5081059ae5f1788ea12b18c71807b02993caa66

SHA256
32fc135dc14d10e0e17e048f51d7ff309ae222ce7e39dca5f9dbc0c56187ac73

SHA512
450c73b82c313b21a485d3a79646a0c55c5bc36aa2cbadd291b9737519e195faaa29643bc72f14dc371624e78ceeba0fb5248981b730fb30ec0ed8877542cd36

Download Submit
C:\Windows\SysWOW64\Jpdhkf32.exe

Filesize
163KB

MD5
66ce4be89fe869a6e70de85e853f1673

SHA1
8209245a2f1b3e7a13a940fc19da24d1b4c09f21

SHA256
0cd0fb0824e4039517dd6d9ad89f959516b288fc0f414dbbbcf1575cee3928db

SHA512
643b99badfdf4aac1629280752cea9ab8acb208253ec0c0e2bcaa85f4bb35e6ff885f38ee6ddbca67dff6f470c6840343715ae1ec1dca22174babd01fcc32d24

Download Submit
C:\Windows\SysWOW64\Kdigadjo.exe

Filesize
163KB

MD5
4a5de08aef39804ff2c0acb3d03ea968

SHA1
34568485ebda29075d0ded20b0540db8a2db24f3

SHA256
80fe1438e070913c9a8f640035f4195ae9e049848d69e56870803587700fe849

SHA512
39ba0b25adcc0c59edadd58d5778652aaf95974f05d8b4641c0a1f30bb6fac5d94cc786cbd845313cf8bee04f7b4e46174b59e50864b0337643571a6576e182c

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
163KB

MD5
96b7bc35a2a78f32de9c758a2f187227

SHA1
05a2e7def3be00d001724c16121fe7ad7b3d1d91

SHA256
845dfcab7a0773ddf85a1ad2c2675f36de65b6ce0bedebc779e98488ddcd2f10

SHA512
5a11941ea8f8eb3856582b702dadbb2f51c0e4658330a9cc1f1adb6fefbcdc789237063e1fc7b6f058d21576eadd40cb3152254dd6fe3daea0fb4e61214a863d

Download Submit
C:\Windows\SysWOW64\Kgninn32.exe

Filesize
163KB

MD5
c47374a2a503c18b97a30e2c99f5211f

SHA1
205973ab34412796c0d71cb17e418b9196914d6a

SHA256
de1d4be8c4bf989c6ec4368a71289589a31cc8887cde659fc7d1b639e419f4a5

SHA512
90ed882fd26e44d58bc895c628639f7e81948bba0204e0845b0c818318276422a78d28028776dfee4a5e46aab8e2466e08b7f0373debb62ab1cfa51349fb2726

Download Submit
C:\Windows\SysWOW64\Kjblje32.exe

Filesize
163KB

MD5
bf62b55cb47ff007c78ca4d22845b578

SHA1
4060c2903a5d4fbfc314c7122d8d7b7783d250ca

SHA256
1205a80c1020e912a6c5b0983780771b85b8a43567236f6d6908cdd84a89763a

SHA512
ee7ad5240bd330beeca632c01b767e007ea65459b1f14952aee62751cb2dfcc6d2f59cdd4d46846f878ea1fd467d366e57a34f9c235839c94fd4491706217512

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
163KB

MD5
f454855cc3f5db6d5e3318a9756729e5

SHA1
19c478a4b57e50220d3c8fa726bcef2eed38aa3a

SHA256
0360fb90ed4a6b6915c5da207b5bca08c6ccdf58623db7f0d31df23cc3202135

SHA512
059b6bd45313dfede73f147e7f14f3c3123bdd0b28950e19f488448ae52105934d71fac939efbba7aeab45c8cc146f66a1ae8585583dbe964a23467d26cbe5ff

Download Submit
C:\Windows\SysWOW64\Ldipha32.exe

Filesize
163KB

MD5
6361cfc3daa735894ec25f795ee79bf8

SHA1
adcb93967114a0ca7ec729a381f33d2e5447ff52

SHA256
f5b2f85a49b3d53afbc852ac87f98c8b16b4c3644ee194670d1a758aa327dcba

SHA512
4f927adc8632f5887b30d9405ac8fc8da1cc76448c48d6cdecc1d98c093a1574edef5a0df9a80c0798e9ea79bb81331cfdaa4e26407b0feebd135196ea97c237

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
163KB

MD5
5a8b6a77ad2df7865ac1bbaa20fda870

SHA1
08f28f9ec7a802b740e1c01e334eba4e3cc40937

SHA256
8b7c7b416f2990d54f9e62b9bfb805dfc0ca8740a9d2af46f66e00ab78df41a8

SHA512
c7b172a2afc0a7769f418e42677fbc12581e08171543d74502f3871d65fb024d3d704cfadd486f8eb31bc4de05d7efb187121853ede93765f853c369c7ded4b8

Download Submit
C:\Windows\SysWOW64\Loighj32.exe

Filesize
163KB

MD5
5e40ad0328c0818486557a762e8ffb2f

SHA1
368bdc17752dda4edd3602cff31c7b8a862a7740

SHA256
a9f3b7b168bba337775e9092a363f6178134a933ccd02fba1231377b4af07257

SHA512
d4bb2cb75ea96c652703fd115eef31f677cef58f5c549c4477ffbb09fb99740b62e777ad7e8375653f90104c3a2d1c78462d50cc954fb33a1134b3e6eca5917a

Download Submit
C:\Windows\SysWOW64\Lqkgbcff.exe

Filesize
163KB

MD5
eddd3be6fcdac88e2e345ac2bbcec476

SHA1
951278308cbbc8defba17bacfaac3109a39c48a5

SHA256
ee48cc19232f527f2a6255ac0a8972e35729358c9a00bf2c4990f987b6e79c1f

SHA512
76324366e1b18a390afe62b20f7d7f5e084e0604a2da8a81fdb3dabc2c6750f50e8ac450ba797749fd494c19b72deab886a2978511435f22f8c0ccc18750416d

Download Submit
C:\Windows\SysWOW64\Mmkdcm32.exe

Filesize
163KB

MD5
0582cbc3a73107d43fd9661ac1cf5771

SHA1
f4da250aa4892937bd84592bc437fbd00b657599

SHA256
13ccf4f578adab8062495485946f6c2704a0104751891bd81741f4986d8281f3

SHA512
77206e78f85904a10b4efb0534d47be920af7ccb6d1a076ed5175f74a5c04b6b43a9e198efb1ddfd8c8b15c4e88d8ca3bd7cc87d1f0d3906820e8e0905b50c29

Download Submit
C:\Windows\SysWOW64\Ncchae32.exe

Filesize
163KB

MD5
c6ae83a1da0793a69a6892e3252c5990

SHA1
154e3c256ef97bac3b2c9a6df2877b3a91783eae

SHA256
44a56fb6efd6a0cc6b19438f6d940f5373cfc4e45945bc0957bcc93deb2c36c0

SHA512
8fc924ae17e428258b412e0a11c0a0d92aa7ea1ded7b57f62f6d48985b636276d2fdb83ec7fb007be0e11b911d9b744c51b6cb3e075f5528b2ccb8dc10e79bf6

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
163KB

MD5
b26de6ef18b873b41bb875fad9774b9b

SHA1
e892cc1ea8ff7f0060b9483e45e0d72d126b3b91

SHA256
4f7df971bf4cd4181adad47a3dbf1b157231b3f2742a2d8ba02cf2c097358973

SHA512
f8d9e55e043f551e818411a7233ae0d17a97a775178c712c0bd41f9a90ba782848c9ff3e77023d37ce31167cfb6a926823ef7153ada4ebcfbbd73716b9716565

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
163KB

MD5
5b5281ffbcda68a21be032e075d20a87

SHA1
1566a1745a7f87f0a131f52d7cf9cb1e16678a03

SHA256
4b3e34d03b52455dcede29600481aabf6478a88ca4343e84ce6838ce39dea063

SHA512
343691a175fa7d723808846f79a00e9e3a3fadd2e5e99cff8ed7eba1e723fbcc99770e12ab8e930a89ecb77c49fd5a7e821f5f66452a02a86c7ec788d9616cb1

Download Submit
C:\Windows\SysWOW64\Oelolmnd.exe

Filesize
163KB

MD5
347d80ba905cde82c34b8de226799872

SHA1
bc191efed0c949fec2c7ade3703048e34afa6a03

SHA256
d3b740edd88e9260c1c4a3a27db79bc23d5013814a7987573bdfe3c2b437e597

SHA512
d87cfae00f7ac12fed45123b00598e9ff8317f193bf7d41849ce858dd7be1e00bd6b5859608eca5e3a454c22859b9df93c3168d7b530d863eecf2a4a8250dcfe

Download Submit
C:\Windows\SysWOW64\Oeoblb32.exe

Filesize
163KB

MD5
c8974330a38450101c0ce404901526e6

SHA1
ace0168b041774c413f7d161fc5db8d467971150

SHA256
fafc16864ab2b1ac8b52ac57a095c4558cf1e15fd48937e9348229b6cfcbcb06

SHA512
fb5c832e2f4efe7faca94966360500477214f7ce5dcc8e57929be7117a832e4bfce01a2f720a533317a898215be2aae2bba39a073d0ac9e8772b35cf4876530b

Download Submit
C:\Windows\SysWOW64\Ohmhmh32.exe

Filesize
163KB

MD5
442b1356c5a3fbeaf64d43dd1200cd6c

SHA1
16411e1cf0a7fec82a6ba345e16e60041ce9e058

SHA256
7003e6c80ebfe567422ce3a602f5e84f7a5f941ba9ccad384912699cb65cb207

SHA512
6887724ee09957e81c68ac698f15d577bf6224b681c09521493a4dbb2c8feb094b5769f40ac18872543ec0729a3d1aa8e436d74ec18204f3416281fc6a94056f

Download Submit
C:\Windows\SysWOW64\Oimkbaed.exe

Filesize
163KB

MD5
763a9c777ca85fe1502090160fb3c0fa

SHA1
2604a2906a6152fa4a3bdf0498d8e744c1612a72

SHA256
3d10d0d49197ced8ff7e375e8f952c282d77b3f14adbc868c1ee760ff9167019

SHA512
255f344f37ffe30f3215937db4eb166e51cf6817d73dfb5b55e56471bf12a41683872f59e9782d7d4dfeb17d5e564e4377e8da97098037706f0ac2767bf5a66f

Download Submit
C:\Windows\SysWOW64\Ojigdcll.exe

Filesize
163KB

MD5
bc4a41b2ec4e5d0811751f645c0d4556

SHA1
d971ab693329b0da3cdca1150c78a02ee43d5a74

SHA256
a3866fa38fb05e9e616d3d9f81af7c0c276418834ec79fdc2f606d17fe967d8d

SHA512
b032302199004886db2bb3a5d3d4945f02b37bb7283ea70e5870f150bcb5e07c23315d2712808ca2f987db4733fec5cafeb8437f4e26a5e2c4c5a1e20ff6ab2e

Download Submit
C:\Windows\SysWOW64\Olijhmgj.exe

Filesize
163KB

MD5
d83b40003ffacba0fa058e40775beb47

SHA1
3197a5a49b10d1912b2970a71ffbe55d9ebf6273

SHA256
977c3616cc25f28fbdfe6b343e2dbdb381bdb1bba14ef7fef2a3bb224a7177a4

SHA512
cc30a9116afd9df9fa76c5102361f7474e065cf624b48c3f0ba622d2548924dd3b99a9b7fdb81db9dd49bcf32075288065c3fdbd12cb130cfe19ed3a082047c5

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
163KB

MD5
e813fb86f459f61d3d6dc2990e55038a

SHA1
3ccb3122f2799b3e869492c01e74f62baddd1abe

SHA256
f57b16f0542ddf563d4b017b34c3ac7e9943d1b774fa78d13e138f39352ba9d0

SHA512
685d17af2db33013e9a9fc6ca11386276054890a78da03e96752a9296c7d188829e91a41968976c38f3c44b1b1936ed65ee3988ae4402bbc9c8edae4714091e3

Download Submit
C:\Windows\SysWOW64\Pabblb32.exe

Filesize
163KB

MD5
dd5b215bf2967a95e9975c23d993a7c7

SHA1
e572946bc78e4b1ee2f9d6224cc62cc7638e8c6e

SHA256
c398fa597b83e2eaef0915a3e91604c3d89dfac9653d570ea694e5fff4224505

SHA512
7196886a7bd9cb374457a1aa3be48c16777590e2048da234ea3189e1892d14ac7620d616eaa5daef6f4004ecea48e5c73067b90e416b9ed5e0bfcfb09d8df7d1

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
163KB

MD5
6a5d9a68696efd8e4900cfb69a3710d8

SHA1
f2c5681e3ccb22ffcf04862a61f96173fa0f2abc

SHA256
0405a833a35eaf29e8cc672ce3493e4ec3e5da0ad2acb41cb3d58a2b922fbf56

SHA512
b485e5cb0295b9c5b19c5a4fd4730915779c952eabdb6191cd52f4da0b5627cc3bedcf704d0538097c54e724a9af81f3bca50a8e89cb8c6b67409cf5ad2af1cb

Download Submit
C:\Windows\SysWOW64\Papfgbmg.exe

Filesize
163KB

MD5
7183e3437a3c5b427c25eb57f8cea237

SHA1
40662907d49b02eaab416cf802d5b2c9c1b99f7c

SHA256
38867c9f651529b3598a99c6f1b9ce5184d24d71f3e47bb4f339c3d717018d5f

SHA512
ba3717cbc993761965a311c56c1eceec1a2884518c158873cdfd853e3e40b3c83cf8a5d433ee75d801a4736a805cbd1757506b0c976ccfd8bfa9379976cda635

Download Submit
C:\Windows\SysWOW64\Pchlpfjb.exe

Filesize
163KB

MD5
4440ee62be3d7650d6c77e5445676ac1

SHA1
8d69ec763cd85a96193d0a4c7622461c94ed024b

SHA256
ddb98a1ab25737c06faa69472dd566e7becfd7b6091d4e495a91f15cd9454019

SHA512
cbc0118497e01bebe3634d10557589aa833a117faee13ca184c9d2e9fb440915476a688a8d915b59d94dde1800a0c6c60b32ed5c6f01fc3c60e5cb07f74b88c8

Download Submit
C:\Windows\SysWOW64\Peahgl32.exe

Filesize
163KB

MD5
23c3b6a12d41ba2d58027d01cf9242f7

SHA1
826672a0da5aa61f9578b3e60a09833bca98f36d

SHA256
e713bece11d0ea21b8c5bff1126967dc3f437929caff3ce38aa02bf30f26a4a7

SHA512
05487185f630bdcece6682c931e3d834a963f35b645629e3600ff17199dc3e48484dbd60df97b4f27510cd0d8f6b5096a6d603822ef6b6b59f8430da7d4198f1

Download Submit
C:\Windows\SysWOW64\Peieba32.exe

Filesize
163KB

MD5
9e3f9b6918fac302d329094b78635763

SHA1
2db0549cbb314bcd34620706c6570980b01b72a2

SHA256
22266c2fe4d415505957a80ac571cb634dadae4f263743c499e4a37564083f19

SHA512
898a88d37c71142b39e7fdbeec97f8d5d9a0c8d5d0a6062687d0ddbea385f733d7d153e1379577d1f19acc43f4af6755aa1ddfd00b76d5870192e6fa8dff2aa3

Download Submit
C:\Windows\SysWOW64\Piphgq32.exe

Filesize
163KB

MD5
43c51eff66f65212d171fd68abdbbc33

SHA1
c517ffba73b718afde93c81ee7c1fcacc1ea7b45

SHA256
d7fbd99cfd8cbe8d17a9b3b8c5adee72a9db729b9819894c88a3356d1b49b38b

SHA512
64a038ce0c751b214443c92792bc707e351ef16bebdbd9f3db4814617e3794c18423803ec9b0f66069c20ae00bf0566f58088b04ccfb2eadab99a5be0df05ea5

Download Submit
C:\Windows\SysWOW64\Pkadoiip.exe

Filesize
163KB

MD5
976fcd66312d9e05b45f15daf0777975

SHA1
6b8b93a29dddf58e542a37ba6946900f7388cdd2

SHA256
c362b6dbac350e9aa9df08796a560a7c2ad6a170f355a9492615989fa33d3e5f

SHA512
91121462ebbcbf6678bdafaefa78f4674f489c88d21ef8a4c81c0385ddb2e741ebf1ece5f5f47bea155fb94bafa1837f7cc70956018246ca1fb1d4f25e28a52c

Download Submit
C:\Windows\SysWOW64\Plejdkmm.exe

Filesize
163KB

MD5
85796ff0dfdfbf08f78d948779c6f6f2

SHA1
a2d9c816c99e30143e67fb3a06dd0412a277b511

SHA256
86d5e879aa669930d4bded1ec8b768e586787ce258761b33a27a3a69af45128c

SHA512
e4463c8cadf48a7a8934d499a9ec378719e95d455b59a1762184783eb80989e97c49a31e305e1f7aa99278890399db15ae320dfcc1dfd6f55f4d06e04cdb8eac

Download Submit
C:\Windows\SysWOW64\Plmmif32.exe

Filesize
163KB

MD5
2363c4d021331258a5eaf28b7bd7f843

SHA1
e61df0b295f31652e2b95f5665cf560abdb9c123

SHA256
f00ad2901beb3be1fd360a2d7fd31ef1fb3e48f3c931e240c397ea0bfee2de5c

SHA512
431664e68b402466566cf385e2afcc9a2b87acb8ef74b0e1f0a07c87e72d710d9f47771cd4900c927678c0c9bc5f6e6c90e878a0c36e55e337408ac983090eb5

Download Submit
C:\Windows\SysWOW64\Plpqil32.exe

Filesize
163KB

MD5
14500f97e460b6295fec56b8e56ca1e4

SHA1
81fdd3d0ef15d52ac3ef412ebbb948e906ddb66f

SHA256
91c1a9d84b577f270bca798418818b6e1e599bebfdb83c785257461d09890b4d

SHA512
94b369308a1d159a6b5d00679e11a783ebefb46c956a5bda216f7126d8bb52f2578ffebb139f82dc4537201a9dc31fa098bb8079653b5e3bb55746b868ede9cf

Download Submit
C:\Windows\SysWOW64\Pmpolgoi.exe

Filesize
163KB

MD5
96126ea3a3d0b2ccf4c3f8e930633b15

SHA1
479859486a60c071fce21ddf88197fe3a4f8465a

SHA256
5620d5482caecc890932a4ebeb9b7e4fe6caed6e5a0c2a5cecf07986a4270c14

SHA512
bf72e48f9a274d5e21e8b9136ca2fac62dc0b04b82b545c24b281abe1d12b3f03be5b2abde9a8ca71c40cd436287083da741ac1dfa5e014ad45567891cf895ab

Download Submit
C:\Windows\SysWOW64\Pojcjh32.exe

Filesize
163KB

MD5
7608cdf0585789ee893865f75651bc88

SHA1
e1781de82d7c784bde2358033cba0b25b1315934

SHA256
185990b1f1362080726e55895a6e4377bb44ea408d5bcefc56a14cf2fd081d6d

SHA512
eb0b1e370d678a050937370797325229debdc47ac5af78201a89da4637be081223b098d2766ff5a01c88aef32aaa457d76ba90bacd8e4c81042c6a2335b062ad

Download Submit
C:\Windows\SysWOW64\Qaflgago.exe

Filesize
163KB

MD5
6b3823f902c183c7745d0b5bd8739664

SHA1
96e3d020236d21d7be667adbc57f24eb4075aca7

SHA256
3b8bc768a10471b3c232d7b13168c6a649c9586a17625f6cb9ec76bbe9fab1ef

SHA512
700130e22ee16bb8695edec1c4f0b16e71d2151a8ffda3727f8f3fcd771485f23d9da5f3d66c30c66ad4d9c5abe5396b1d62fe190f0b5aa6d07160a83bb5a58e

Download Submit
C:\Windows\SysWOW64\Qcaofebg.exe

Filesize
163KB

MD5
0994c589613f13878bd275ece16a83b3

SHA1
b3edf5fd53dbb3c26e3978e1c0e4e9d680c6e2f9

SHA256
76da7a65fe7716d4aa03900ecb2354fbfe4e5757461bd2da4befa6cd1a83ff27

SHA512
098ae5b61544afe82f4f79762de6f195752a437e510656ca6c50a90ac40e6a18647e245a9560e7e90bbb0f70e8fdb1a823941bc8630c5c5d830aa995837c086d

Download Submit
C:\Windows\SysWOW64\Qhmqdemc.exe

Filesize
163KB

MD5
7d05b52e1bdc34fee35831e2fa0c69c2

SHA1
4d76adbe4d2d3a63342b101895497a387265c702

SHA256
74a54d03b4f9c98c81e5f8572dc5bf4f4413427fc6d0a51b8ffea1b7fe226838

SHA512
c5457bb16a8a0826f93e07758315cee3f871a9756894703f596e39302f6cc08385cc20b934fcc698cdb7a590b53d145b3f7a20461cc4e77f8cc2fcc475b96b00

Download Submit
C:\Windows\SysWOW64\Qjiipk32.exe

Filesize
163KB

MD5
1bfa5fc85f2632ddf8ee69b8170a0a9e

SHA1
4160d536c45e43928ead6b3e22945734ef43cf7c

SHA256
1fefbefa2930ebd96f76818fc42f98f59e0ebd81a5f42748879b6a234de12966

SHA512
3a8b869a9f604cf53dc34d4948958e3c7e91eedc442af7d9ef642b2db07ad9906699d16a036417549a64824763ff042429d0d259691c3c4334939805cc2f09d6

Download Submit
C:\Windows\SysWOW64\Qlggjk32.exe

Filesize
163KB

MD5
45a24f32126cdb22f6089d053737dbd8

SHA1
f94561f12bfd19d4c32bd9ba631b8ed6475f491e

SHA256
2e3607763d278d9f239d2611ce0705db105c4cd447d26fe1b841b00b24b8f3b5

SHA512
5453dfcf2460f5d19c85e11f570735d0785ca1cb873127c2b3f5b2ca4b809081aa4262268136d818affb1b8df388da35288e5da8ac482ec323e825426d00d4f1

Download Submit
C:\Windows\SysWOW64\Qljcoj32.exe

Filesize
163KB

MD5
d21417d01251739007df5f0dffd19db5

SHA1
7f34ab9bfc24f43404c4b8ed2cb0065cb01254b0

SHA256
844dfc930112919c45fb2761e464cf024095a7f68f4b1b95a1561c7825860537

SHA512
cc9da2eea6513a643dd6a03ee5b2cf466a86b42d4b94c20d3bc94e5f3506892ba2e66c41716349bc2ae2551b11782fcfd345e97c1f6b53f8125bc593250161ae

Download Submit
C:\Windows\SysWOW64\Qohpkf32.exe

Filesize
163KB

MD5
7401c5f3ff6c459df163f606663fe1e7

SHA1
9461052f63c2a54da1c7841104ae22c090e1dc35

SHA256
61045c75d06e10cdcc4cd77b366a5d99ed6ddbd635f525992c495b9c77048501

SHA512
68b17c981181da44a3459662de6ec56400f9a354a54199db5691f76765ba77784e6edf154d8b88d71fe6c36fbd2fe525188af1d8e50a15daee4a850a58678be7

Download Submit
memory/264-242-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/632-478-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/660-580-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/720-363-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/760-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/868-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/868-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/912-137-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/912-640-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1012-647-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1012-150-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1232-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1232-593-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1248-52-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1248-566-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1256-414-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1268-112-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1268-621-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1456-461-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1616-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1616-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1624-181-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1784-467-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1952-326-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2028-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2028-519-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2060-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2180-218-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2232-489-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2252-408-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2280-426-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2384-607-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2384-97-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2464-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2464-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2600-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2616-384-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2680-567-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2840-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2840-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2904-396-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2940-291-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2980-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2980-579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3060-459-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3100-88-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3100-600-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3168-161-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3252-390-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3256-402-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3336-495-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3480-546-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3536-249-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3560-508-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3580-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3700-125-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3700-627-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3876-560-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-532-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4120-297-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4148-432-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4236-520-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4240-573-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4240-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4256-189-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4300-280-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4332-258-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4344-234-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4432-158-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4432-654-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-347-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4496-315-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4500-309-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4612-226-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4616-501-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4740-502-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4760-614-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4760-107-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-633-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-133-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4904-303-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4940-420-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4948-586-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4948-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5080-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5080-531-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5084-443-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5124-587-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5172-594-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5220-601-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5260-608-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5336-615-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5480-634-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5536-641-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5584-648-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7220-3229-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8004-3231-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8456-3161-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/8468-3199-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9484-3101-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9564-3099-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9708-3056-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9928-3089-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10136-3054-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10500-2976-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10692-3014-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10724-2975-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10844-3010-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10876-2994-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10884-3032-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10912-3008-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads