berbew | cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0

Analysis

max time kernel
108s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe
Size

163KB
MD5

6fcb198e0dc3068665f84abdb608d860
SHA1

723fa228b747a1852ecfa0775e07711492ddfdd6
SHA256

cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0
SHA512

8321283c73968df1826f80bf2cba73600bd18265babbdd9d25a2dc5620bea5df728c41350b93ce45c26c2cfcd7e0c1fc187181ccbe8aebf17b9d13866226c46d
SSDEEP

1536:P7wkhHv8JaFCMh+k38eadfl+8+lProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:DwkW/M9addB+ltOrWKDBr+yJb

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpofii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqbncb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjmoag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfaohbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjadje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikbfgppo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgccinoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njpdnedf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oelolmnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efepbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpofii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmkgkapm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgaokl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfglfdkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbbpmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmggfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjafok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaalblgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcejco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efjbcakl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phdnngdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnjejjgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgbjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgkmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldgccb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjmoag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgclpkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emmkiclm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphphj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bochmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chlflabp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enpmld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfoann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdokdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqbdldnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adfgdpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbanbmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adndoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jilfifme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Difpmfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bochmn32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

pid	Process
2136	Cmmbbejp.exe
3716	Coknoaic.exe
628	Diccgfpd.exe
2452	Dcigeooj.exe
4200	Difpmfna.exe
2120	Dpphjp32.exe
5008	Dbndfl32.exe
4664	Djelgied.exe
3308	Dcnqpo32.exe
4480	Djhimica.exe
416	Dmfeidbe.exe
4412	Dcpmen32.exe
5004	Dimenegi.exe
2616	Dlkbjqgm.exe
3928	Efafgifc.exe
4476	Eiobceef.exe
1032	Elnoopdj.exe
4556	Ecefqnel.exe
2792	Ebhglj32.exe
3080	Ejoomhmi.exe
4884	Emmkiclm.exe
3336	Elpkep32.exe
4636	Ecgcfm32.exe
220	Ebjcajjd.exe
4224	Efepbi32.exe
676	Ejalcgkg.exe
3948	Eidlnd32.exe
2808	Emphocjj.exe
2276	Elbhjp32.exe
5028	Eciplm32.exe
3912	Eblpgjha.exe
2848	Efhlhh32.exe
1008	Ejchhgid.exe
1640	Eifhdd32.exe
2684	Embddb32.exe
4216	Eppqqn32.exe
2372	Eclmamod.exe
32	Ebommi32.exe
2548	Ejfeng32.exe
4296	Eiieicml.exe
2244	Elgaeolp.exe
3012	Fpbmfn32.exe
4788	Fcniglmb.exe
764	Ffmfchle.exe
1612	Fjhacf32.exe
1404	Fmfnpa32.exe
4752	Flinkojm.exe
1472	Fdqfll32.exe
2336	Fbcfhibj.exe
1984	Fjjnifbl.exe
2612	Fimodc32.exe
636	Fllkqn32.exe
3544	Fpggamqc.exe
3136	Fbfcmhpg.exe
1432	Ffaong32.exe
4380	Fipkjb32.exe
2060	Fmkgkapm.exe
1716	Fpjcgm32.exe
4120	Fdepgkgj.exe
3128	Ffclcgfn.exe
1136	Fjohde32.exe
388	Fmndpq32.exe
3752	Flqdlnde.exe
3236	Fdglmkeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bhnikc32.exe	Bepmoh32.exe
File created	C:\Windows\SysWOW64\Ibdlakbf.dll	Hoobdp32.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Paeelgnj.exe
File opened for modification	C:\Windows\SysWOW64\Knhakh32.exe	Kkjeomld.exe
File opened for modification	C:\Windows\SysWOW64\Ilmmni32.exe	Iinqbn32.exe
File opened for modification	C:\Windows\SysWOW64\Kdigadjo.exe	Kmaopfjm.exe
File opened for modification	C:\Windows\SysWOW64\Kclgmq32.exe	Kdigadjo.exe
File created	C:\Windows\SysWOW64\Qaalblgi.exe	Pocpfphe.exe
File created	C:\Windows\SysWOW64\Akqfkp32.exe	Aednci32.exe
File created	C:\Windows\SysWOW64\Effkpc32.dll	Cfkmkf32.exe
File created	C:\Windows\SysWOW64\Elkllcbh.dll	Dbbffdlq.exe
File created	C:\Windows\SysWOW64\Elnoopdj.exe	Eiobceef.exe
File created	C:\Windows\SysWOW64\Ignlbcmf.dll	Jgbchj32.exe
File created	C:\Windows\SysWOW64\Ieoigp32.dll	Akblfj32.exe
File created	C:\Windows\SysWOW64\Iocedcbl.dll	Akdilipp.exe
File created	C:\Windows\SysWOW64\Pjllddpj.dll	Bpfkpp32.exe
File created	C:\Windows\SysWOW64\Bhqndghj.dll	Bajqda32.exe
File opened for modification	C:\Windows\SysWOW64\Flfkkhid.exe	Fmcjpl32.exe
File created	C:\Windows\SysWOW64\Pbjnik32.dll	Fdqfll32.exe
File opened for modification	C:\Windows\SysWOW64\Glengm32.exe	Gigaka32.exe
File opened for modification	C:\Windows\SysWOW64\Jpdhkf32.exe	Jjjpnlbd.exe
File opened for modification	C:\Windows\SysWOW64\Bomkcm32.exe	Blnoga32.exe
File opened for modification	C:\Windows\SysWOW64\Bakgoh32.exe	Bomkcm32.exe
File created	C:\Windows\SysWOW64\Kaofbcjo.dll	Eiahnnph.exe
File created	C:\Windows\SysWOW64\Doepmnag.dll	Jniood32.exe
File opened for modification	C:\Windows\SysWOW64\Fdqfll32.exe	Flinkojm.exe
File created	C:\Windows\SysWOW64\Oghghb32.exe	Onocomdo.exe
File created	C:\Windows\SysWOW64\Lnoaaaad.exe	Lcimdh32.exe
File created	C:\Windows\SysWOW64\Mqimikfj.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Apaadpng.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Lknojl32.exe	Lgccinoe.exe
File opened for modification	C:\Windows\SysWOW64\Efepbi32.exe	Ebjcajjd.exe
File created	C:\Windows\SysWOW64\Haaaidfk.dll	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Mmnhcb32.exe	Mgaokl32.exe
File created	C:\Windows\SysWOW64\Lnjgfb32.exe	Lgpoihnl.exe
File created	C:\Windows\SysWOW64\Dbfpagon.dll	Afpjel32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Dcpmen32.exe	Dmfeidbe.exe
File opened for modification	C:\Windows\SysWOW64\Jlkipgpe.exe	Jjlmclqa.exe
File created	C:\Windows\SysWOW64\Ajfmkfhq.dll	Jjafok32.exe
File created	C:\Windows\SysWOW64\Gphphj32.exe	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Eoaedogc.dll	Popbpqjh.exe
File opened for modification	C:\Windows\SysWOW64\Akqfkp32.exe	Aednci32.exe
File opened for modification	C:\Windows\SysWOW64\Fbbpmb32.exe	Fligqhga.exe
File opened for modification	C:\Windows\SysWOW64\Cmmbbejp.exe	cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe
File created	C:\Windows\SysWOW64\Hdjgko32.dll	Knooej32.exe
File created	C:\Windows\SysWOW64\Kkeldnpi.exe	Kgipcogp.exe
File opened for modification	C:\Windows\SysWOW64\Lddgmbpb.exe	Lmmolepp.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lndagg32.exe
File opened for modification	C:\Windows\SysWOW64\Bkjiao32.exe	Blgifbil.exe
File opened for modification	C:\Windows\SysWOW64\Gphphj32.exe	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Ladfllde.dll	Hloqml32.exe
File created	C:\Windows\SysWOW64\Jhdnigno.dll	Ipoopgnf.exe
File created	C:\Windows\SysWOW64\Kcejco32.exe	Kqfngd32.exe
File created	C:\Windows\SysWOW64\Dfookdli.dll	Nnicid32.exe
File opened for modification	C:\Windows\SysWOW64\Qlgpod32.exe	Qdphngfl.exe
File created	C:\Windows\SysWOW64\Ncpgam32.dll	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Onkidm32.exe	Ngqagcag.exe
File created	C:\Windows\SysWOW64\Dimenegi.exe	Dcpmen32.exe
File opened for modification	C:\Windows\SysWOW64\Dmfeidbe.exe	Djhimica.exe
File created	C:\Windows\SysWOW64\Ajmdgelp.dll	Dcpmen32.exe
File created	C:\Windows\SysWOW64\Fcniglmb.exe	Fpbmfn32.exe
File opened for modification	C:\Windows\SysWOW64\Kqphfe32.exe	Knalji32.exe
File opened for modification	C:\Windows\SysWOW64\Olfghg32.exe	Oelolmnd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11292	11920	WerFault.exe	605

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpffeaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kckqbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejoomhmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjfnedho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcejco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcnfohmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpaleglc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcimdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcpmen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlkbjqgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnlbojee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jddnfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlfnaicd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkmdecbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dokgdkeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlglidlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgpoihnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flinkojm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phdnngdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komhll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqdaadln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jphkkpbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahdpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fimodc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddgmbpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkbjjbda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnfnlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Addaif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iomoenej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebommi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neclenfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popbpqjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coknoaic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqfngd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Felbnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqknkedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jleijb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjola32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnjejjgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbdcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iedjmioj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpcjgnhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmfcok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoopgnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknifq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfaohbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dndnpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpkibf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikbfgppo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aonoao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbhboolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elbhjp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icdheded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcleml32.dll"	Jcikgacl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkldkg32.dll"	Nlfnaicd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Felbnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baadiiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nohffe32.dll"	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcjdoc32.dll"	Lgqfdnah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnohlgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkegpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdbdcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjojj32.dll"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Ofkgcobj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmkdcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hclnnc32.dll"	Ffmfchle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chlflabp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpod32.dll"	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmjob32.dll"	Lcnfohmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmnbjama.dll"	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcanll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koodbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejain32.dll"	Onkidm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjfnedho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lckiihok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmhgmmbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Faimhjhp.dll"	Ebommi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpbmfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkdjfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iddgpk32.dll"	Ipflihfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojigdcll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njfagf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Gikdkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbofcghl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkchelci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oelolmnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbqdpi32.dll"	Iedjmioj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcmdgodo.dll"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnnlhc32.dll"	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgaokl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kikdcj32.dll"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lddgmbpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbandhne.dll"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghjnkpdc.dll"	Gpbpbecj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqknkedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgfoqnae.dll"	Lqbncb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfhndpol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oghdfilo.dll"	Dlkbjqgm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2136	2436	cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe	86
PID 2436 wrote to memory of 2136	2436	cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe	86
PID 2436 wrote to memory of 2136	2436	cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe	86
PID 2136 wrote to memory of 3716	2136	Cmmbbejp.exe	87
PID 2136 wrote to memory of 3716	2136	Cmmbbejp.exe	87
PID 2136 wrote to memory of 3716	2136	Cmmbbejp.exe	87
PID 3716 wrote to memory of 628	3716	Coknoaic.exe	88
PID 3716 wrote to memory of 628	3716	Coknoaic.exe	88
PID 3716 wrote to memory of 628	3716	Coknoaic.exe	88
PID 628 wrote to memory of 2452	628	Diccgfpd.exe	89
PID 628 wrote to memory of 2452	628	Diccgfpd.exe	89
PID 628 wrote to memory of 2452	628	Diccgfpd.exe	89
PID 2452 wrote to memory of 4200	2452	Dcigeooj.exe	90
PID 2452 wrote to memory of 4200	2452	Dcigeooj.exe	90
PID 2452 wrote to memory of 4200	2452	Dcigeooj.exe	90
PID 4200 wrote to memory of 2120	4200	Difpmfna.exe	91
PID 4200 wrote to memory of 2120	4200	Difpmfna.exe	91
PID 4200 wrote to memory of 2120	4200	Difpmfna.exe	91
PID 2120 wrote to memory of 5008	2120	Dpphjp32.exe	93
PID 2120 wrote to memory of 5008	2120	Dpphjp32.exe	93
PID 2120 wrote to memory of 5008	2120	Dpphjp32.exe	93
PID 5008 wrote to memory of 4664	5008	Dbndfl32.exe	94
PID 5008 wrote to memory of 4664	5008	Dbndfl32.exe	94
PID 5008 wrote to memory of 4664	5008	Dbndfl32.exe	94
PID 4664 wrote to memory of 3308	4664	Djelgied.exe	95
PID 4664 wrote to memory of 3308	4664	Djelgied.exe	95
PID 4664 wrote to memory of 3308	4664	Djelgied.exe	95
PID 3308 wrote to memory of 4480	3308	Dcnqpo32.exe	96
PID 3308 wrote to memory of 4480	3308	Dcnqpo32.exe	96
PID 3308 wrote to memory of 4480	3308	Dcnqpo32.exe	96
PID 4480 wrote to memory of 416	4480	Djhimica.exe	98
PID 4480 wrote to memory of 416	4480	Djhimica.exe	98
PID 4480 wrote to memory of 416	4480	Djhimica.exe	98
PID 416 wrote to memory of 4412	416	Dmfeidbe.exe	99
PID 416 wrote to memory of 4412	416	Dmfeidbe.exe	99
PID 416 wrote to memory of 4412	416	Dmfeidbe.exe	99
PID 4412 wrote to memory of 5004	4412	Dcpmen32.exe	100
PID 4412 wrote to memory of 5004	4412	Dcpmen32.exe	100
PID 4412 wrote to memory of 5004	4412	Dcpmen32.exe	100
PID 5004 wrote to memory of 2616	5004	Dimenegi.exe	101
PID 5004 wrote to memory of 2616	5004	Dimenegi.exe	101
PID 5004 wrote to memory of 2616	5004	Dimenegi.exe	101
PID 2616 wrote to memory of 3928	2616	Dlkbjqgm.exe	102
PID 2616 wrote to memory of 3928	2616	Dlkbjqgm.exe	102
PID 2616 wrote to memory of 3928	2616	Dlkbjqgm.exe	102
PID 3928 wrote to memory of 4476	3928	Efafgifc.exe	103
PID 3928 wrote to memory of 4476	3928	Efafgifc.exe	103
PID 3928 wrote to memory of 4476	3928	Efafgifc.exe	103
PID 4476 wrote to memory of 1032	4476	Eiobceef.exe	105
PID 4476 wrote to memory of 1032	4476	Eiobceef.exe	105
PID 4476 wrote to memory of 1032	4476	Eiobceef.exe	105
PID 1032 wrote to memory of 4556	1032	Elnoopdj.exe	106
PID 1032 wrote to memory of 4556	1032	Elnoopdj.exe	106
PID 1032 wrote to memory of 4556	1032	Elnoopdj.exe	106
PID 4556 wrote to memory of 2792	4556	Ecefqnel.exe	107
PID 4556 wrote to memory of 2792	4556	Ecefqnel.exe	107
PID 4556 wrote to memory of 2792	4556	Ecefqnel.exe	107
PID 2792 wrote to memory of 3080	2792	Ebhglj32.exe	108
PID 2792 wrote to memory of 3080	2792	Ebhglj32.exe	108
PID 2792 wrote to memory of 3080	2792	Ebhglj32.exe	108
PID 3080 wrote to memory of 4884	3080	Ejoomhmi.exe	109
PID 3080 wrote to memory of 4884	3080	Ejoomhmi.exe	109
PID 3080 wrote to memory of 4884	3080	Ejoomhmi.exe	109
PID 4884 wrote to memory of 3336	4884	Emmkiclm.exe	110

C:\Users\Admin\AppData\Local\Temp\cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe
"C:\Users\Admin\AppData\Local\Temp\cc1454b245411b23eb18db999c235acd5404892a04247ec2a715a5791f88fed0N.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\Cmmbbejp.exe
  C:\Windows\system32\Cmmbbejp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\Coknoaic.exe
    C:\Windows\system32\Coknoaic.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SysWOW64\Diccgfpd.exe
      C:\Windows\system32\Diccgfpd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
      - C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        23⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        24⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        27⤵
        Executes dropped EXE
        
        PID:676
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        28⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        29⤵
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        31⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        32⤵
        Executes dropped EXE
        
        PID:3912
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        33⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        34⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        35⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        36⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        37⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        38⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:32
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        40⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        41⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        42⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        44⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        46⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        47⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1472
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        50⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        51⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        53⤵
        Executes dropped EXE
        
        PID:636
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        54⤵
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        56⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        57⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        59⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        60⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        61⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        62⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        63⤵
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        64⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        65⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        66⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3464
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        68⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        69⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        71⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        72⤵
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        75⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        76⤵
        
        PID:472
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3524
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        78⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        79⤵
        Drops file in System32 directory
        
        PID:1768
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3864
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        82⤵
        Drops file in System32 directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        83⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        84⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        85⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:1172
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3056
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        88⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        89⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        90⤵
        
        PID:864
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        91⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        92⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:420
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        94⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        95⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        96⤵
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        97⤵
        Drops file in System32 directory
        
        PID:2172
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        99⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        100⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        101⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        103⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        104⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        105⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        106⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        107⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        109⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        111⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        113⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        114⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        115⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        116⤵
        Drops file in System32 directory
        
        PID:5840
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        117⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        118⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        119⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        120⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        127⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        128⤵
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        129⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        131⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        132⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        133⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        134⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        136⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        137⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        138⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        139⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        140⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        142⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        143⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        144⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        145⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        147⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        148⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        149⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        150⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        152⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        153⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        154⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        155⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        156⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        158⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        159⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        160⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6352
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        162⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        163⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        164⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        165⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        166⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        167⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        168⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        169⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        170⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        171⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        172⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        173⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        174⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        177⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        178⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        180⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        181⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        182⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        184⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        186⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        188⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        189⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        191⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        192⤵
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        193⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        194⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        195⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        196⤵
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        197⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        198⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        199⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        200⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        201⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        203⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        205⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        206⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        207⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        208⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        209⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        210⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        211⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        212⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        213⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        214⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        216⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        217⤵
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        218⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        219⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        220⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        221⤵
        Modifies registry class
        
        PID:7640
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        222⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        223⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        224⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        225⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        226⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7892
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:7932
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        230⤵
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        231⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        232⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        233⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        234⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        235⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        236⤵
        Drops file in System32 directory
        
        PID:7272
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7336
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        238⤵
        Drops file in System32 directory
        
        PID:7408
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        239⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        240⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        241⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        242⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        243⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        244⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        245⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        248⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        250⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        251⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        252⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        253⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        255⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        256⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6252
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        258⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:404
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        260⤵
        Modifies registry class
        
        PID:7760
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        261⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        262⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        263⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        264⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        265⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        266⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        267⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        268⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8008
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        270⤵
        Drops file in System32 directory
        
        PID:8208
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        271⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        272⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        273⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        274⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        275⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        276⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        277⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        278⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        279⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8612
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8652
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        283⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        284⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        285⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        286⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        287⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        288⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        289⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        290⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        291⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9116
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        293⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        296⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        297⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        299⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        300⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        302⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        304⤵
        Drops file in System32 directory
        
        PID:5068
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        305⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        306⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        307⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        308⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9156
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        310⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        311⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        312⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        313⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        315⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3592
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        316⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        317⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        318⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        319⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        320⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        321⤵
        Drops file in System32 directory
        
        PID:8660
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2880
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        323⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        324⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        325⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        326⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        327⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8648
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        329⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        330⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        331⤵
        Modifies registry class
        
        PID:9228
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9264
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        333⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        334⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9372
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        336⤵
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        337⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        338⤵
        Modifies registry class
        
        PID:9480
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        339⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        340⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        341⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        342⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        343⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        344⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9732
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        346⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9804
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        348⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        349⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        350⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        351⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        352⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:10028
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        354⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:10100
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        356⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        357⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        358⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        359⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:9284
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        361⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        362⤵
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        363⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        364⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        365⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        366⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        367⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        368⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        369⤵
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        370⤵
        System Location Discovery: System Language Discovery
        
        PID:9920
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        371⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        373⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        374⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        375⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        376⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9524
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        378⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        379⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        380⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        381⤵
        Drops file in System32 directory
        
        PID:9976
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:10124
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        383⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        385⤵
        Modifies registry class
        
        PID:9724
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        386⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        387⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:9440
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        389⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        390⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        391⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        392⤵
        Modifies registry class
        
        PID:9828
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        394⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        395⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        396⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        397⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        398⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        399⤵
        System Location Discovery: System Language Discovery
        
        PID:10296
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        400⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        401⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        402⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10408
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        403⤵
        Drops file in System32 directory
        
        PID:10444
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        404⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        405⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        406⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10552
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        407⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        408⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        409⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        410⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10700
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        411⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        412⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        413⤵
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        414⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        415⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        416⤵
        Drops file in System32 directory
        
        PID:10920
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        417⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        418⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        419⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        420⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        421⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        422⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        423⤵
        System Location Discovery: System Language Discovery
        
        PID:11176
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        424⤵
        Modifies registry class
        
        PID:11212
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        425⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        426⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        427⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        428⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        429⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        430⤵
        Modifies registry class
        
        PID:10540
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        431⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        432⤵
        Modifies registry class
        
        PID:10672
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        433⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        434⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        435⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        436⤵
        Drops file in System32 directory
        
        PID:10940
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        437⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        438⤵
        Modifies registry class
        
        PID:11072
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        439⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        440⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        441⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10328
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        443⤵
        Drops file in System32 directory
        
        PID:10452
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        444⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        445⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        446⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        447⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11024
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        449⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        450⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        451⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        452⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        453⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        454⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        455⤵
        Modifies registry class
        
        PID:11232
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        456⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10784
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        459⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        460⤵
        Modifies registry class
        
        PID:10324
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        461⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11120
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11300
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11336
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        465⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        466⤵
        System Location Discovery: System Language Discovery
        
        PID:11408
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        467⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11444
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        468⤵
        System Location Discovery: System Language Discovery
        
        PID:11480
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        469⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        470⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        471⤵
        Drops file in System32 directory
        
        PID:11588
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        472⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        473⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        474⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:11732
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        476⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11804
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        478⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        479⤵
        Drops file in System32 directory
        
        PID:11876
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:11912
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        481⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        482⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        483⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        484⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        485⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        486⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        487⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        488⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        489⤵
        Drops file in System32 directory
        
        PID:12244
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        490⤵
        Modifies registry class
        
        PID:12280
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        491⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        492⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        493⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        494⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11572
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        496⤵
        System Location Discovery: System Language Discovery
        
        PID:11652
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        497⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        498⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        499⤵
        System Location Discovery: System Language Discovery
        
        PID:11836
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11900
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        501⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        502⤵
        Drops file in System32 directory
        
        PID:12044
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        503⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        504⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        505⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        506⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        507⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        508⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        509⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11752
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        511⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11920 -s 400
        512⤵
        Program crash
        
        PID:11292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 11920 -ip 11920
1⤵
PID:12204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaenbd32.exe

Filesize
163KB

MD5
9aebaeaf85d82aebf0ac5c8505a66b6b

SHA1
e9f3d42757b5a9bfb020b28997ebcd095f129556

SHA256
26b5294e2b16244769809aba0c033dd34d16f98f99593df4d7aac1272ff8a6c0

SHA512
44babf842ba81d96469ab830179533a5a484af89d7c44740bfea4c3f72e2740f24eafef4624f666ec7ccd84651652e8b32383e2aaaf0e12daa7b6432d67d4234

Download Submit
C:\Windows\SysWOW64\Aajohjon.exe

Filesize
163KB

MD5
ccd79aa996c6d130338ed03674d119a9

SHA1
294744901e28e134fb02f9340bd16d7b338dc849

SHA256
d15526723cb16fb16286bd76d5d00d02456b1d49f5658ad9dd49d2ff28663085

SHA512
a39c3e160b023c299898bfac9a881d27999417d1df5d3e31e53aed7345fb430712357b72e89cf70428bb4038a9931ef69fd863a7da12cb5baebaa5ae2d1fb9c8

Download Submit
C:\Windows\SysWOW64\Aednci32.exe

Filesize
163KB

MD5
03ecb07a152aa00ee3760a4b56473e9b

SHA1
25918dc12f087464a4f1f1687909a971014242ea

SHA256
e32fe6f37c0d9fb4d880146689b20c3e431cb145e72cdd221e16bf403d27227c

SHA512
078e02c009dcb73c253bd81020f34cc32e06c1280197edcb105b3bf6c683b329cb3cddd279cd1c24cb87700119502d1819c40dfbcc9969ea45134d532e0015ae

Download Submit
C:\Windows\SysWOW64\Aonoao32.exe

Filesize
163KB

MD5
a9014c2bdd2d2c49578cab661ace7397

SHA1
55e9725ff016214d3a310d5160092e16c77c21a7

SHA256
77bf9a27a10cce5604083bc6ad69e4760777ed240b539b5b6e3ab39f42947a74

SHA512
2c6487be33ce4e7224198eceeb2b23b7383642d4631b385cf250dd9f198c67685d4f8f2a7e522f38bc8991b052f6bf14660e52cdf905fa669da5fdb8370e638c

Download Submit
C:\Windows\SysWOW64\Apaadpng.exe

Filesize
163KB

MD5
424a6c62229fe5ae585fa1e0ba655023

SHA1
d69af36978fc7b88df753366c2c95b31829da429

SHA256
e07f2e728326935a9efc62642c6b1ff781cd8d94a5d3c88d53c1d4bd9c4161d3

SHA512
35241c8f42194333049c37ddc9f5545a3e4ba2464d972c990c95e5462263d091f64987caa53ef97b3cb2aaaf23348b0bd332a977df1ed023f4bf4471f6ec9440

Download Submit
C:\Windows\SysWOW64\Bhkfkmmg.exe

Filesize
163KB

MD5
404120c1b2ea27bccd1fb3b12d876fba

SHA1
c6b1de82a28dd4fa70fc5f63137838533c48f8f9

SHA256
739903129dfc8486ea56623865f22bbe62298e7a00d1d96a4917e7e5e1f59feb

SHA512
82a8f3eab19ee643b45c046138439163f3fe8bd9ac7b00991c4bc00068e5d4f3be9d20f745fa2abbe4a35462a4c9d161a6e5dde6eef453875b40b89393f4481a

Download Submit
C:\Windows\SysWOW64\Bhnikc32.exe

Filesize
163KB

MD5
5d88abb3711cdd9e32603b75e77ed416

SHA1
c8ae6f3356108d98946fdba93c76cadfec816cae

SHA256
4bd216aff7a96438e9472f6f60aa21afef99a2f8be9ce46e789e30113ad72218

SHA512
43092a4c25d97ae8c7af4d290c6ae0989e8f4a233898a733140c184e6f471780e8e0280eb52ae4358c0f8b511d353e3c142ef33af8429d7d231ddee8d76e4d4a

Download Submit
C:\Windows\SysWOW64\Bogkmgba.exe

Filesize
64KB

MD5
f3c1f52d46dfa356a87ec50105d6226a

SHA1
41c9d52418eff5b1c1717bf0b2660c6855d4dbd4

SHA256
33859e02c2d654018205168fced1dca4ee0170f97257d1078c4e0ee6db444e63

SHA512
5b73c44d0dd30c3c5d3ea97b6e32d2f93f7cf7481f8d2ef0bd3bea0bf7352e66573aebee7e7a289fd3acedd423e5be92987de350f721eb8f59dd3c8f871eedca

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
163KB

MD5
7123d5dc2ed7a426a3dee4aef77edafd

SHA1
bf45bc7128eebc4db6003cbefb46727bba3886c3

SHA256
ff2e7656f33a5df6f6ffc672bfd66d7568bbe2e6b95d85cdc66655b244d77d6e

SHA512
6c92ce3ef13b35c2c47cbe5c8bda7f24175b7504dfeb4b481a7ff344b75b75725ca10f77129bbfbfed2bf678342ef8c81a525b0ac01511991bd1a197c4d364c0

Download Submit
C:\Windows\SysWOW64\Cfpffeaj.exe

Filesize
163KB

MD5
e05691136154f977f014bcf32e1d9470

SHA1
0853225910f1f72f7546c199741805fd18612c92

SHA256
2cff5e2258712ce7c00625ee898394f303cf7d242486c8df9e6e98708f5e22d5

SHA512
47483033dc81711e6ae31abd5ff53f77e3d3ec4a2914a1c65f4dc1bb71ee8968c1669e9f7612463ab30fcc5871c21b8224a1e19054cbe11edfab31ed2ee7321a

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
163KB

MD5
2db4639f4b865d0fb693046198c514e0

SHA1
ca2a9e0a152d891b4e84cc6f3e2d4c9a9c801c75

SHA256
ff0aed239be53a128750dc219bda619856423f8f11eb2151555df763d5690aca

SHA512
5660fb19787099d3a3f3009dd99d1b17964c73913f5d7fe18d4951047ce02b971659aa4bb03f63abfd984239eb73316a04acde6a8c38ad0dc0b323621b063701

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
163KB

MD5
775677cadc5e4363404cd955bc4a137b

SHA1
2f3038950fbdb74581b496e1638214b73bd63677

SHA256
a7b6acf3536812fcd7968b137a4e49c4656c9312b3543f3fa3a2eb751cc1482e

SHA512
9f8543d0773b789d2a47ed11afa926de3e57e96e885d330fd25fefbc4d67cd195a34e2d39f152a182f6c9eb53f332bc759ecccdb3e84c7f1bdf31303c9b74577

Download Submit
C:\Windows\SysWOW64\Chiigadc.exe

Filesize
163KB

MD5
15d219af6eab4d9792c56f5a634979b9

SHA1
8863a92501ea45146eb381bab43e9f44e2d92954

SHA256
f73d84fa8525d305ba04e8bddb0bf6f76739c3d69a90d873b402a40bdcd8d832

SHA512
a59c8cf1a55553bf06d7072516f580b77964c4ec539cdf35024a41ce8c64ad8b9601a19a8b0f1d6e26d5bc68d9e9bad3b7df828e6e22d35a9c1157b700bd3970

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
163KB

MD5
ba5be12375538857ab425147a48768b5

SHA1
2418cd8b84599a11d13f7f6ad0dbd8ec248bdd16

SHA256
ffcb88f5ee03f0cfff75e1873359501c563704e1258f040e686533ec94d26c7d

SHA512
a285c0cfca34fadf368382484b8cc5dd97c643c96e6f768f594d7dc7abf05d18ba91293d114a536fd1e17f8f49d2694e6d7c7e8476abb4afbfbfb0f92fdc0b7c

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
163KB

MD5
2975a0de873eb913a45bf225074adef0

SHA1
a4212d4c80a5c381126c12b77ef6969bc6265477

SHA256
cb922e8aac6a810c767d9a88f58aa9c0cb82cb6c29cc23f244d9ffa612d45ecc

SHA512
5ee20b32542936d49f439a2e3b1e56111d3b32013eda2148c9bac2ffac7dfb989f117076cd66eebd46af9aaf937c0a45609edf56ea22a25f5e177ad98ff6fae9

Download Submit
C:\Windows\SysWOW64\Cmmbbejp.exe

Filesize
163KB

MD5
3d505b194d720eccabf3f25188a794c3

SHA1
b675d90dc7dc4ab9fc14c7fd84fb405b0143d6ce

SHA256
696c1ac25997c8495fe84246401b1aa4ea9e095353bf7f026237a25298f367d5

SHA512
30028f43ddfa614e4d2f85d6ac3d0cb80a8ecaad92406651d9c13f5800b0f56c461c7a7683928eb25202221065931873f82fead9631533943364c395dfe28d55

Download Submit
C:\Windows\SysWOW64\Cnjdpaki.exe

Filesize
163KB

MD5
b3213eb61f68f851d631fb6688a3ca81

SHA1
46e0a4f7837310b6f33754fc08ee340fc59f9821

SHA256
7b65da748669e177cceb707f303634a8c5b8171da796d5db4dfbb9f68169dbce

SHA512
d9009081af7c2c13a0da092bf6ec76b666ff27fbf4d26b96489a3174ab471de861cb296ee74c4ec47919ce295d3cd6c101d33328ef01390219831ab325e73893

Download Submit
C:\Windows\SysWOW64\Coadnlnb.exe

Filesize
163KB

MD5
52ffba2c9de33e6ca15b3f5d31a1fdcb

SHA1
dacdbc52f631f62d96d7714a4c5c433bf9b94fb5

SHA256
8a3084ba37cf366405699f4da06d95a0bf45d02ab1e345640dc3fb0407964c16

SHA512
e03a2ad21ef89b7965d6d99f842e1d7ed8a2c7ba07a5079d73af33751db785ec259b9fe2fb8a2af287381dc669f62e9d282c031030fd250a46aea415f9af48fe

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
163KB

MD5
86c3504c71ff87eb62f63837b7ed221a

SHA1
90ff1604b62fa7d46891ad3860cf7b0e74b1979e

SHA256
db6c7908f4353ee2f831a5bbded7f55101bba66d0ae4da618890cfe1565233fa

SHA512
99a5fb2e2262ba7985bc8046ae84f878fb57cde4b2e25440fc393a30778c4ff71c2cce4955557d63f6eb9ca8ff4417156dfb3242deed528854dc945fdf742374

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
163KB

MD5
34a5b2f943b4103c9498dac917d0f39e

SHA1
ccdd13e07c137b447bde834332d03f54642aedf1

SHA256
b9ebce6854449ed2243f24ee00e50a7f23ad226e4ac2e452a0eeb6d7d5909734

SHA512
9924629e42afb63820991feb3d866e82a8678c0edc24cd0185d4ebc9031584b85b8755fc191453c32137ac1fbddfa07275401482c4c4385416793a2ddf254f1c

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
163KB

MD5
525ecca7b9605e9ed3b5d96ff89c1509

SHA1
19c58dcbe3d50d2cecb2d8232924422df2ed6609

SHA256
59a879cc529c1712d886395090b63fbd64e3d3749d613f2ed14d74ecc92ddf79

SHA512
c83480f57edd55f0d27a9712db5fa907a3a56d5d4835869233a69397d5f5dae37bb5de54ce8cb6045a3210cd1edbc8bc42b2863f507f523ee06225d992317a8c

Download Submit
C:\Windows\SysWOW64\Dcigeooj.exe

Filesize
163KB

MD5
05e1bc702e7a80f83b2da96f7b31452b

SHA1
7064fcae32f6495237c4b2ed3eb735caece0314e

SHA256
5ceea7d16f5a5ce20dfbd294286dc74e82248a4ff7b3bb284977a8a721e0c324

SHA512
466f9226bd528e2b4baf37f896b7084cc2fd171e58e711f535da380a722b4ccc0a5f1c685516ff19fa524e3257ae3c23b36d31883b8516b141297cb8d6373bb1

Download Submit
C:\Windows\SysWOW64\Dcnqpo32.exe

Filesize
163KB

MD5
c9d3b11a76ee1b8b43754375a3d40d3d

SHA1
1df855245c7bd972998fccf0f0ff46d4312ac0bb

SHA256
18a0ad12aec1d85733abeb7283ebc5e7b9925cb196af0ccf07b4f9fee78b6328

SHA512
561df860df93b0176374492341d9aa56ff996eda5f0b10521a5244d600826e6de4da5c063d61b7cc5afde9c63b7ff28c7bd6f5a716514d3c4f7fdce6eb17b572

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
163KB

MD5
357f6beaeb27fd3263471a5dc7d123d7

SHA1
bff97f3d393fb703d0ffec83fa9671584fb843d8

SHA256
b3bff2e4e4e2cb8ff054f443df3e9a1582a1864887d374e833fa691e6f25aef0

SHA512
a3b0befdc278a9be92a0dbb50f971153c565a6f468ebb36036dd553daf55801c411bdd15e1bea592a416c7521316d6a5ba3b39a1104a69d01ee15cfb984a151d

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
163KB

MD5
c5469d611c9a0e4d81baa7fa9e841f13

SHA1
9a4ba9a343bd8f711d8a240d8923d6d3247876ad

SHA256
ab0fe7c04690a02fe0e0d3fb1eb947c8f80d6ce2f7a73288b3e54932e6f791ef

SHA512
844e05b4bdb51d604204e64694d17b1cc7d3f2841c9714c9b92cde576a2b6e9a55e6c76eafd1ee072e4091e0b67ff8bb17a934e7bcbe96a0c61339c8da8940ce

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
163KB

MD5
77dddf1a2789b2d9898b54423e443bf4

SHA1
1724611a5217e85ea19225592fa01c855606469e

SHA256
3f17ddc143743bfea7ab9ce592409495b38de35cdfdf677766d5bb0efe43a824

SHA512
567d71b9750fd2fe6713be23cbcf4f74fc8af52ca7ffad6d0d1c6fc768a12facf0a717680064d66b330d31e158fc0af53ffdc8689fa526d23f3e90862b17f7f7

Download Submit
C:\Windows\SysWOW64\Difpmfna.exe

Filesize
163KB

MD5
a2a4cac9dd2f5af4419563d962fa9a40

SHA1
3ce4b2b552ef1ad6671c441676ea247022499389

SHA256
a925ded439b3214e7b80d980c91bc26c447674ca9a665e10cc55510170ac5726

SHA512
76ca7823010ecd5b2ee7bbb131e7f1de403a5f1a26572b90d24ee5291baebc713a35fe5257efc17785af4bcd7d3c3136c3f25b9881092a64570248324c98eb65

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
163KB

MD5
0da0a911811b73f774181e1b2f3aacfd

SHA1
b7ed1527817ae0853cc5d9f718d5c8323b7be590

SHA256
0ea6b905bfad0f305e46466b2de1642c727bfaa28cf41a8e966ccac51cf2c4a4

SHA512
a14f375a34b69b2acf14c3b124ce7146d125b8a7059c9ae2b4a1086427eaebde41da9be9b2a7241243396eed019ae8c8220d8e6947c90d932810047eae8546c0

Download Submit
C:\Windows\SysWOW64\Djelgied.exe

Filesize
163KB

MD5
a6be2f87e58bf238e427d156f4de6d03

SHA1
0b5acf1ded2e45d38ab870fdfd61de9cfb83d4f3

SHA256
589cfe11c51179da17b49f3b9330cb60f5848ad83482c94533a0a7b914f8e8c3

SHA512
5c8ebca15127dada944bc1ca1d102d711100ac6a112622543c5ffe8b447564956522677481ebf6ccd64a22941a9609817bc01fd6fae5398d4fb794caa87c7cea

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
163KB

MD5
417d4a77c69016c4a22245d30834a44a

SHA1
569b5218f45be1a2e3e6248d678ded76d0b9a55d

SHA256
448a4ec12b73a43078b129b0cbd8827ec7fdc30a0ed6673433f02bc27b52748d

SHA512
34a20af6ca49a47341b38ff828b6df3219acce11091b7688f84fde3a99468aa9948ef89af03f1a37fc2c56a73cd80a725bd67e77d65be7eeff421d0f45b09f85

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
163KB

MD5
f1ab2010b7144e6d6dded4485f3b02e4

SHA1
66a4f6e6cec4a24ad64c2642212dc009b1a90bfd

SHA256
3e29af6e00850d72028031d0b9170287be15e316fa1aaef45fea161fae155b26

SHA512
cbccb53b0f47f05ea116ff63da7b158c7cd66596f8541e318083e45ef2deabd5cfed13bf6718b31d2bf9a6d1a3769650bfd4850fa28148049389b6a2853b3b5a

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
163KB

MD5
85ab7aea58d69dc4919ba2ce33803387

SHA1
d4b73dde27ed962c0aa0744eadbbcf1cddd66c73

SHA256
9e67ae3472c9201d4f90a5e682db497624875c87879b926ab3970ee286b9af69

SHA512
34f3cea60a41c6017c8ef58187655824eb0df86bb09f23566a1e79963ef3c0813fe5b5653ea3327cfb34ed3dd51c13970cbf98fbfcb0bfb1ae6d55e4b111a70c

Download Submit
C:\Windows\SysWOW64\Dmcain32.exe

Filesize
163KB

MD5
1a63be45083f7b61514a3b4b7454d377

SHA1
6f7bc0bb363226de61745608bf6621add246a92b

SHA256
ddeaa342e6f981dff18509c5f17c67cfa6f46045b4a15e95a094754e31040c5d

SHA512
79e4873d4b5e08e5dde2b865d7f014b98cbb385ab36d8ea5c5ac7690ad4cc2d17f2f1f488d349fb3454a4042455988c0ef7070896acb4297796842668f0103ee

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
163KB

MD5
14839aa61ac8d19b407a569dfb89aa3e

SHA1
20638a631095bb386c167865acdb94d8e7c5cc1c

SHA256
2fa6465d5d732b0e8adbcb6d81ab273a43e3b77908fab44c1225c45d35414c29

SHA512
236c5eaf8b0d69de08a7e5fa76727593dd2269fe9c212e5c5b4be81ae4caa986a42d77a7c30a0c252c7f595a25163ce4540e2b09842fdc0d9c9bc1205b6c7de5

Download Submit
C:\Windows\SysWOW64\Dojqjdbl.exe

Filesize
163KB

MD5
0e4345a352e223cbafb879af97c31e2f

SHA1
fbe54cd10cb7964a085b19b844fddcce20ec3a7b

SHA256
51f626f4a2a5264559f6818cebbb6497f0579cbde5c7955b487c1a718e46e698

SHA512
53cd464d92519afcdf3e09f9c12b2a5b2891d678b59339ec758626d3048126f3aa7083f8c045cdd1c794e9e38838397e2e748a633bb646c93a355a9414c9469d

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
163KB

MD5
80eef6d2837bab9daa595b1bbb27286e

SHA1
0c1e1cc336d133ec529f77b02b5d2e4b44a3d3cd

SHA256
bd0bbf82d3be2ccc34102e0b94673addb4c80bac6b2a02d23717aa2afe590c91

SHA512
67c9dc38a9cc62b7f304140a9773955769cae9f3b528ca827dbbc50f404befa8b10dd60b5f2f0b08c00e08ca0982da7ec573a5bd2efba13cbca2efff8eca214e

Download Submit
C:\Windows\SysWOW64\Ebhglj32.exe

Filesize
163KB

MD5
075fc5c489bb2e0ef4a9d62bb82a88df

SHA1
6c9369c95a31d7f2e66f98ab2efd228720bdc1b2

SHA256
88760dd704240b527ac471789ef48c7146222b274d372411ead508b48b504b72

SHA512
f4f05a66d6d17a51209fb0a05a96ceb4aabe625e71041c6c0c110b69a0a0c10f53a52c0b9138c913060f956bf62723122e051681c51be954df0067dda80d9736

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
163KB

MD5
eb7a28f71474416434cf46ac876e61f5

SHA1
95dbf4de934e777ef7f54b07f6739b3a05fcaf45

SHA256
73b474933630ce4744ff82501b6d6272977f8c4322f8dbbfe1ae607e8e78bad0

SHA512
880fc20c25ce33522c1c1d3a02c7e6413cedeb44ffa36ba201b29e99ba909c1a4e9ad251a8a986bcfcb9dc8a1a4e89c86f9043f363189a4d043f9750d2afe1c0

Download Submit
C:\Windows\SysWOW64\Eblpgjha.exe

Filesize
163KB

MD5
ea7e255622bc84316aff29061367106f

SHA1
110cdf78c2445950b4dddb686e9a063745db3013

SHA256
2e3ce5dd2e14898fa22c9bd433db1c6065c50231e32a5583bdcfd21e240a719a

SHA512
0ca5457975016f98e7eddd9a6d58318c2da719005fa36d14193928f006d9ac2c3cd9aebdddb668ffe6624b28786871eca64dda03df55aa31b1bd62d789427580

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
163KB

MD5
395cc6530ec6772b76dbab7ad00516e2

SHA1
dfdc2d5ddc7e928815f6bc583a6aff46a66d336d

SHA256
26b102a052a21b352bf421f6567fbeb6a5cdb43537992f5b7af396943ad5aa58

SHA512
2fe9633c6825f7d8fcd3071e3e4d08396a8842f2716a486fe95c0cff959cabb77b62b3bd15076bd1ed45626098ebefd831bdd234346f94b9846f18091fc25325

Download Submit
C:\Windows\SysWOW64\Ecgcfm32.exe

Filesize
163KB

MD5
0c99175d42c8df784a9abc6ee828154e

SHA1
386fb023d42814a511b71547fdf1fd7b956bec21

SHA256
fe78e514e1566e77bb2f58aa521333876770c45c137caaca2e7a0808dace4b32

SHA512
300a6dc66be8b8637050e80ff595e0eaa534eb138c3c60799a6a321187fd5c336bd2fbb2b9707ee2fda81ddae6ebebfa45eca5fcce2c57f6f8799eeb5057dbd7

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
163KB

MD5
8c3fd4685fb2ad072c7f8be053db1d75

SHA1
abf8a3cb99e9019a59616e291d1500b204e2564a

SHA256
8675febbd03f3c588e284da22b1d600c9ca9021afcb0c4f1072f3e0bf97605d9

SHA512
97ff9ac87bee8d5ee98e4fe6537871a9af8a35ee09592a68773f09c4e8776efefd42ba5a587d1169350aaddf85b59cd73bbd77a6362aeec0de3fd45eb0279c06

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
163KB

MD5
306287998ae5ea31ef8d0e09ea9b0326

SHA1
4b568474fbc74688e4acbda6e2371aed67d4f382

SHA256
7bd972b5deeb20fcd990f717f8dc23a57d3a5b52b25902e7d6a2974c7e07f90b

SHA512
be2a9f898e2781a37243e154e7aa68b07c066ad8ac79fbcd2bae0bfa4575875eaedfbf9746d9a55c2ad17eef6994fe7887039519d095a026dfb1fc7ca2cd6602

Download Submit
C:\Windows\SysWOW64\Efepbi32.exe

Filesize
163KB

MD5
4a73d8f248bafaf940e0d2ae93212ef0

SHA1
ec882b594fe03c1f1d1c9f96fb74845236baef23

SHA256
a921aa6074b18d75ba6efaa20650e5fee387c0db80baa288f67e37637592255c

SHA512
02c56e4975809d90b0ca0322f15eaccb79f552d33a175aaf620cce82bf1bec711ecade8e09eb93dc8c1ef0c3b5300e924430146b18e75ef999b563cdb6da24aa

Download Submit
C:\Windows\SysWOW64\Efhlhh32.exe

Filesize
163KB

MD5
8ab31f75f81ed5b28e835e18dabf7851

SHA1
6f1a2d364ba0838486421df97474edf66262a169

SHA256
f24d5d05edc09241eacbe94faad4131426e87efbbd0035ca9081f317cad33e32

SHA512
33dca2276f10951b0926a669c77cdb09518b48b13a56bdf226b829a13ef28dd5191821b8ba0b234da2de749f1c31a09b449e77dc32c44895501e1f14a367be87

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
163KB

MD5
60aecb9c45098cb05d79c6eda9f42021

SHA1
3003f0af671533b8ff25435a5030619943a19b29

SHA256
ad81e58de84bc8530a8d26bad45fe345e18f6b1014a295c57004e1bc6a5a4be5

SHA512
67d519745909374c3a8c5dc09a883729e5ba4141b0b005807bb7d10f088ec5342a04eec5c61431ec8f34fafcc421daaff14281912ceba66e7a1f378e87e4b9ed

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
163KB

MD5
bcb4ae5d7977c59a16c2ebac8bbd5706

SHA1
4a019911c1beee3b9cbde27edbc50721e1080aa4

SHA256
44a22a548d8fbf8b09c53cbcbefb6221a7cb4a27e9421ad086d47d21607f6d31

SHA512
554b6cf1c4b65d745fd941edb3bb9970ee41d42b2ce46b3d5989a5b8e54a54559bfaa1226c4985b87e99bfbcd48dfa8e319de4789f4b083576697b01ee3a8d26

Download Submit
C:\Windows\SysWOW64\Ejalcgkg.exe

Filesize
163KB

MD5
1e9fac3102cdbb2c57f86e8a1241f0c2

SHA1
887893bbb5daae0abc142ee0f898e9f53589a5e1

SHA256
631be2b6b257cc4ca97c10496c95087ca83bcdda55266665135c9c6dcc299dd4

SHA512
179219247b2dce1a464a9f94c7dadb3260656dfeab45fc90cbaf3e6a61103f6de010675e6f95dceae87132a70eb9757d623ee765ee8a613b3cf368a9372d7235

Download Submit
C:\Windows\SysWOW64\Ejoomhmi.exe

Filesize
163KB

MD5
490521c406a796589034765229c94cb1

SHA1
865f941dd3b846fa1f3e85c66c8476f36831a584

SHA256
a0b24391f2995740fc00f46e246dcf6ec5541e4107e22f625130920f77f2c895

SHA512
aa7ce2551cafcb75404e748af1bc8d763115c34300648e563a823c7fec345c9edf026aad37becf5bdb28c273872a093eaf25059d6ff54a59516cc196ce76e47b

Download Submit
C:\Windows\SysWOW64\Elbhjp32.exe

Filesize
163KB

MD5
e24f70af1c857869bc67d0faec66dd69

SHA1
79da643db6e8bb9f727e3a8ddaec3321f1944c6a

SHA256
77e55a848166d8fc15ef7b5e16171b6459be90dfe4e57c8d350c39e0f448a9aa

SHA512
e02d10c1e701e265dca86d5a237eb491545d0755f543053183f8b1b6acc9e60d6e859d53408b0bef216c8ac83eb5180cce781d0443a04a035d0e346947031144

Download Submit
C:\Windows\SysWOW64\Elnoopdj.exe

Filesize
163KB

MD5
10c158fa27324e69e1c38bd94650c070

SHA1
b6afa27e8e8df22c1b40f459d674b750fb3a06b8

SHA256
2b0ab19e19e69092da2c44eafe7642d58a6de339ffc3441a1b10dc71aee43976

SHA512
51fd20818d3a1a402769630031807c124cd208f552e72816e7dd8e17eead52ac1841cdfb58587f3860d6cbb52b29e90f6efa4d62dedcb0c93c677fb64f6eb8fd

Download Submit
C:\Windows\SysWOW64\Elpkep32.exe

Filesize
163KB

MD5
bcbf3567cc9bd7880adc12a7353a1e93

SHA1
2247daec0b3afdc846a0b827d094699e241d0ef6

SHA256
fb3c111d80e005262825d97420f9a46f6fc2402c7377d1a1e7ed7890df5a38ba

SHA512
ef46ca0fed23293ce6f36a2f25576bf02ee323f1f1df0ffd51becdba641286dbfb56c06a0553ead8dcc7a12c5b231dfba68bdff3ccf29ce6dac5ceebc577da38

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
163KB

MD5
53e61d749e9baa644359f74a931608eb

SHA1
e1824c2aa5fa5a35a0c3b288b101edb735fe6212

SHA256
af6614c5d80a963d2265631477e5e368fb4107da6f5593613b503528d5d8bd6b

SHA512
23e6d1433f4224b8fcfc49d5e332d7601d2d8f8890958bfd158843b0157ee29d58ecf9d064c206971a82eec6eef26a2ff618b4afc9e432e747a8f48a52859975

Download Submit
C:\Windows\SysWOW64\Emphocjj.exe

Filesize
163KB

MD5
2fe052a286188122f9d187898ff5b3c3

SHA1
fdc1ded137a12a8874785db3a67fa8e5dbf2fe48

SHA256
44d03f87483293ef13938f589768bd25c20fbf0939c05b0a167612dfa0dc513b

SHA512
3cb5c9dd306067f8f7477e870580d083ed2d8fc7585ea940bf1bbf724ddfa3a3cf95cf3f93a0d7dd4f26051d4bb94cb042fcfaadb3eae2cb52acc653afba4d48

Download Submit
C:\Windows\SysWOW64\Ennqfenp.exe

Filesize
163KB

MD5
bb85ed7b6446bdacd4d9b6dff7925683

SHA1
5e82643b6f17431b2f9bcc26e76bc3462733a51b

SHA256
7087e4c1cd9a9c4d420f39f1ca83178c8c84de999349f6de96f132111adb82fa

SHA512
52faf25f500eb0d0e4bbf4c893b8460fd8d93215a251ee8872b40f80e59759c09d06915c01eff3ea5c314b245b8d622e460308616b15a126b1298c402d41290c

Download Submit
C:\Windows\SysWOW64\Enpmld32.exe

Filesize
163KB

MD5
5e9acc3d3946c8a55aa659690f95b4e2

SHA1
64bdad541cc36e7aaa57374299069ed135ab24d7

SHA256
d0e65d88d02c74ea03bae40ab9bc57d190d976daa5290a84646c7dc21e7526a9

SHA512
271808534dcb3e619708a84cfa1e3d259e242aef58e9f3ba977aade07f629bfd8f7c2fe48ff8f4a3919c77d55f24004a5cd2ec84ab5ee42f955eb0694bc056d5

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
163KB

MD5
c8c5418a695d43ee92e46b6e089a87a7

SHA1
e6a5a1491ab4062f80712974e93da8d2bc359c74

SHA256
1744475bfe1473c84422bd27c2f83b7eee319b98d6599e7aa996e8cc6f6be458

SHA512
9ff5ba7fbfd2ef1720f830404ab29642d8533d863b456e0705a8a48cebcc5cb691304874e775513a775310d6032229234b40f865554583318be4a1877d081e21

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
163KB

MD5
c0d02593505e8902181435bd18620421

SHA1
f0a792ba5245c0536938cdd71be1a75af2edd11b

SHA256
605a1e3437773552c8329eaeaeeec24dd3f0914b36412d20562d26e03308c408

SHA512
85aa97e27979338d5f17b93a11da9db1140622c3da0656669281d4bc85c5223854d22c5a7dd44be986d4808ad12acf54d15880c0fc2fff0cbe87130ec8832ae4

Download Submit
C:\Windows\SysWOW64\Flkdfh32.exe

Filesize
163KB

MD5
d3b476934fec443401f37492dc5e9ce1

SHA1
8bf12218189221ea2c07d6c74b7d26926add34f0

SHA256
7715c0e6928f747c8adb8f809a78c762b496aa60f9c17c1f7850a5a63f935262

SHA512
754c86df493857cdd0cfedefa74ee724f5b2241fd0d4f2a0be32a0d3c79a16a141411999d03d26e9ba12cab7f25d63a67e258554ef8aa5c476bed7284443c2a1

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
163KB

MD5
2ab9506fc05aadbc26b003a60427e6b1

SHA1
2abfbd4175d34c6c5f6be0bb4d252a037daa2b32

SHA256
c8adb6968a625d374b40c12aab8cdff3b5ea6cdf59e56d495c6cb92869be643e

SHA512
e71c78a092bab68e1467b72e2019cb3f5cc98b0506d8d6b10380fe9dd5bee84964bac18433850e554eae413bcbd9231e8acca59163233dcb909e9e187adb5865

Download Submit
C:\Windows\SysWOW64\Gojiiafp.exe

Filesize
163KB

MD5
2f2c20f1c0445a26c3b32011daeba28f

SHA1
232fa993634184495d8c988120b1f74faf9505e9

SHA256
d15ee65070f94c2bb6636f69e4bcc7d3e945b940485bcdf733d7fef7755d2866

SHA512
d6ed926f700eca1554003f8312cd44ab149609ca4a730adbd22ff4c8fe70601166c02146eaf7f9990e37cd2f473875c832d717f04f04e1da1ce5b15c5b028065

Download Submit
C:\Windows\SysWOW64\Hibjli32.exe

Filesize
163KB

MD5
6c71216c0535533545e6423c116e8701

SHA1
2f1ed60fc22a2fcee69e27b534988d34693ac4df

SHA256
d00749809c97aa65fcf435399cf08dda311eae44eec132fb7a116c33820a3dbc

SHA512
edc52694e9687fe487a1d77dbc2f77581698fb52453598aab3d3fb4c22ad3768256bf5e64be2aa67c7224ca543c76ef2f32b330c3dabcb886c974e219e50cf37

Download Submit
C:\Windows\SysWOW64\Hmkigh32.exe

Filesize
163KB

MD5
39d7b4edaea3c0f3e648eacb4c5f6714

SHA1
232b81cd2502e8a34231aee594995531f8a6abd9

SHA256
cc99ee51f7bd370f5cba6e0aa6322d5545e8ac105d9cc5a5cf5dd8e7f831afa1

SHA512
37347359f859e35d349b8f7fa77cac0085432ff2cd7589fd014e752192ced3b125ef9c9a1cbe0799431ee45245c824ab7038bb317357b1adb030b374fae239cd

Download Submit
C:\Windows\SysWOW64\Hmpcbhji.exe

Filesize
128KB

MD5
9364309209b5132dbe13a7c185c770e0

SHA1
f08a16d709777a270d6fa1109b3edb1a082e8fda

SHA256
a3a031b140ce3c58739bd13a3f5f1763713d883975cb53ebfac14837b7673aea

SHA512
7c9f4ee6504f4e82134305c9d46a0b139be2439fa81695e743900624311ece2202a3e6bdc08085b86879a4395555fbe439bd6cf00280483c2d0cddf45dab7d40

Download Submit
C:\Windows\SysWOW64\Iohejo32.exe

Filesize
163KB

MD5
fcc7cb18fd528dfe2cc490d665d73403

SHA1
ff201f95614afd0af0070dbb0f0c553f3cdf6d1e

SHA256
0ad14929dad16ca8a1a284aff18c812e625602607374230ccadc20a8a4f70e44

SHA512
86694d0791636f3776b6bf71758372c1085c36ab8f1c2d6c51ebaf820a833379d615bebe6534f1756f1bd2df2b7273f475eee57c02e1884b0d46a80688febc09

Download Submit
C:\Windows\SysWOW64\Iomoenej.exe

Filesize
163KB

MD5
f4dea5021f3ef5a236232e2025a95228

SHA1
91d465e8416c102e3928377bb1c990086438f160

SHA256
7588e8a8b30e40ff624bddf55b2c3ab33f4d67e354a535d472c553b1498d9d0a

SHA512
3b906681ab1f9a129d6146f6c996d9af2f99b50c741842a0ce12b10653749ed691b29f104ccdeec265dd6407fd9a6cd56dd77e0dda1de6bca4180955a66893cf

Download Submit
C:\Windows\SysWOW64\Jddnfd32.exe

Filesize
163KB

MD5
68766335e2fb2f55163370f5df7359eb

SHA1
d8c9fef48d6d771621ab7a70258227f44e03b3da

SHA256
c79843c08b89af774852a36e0c971bfc11441fcfd85f37dd1b15aab9e7b7b83e

SHA512
86033fd8b2f2130b91eaf350bbdb222564bd4a4760bf9c57fce3637a3d186b1b3ecad182bf552837d2ff32d2c6ffe310fe95fc02223ee4d5705f23584b430382

Download Submit
C:\Windows\SysWOW64\Jpaekqhh.exe

Filesize
163KB

MD5
7449692224d1ab28fdf4e667a75a3530

SHA1
40266a68260369c3a27816b5867941dfa7368404

SHA256
dcb9874d13b1bdb6f34548d4430dd10d12c10d8a4e69452e03902fa5ebb84595

SHA512
7b61f1b4f5cd472751759c5fbaa3c5bc5492d47d51f3505ee3a47e92c6a1173c47555a894411991e01ea7ed00767a020fdae19eaf63492c7c82333bf5d2f4ac9

Download Submit
C:\Windows\SysWOW64\Jpdhkf32.exe

Filesize
163KB

MD5
66ce4be89fe869a6e70de85e853f1673

SHA1
8209245a2f1b3e7a13a940fc19da24d1b4c09f21

SHA256
0cd0fb0824e4039517dd6d9ad89f959516b288fc0f414dbbbcf1575cee3928db

SHA512
643b99badfdf4aac1629280752cea9ab8acb208253ec0c0e2bcaa85f4bb35e6ff885f38ee6ddbca67dff6f470c6840343715ae1ec1dca22174babd01fcc32d24

Download Submit
C:\Windows\SysWOW64\Kflide32.exe

Filesize
163KB

MD5
04beee600648677e394ff6f5f49c40de

SHA1
cdc118caa6bc357008a88f185149c0c0d976ee2e

SHA256
0ac804bba6104ef7ceaa1a1be1ee771b36ac9455e87ccb320286bce0a63db33e

SHA512
eee289c6dac55c044f57f7c61ed746853a66e4fcefb496ac54a82726f5040a20af45b20ac8c78dd3dc51c8a318551ba34d0fe2b207d1b799f7bd1fe14989569a

Download Submit
C:\Windows\SysWOW64\Kodnmkap.exe

Filesize
163KB

MD5
2a86535a9bc7cbdda2940395ca1cfbdf

SHA1
4218761bdddb41e4d5f41badc1da5195664c4374

SHA256
ad2129fedbe598a4b8df8269c3dc16ff3f769c4b2df0733a2cbd70b898020b52

SHA512
a6ba9dda5df186be0413e8cc5046691e3518eb36cf41cdc2d3994c424cf7ecfd856d7d37b9ce3724be6112398ba1e59310430be773fe6b213900cb1b844ff9fd

Download Submit
C:\Windows\SysWOW64\Lckiihok.exe

Filesize
163KB

MD5
133010a716855c6f1bf4e2a39bcfc444

SHA1
ab1b31402379f2df9fcad172b91cdaf58fa7bba6

SHA256
02ac39b7803550aa777e23b2c144f957bbc102aa76fbc4c46b3074dfb2b5c4f7

SHA512
232802b688447b7fe910a4bcda581243fd3683c76c247c62789d2f66cbf1bfd8d41f38ae4d3d40650068bffe2c7600085e6cdbacbc99c024a796a73fc92dc6ce

Download Submit
C:\Windows\SysWOW64\Lcnfohmi.exe

Filesize
163KB

MD5
4a23012a40f4b2402f1eefecac27ecfd

SHA1
ec76162d81de43ace5f009bc4b44d0e45be08fa7

SHA256
8fca89af7197d665765bc0c80a59a2515bcaf672bd778ce1429ce7ba61b04b7d

SHA512
95b88a8d0ed05b2eecd6c5e7cc8b7583706217561a146875b5974873b61e529568dd9c4450594b237c3b10be6bd0c5b4cec4ab5cf637aad6344a81459387b3f8

Download Submit
C:\Windows\SysWOW64\Lekmnajj.exe

Filesize
163KB

MD5
64c777b3da8ef4ed3dd6fa056cdadaad

SHA1
0081942caf17d1246b1f685660f1aad144349a27

SHA256
52548bb24d2cf54049f0b1f42b6596a85fd9f5891b1059b76fac82668c359e63

SHA512
a33258db19cdb7920610fd906b68dbee54326712bf205115e792fbcc30107c5a7aaf3b2fa07f57a22f90c0132ed17630f34d6c3f3858be8e514f33087ba2a928

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
163KB

MD5
ad9f6041770b3a96d869915648c4e2d4

SHA1
159bdb2e71d3211e8cd3ae3079de3948d7b64f11

SHA256
5e021a1b73015fb84a3e9bee1cbb26a9e645b8df91437d81d5535de669539643

SHA512
4309fa34efecf4c86780255554a9b056032cb6ed9eb5eb79696a51654b95629628f9069370c1fabf4e04cfa49838f534ade78c4327ea4ec55887f3947111a7c5

Download Submit
C:\Windows\SysWOW64\Lnjgfb32.exe

Filesize
163KB

MD5
8f9d2d2fadee255cc6a252d5ad1dfe09

SHA1
6bceb4acbc30b0adbbb2bd2ecc5b18e172d1e580

SHA256
f51a9d5b524d112fd90dca1fa559d560d319335730e4f0f693fd7599cb5d7bde

SHA512
c95d4bf3a5fcfc7b1dfed515f88025355866c7a36362034343ec11167e1fb95a3541097ed7d1af9c1dd7861234341d8c3e6d1f5e55baa6ef428b2a39de0c4e24

Download Submit
C:\Windows\SysWOW64\Lnldla32.exe

Filesize
163KB

MD5
e9b7046bfe401928741af29057951aa3

SHA1
961f1ee2762426247b2a726e2c4af3fa05267320

SHA256
fbb7d5de4b448a26057a14cf69f3f412fc9cfcdfce5ef404e52958ec33a4dd30

SHA512
2fd97d187ffaae1a6e2d697cdf7b8b6f2dff2821526ba4dc532f63b2d1cf7f03cecaf17da2cb6f9d34f97419cc287f9a482a540ba625ecbaeadcebfd20c5e133

Download Submit
C:\Windows\SysWOW64\Maggnali.exe

Filesize
163KB

MD5
1bcad82029060903d67c30723b071da1

SHA1
9c5bb7415678ce7f6e214ada3ddcdc46e65770a8

SHA256
f6ee4db9d644cdffa1fb09d00639eaf586ccb3723b4d1c89bf96c94f6ae2b2b6

SHA512
3b7a4f92f91c8cc2e88c4b62cb28c746a6566ee3c3960eed6b87cb331d2f23fc4a31d0ffc901f0e2b28a2a4256551c0ae3f0213ef3c10070900ae436c219a196

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
163KB

MD5
1f3686466275bd8226a6fd2c4c353ebf

SHA1
b3aa81ce788497820fffef15ba8fb8c387cee11c

SHA256
b62a4ada1470d3e00f6095e26d81b1d5af559b163ebcdf7993f20f06fe1faad7

SHA512
7cacf92dd3208867a2de5c6371eed1695fc5c073f9055fdccc0298a4ec8523e438c91916b5c28a8e1c4d74101643d1892941a419e6d59dd54ec0bb64834fb1ce

Download Submit
C:\Windows\SysWOW64\Mmbanbmg.exe

Filesize
163KB

MD5
c076f4fed9ffc956c1ee4e63a743c6c4

SHA1
836f7115f06a96817b36fea5a0ef285060d81193

SHA256
27cb57f02e063bb779cb2a74065fecbae038d48dd2d20561c913595a2fc4a3fb

SHA512
1d9271c4414dafb78ddf795a7763ae2733eaf30ab22bdd9b5ec52a0795a0aa1ae52780320dcc70da82ad980413eccc1c5955d418be8d548abf8ce8626c75b2d0

Download Submit
C:\Windows\SysWOW64\Mmhgmmbf.exe

Filesize
163KB

MD5
e47b85a4f151166ca433176c3a4e4d73

SHA1
0689b556e1071232ffd4e13c61d9a37c478191f1

SHA256
0f9eea04eede9ef9b7cab818d4cfc7bf7ead35bb3f3445ea8ee9996bad05915f

SHA512
c9330cbc6986c2fc78245f0b448c3c0be8bc075c2f1c52807a62b315cd673eb26495a735fe265abed0888bba0e4714bace688585391d5ee5450d14b55721159f

Download Submit
C:\Windows\SysWOW64\Nfjola32.exe

Filesize
163KB

MD5
d4ce339ca798ee80b801551771bd15ae

SHA1
2ef1112cadf6381fe60a27b1ee11ba183e416be2

SHA256
b463dba901090cf7fd10b908dfad30d1a3a6db47ef2079a5be2616f6dcc284ec

SHA512
50579689150cd9eb155c63196aa33b33745057ccab9ca177fa05790b90ecbd52d6ae0096bea6e64e17ba877fe699efe5016a2b027b63f64da848a8f226f1bd8a

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
163KB

MD5
6951e8317c39f191260237f3b704c805

SHA1
84891516ac30e2c6c6b8622af1df7298f1a6f50b

SHA256
02400398daf689e99e3bc4adeadf9406cdb43cac059916f2a66bff9f609797fe

SHA512
377d79f7ffc4552aeda847fabcd7ef37a2f5a288413b50583af4eaf6dc57364a25edb240c475e91f668a1a8067a1851e27a28fad7d4b17f6b81e01cc6be1eee8

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
163KB

MD5
6e095ad6f0a54416fe5ba4ec4ede3caa

SHA1
c032d3bb46f5a2033d9bb3e224cb1fcd3b5d547a

SHA256
75f783fad7530d7e3af4a9072c0911247603384b7781dac8190d2f945dd39f7d

SHA512
860e8846e42e8dfe7da1e4af3165ce5d58bdd5323db7fa1198beac74d77cf039eebdf10a6ca2a0c2134e035b7374946dc810097448fde9728390a3abde99d20f

Download Submit
C:\Windows\SysWOW64\Njkkbehl.exe

Filesize
163KB

MD5
9d03d3efb80b45dbecf3511f6baa20de

SHA1
8fd01311cdeb0fc8f1f5d9068f6b434346dfec89

SHA256
90417d853a19c779e4077d310a381830a73aa2804130d608ca5032e56ec2e709

SHA512
7e7acb9db177d9142498746457adac3e10b196a02ccdefe36a079696eb143637e69fe733c83c7bbdab743c722cde30ad6894bdc69dc3130fdb07e1c2e64fd8f8

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
163KB

MD5
610f77069271f2b8e4694522a932d5a9

SHA1
b6f31ce2c9b0c411f12246c6e73a769246c70637

SHA256
8a389db8cb7068dfdee67ac16228d433087e2bb06b8f5c9836537c6bf4507d50

SHA512
24a61a1549d2df65f0496003fbf49615005743ae239d6dbbc4f5d38d7acc67ed1f3945eff3ee9faa4966afb6c60550ba1c165c7566fd191ad85c9f5aca56452e

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
163KB

MD5
d4f9ecc25f5c25307571f99ca30d4cd5

SHA1
41a8805d5d4584e05c1d13e7bc568b8c8a25d4aa

SHA256
cd1478b40233ed73d42697c5996cc00725156c3b946657f5b3acb97ded8be05b

SHA512
81150ea1e1bf0e0a9f42ae513bd8eb54c970f1db2874c7e2d962a3475425dcd32e918f753fe155acbf6a60434cf90eb8c5e40ec20d79fcab6ae034593b68635d

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
163KB

MD5
77f1546990d974cdd9fc817b962a9c15

SHA1
c47221ee05f26da4f2eab13856c75f76acf23837

SHA256
068d91df6ee16f87c6a455f9cad284c3dcc609dd8ade8cc7a497d3fe7b8f068d

SHA512
48116e295a0ec249c99e07af1410f749b3373640da648583c91c4d0a57558a7752a902e687b2e6e0e9e53d400f5cf34b43cd2eaaef3ac18f8491d21f58790d93

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
163KB

MD5
61f87d63c25bc9dcf22af4ba115dd8b1

SHA1
1895ac7be81f11f09110b9eef270f9e2f37858f3

SHA256
4c9d9c254269f973083c2900cba46c08c1d9bd3eb26356c9a1db0c5896844430

SHA512
80f3fb492ca0505727b9835087edbd929aaa6cd38f14acb713c02ee960c6aa41656b56e7e8ca8c24f4cd8bfeff6430fa6889ad77447c6f48881cc22630e12f7f

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
163KB

MD5
711c92b3bf08c1447fe7c3092039d8b1

SHA1
06dad854b695f202c353a1712bf8645a8a143594

SHA256
2a5a76a79db093fb3e7ffee412e997399eeaa8647d10dee402cdb3f6c16e6d8c

SHA512
91d42dbd194d4b01b65e1136183419f6e603eb3eab26483367629e795220000b1bc1780e3ead4446a5186259db2f9609ea6ae3ba3650179051b1730fc39339e7

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
163KB

MD5
9e8e159d32ccb8e3aad86d89f33a8aba

SHA1
85b1b803e2201141610e5d663c5a37fd05e660cb

SHA256
3b8453b517400ac944c4b74a6b27d2fdfa2fe4041ae804e0806b3f80b2d1e32c

SHA512
f09e9e6df5705ae7b26a52c87fcf0a1e430c6a53f51cc367e0b48c5262ed760cbcb1b2110e5f811cce1351364e6fbee4ad302669a29dd2eaf684274321ffc6eb

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
163KB

MD5
df236f99a66b92121465ee4e3cb9478d

SHA1
c817b8e16261bcc37137f382f25f05d348c1e9ff

SHA256
a834f0319fce016dfa0fba593d1988ebb02a5cfe4d51f19f258931ba8e2fc22c

SHA512
6da96439b84315faea81c2ff0b433499a567dd78330932cdbaf78de76d80ff75de323905e9b65dffe3d4d5eb7871a207dd38b7394511512b98ea045cc7b826b5

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
163KB

MD5
b6511620689b5dc6607eb03fd51241a4

SHA1
8ad5897db2668bd04309ec14f8759131d9966822

SHA256
b6e7860941b1d88bdd151336afd6c265d0d6236f9c00508105b5f31761a5a200

SHA512
7f2beec825d885746524fa7fff857f4bf69d3fc0efeff808e0cade211ce0c551a59dafeecdf970ea7569c407d178cbab6f916df7cc2891daa1611656b70407d9

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
163KB

MD5
46fffca917fa11d1eb1a46c94d09ea9a

SHA1
c159d078c98d75728b23048d99f8a69c085024c3

SHA256
e1cb06d10aa07c94462d8a3c99d0b35bd382e59f767079937cda03f09eb83a5c

SHA512
0a76679928c13bf9b12634ed2457b68d4406666f42a6e0dcdb73459934798e21d9b2a87a3ac6c6a9a021a95a4ae06c6c8da9377d85790e306399c1b65a86b073

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
163KB

MD5
3b5be5a953b725d1653c1778923e321f

SHA1
793b2999a54fa744b56d2d89efcd6c26db470951

SHA256
5b69edd3dcd62fa51b3662d03564e3b158c3b5b7441ad07d6ba342d6d4a63911

SHA512
6a08e06438fd67c9a2b1421dee48d8c60858cb4791367956b61e813719d37545918706f51a3ca0d10c3b0cdd24ddae7c6021753a668fb6848b753745118b9e44

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
163KB

MD5
6088aa47b1a60ecb7f115b0de1d29177

SHA1
85e05013aaee889f86ab248124814e59d1c48aeb

SHA256
890000366d096148f6f913c595c8c1099f1807ab8a806e58e3806371209e58c4

SHA512
7918651248ca8e8b431ba79fdbf5f7b2977f4e70a387d8b7db428606e9e5a3a590a10ba9649f43196e234501b98c5aaae420c60da8bdccbd5358f714c2acaac2

Download Submit
C:\Windows\SysWOW64\Pocpfphe.exe

Filesize
163KB

MD5
bc2f44e7087d2c9c50895498740e86a3

SHA1
3cdc22333772769991484507f9a3a6eca8c00bfa

SHA256
dad42480f39f02e5da0ed164fb9b942b218743afe49938c074cca19e8626b3f9

SHA512
02404eccfd0fad6984d49f7bf7c0e43dda26d410a175b05e7c154d3bbe273fed94cda5a06ec30df2f4c02a9135e99c39879cc6d89988e7bace4dfc11cb9228ea

Download Submit
C:\Windows\SysWOW64\Qhhpop32.exe

Filesize
163KB

MD5
8c32959fc9cc5f3015100f9903b997e4

SHA1
3316ee96a9267938793178b384c86c49e9dfbd25

SHA256
349578458220e580375844f94567b21786c2a87e4ebba217fe0d46e27dbf3702

SHA512
30bfdf9f154b05c1affc3faa79df1be6f86ed8e4f02570885ffc09ca9d955e94b0d9b74558900bcf612ed14a5d8d4a8a9164f8eb7a66c37a04bdd143647e00a0

Download Submit
C:\Windows\SysWOW64\Qklmpalf.exe

Filesize
163KB

MD5
d81d6323a3eb19202ca1226afa88fd56

SHA1
c20964edb4b1e8d93a5451fa9ef07e7d016df359

SHA256
8ef2c6f4423f6e0874827c543bce0c5d33012a09245fb2b4c73a490c7273711a

SHA512
a4e6ea34f3aef500e585899cdd76b097a4b05b8820b7bbc8d4d0d1d2faa56a13f3a075929da119073981073eff0a77ef488c3bbb19192c67ef3067044e9f1888

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
163KB

MD5
4716e3840ad5d1671115852e20a8da28

SHA1
92b09793b23c6da2a4339504dd0a326869aee9bb

SHA256
f4691150f38a5a56cfb89abb8115695ff24db182652a363950c90ec9fca5aafe

SHA512
d6de0adbd4aa7d980c6b8b940fca061295916ac18f36a59aa2e03f0cdba01e37be0d095a72db634742a3135e8f054c8dec89f2ff547ab28a29d74fc4dd7d8206

Download Submit
memory/32-296-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/220-197-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/416-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/416-600-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/420-608-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/472-499-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/628-3823-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/628-24-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/628-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/676-213-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/764-332-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/864-587-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1008-266-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1032-638-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1032-142-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1036-476-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1172-560-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1284-546-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1308-452-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1404-344-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1428-525-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1432-393-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1472-356-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1480-458-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1612-338-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1640-272-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1768-512-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2120-48-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2120-566-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2136-531-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2136-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2244-314-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2276-236-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2372-290-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2436-518-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2436-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2436-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2452-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2452-552-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2612-372-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2616-113-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2616-620-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2684-279-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2792-153-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2808-228-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2816-487-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2848-260-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3012-320-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3056-567-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3080-165-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3172-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3236-440-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3292-470-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3308-586-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3308-72-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3336-181-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3464-446-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3524-500-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3544-383-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3716-538-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3716-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3852-580-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3864-519-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3912-252-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3928-120-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3928-626-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4200-40-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4200-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4216-285-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4220-532-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4224-205-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4296-308-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4412-96-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4412-607-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4456-594-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4476-129-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4476-632-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4480-80-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4480-593-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4556-150-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4556-644-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4604-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4636-189-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-579-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4752-350-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4788-325-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4804-506-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4848-601-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4852-464-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4884-173-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5000-493-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5004-614-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5004-104-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5008-577-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5008-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5028-244-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5932-3105-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6132-3561-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6352-3511-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7260-3408-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7596-3392-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9064-3204-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9116-3249-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9444-3162-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9624-3156-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/9668-3132-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10444-3095-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10784-3041-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/10872-3063-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/11660-3025-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads