berbew | 9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7.exe
Size

368KB
MD5

e8f1865aca921f6c5fd6fba96154ec62
SHA1

290e6df6e633390d326b3cd1f30e10ecc64044d2
SHA256

9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7
SHA512

20e54ad621cc317ca53a7affeb0de459e977796e7b9f6fb4e632a0536b1d2b3d8637c15bdb8fe83d78cf8ec7ced50562fed25b474b5334d042db0cf379b034c9
SSDEEP

6144:jSbektEoqrQO+zrWnAdqjeOpKfduBX2QO+zrWnAdqjsqwHlGrh/tO7:WtJa/+zrWAI5KFum/+zrWAIAqWie

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plpjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqhafffk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpcodihc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfglfdkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jniood32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnifekmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gngeik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbofcghl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqoloc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mhjhmhhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdobnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knalji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekkkoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpiqfima.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiieicml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qoelkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkjeomld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpnjah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjgchm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkpbin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmfkhmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icdheded.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbdcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jocefm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjjnifbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpjmph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdkdgchl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baadiiif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhkdof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekljpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpcodihc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oejbfmpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plkpcfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plpjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ompfej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opclldhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Innfnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enhpao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogekbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpfepf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpedeiff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iljpij32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4148	Eiieicml.exe
3076	Fpbmfn32.exe
1016	Fjjnifbl.exe
1836	Fmkgkapm.exe
3960	Fpjcgm32.exe
1872	Fffhifdk.exe
2496	Gigaka32.exe
4616	Gbofcghl.exe
3704	Gjfnedho.exe
3416	Gmdjapgb.exe
3372	Gdobnj32.exe
2664	Gbfldf32.exe
3820	Gkmdecbg.exe
3940	Hdehni32.exe
2576	Hbhijepa.exe
4336	Hplicjok.exe
3252	Hckeoeno.exe
908	Hmpjmn32.exe
1324	Hpofii32.exe
1316	Hcmbee32.exe
928	Hkdjfb32.exe
4672	Hmbfbn32.exe
2652	Hpabni32.exe
4884	Hdmoohbo.exe
4176	Hgkkkcbc.exe
1288	Hiiggoaf.exe
3636	Hmechmip.exe
4484	Hpcodihc.exe
4052	Hcblpdgg.exe
4920	Hkicaahi.exe
3388	Hildmn32.exe
3732	Iljpij32.exe
1492	Icdheded.exe
4864	Iinqbn32.exe
4168	Ilmmni32.exe
1816	Icfekc32.exe
5028	Iloidijb.exe
4812	Igdnabjh.exe
3152	Innfnl32.exe
2092	Ipmbjgpi.exe
1560	Icknfcol.exe
2720	Ikbfgppo.exe
3896	Inqbclob.exe
1264	Ipoopgnf.exe
4896	Icnklbmj.exe
5096	Jjgchm32.exe
4576	Jlfpdh32.exe
4804	Jcphab32.exe
2784	Jgkdbacp.exe
3512	Jnelok32.exe
1052	Jpdhkf32.exe
544	Jcbdgb32.exe
5112	Jkimho32.exe
2876	Jnhidk32.exe
1248	Jpfepf32.exe
2660	Jcdala32.exe
3508	Jjoiil32.exe
4436	Jqhafffk.exe
1900	Jcgnbaeo.exe
1632	Jknfcofa.exe
3096	Jnlbojee.exe
4700	Jqknkedi.exe
1136	Jcikgacl.exe
3488	Kkpbin32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hdehni32.exe	Gkmdecbg.exe
File created	C:\Windows\SysWOW64\Dnbokg32.dll	Hcmbee32.exe
File created	C:\Windows\SysWOW64\Kqfngd32.exe	Knhakh32.exe
File opened for modification	C:\Windows\SysWOW64\Mepfiq32.exe	Mnfnlf32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhnbhok.exe	Oejbfmpg.exe
File opened for modification	C:\Windows\SysWOW64\Poliea32.exe	Phaahggp.exe
File opened for modification	C:\Windows\SysWOW64\Gmimai32.exe	Geohklaa.exe
File created	C:\Windows\SysWOW64\Cnaqob32.dll	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Mliapk32.dll	Adepji32.exe
File created	C:\Windows\SysWOW64\Momkkhch.dll	Fpjcgm32.exe
File created	C:\Windows\SysWOW64\Bmnogj32.dll	Olanmgig.exe
File opened for modification	C:\Windows\SysWOW64\Cbfgkffn.exe	Cnkkjh32.exe
File created	C:\Windows\SysWOW64\Digehphc.exe	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Mfchlbfd.exe	Mnhdgpii.exe
File opened for modification	C:\Windows\SysWOW64\Pnifekmd.exe	Pccahbmn.exe
File created	C:\Windows\SysWOW64\Mablfnne.exe	Mpapnfhg.exe
File opened for modification	C:\Windows\SysWOW64\Objkmkjj.exe	Ofckhj32.exe
File opened for modification	C:\Windows\SysWOW64\Ndflak32.exe	Nagpeo32.exe
File created	C:\Windows\SysWOW64\Ahbjoe32.exe	Anmfbl32.exe
File created	C:\Windows\SysWOW64\Lpamfo32.dll	Ahippdbe.exe
File created	C:\Windows\SysWOW64\Hpioin32.exe	Hioflcbj.exe
File created	C:\Windows\SysWOW64\Iaejqcdo.dll	Iamamcop.exe
File created	C:\Windows\SysWOW64\Fldeljei.dll	Mfpell32.exe
File created	C:\Windows\SysWOW64\Ghaeocdd.dll	Ofckhj32.exe
File created	C:\Windows\SysWOW64\Pjcikejg.exe	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Fbihneaj.dll	Kdigadjo.exe
File opened for modification	C:\Windows\SysWOW64\Enigke32.exe	Ekkkoj32.exe
File created	C:\Windows\SysWOW64\Iefeek32.dll	Iibccgep.exe
File created	C:\Windows\SysWOW64\Cepjip32.dll	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Hioflcbj.exe	Giljfddl.exe
File created	C:\Windows\SysWOW64\Oipgkfab.dll	Mlhqcgnk.exe
File created	C:\Windows\SysWOW64\Olqjha32.dll	Aadghn32.exe
File created	C:\Windows\SysWOW64\Ecgodpgb.exe	Ephbhd32.exe
File opened for modification	C:\Windows\SysWOW64\Ecgodpgb.exe	Ephbhd32.exe
File opened for modification	C:\Windows\SysWOW64\Gbfldf32.exe	Gdobnj32.exe
File created	C:\Windows\SysWOW64\Inngdb32.dll	Jcbdgb32.exe
File opened for modification	C:\Windows\SysWOW64\Blgifbil.exe	Bdpaeehj.exe
File created	C:\Windows\SysWOW64\Qffkpn32.dll	Bomkcm32.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jljbeali.exe
File created	C:\Windows\SysWOW64\Mqkiok32.exe	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Jlmcka32.dll	Hpofii32.exe
File opened for modification	C:\Windows\SysWOW64\Hcblpdgg.exe	Hpcodihc.exe
File opened for modification	C:\Windows\SysWOW64\Ldipha32.exe	Lmbhgd32.exe
File created	C:\Windows\SysWOW64\Omqmop32.exe	Oloahhki.exe
File created	C:\Windows\SysWOW64\Oddfcg32.dll	Anmfbl32.exe
File created	C:\Windows\SysWOW64\Ddipic32.dll	Hibjli32.exe
File created	C:\Windows\SysWOW64\Hfhgkmpj.exe	Hlbcnd32.exe
File created	C:\Windows\SysWOW64\Kjblje32.exe	Kcidmkpq.exe
File opened for modification	C:\Windows\SysWOW64\Mcgiefen.exe	Mokmdh32.exe
File opened for modification	C:\Windows\SysWOW64\Kpiqfima.exe	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Plpodked.dll	Mfbaalbi.exe
File created	C:\Windows\SysWOW64\Iponmakp.dll	Bdcmkgmm.exe
File created	C:\Windows\SysWOW64\Fpiedd32.dll	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Empmffib.dll	Inqbclob.exe
File created	C:\Windows\SysWOW64\Jnhidk32.exe	Jkimho32.exe
File created	C:\Windows\SysWOW64\Omegjomb.exe	Ojgjndno.exe
File opened for modification	C:\Windows\SysWOW64\Jcfggkac.exe	Jniood32.exe
File created	C:\Windows\SysWOW64\Mmfkhmdi.exe	Lqojclne.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Ojdgnn32.exe
File opened for modification	C:\Windows\SysWOW64\Pjdpelnc.exe	Ppolhcnm.exe
File created	C:\Windows\SysWOW64\Ieppioao.dll	Dhikci32.exe
File opened for modification	C:\Windows\SysWOW64\Eghkjdoa.exe	Egened32.exe
File opened for modification	C:\Windows\SysWOW64\Kadpdp32.exe	Klggli32.exe
File opened for modification	C:\Windows\SysWOW64\Mablfnne.exe	Mpapnfhg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11912	12064	WerFault.exe	621

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npgmpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccmcgcmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjfnedho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfpdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qoelkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibcaknbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbjoeojc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkceokii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Impliekg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baadiiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhqcgnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiiicf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcikejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahpmjejp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjgfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkofga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Digehphc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmeigg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqfbpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edaaccbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpjmph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcikgacl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dijbno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emanjldl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcgiefen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbfbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqknkedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enigke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibhkfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcphab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacoqnci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bafndi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgiimng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eppjfgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glgcbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpmdfonj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gojiiafp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhgkmpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncqlkemc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaebef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgnbaeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqkgbcff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgbloglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfchlbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloidijb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkgje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmhhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onpjichj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahippdbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lancko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llnnmhfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgkdbacp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olanmgig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dokgdkeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oodcdb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhoneioi.dll"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fechomko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dickplko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdflmg32.dll"	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aadafn32.dll"	Njjmni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccmcgcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpjcgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnhenj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekeodnf.dll"	Lqkgbcff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkpbin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bojomm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocfgbfdm.dll"	Fbmohmoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mhjhmhhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glaecb32.dll"	Gbfldf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpenhh32.dll"	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfikmmob.dll"	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcdala32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jniood32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldipha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bomkcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfbaalbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkppnab.dll"	Dgpeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmpjmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfbhmo32.dll"	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboeai32.dll"	Dngjff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipaooi32.dll"	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgnagk32.dll"	Kqfngd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlhkgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Naecop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omegjomb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jiglnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nhhdnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndbpeal.dll"	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgicnp32.dll"	Dggbcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnlinml.dll"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iekkfckg.dll"	Knalji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odalmibl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aaldccip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqbala32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4148	1092	9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7.exe	85
PID 1092 wrote to memory of 4148	1092	9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7.exe	85
PID 1092 wrote to memory of 4148	1092	9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7.exe	85
PID 4148 wrote to memory of 3076	4148	Eiieicml.exe	86
PID 4148 wrote to memory of 3076	4148	Eiieicml.exe	86
PID 4148 wrote to memory of 3076	4148	Eiieicml.exe	86
PID 3076 wrote to memory of 1016	3076	Fpbmfn32.exe	87
PID 3076 wrote to memory of 1016	3076	Fpbmfn32.exe	87
PID 3076 wrote to memory of 1016	3076	Fpbmfn32.exe	87
PID 1016 wrote to memory of 1836	1016	Fjjnifbl.exe	88
PID 1016 wrote to memory of 1836	1016	Fjjnifbl.exe	88
PID 1016 wrote to memory of 1836	1016	Fjjnifbl.exe	88
PID 1836 wrote to memory of 3960	1836	Fmkgkapm.exe	89
PID 1836 wrote to memory of 3960	1836	Fmkgkapm.exe	89
PID 1836 wrote to memory of 3960	1836	Fmkgkapm.exe	89
PID 3960 wrote to memory of 1872	3960	Fpjcgm32.exe	91
PID 3960 wrote to memory of 1872	3960	Fpjcgm32.exe	91
PID 3960 wrote to memory of 1872	3960	Fpjcgm32.exe	91
PID 1872 wrote to memory of 2496	1872	Fffhifdk.exe	93
PID 1872 wrote to memory of 2496	1872	Fffhifdk.exe	93
PID 1872 wrote to memory of 2496	1872	Fffhifdk.exe	93
PID 2496 wrote to memory of 4616	2496	Gigaka32.exe	94
PID 2496 wrote to memory of 4616	2496	Gigaka32.exe	94
PID 2496 wrote to memory of 4616	2496	Gigaka32.exe	94
PID 4616 wrote to memory of 3704	4616	Gbofcghl.exe	95
PID 4616 wrote to memory of 3704	4616	Gbofcghl.exe	95
PID 4616 wrote to memory of 3704	4616	Gbofcghl.exe	95
PID 3704 wrote to memory of 3416	3704	Gjfnedho.exe	96
PID 3704 wrote to memory of 3416	3704	Gjfnedho.exe	96
PID 3704 wrote to memory of 3416	3704	Gjfnedho.exe	96
PID 3416 wrote to memory of 3372	3416	Gmdjapgb.exe	98
PID 3416 wrote to memory of 3372	3416	Gmdjapgb.exe	98
PID 3416 wrote to memory of 3372	3416	Gmdjapgb.exe	98
PID 3372 wrote to memory of 2664	3372	Gdobnj32.exe	99
PID 3372 wrote to memory of 2664	3372	Gdobnj32.exe	99
PID 3372 wrote to memory of 2664	3372	Gdobnj32.exe	99
PID 2664 wrote to memory of 3820	2664	Gbfldf32.exe	100
PID 2664 wrote to memory of 3820	2664	Gbfldf32.exe	100
PID 2664 wrote to memory of 3820	2664	Gbfldf32.exe	100
PID 3820 wrote to memory of 3940	3820	Gkmdecbg.exe	101
PID 3820 wrote to memory of 3940	3820	Gkmdecbg.exe	101
PID 3820 wrote to memory of 3940	3820	Gkmdecbg.exe	101
PID 3940 wrote to memory of 2576	3940	Hdehni32.exe	102
PID 3940 wrote to memory of 2576	3940	Hdehni32.exe	102
PID 3940 wrote to memory of 2576	3940	Hdehni32.exe	102
PID 2576 wrote to memory of 4336	2576	Hbhijepa.exe	103
PID 2576 wrote to memory of 4336	2576	Hbhijepa.exe	103
PID 2576 wrote to memory of 4336	2576	Hbhijepa.exe	103
PID 4336 wrote to memory of 3252	4336	Hplicjok.exe	104
PID 4336 wrote to memory of 3252	4336	Hplicjok.exe	104
PID 4336 wrote to memory of 3252	4336	Hplicjok.exe	104
PID 3252 wrote to memory of 908	3252	Hckeoeno.exe	105
PID 3252 wrote to memory of 908	3252	Hckeoeno.exe	105
PID 3252 wrote to memory of 908	3252	Hckeoeno.exe	105
PID 908 wrote to memory of 1324	908	Hmpjmn32.exe	106
PID 908 wrote to memory of 1324	908	Hmpjmn32.exe	106
PID 908 wrote to memory of 1324	908	Hmpjmn32.exe	106
PID 1324 wrote to memory of 1316	1324	Hpofii32.exe	107
PID 1324 wrote to memory of 1316	1324	Hpofii32.exe	107
PID 1324 wrote to memory of 1316	1324	Hpofii32.exe	107
PID 1316 wrote to memory of 928	1316	Hcmbee32.exe	108
PID 1316 wrote to memory of 928	1316	Hcmbee32.exe	108
PID 1316 wrote to memory of 928	1316	Hcmbee32.exe	108
PID 928 wrote to memory of 4672	928	Hkdjfb32.exe	109

C:\Users\Admin\AppData\Local\Temp\9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7.exe
"C:\Users\Admin\AppData\Local\Temp\9abc3f1ff521ebbd023f1eceabb70231bec9f583815206179a20716895956ac7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\Eiieicml.exe
  C:\Windows\system32\Eiieicml.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\Fpbmfn32.exe
    C:\Windows\system32\Fpbmfn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\SysWOW64\Fjjnifbl.exe
      C:\Windows\system32\Fjjnifbl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
      - C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        24⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        25⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        26⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1288
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        28⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        30⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        31⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        32⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        35⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        36⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        37⤵
        Executes dropped EXE
        
        PID:1816
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        39⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3152
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        41⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        42⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        43⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3896
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        45⤵
        Executes dropped EXE
        
        PID:1264
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        46⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        51⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        52⤵
        Executes dropped EXE
        
        PID:1052
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:544
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5112
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        55⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2660
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1900
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        61⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        62⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        66⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        67⤵
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        68⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:404
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        71⤵
        Modifies registry class
        
        PID:2716
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        72⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        73⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        74⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:4076
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        76⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        77⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        78⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5116
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        81⤵
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        82⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        83⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        84⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        85⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        86⤵
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        87⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        88⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        89⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        90⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        91⤵
        Drops file in System32 directory
        
        PID:4980
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        92⤵
        Modifies registry class
        
        PID:100
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        93⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        94⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        95⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        96⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        97⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        98⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        99⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        100⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        102⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        103⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        104⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        105⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        106⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        107⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        108⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        109⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        110⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        112⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        114⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        115⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        116⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:412
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        118⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        119⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        120⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        124⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        125⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        126⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        127⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        128⤵
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        129⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        132⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        133⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        134⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        135⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3256
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        137⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        138⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        139⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        140⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        141⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        142⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        143⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        145⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        146⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        147⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        148⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        149⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        150⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        151⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4940
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        156⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        157⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        159⤵
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        160⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        161⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        162⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        163⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        164⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        166⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        167⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        168⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        169⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        170⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        172⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        173⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        174⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        175⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        176⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        177⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        178⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        180⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        181⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        182⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        183⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        184⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        185⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        187⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        188⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        189⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        190⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        191⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        192⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        193⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        194⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        195⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        197⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        198⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        199⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        200⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        201⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        202⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        203⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        204⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        206⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        208⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        209⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        211⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        213⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:7224
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        215⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        216⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        218⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        219⤵
        Modifies registry class
        
        PID:7440
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        220⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        221⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        224⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7700
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        226⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        227⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        228⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        229⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        230⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        231⤵
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        232⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        233⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        234⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:8148
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        237⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        238⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        239⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        240⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        241⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        242⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        243⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        244⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        245⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        246⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        247⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        248⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        249⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        251⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        252⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7428
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        254⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        255⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        257⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:7960
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        259⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        261⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        262⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        263⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        264⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        265⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        266⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        268⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        269⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        270⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        271⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        273⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        274⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8256
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        276⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        277⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        278⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8432
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        281⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        282⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        283⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        285⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        286⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        287⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        288⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        289⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        291⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        292⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        293⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        294⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9132
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        296⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        297⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        298⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        299⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        300⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8592
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        303⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        304⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        305⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        307⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2540
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:9020
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        310⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        311⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8224
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        313⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        314⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        315⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        316⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        317⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        318⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        319⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        320⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        321⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        322⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        323⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:8312
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        325⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:8964
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        327⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        328⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        330⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:9228
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9324
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9360
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9412
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        337⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        338⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9596
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        340⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9684
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        342⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        343⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        344⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        345⤵
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        346⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9948
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        348⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        349⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:10080
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        351⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        352⤵
        System Location Discovery: System Language Discovery
        
        PID:10168
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        353⤵
        Modifies registry class
        
        PID:10212
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        354⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        355⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        356⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        357⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        359⤵
        Modifies registry class
        
        PID:9540
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        360⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        361⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        362⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:9824
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        364⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        365⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        366⤵
        Modifies registry class
        
        PID:10024
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        368⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        369⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        370⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        371⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        372⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        373⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9716
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        375⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        376⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        378⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        379⤵
        System Location Discovery: System Language Discovery
        
        PID:10132
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        380⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        381⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        382⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        383⤵
        Modifies registry class
        
        PID:9584
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        384⤵
        Modifies registry class
        
        PID:9804
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        385⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        386⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10052
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        387⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        388⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        389⤵
        Modifies registry class
        
        PID:9624
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        390⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        391⤵
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10204
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        393⤵
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        395⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        396⤵
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        397⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        398⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        399⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        400⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        401⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        402⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:10408
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        404⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        405⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        406⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        407⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        408⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        409⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        410⤵
        Modifies registry class
        
        PID:10720
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10764
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        412⤵
        System Location Discovery: System Language Discovery
        
        PID:10808
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        413⤵
        Drops file in System32 directory
        
        PID:10852
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        414⤵
        Drops file in System32 directory
        
        PID:10892
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        415⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        416⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        417⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        418⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        419⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        420⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        421⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        422⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        423⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        424⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10336
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10396
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        426⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        427⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        428⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        429⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        430⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        431⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        432⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10860
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10928
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        434⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11056
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        436⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        437⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        438⤵
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        439⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10436
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        441⤵
        Modifies registry class
        
        PID:10528
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:10616
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        443⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        444⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        445⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11068
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        447⤵
        Drops file in System32 directory
        
        PID:11136
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        448⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        449⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10348
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        450⤵
        Drops file in System32 directory
        
        PID:10532
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        451⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        452⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10792
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        453⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        454⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        455⤵
        Drops file in System32 directory
        
        PID:10352
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        456⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10820
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        458⤵
        Modifies registry class
        
        PID:11096
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        459⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        460⤵
        Modifies registry class
        
        PID:10716
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        461⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        462⤵
        System Location Discovery: System Language Discovery
        
        PID:10728
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        463⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        464⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        465⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        466⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        467⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11392
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        469⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        470⤵
        Modifies registry class
        
        PID:11484
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        471⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        472⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        473⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        474⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        475⤵
        Drops file in System32 directory
        
        PID:11704
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11748
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        477⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11836
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        479⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        480⤵
        Drops file in System32 directory
        
        PID:11916
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        481⤵
        Drops file in System32 directory
        
        PID:11956
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        482⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        483⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        484⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        485⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        486⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        487⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12212
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        489⤵
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10560
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        491⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        492⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        493⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11436
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        494⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        495⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        496⤵
        Modifies registry class
        
        PID:11604
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        497⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        498⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        499⤵
        Modifies registry class
        
        PID:11776
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        500⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        501⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        502⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        503⤵
        System Location Discovery: System Language Discovery
        
        PID:12016
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        504⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        505⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        506⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        507⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        508⤵
        System Location Discovery: System Language Discovery
        
        PID:11404
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        509⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11712
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        511⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        512⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        513⤵
        Modifies registry class
        
        PID:12024
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        514⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        515⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        516⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        517⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        518⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        519⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        520⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        521⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        522⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11864
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        523⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        524⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12064 -s 412
        525⤵
        Program crash
        
        PID:11912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 12064 -ip 12064
1⤵
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abjmkf32.exe

Filesize
368KB

MD5
c6dd0555a155ee63abd01fb09571b02b

SHA1
293637156b050ce67c89a46c0c36033cab36d5f5

SHA256
ab78bd03a46abfd060d8520a7b8ff85173c6fefeb657923347dab6ad6037b7cf

SHA512
10cd7b339aecebb2af3a63d6bf4483b42a600041f96f74c8b84dd395c311796ab4a402edf9ab2c70ad5965a1efa62195965706d90b3108ed9c004c3b56242482

Download Submit
C:\Windows\SysWOW64\Adikdfna.exe

Filesize
368KB

MD5
48a4394b6153c47d10fe871b486ef39c

SHA1
34ebe12117dcaf10c9723d422d4a8197f8c1c4b4

SHA256
d4f2fd6bcc929e147639b581abe4098ef649d5957ce1d35ce838d011f4aecb5a

SHA512
8809a02903febf850571440bfac36bf3649800633238685ac6b1adef4fafa7249b3bde34c0e5c7c60ca89464da722e21a165c3fe59bc4cddce99779abfd36087

Download Submit
C:\Windows\SysWOW64\Akblfj32.exe

Filesize
368KB

MD5
f41ff7c5e0d890b2946f07f2dc35493a

SHA1
3445da8e73d1a989223db974e4856f4782606e8e

SHA256
dd40eb8dd62b8bfe9a444f9dc42c55a97364077e663092073b8b39b5585ec7a4

SHA512
454a1225f50e307242f66d1d37b4fa2db6781199d3583151dedf41fbb6ca393f604eaa23083c0cf18d16a5c10a702e4bcfccd2ca174066332a3dbed187ac415e

Download Submit
C:\Windows\SysWOW64\Aoalgn32.exe

Filesize
368KB

MD5
450b2588a0fddd54fc7c638cb0e0f407

SHA1
effeb90c6af97e102eba690338f8fae716389a95

SHA256
1dece0dda03afef219b3bb9579368b98e93c1ab91bb04436b4d5a157ded13121

SHA512
bc4c13085bc660214c7519f495e242eed1db0050f6de7ae19953672c8a9e70bb14076eef31eff3f54ac3bd96fa6c825c034a10896a3ef969fb729c7cf02e322c

Download Submit
C:\Windows\SysWOW64\Aphnnafb.exe

Filesize
368KB

MD5
d4f32f43156a7472b7e597eb7ff5e458

SHA1
d6e780f28b7356199f658291f8721f35c69dbcac

SHA256
6ad07abca15721198b7e078aca8245286ad44004cfc99a436928cba7a5803691

SHA512
8f8b5a0e7431cf5cf55d344e87d38f84399a752c5b30eafe886efc876434c187b86aac7646b4cfda37be0e0f22c6336a105565d6610743925670b36a0fbf761c

Download Submit
C:\Windows\SysWOW64\Bboffejp.exe

Filesize
368KB

MD5
8df4b4b57eebc0b93feb4681e8b0ff9b

SHA1
964c3ef243c59e99f29ab6f668b5dbb452826d1b

SHA256
7ab78a34ff96a85e42556b7e8e937d99859ebf8534f8d15a8fdd97c8282fad59

SHA512
d8c2b70eb0b8ae836e5a4e0c40a52bb5674521392dbddb236fe9970c732273d66a18ea6ec8cb04c052bc868e44790633095e8a41fc5cd1f3f67283ba6655cea6

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
368KB

MD5
c6f46e0f1512675488942660c93c2fe1

SHA1
42ad7d999b420eb596dd5590794ac14029c3e5ab

SHA256
01580c4979f3a4f8fac390ffd1b1fa7d4e5719b0ce6a9d4d88063e010cc74ce5

SHA512
a4cef6a95f77afa88d628de54b03beeb2ed3327a1059a96b0e350fee8fa68d4b89af2462846f3754379f61b70e37c31bfce97506fa003156ae61581c5357c39b

Download Submit
C:\Windows\SysWOW64\Bhnikc32.exe

Filesize
368KB

MD5
a20a503ae58e573514855c75ccc1e028

SHA1
1bb381653dafa5da0d8a4bfd86e26e451eed43b9

SHA256
2b2a10a101975b8f86a5694c0c6017f2935ba509be20b24a52f6ef8719f940a8

SHA512
610c28b55915b3d554299ff25a322b9fa3665aad2b70322fe0d077efe6f562399b1c046f22ad9b80a9b0a9a075abd047ce5b69df085415c2c46a1b1928a3d148

Download Submit
C:\Windows\SysWOW64\Bknlbhhe.exe

Filesize
368KB

MD5
427d531f8fc7196e8950e693faf15e15

SHA1
8c65c6df0a6ed1784fad85e6601d82f592a4010e

SHA256
b30709a96ed638b8a9049c7ee99c3be4105154b72dc5bd485d03899d954994b9

SHA512
47e130d380d54e5a1ad6c452ca3d726e987cc05347e9f77580c6e594b7abf3a24707dbd326768d267a073ad53ab05cb843ad194ca17280daaf481a8affc58595

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
368KB

MD5
56610c08800dbbddfc4028c992c0531b

SHA1
5be5f21425e3a051881d0766983672f482049ca6

SHA256
7f3934f2aca9ea86beb1d983332d0d4c961d0ac0da3a7cdc1e6a20880f90334d

SHA512
31caa16e3e78f00428c141ec2291a99f17e9e0c398eeceebc0660b7f46a918972eafe4a096417bd83539c1c476ae5077eb3ea623047285853f9abe6a8dd8803a

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
368KB

MD5
27ddb21299150968e9a0ad87c307452a

SHA1
5ad943d9e8f2a101946a58c4349bf7204a868f60

SHA256
970b50179cfea007561d40f4304756f8b79590a75168366b866e65d0b27584ba

SHA512
8966ca0433bca20d2e4ac71d89ef935cf2af72f7fa8a750ef7620768d3ad4cfd010b4addcb0f2fc43e68eeaa9c85a8b7c0374f397f01137ff594a0f7cdbf42d6

Download Submit
C:\Windows\SysWOW64\Bomkcm32.exe

Filesize
368KB

MD5
b39cadd6d77c9b54ff36828c09e29a8f

SHA1
a7113fb76729d73ff213c1ccc409e9b27f360d4e

SHA256
b7347faaa1d1089372d585850616c309023c2904cf9ac97caf803e95c465e752

SHA512
f49c3f0837b0e94e78f56ce1470511948120534d192a7e8337742371ffc4b30876bfdefc8df68cc075ddde90127246bcfef0e9f3ff8b72bcdfd9d0878ebf4895

Download Submit
C:\Windows\SysWOW64\Bpedeiff.exe

Filesize
368KB

MD5
539fbe15a02f37db705bafb907f55cf6

SHA1
974121404bab628d024eec8c7172533196b81f0e

SHA256
3638a51023a8395300deec165518acebf82310488dae1117a8f2c09f7ca00347

SHA512
036c5f744a781cdabb19c7a5c7ccd3ea291f83db9b969281d2bdec79669275c1e435c63784762d125d10c9166601f3cabd4954530db8fcba97bd8591fed5ca6b

Download Submit
C:\Windows\SysWOW64\Bpjmph32.exe

Filesize
368KB

MD5
f65a0f0d5ecf817a9616f8f7ae3756ca

SHA1
f85356bb56c8f5e0ce19c7e6f1240a2b5b5d7bba

SHA256
7e5e77d46f71302bdb81dc503655ad120e53fad3b2f765d5d1d92be4fb271056

SHA512
3624d4db9e8013d0c12a11d420a52d988fe06baf3fb49d04b5b7b407890e4c8123f718ae03a5527ec6b90373f89ff4cba969492040d85ee03c5515fb018986bb

Download Submit
C:\Windows\SysWOW64\Cmiogmig.dll

Filesize
7KB

MD5
53a91ce06f82d7ff10d986bc2448d3a5

SHA1
6063a7c4553564cc9cd2852c546b79983929b700

SHA256
74420471a14f2cf96f6fc28b47718a4dc522ad1b13045dff225ef96ed8e2834b

SHA512
0a2b64667a75e3dad2110b5781baaf517508f49f4cd57dfad3c7f83c65b30a9548f083c24fcd02d5a923c7fec70a8ce126fb9bd5e6edcd8b0263792b435e186b

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
368KB

MD5
9e361dbb34e89ecc8da25a78482fe1d6

SHA1
054b63e43c262492a1445de9cf5b5224381bbf74

SHA256
2520358362507bb3df044734e1b2644a6b597d1882b0a9f5a625b80377164c01

SHA512
833c17c81d2c0c28b85ce874856254056bb6c7a61bb4d6cc6c9e8e133b2bac4be6e2af20cf5eed89df1339fa038aed4d5c62677c7ee3457e63251de2f0113489

Download Submit
C:\Windows\SysWOW64\Dcnlnaom.exe

Filesize
368KB

MD5
afe787806f54148d971ed5950dfb3543

SHA1
c61ee321b30555ef33619b07ea9556fb2a4376d6

SHA256
4956c073320aa7c7643a6312c277265e767cc69c6df2a6f23328ab78083f1751

SHA512
238e440cfd680f7d22c7a0496dfcaa066384a141e583443d7840a660f86dfaf493f12ee3c82f6d77c2fce77f679976e7c9432a7924293ca8805c15dfd3d3a106

Download Submit
C:\Windows\SysWOW64\Dgbanq32.exe

Filesize
368KB

MD5
7760b34cf2c0b983c8e990f184a491e5

SHA1
d9bcc812ed8597ddd9bb1ad03eb0041e6ca02920

SHA256
a30ef4cefec77cb3e6fd1285bf628c1709e6df971a7062b795dc03646d5ee436

SHA512
756d5b0de53dca386756e0fdb25f9025312b36c280aff9cd49e6b30ddc0b3a1fd40bb04deed9a2a4b0880bb17bc3a13fe2aeb3f0f0a03ec49ff7d4147231e5b7

Download Submit
C:\Windows\SysWOW64\Dhikci32.exe

Filesize
368KB

MD5
80c2e9a745c641a0bec64808d6bb1652

SHA1
8564a655dd3c96303ca4baa3b93cde66ba1b9088

SHA256
82723e8721f27b16b0e3a95d26a9833a118ada21d1130f353929529522bca46b

SHA512
5de884e02774f0534d5e53d035fa379fe211b3173f2ab2014b1bc19b6d7cc6defef774e8f1de81938b9c8e30a7882082d427cdaee038510d5bf7b74db14f6bcd

Download Submit
C:\Windows\SysWOW64\Dkbgjo32.exe

Filesize
368KB

MD5
393fbed0345fac262ff1574d2f6641f5

SHA1
741e63232107df302ddf76c7f77409ed2fdcae97

SHA256
8598683b6a740397be8ea68e6525741fc652887f39ff4aa7dc255ed115ba18f7

SHA512
f78ba64e085857c80721bd84164633ed6a0ea5435ed51d050eb0a67c9b749e17769052a41c6b3505f027dbec52d6138f6b3acc84e03c352d57a604d686b1f3d1

Download Submit
C:\Windows\SysWOW64\Eaaiahei.exe

Filesize
368KB

MD5
8328a3a43bb676fe412c7fa976661085

SHA1
38ad74a63475cee1a80013d4dedcc1b2ca89a6a5

SHA256
0be82d0feebf736b33c23152679eaa3f2f1ccd98a29b66640c8b0ece5a2e7b1e

SHA512
0677b3e80576016631b67b06cd8be7f97a2c11282ddf2eda53dc8380e4b6a698ae8f0f0aa0d05beea52ca916954b146d69f78821a73820ae5744ca53b1a51195

Download Submit
C:\Windows\SysWOW64\Ecikjoep.exe

Filesize
368KB

MD5
be9bf2af583176f8a01db18b8696f354

SHA1
f70587b43d911ca6ec41d9b94cea6ca3912f459f

SHA256
78224e8c16283abecd9cb6f0c27e8fd5693a763c21f56122573998b7cdf2780c

SHA512
bbe6f6ef925a0df7becfc0dcf2b0a768f58e741573df26e5b73720835da3ad74ecc89b58a58f1bac4eef62eff1137c6f6b4827ea62bf4a051dbee10d70b4a354

Download Submit
C:\Windows\SysWOW64\Eeelnp32.exe

Filesize
368KB

MD5
ebb75b16e0c5ab7113d4be9f511d0982

SHA1
d79da4cfd7484e7c0c63bc7e97462409943573d6

SHA256
e172128aa671fb2e3eaea3565db2bf31e5f16572d17263dbce1386b246a4b926

SHA512
f88079ad014d85f78ad8648279d28937abf9a8f25b186c2d955b0a797e0c2a160ff18c0f0d4b7efcdbc5a814a2795be4df9d479f8cf266f77a465e117d54cc1b

Download Submit
C:\Windows\SysWOW64\Eghkjdoa.exe

Filesize
368KB

MD5
41ee7aec22a7f288986382e03a1d7c62

SHA1
ab2b817b802f494284ec8c21443492c77ca4c136

SHA256
107d4bb69e5403a9aa0a140d0842922be2bc10da6c06e2c7847d84098834f081

SHA512
d4e32c0ddf0f570d4e9de4a752a75bd60b13f9dedc14178a53e254e91005e6fc2abe1c68bc916d1b1ea3dda105ec0f4706532c67a0a525b443c3093f892c8219

Download Submit
C:\Windows\SysWOW64\Eiieicml.exe

Filesize
368KB

MD5
287c5011fd07713033f248ae340e19ca

SHA1
2b3faadee354dbb18b25eae170439a1a87be3662

SHA256
987ba6d421d75a9d0866766e6015ae63d0cdd7fdf8a9cbfa912a8e097bbe66c3

SHA512
d292ed0d7ea04f2141ecc8dfcb00d27766cdbe0977bbc1604a967fa8915ee07a06f0b066ccead7ee9ce2037752f49af610973eb599b473314bba2ea7d8f74d96

Download Submit
C:\Windows\SysWOW64\Enhifi32.exe

Filesize
368KB

MD5
58524221259033fcaa4d50cad7c2ff39

SHA1
310b45a1585945ecaadfdd371c8a94571a8282c3

SHA256
efda3c6598561a4351689259962b181ee2d26e667913e20d75a30a5e40a80e1c

SHA512
e95d6a2e4478b59e89be0bc754d4df04f0508ba74e45f4598abadf13aae659a748b48ce9cc8ec2d345048d6f81d571a1e5b9a4f35645bac838bfa8fd2312e0ff

Download Submit
C:\Windows\SysWOW64\Enhpao32.exe

Filesize
368KB

MD5
3a92b732d5a05ecd8a6ae6547a6587da

SHA1
873869c6470a83423a794e59608a9dfb1122c3d2

SHA256
68132b3ac506a2138dcda19961fa354c684f98dd532c14e92a143e95f5d9af1a

SHA512
f1d1ced86cc064675ba7cf8b28ab58fd3ca673a5f08c864da6228f5e350f74cbae205efedb6d4994c63f2d7f723005cd1cfdce02f923f535f5b024300f6db658

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
368KB

MD5
be0e5b19fa6e23334dd3dd097ba7e80c

SHA1
fc5fd6313c8863302b7c4b9815cd691922a6e018

SHA256
c366aebca889865748e279361671b5fcc1b9ed3ba93b4ab9b3e719158dcc242e

SHA512
57dc227ecec3d1c4c00612f415fed9a45ff9e0913744b1688add0b085c16bd8207c7a376552c76a85988fdccf8977ff7329c16aa3597008351453faf7dee6a1a

Download Submit
C:\Windows\SysWOW64\Fiaael32.exe

Filesize
368KB

MD5
3fa53bb3c4d19d4157bf6154ada559f8

SHA1
62236efb5c9e8828bcd77d9817d3c4d913731822

SHA256
54885c67bd74b447bd438955651d85e1d3fc0bfe2c29134897303875d435ad2d

SHA512
3b3f60ea05aef44dcbcaa6524eab84ea9aefac3dbb6dff84067ce9236484937b2ec8da2cf15fd5fbd51cbe1412bebc14d84facdc059340f7f98a0587f264743a

Download Submit
C:\Windows\SysWOW64\Fjjnifbl.exe

Filesize
368KB

MD5
73d06e314bfc92f6fe13a6ef14e59546

SHA1
62d5dc5f87995a5981b4fa70d3fcc464d13c7b64

SHA256
f794a6383a451462e290f630a994b748831459a3c66bad2b3534517c461b225f

SHA512
2ebedd30d03599a5d1d4e8b054767f71242cd952eba7200ff3f4b5002fac280e2366cbf98baae24f8b042023423b1b2b4c15b3c3ca20777fe8c73079240d241d

Download Submit
C:\Windows\SysWOW64\Fmkgkapm.exe

Filesize
368KB

MD5
bab9054a7068a3f1c28342885d9dd202

SHA1
dc7d0a79ac1e970053510175aae141ac242c4fd6

SHA256
63e53e8104391a1db80021fc051582a67fbef233b3de0670e0711c2619c10a82

SHA512
47a7e6a0094c367218e85a6bff9752ae01116b10960efe40f0779cce77b4a812804be4777a3f9b707366c0461c92123263189cc553d3fbfb1c5dca05638f6049

Download Submit
C:\Windows\SysWOW64\Fndpmndl.exe

Filesize
368KB

MD5
2b7d16ebb83cdc9646b4ef0aa774e9b1

SHA1
202e2035d3d53ba4332956e75da6f7da432163c9

SHA256
0a8702941c4c73832a9d42696de43c2e7f9977df6edff379d97d1d8d080b61c8

SHA512
7e00a7f80317af84f606e060afab0b3fc99a11947d88f7b6456053dac8f46054d53302435e7f3801afd34c9819d46ca9d67ee51829139086849ca1968d0ff4b9

Download Submit
C:\Windows\SysWOW64\Fpbflg32.exe

Filesize
368KB

MD5
6f4b3cd1c5484df45a50f9f09d04ccc8

SHA1
c13889a040b0a5d6885cb4938a6c354a37d925ac

SHA256
89f1dca529ba0ca996953f70e50095591ac1da0389600b69ff97774ec5b72f1e

SHA512
f259bf27344c27bfdf69c871745dbe7729e4d92522f9ae40b0aa33790e4a5b0c2d0e108ff60e2ff40c558a4ef9ea2aea4efe4e6a6fc23780a73078fac9c28254

Download Submit
C:\Windows\SysWOW64\Fpbmfn32.exe

Filesize
368KB

MD5
626c89b7a403797467a172e92af3dd8d

SHA1
b734f41f295d86449b7c8fdcefb9c8956c11ed7c

SHA256
033b4efe24124e8d847cf8fd6046eaa5c000c0f89edb81a9e49534a35dd3b384

SHA512
1edfe7a8ec8d9189f637ffbba16a0d23a45b604bf23d359ee013c16f2fc31cb1c2ecb982bb15d7661d8cfb33bf76dfa0ace5978b4f07fce84c5a0050c0d53fca

Download Submit
C:\Windows\SysWOW64\Fpjcgm32.exe

Filesize
368KB

MD5
0e51f22895de6a304902fdbba4554649

SHA1
8c22bec3fe25ec816f363c99e440d19908539484

SHA256
b419afb7097b4248ac56af5a43f3e1d0a10e4799c1f785ea726e99248b83fef8

SHA512
645f153ca2ff914c27c94560a1863370ac1809316a96b48d3a1b8645f7d96ae7d6f2ab7827258d7ea8b59d28be11f3cb668045b546cde5ea2662e5b9fe3587a9

Download Submit
C:\Windows\SysWOW64\Gbfldf32.exe

Filesize
368KB

MD5
a3d0bc71e496a4fb228762d2beebbe11

SHA1
5f265c16d83a0285ed3c80e91b7362b25a43a113

SHA256
00c3189b4bd86d176f67ed68e52e28d59aa1b8e6d9edb555ce723b6a492137ad

SHA512
01156b1ec831ea089d5d011a6c765057ebf04a6d620d17e5336a2bcdc8db8bc268efeabddd7517e47145397ad63f1dad3cf60d7fb184a59e69a67bbe5ee6bc7f

Download Submit
C:\Windows\SysWOW64\Gbofcghl.exe

Filesize
368KB

MD5
b37b51d30e48bcd4b3660b5b598b7633

SHA1
f910dfbcded0ac818936c34e42ba0d73c6f7ae68

SHA256
a9e18611391c65213c4db09e210964c6a0e73219895f8487a8610f7a3e739e70

SHA512
1a8b4c9a4b945cea3183b0efef4bbcc604712f934aaabdf58e99880eebafeb5055776ebb2c13d057bfac5077f87c971f1ed55c550a6c3b9003d243613bfdaae1

Download Submit
C:\Windows\SysWOW64\Gdobnj32.exe

Filesize
368KB

MD5
4dba64ef04c6ff1ceacfeb65887417ac

SHA1
7b11949f1eda7e4263aa81d3bbcdffecc76d49d1

SHA256
74fad455cc720a29c9c72f0a3a5a7f3f872793ca35a5ebdbb85dba34d8f39a1f

SHA512
5d342fa03dbafb0bdf8a258dac9b133e9ef4a32e89eb7690ebd813306b43476bd473f6be3ab9cfae7739dfb2aff6864acd2f420a52602964715dfd28df3da2fe

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
368KB

MD5
bfa15b415e06a5e9b824c378925f5479

SHA1
27d12ea18976360a83f4b5cba09f1ccc8fd30978

SHA256
4ab1052fd09dd2a9968e99cef32c77adef73ecb87d0e3b8cea6a684dc6d516f6

SHA512
a82a7529013e547b69c3248eae6053ab598d24709553686c287d9f67fb5a91bf74a53ab5774663142352d434618e5c32cda4c7772fda3dc2fcd01d1514f9aa1a

Download Submit
C:\Windows\SysWOW64\Gigaka32.exe

Filesize
368KB

MD5
1e7cc7e005f815529a833bf62c28abde

SHA1
c7d9172b1426f00efaea943291b302039e98e56a

SHA256
27f7a04d0b6ecc8055a53bb34eb2a30fdc5e56909c95232bba9e2f5190c5ef2e

SHA512
cd30ffcd3c6b3167e8b90cd41764f436ffbaf8646440a77eacd694a9fc804578016aa468ab1a878b8f2e156a269613295e1b701b3b056a6826fe77d52cfb2878

Download Submit
C:\Windows\SysWOW64\Gjfnedho.exe

Filesize
368KB

MD5
056c7e9f0d12ca2a8ff213cbbd7485cf

SHA1
ee42d051e90cbbd20e59c0e321088ecb3e22e408

SHA256
361c19425943c4c467e70d22961169d787b8db14e8b85bcd2e20f1855e809875

SHA512
2e63d76d33d84448a5afb7a4fe2559769fefc07eefd871bf99ca838669121470857dc88d23a2a74cfc03d79882ae12e5720d9e6326cd185b7dcb12ce13a5fc1e

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
368KB

MD5
448a7eebfe7ef38e22dea584ae9bfe57

SHA1
1128b325aaede87e3c6100d76871188f9d77d137

SHA256
378af122357a1173c6655dca220c5b420aadf2e33ee341d6f83728dbed07c238

SHA512
704892c1fd53c4207ac11e06e8318c59b5dd56791abc7e4c01e239af1e369969f8fcaea60e73afc257d6dacbb503865d48098151cc4ec4359b32078e098f2858

Download Submit
C:\Windows\SysWOW64\Glfmgp32.exe

Filesize
368KB

MD5
1c65c25144dbab0b44231b3d5db52c82

SHA1
835e03fdd7c52318176f194ad5f7b692ff3d00b5

SHA256
8042ebd9e27d1756c8108497a0cfa982087c2b7be29d767d11397eecc0513ca8

SHA512
8e7fbde95585ae73c63b8e558eb700435eaf0b62093d3bada8841dcd4fe42a79cad93eb0139220af7d36b29538f3a01bb61628a217e5de4c6b4cd40ff88a566f

Download Submit
C:\Windows\SysWOW64\Gmdjapgb.exe

Filesize
368KB

MD5
87ec8502032b6ab15302cc2fa787bff5

SHA1
46b8ab8910d76fdc4f5d411e1ca609b76e176808

SHA256
3a47dcddc2b5e33e93a71ce7858baa297cea3e14673f013ffc5cc163a6c443af

SHA512
face2dc37e6394b754d45c5c422728efb252d1ba7c65144ef35f97f91b81e62a7afc0a5b75b9ba7ee4912558b686abec3652b9c79483cbab57942f636dcef645

Download Submit
C:\Windows\SysWOW64\Gnpphljo.exe

Filesize
368KB

MD5
876550c871b229f6b78a6906cb611340

SHA1
75dc93cf4831451378450490664a3943e8a97cfe

SHA256
933453e691338cab7cbaae3c73a98e0b104f40b88d8c1c37adbb32d1775813fe

SHA512
678a65d78adbc2504edbe888bab1733cb670e04e2ca63fc5eacddd5779d75fd5486f67bafce9bd383c360096cb96e61c444736433e22e1a4fa36f0045ba66e69

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
368KB

MD5
09baa3f2754fd2255fbcee9e0e56b363

SHA1
9af589a26aabdb1025f3ba2bf515058ed185a070

SHA256
adca31f0293f6e2da659fbf9fdf9d9985d81f72c3016c50eda44186808ed0da0

SHA512
c42be9fc5ffc7b37cb73a6a8756e09af719f9af7cd170e6b8ccdaaf130fca62e6a243917fd9183972d700542eda4711166bd22d8bf9112c505cae20b8a7ffb86

Download Submit
C:\Windows\SysWOW64\Hcblpdgg.exe

Filesize
368KB

MD5
d0db553b74f9416d27509cc74e30c33f

SHA1
b195ed624b32973207266fb6218fed03eb6c7c94

SHA256
046e83f211669b854a1507263a797451dceb1c80f94cf75bc1b23909dffa5c71

SHA512
9729ef2bf209efb2519d5f8e8f08faa022a5d8fc3109be41cd9c8c2882ff325a193d61a96f0e7197b1c14b4d981dbb8a529b3a796b9d47eb3f88e7a989e446a0

Download Submit
C:\Windows\SysWOW64\Hckeoeno.exe

Filesize
368KB

MD5
4d95515f78b27d8ad545e0e43a5221b6

SHA1
a8832d8c8f9f5906d867c5be144fbbcedc7b3b5e

SHA256
9d8660d0b612d0d8271ee7163a21d54d7c6011ef18bf3d39967c600e35f41a34

SHA512
ed35096cbe9a05f70b2125261a9f72cf120e4471039a6363873bf0857229f6ed04c40b254ead6d15ef739059b6b97064c4851459f469b70b612c9b73bfbce939

Download Submit
C:\Windows\SysWOW64\Hcmbee32.exe

Filesize
368KB

MD5
2b63ad66b4aea0b46a1a6947b674b6fc

SHA1
96a9f06aa0f8558110f6cf11b92f27f0c12fd83f

SHA256
cd5c67e95e3af8d7201151bea94e3c65a12672380a3bb594d9007a9095bdb5c3

SHA512
be9165e567483800d104b5e9f2a625821b3f18650647b683d26cbbe3222ef96a131111c6dcd38999e091580160bfb0d1d3a5ebff546bd30536d8984caa463ae7

Download Submit
C:\Windows\SysWOW64\Hdehni32.exe

Filesize
368KB

MD5
bed26561ff325c56b8c5013958f87838

SHA1
93d2cda1f346c0ce55568b1ca7b5368d4205d2fd

SHA256
c39cb4d0ce7c9a19e7e2ceb924670f8da2c44d799d87cbd5a7cd321efd8e59cb

SHA512
f6e689432de8d33bd9c527e89e1725132b5beea358d5c9cd1f0ac2ebd71015a59967074754242ec4a048c42463b8591f3eadbbfd00739b93074435ca65e1fe20

Download Submit
C:\Windows\SysWOW64\Hdmoohbo.exe

Filesize
368KB

MD5
a3c188d4ca19eb421ec92c2062b838de

SHA1
a9aa632408c67d132e5cce2f20b89657c0f801be

SHA256
e5a09b14c30defb8e04c42af0d384e5cb592276065f7bb0b327de9d54a604d1f

SHA512
b561d075bfee67a6e2b3865fcc5f65f32a1c9ee013df1d925638d3a7f6c42dac1b50aefa13a7e916bf93bf4b432dfb8a259d182ce7ff2be78edece3db31df8ff

Download Submit
C:\Windows\SysWOW64\Hgkkkcbc.exe

Filesize
368KB

MD5
922cc46eef6ec412a77493a83d8db244

SHA1
51f4d82000378cbeab7d2c4a8483f6f914e8718d

SHA256
1c5befe74aa9317723c67a07d2cfdaf11a16f27a17777de6d7df67372d2b5357

SHA512
cabfed6e0ec1ff31b4adf574dba2eedf81040559c2a986a24ee9a245b13384989f2859fcad3abbbdfb92540dd17d5612a0e4aadadc7be2923ac8fa43c239a32f

Download Submit
C:\Windows\SysWOW64\Hiiggoaf.exe

Filesize
368KB

MD5
0cbb57cc138e9825641dd10a1bce3e12

SHA1
679a2baf46fd711e1e62cbc5e3d06eba6231e753

SHA256
5af341fb8638566c7ba8725e9ec5fe8525f9195d5e6be6a7209039d5976c7136

SHA512
5f20f816af0131ca2e9e16e98dfa049ac97f61388989ffc807fc20636264a56dccd8212f5a49d29aaa3bf1a2ad3a3decc3fa2feec93d2525d1007633f2a93159

Download Submit
C:\Windows\SysWOW64\Hildmn32.exe

Filesize
368KB

MD5
89d986ca36bcadfc36c4f47402024a0c

SHA1
b24107018d6fbc6951d917e279657bb6d109041c

SHA256
ff0f62ccae354a398b61a19a0a4f27fa03ad255d675df912a99222b7761f5afe

SHA512
4787fc78eeb6892e47e7ac776f71170fa41f1dd46595395c488703398c40e0aa3ac6832653aafc2880eb76a8c82d70a754fb6f95db9dd1d7db34f21d81105729

Download Submit
C:\Windows\SysWOW64\Hkdjfb32.exe

Filesize
368KB

MD5
e6ccab9fe39172a95ae9fa3cf0bc1e34

SHA1
4e4384624b7c7a332bb4e18535699eea0cd4b790

SHA256
6ba16777bbe8e17ede3524b46d50bc917ac1d7a70d53648269a8bd0a28f14eff

SHA512
43caba00a43a9cf3f3e54418b35242a1c10f64b4d8e475dff26bdd93869c1ef91f14a99d0f4d12b56145934d87b60fd8571465211bca0f6dabb4f537071293e3

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
368KB

MD5
c5b6da6d008085ede69b2a9cc69af0cc

SHA1
13a37292cf4a305bd42a6fc8756e5e35b8e939e0

SHA256
93111f1c833e7721eeb088521ba4af831445bd8fca8eac87b01bcdedce01a5e7

SHA512
b40f4797cf11f1b0866da213207ef4690be05d45a6172f7ee45ec1251c7ca69509218f4d63dfd722c5d1c5d0e4680b718cfb721b4f5a421cb25e2964355d181a

Download Submit
C:\Windows\SysWOW64\Hlbcnd32.exe

Filesize
368KB

MD5
305d03d9a03e3f43c75f66c70e5d069c

SHA1
91ca372e14a1fe1087cef3164e905b445d747c22

SHA256
2ef9958854cf518367538a210e041eb78cb9f47eb46d7aa66ca3f7843d31cbc2

SHA512
84d6a15e62770aff47033ece72b88173b47b5164b3e049a51f984b520c63f41836a960f44b528ffd3b266265c7a4ca0b35e247be54f1031133ab6e2270717fb6

Download Submit
C:\Windows\SysWOW64\Hlepcdoa.exe

Filesize
320KB

MD5
1e42c4206fc41a714c700fa990b2f558

SHA1
bac7841bb6cd3f6ff1c16064df1a7d7abec83513

SHA256
93fcbc4cdc9f62c4d073c1a8692767a4241ac10bbff079e2b2d0b81a9af1d9dc

SHA512
7be1891ddbe229d8cc0accd3adabe55008352975ecf17877e3d9f12782c293695bcb09b3bde90e5fea3d9bf8f052361a32a1cdee9c80c02144a6a64a1061bea4

Download Submit
C:\Windows\SysWOW64\Hlnjbedi.exe

Filesize
368KB

MD5
724e87228945692591dfe00f84eb5880

SHA1
910ab4b6131bf8ad74b9e35c3697bbd9d256ed0e

SHA256
108e03223191ebab6a0526fcc2dbffcd513446b526e18c95623799ed69c767d6

SHA512
f1443443a028938e2f967a7f4cb4662aaa5adaf482fdf4196d0eff7ba7e26a926cf5bc622ae4efb87290703b1c0b8649456ce2ec80e7e62f250fd62d7d9a84ce

Download Submit
C:\Windows\SysWOW64\Hlppno32.exe

Filesize
368KB

MD5
f6c2d2fb52e1d9fa32289ba07260447b

SHA1
a3ea832f6454f995d1e92a0b65dcc61c70c547b3

SHA256
9ed694fae4ad53573cb44c7c34601886aad85672f37d928b0854a5326ad55b72

SHA512
c8b222dc7c366eafad0ebaa8ef28ed00774f84caca38f329bb3cd12b9da3971de52cfd548d6caefea6a663906e828efa76cbde2a45ff5b78bdbcad7ccf514ed4

Download Submit
C:\Windows\SysWOW64\Hmbfbn32.exe

Filesize
368KB

MD5
2c3b9386b429acb284199b22d2556b7b

SHA1
41dc8c641aedbabadff24320e46f3cf4274b6609

SHA256
d8d3dea3a84285a4f5887928320200dd0398552790d571d5fba16f32dab29678

SHA512
80c3b428dce5177af7dcf343f1c4cd7953ea7294e4a55b0d774f76b98efb09a92fc0b4f2170686e451d6b8263d7c0f0489e855f3d8f7c5d91c7ce18d00583172

Download Submit
C:\Windows\SysWOW64\Hmechmip.exe

Filesize
368KB

MD5
966d9e04e62a21421f0f1bf92d958e6e

SHA1
2732deea657b3ab5c81f10c7d7331248175c3a29

SHA256
1084af816828bcaf5b86309f9bebe1d5df176094714736b6f11c19af941c2944

SHA512
b62fac496b53215cb8fb9b348295be01f1c56e252dde895a8b1bf4d294db5d543e336a17cba20e7f8d5affbafde54f6de054e83d7d9f3841bdf0926618f29c46

Download Submit
C:\Windows\SysWOW64\Hmpjmn32.exe

Filesize
368KB

MD5
2ab6d4bab3f57bd627f0d3232e578b9b

SHA1
0043d91aeab5cb57890178bb90755946570b606a

SHA256
03bbaed96f2813622d5d8b3964cc047abeead620f4655626602ab4d3b42a610b

SHA512
e41bfe021ab97f727d24cb0be60c2434d1ffee8fa5819bee4e59fcb69c9f76f73449ae09315a17c777e5e5973ff268f4ee680190e304d448379e04852ec09a1b

Download Submit
C:\Windows\SysWOW64\Hpabni32.exe

Filesize
368KB

MD5
1f5f6bb2442245394cfb8be798209050

SHA1
eb4a0e988acc0018e68d48caf5375dc88270071e

SHA256
38e99eb0030ddb49cc7b1254c993c9ab320baa974e52ba65e6251bc9e4af83e3

SHA512
1a97dd417ee66e7d5ee91a0614ab71a8f7d8ff29370f86c579a82c645dbd00501c1ae6b1c8724f0f716cc06b7374f560ddfcbe568d59f52249463d8816238cfc

Download Submit
C:\Windows\SysWOW64\Hpcodihc.exe

Filesize
368KB

MD5
81e657ddeb8f5d0e025a2aa2c59da88b

SHA1
2a1ea93b8a6f6e6460385fdc786939ed8758b555

SHA256
14c732f1383e0669f1a4bfb8df0e7f6e5948e77ffe21a1f4b85ae181a186183a

SHA512
431912adde1cc5610d49cb2e227b6a77def313a838d92be8cdf2deeb8a832fd329e59b9bff81e8ab853f2911961083db222d30b31b69d6042ae3f159783bfc76

Download Submit
C:\Windows\SysWOW64\Hplicjok.exe

Filesize
368KB

MD5
c7b42a43f16cdec298a5956ef5d9d747

SHA1
999c9dd988a8e224914020d021c9a8cb17c18de3

SHA256
b2470fa3e5787977a0e0e17593a72b6b4deed7ce5deca5b6baf6483e32462bbc

SHA512
54d6c759c85044103235f6b3421ac47640e614ff60a2c8bc307f384adf23bf7f6fb1ce06cfd22708033f32f5a9693c7da15cf4ce1135333ded0ce4dc5b6278d3

Download Submit
C:\Windows\SysWOW64\Hpofii32.exe

Filesize
368KB

MD5
22528d89884a913f41594fc38528e7e9

SHA1
bc3a463f9547f79f27cbd52b1a4c6adeeb0abb40

SHA256
bbe447788298e499d5b55c46fa8322bced8dd95cdc113132e9aeba65676e9f3a

SHA512
232fb094b7190e7280853e6cab2667afd82f23a2640e753c30f4b6b828c8879eadf47496e213dde0ef20452f60db0dee7b398919064b1116391916f61f80841a

Download Submit
C:\Windows\SysWOW64\Iljpij32.exe

Filesize
368KB

MD5
9e357fb01172a673c16b42090471997f

SHA1
366c8eca99a3845055074c01ad45a3ee76e35f37

SHA256
f41d353613e9ebe0205df0cff3a77a859fe17f5084bb678a85e9d06332dc8d1d

SHA512
747b940bf9a2e208f39c2e649b1c457549ef01dcb354b34b3506099614d458dff719e890502e63aa168d943da4b22e5ec31e153400e948fca438b466a64d7549

Download Submit
C:\Windows\SysWOW64\Ilqoobdd.exe

Filesize
368KB

MD5
bbeddb31abcc490c1ba02e48a3f68f4c

SHA1
bcd2d9cd65293b18804cc9ba9263f7bada7d12ae

SHA256
17c07342691678948ecd713df72fba2ea2d5c12d0ab81db2974e5e9b0f799ec9

SHA512
5995c6b4a2d478f1a0853bc477b022e11f15ff811e40ccf04434921658eb13a6629ab24000539fc5c7846ec65f3cb6dfa6486fa0b603652cc00301415afa9a67

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
368KB

MD5
81737ec119b8b2eee8249f082df28bb3

SHA1
d8e29041ea15c5a5025e2c7ad051fa53898748c5

SHA256
04511ab81a8af0c614e141a9a3538f324bbdc1f19bdab87364e5ad308dfb584f

SHA512
042baa1268cb07b3d215254b0f9bf76bb4fa2e6cef11993dca72a787bcbb1dbad83db4864f9e004b56172beb18fbdd6744da00e2fe75c3be6c639509f1b863c2

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
368KB

MD5
064eb6729b7e1d4036929ad2b2a85b93

SHA1
70f50080727b8b3a17e2bf7bf8a62327325bd800

SHA256
e5183ad6a142771708847e847d1d85d1ba121cbdd6c8e33124c4a2a5ad7eacd9

SHA512
b8b1548e3ef9d2b4633687b92b1ffdebcf81ed86c97284860eb456af31e8ecd56b037dd5b2153ef34fb7af2fe436afa1a85c0c75b36fbb74ec06912ed5e0b774

Download Submit
C:\Windows\SysWOW64\Jnlkedai.exe

Filesize
368KB

MD5
b1e1be294565cc31d7717d2b3ec8a67a

SHA1
4083e8943ddfbf500243680f7bff5a79dbe4dcbd

SHA256
eb2113a4bc1fe31c169ea064edec3cb428591a3b1b272ab771ab7ce001307d72

SHA512
066aa9200ef9bebb55f1d5075ad50dfcfda28d959b7f3b3fe60d60975b1e967d0834be2d7709cd03a4283fee6ba3e9dd439a3ce97cebcbcc3a4f6a020aa421c1

Download Submit
C:\Windows\SysWOW64\Jocefm32.exe

Filesize
368KB

MD5
3b9c1690f3abf9ece0fa9fa477b976b8

SHA1
c9055b9f23d9aeef2910045dc7ad77f8650f28f1

SHA256
07fac5ef90c4539d674530afd00e602e7618fbea36c1048723ba955afa03b99a

SHA512
6cfc38e3e4f50e118b901c9d22dab4ccffba858a0defc8b2141ff49b21b251f2a42212961176bdfab71b38fc2f6941fee62cf553f13572fefd7e131181dc291b

Download Submit
C:\Windows\SysWOW64\Kadpdp32.exe

Filesize
368KB

MD5
46e3a239846b6295bd3e545c76996b54

SHA1
741b2081e78b4af1e1eb83f24b89fc0bc2bffb3d

SHA256
041caea3f0a62b936ac49fa998655eef0f2212295c2ef6dfd18787558d0b94ea

SHA512
40699fa376d6de580e575ef6c2c144bac226e4df62456ddffb1fffec95720e20d6ec9cfc1be3e87f96638fe04769d9d1ea006899d2bb80708b594a0b39c6b769

Download Submit
C:\Windows\SysWOW64\Kgnbdh32.exe

Filesize
368KB

MD5
2acb5a8f06e5643e533651dadb6030ed

SHA1
ae20fe010e2a280b1289b82aae1d724e0b90a4b7

SHA256
54b248982f2ddd6ebec7844e3405e1fea483c076623beacd9290f517a4930865

SHA512
83d30368d1c850eb7bbce1eaad96da747028370195f1b00c2c37c535b1f28edefcb2f1197539deaece722525409730f684668d68ab23a9d13aec8713a18e3cdc

Download Submit
C:\Windows\SysWOW64\Klcekpdo.exe

Filesize
368KB

MD5
9c70acd0e4da77d6eed724bbbe5bf4f4

SHA1
b952acc0323f5ad17e9b316263580047a4cf0a31

SHA256
cffa83c4f7125df771dcec9935e816d865c9746feeec76627bc9ccdf07b4016e

SHA512
26d77e073ef13f2a9e48e7bda468a62becbf563477e93e7569f0e1f6fe94131bb0f13936e4f19bdd6146bd5a38b3dd2c45868996c7b04c9bdfface03774f2957

Download Submit
C:\Windows\SysWOW64\Kngkqbgl.exe

Filesize
368KB

MD5
cc132ea2146d6ffc1c991bfde6e9e88a

SHA1
7898ee70ee9418d8b1192460e4a399c1b55b6af3

SHA256
39324c4165900a6d4562677b1880e766c31c3d42d7f1be5ae2bcca3ed8439217

SHA512
93f88f47bec58f0832d566eda1e5a284a84a38702178a842fb5148c2da7c9c3399f4d8cf14d6acfdacf58a2f9b5e3aea3a9c0cc8c3176b5922fd589829df3bfc

Download Submit
C:\Windows\SysWOW64\Lcimdh32.exe

Filesize
368KB

MD5
e3c3e309a2606ee31b943b7174cda4b3

SHA1
4b56fd1f9107e232aa2acac960eefd45736086a9

SHA256
72d29196227fb7a81fef47a7292170b79adff072294c4d12f82aa6e4d44e2061

SHA512
f8b97a7e33007e11f5657f46e62e36f26141959c75b156c07bbb1951240352a941875cb6e6498324f28b32e8e9955eb5fddab095a8e0174ac8970e94819376b6

Download Submit
C:\Windows\SysWOW64\Mcpcdg32.exe

Filesize
368KB

MD5
42b77242e2e726c538833c98300cee58

SHA1
bd3edc9aff11aafbe235301ef9fada7c6841f6d9

SHA256
d54be609de2404c13cd9d83decbb397881a3c598172b767468f665e7f1da09d3

SHA512
0dfccd505237bc05aa73995fcd3f99c7eaab73f6d2dfd57de0af6f8b3a59f6de804ebbed96b6a328b5f2ae4cf5a04a76d97d32fa9e54c0b0fddf19f8a9686ad7

Download Submit
C:\Windows\SysWOW64\Mfbaalbi.exe

Filesize
368KB

MD5
f83ee066226877e887673be7b15f84f5

SHA1
6944e286ebe8d15d5a9fd28e8761e607939fc57f

SHA256
faf04ec8ea23cac0e472a49a9db6faa80107cb6b41430f6e3ed987f17872fd90

SHA512
a2f2a4110dec35655d570fab23cdd9e8d70cd1492ac15b9b1003ee9df0399bd612f1d6651f13a77cadfe4ef565c0d728536d0e8850a669e3b1bd3866d8de44f7

Download Submit
C:\Windows\SysWOW64\Mlhqcgnk.exe

Filesize
368KB

MD5
f995a60dc6200145c39b0be44285a576

SHA1
66cf3d177a36660d93d99d966ec3be2c3ffc8982

SHA256
8f83d966d81bdbdd9b44d44152ddc49a32a58ad819a0c301f393092ece45da53

SHA512
d5db4e174c48b8ab06774d490544e774e1ebae3e36e19272e83835063930b518aaa980feea6b3ba2982851e6f4b931aecc1bace5ee8cede306df27fbc104c271

Download Submit
C:\Windows\SysWOW64\Nfohgqlg.exe

Filesize
368KB

MD5
1054ef365ba578f230bcc1c6b28564ec

SHA1
9d8cc045dad7ee66da82d81b126120bf624500d5

SHA256
dba7032eebe4d60900fd0574c31d55c2538445432516043c6b2276c4cc0e842b

SHA512
f81246dcc1f437e376d838b6bc37c75c9d03a3e52137bdc347631cae522f3cfd63fff1a3479b9727dc2d01931a74683f5aa6c4c3005173cbbb3384abcf46c6ec

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
368KB

MD5
6c3db57d4035ed0a78345fab5f46dd50

SHA1
b4c74617ddf95b0556ef84147f8bc9bb69b8e9f9

SHA256
904f5f9cbdeafd790aedcdca654f2e7f039b7bec09407f86731130daede761a6

SHA512
2c30f3cc7bda1edc1da92bbbe14c08c16fcb38b7bf97b19a9f0d1de769a0e95905ea7292fb11f1e34fe853d39644c159f573db725130edd134672b5b803d5b8c

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
368KB

MD5
8355c42d3e4d4df5ac12bab49cb78e1e

SHA1
b5277ccbb47d59542feb95ace258645c8264fb85

SHA256
55e8be3ed3eac5eb00455035cba3fa1b6c9960864bfb5182dd2e59d2c992211e

SHA512
f6d174eeef320fddb450b548587be99e1d33183498737c1a9e1f431d2d6275bec4d45ea5fdf880987d41a9c5c1117d5e58b792e054ccc43246fd412d298830f4

Download Submit
C:\Windows\SysWOW64\Ompfej32.exe

Filesize
368KB

MD5
3d2d92fbeaafb3ad8113782de117b1c1

SHA1
603d3cf36b3cb5e73aeb1ba4eeb3453451c4a900

SHA256
69b805c2adcc4fde797d73bf64d07b0a2fb06310feec53451c880d6407e046ec

SHA512
f8bb65062cfc23b9a0c36f4cfbbbb7e6bcd31acd259a03e458d5a33dc876e64a2d984c725a9e31d96d381504a892379d925a1089019006d625a196e5f2593658

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
368KB

MD5
5625a1ed69b7660b61c442d332816487

SHA1
b5b2b2065ed37666a11f412a784451ba96fe73d2

SHA256
a4c79d33e67e26a96a56cce49d14593d43581cfc653f5781db97e75fd5c9b98c

SHA512
b34d842d96b0e7ab2cac062208485b7d33ad9fbb858ae6a42194c011b632423a3d2772e0472248c64fd47f4899d5995076f9e713cfcdca1d8118fa0b184e3adb

Download Submit
C:\Windows\SysWOW64\Paihlpfi.exe

Filesize
368KB

MD5
25ddf5cae47bdd61dba5647caf09b2dd

SHA1
2cc0859d107f2a06c8bef1db5446146eacae093f

SHA256
d8309ec3692886d2dea032b13f674bdd6b83edc94c3e7e327a26b434e6f9d3b9

SHA512
768b1e3201ceaa9898c07f4fac3861f7e32b43a16f167ed32dfaaa3a2047be3bfb7a6c4c67f7c98d8de79d0fd3e9fc8f7c34f3df5e38a4593973e087493b7231

Download Submit
C:\Windows\SysWOW64\Phigif32.exe

Filesize
368KB

MD5
e519557d3b40eda8c78a04dddb9059ad

SHA1
4d6cc90dc5046116add449edc9dae6b333d37dbd

SHA256
c489e57e2a3b8780639fd7fb1f24efba3ccac73b39a1068e7069b2a676abbf2f

SHA512
446907814ee9f34c1e380ba1d648b05074711a926443918b94dd0d50c7b3626e2081d06e98ed00c778033adee8fa90edaa30c748269d98a1fbb5fe1e29385c62

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
368KB

MD5
84945263fc02bd9cbefecd193ed40e3d

SHA1
8d8d11e9284ae69463f4a438002c59046be8e769

SHA256
cc3b6904ac92a6adda0c833ce776dc6b4ba333479ffa0d0ec0eaaee0d11da3c7

SHA512
e8e36f1e05c3132051fb3c9330fca03bcdb6a890d1fb5dcd635332dceb967e58838e0e2813cde9745499b26ba001c376d730134ba7ae6af11baac8adfa03bcc9

Download Submit
C:\Windows\SysWOW64\Ponfka32.exe

Filesize
368KB

MD5
beb36f3a12c3a97050da1b630a7fa89d

SHA1
e68306f38c5b0f76c6f41bca83065546a77e14f5

SHA256
b3dcfb38a988e24fb581bbba2dd3abd03a9949010a51e5fc01cac5a55c995814

SHA512
c4aa7c9aadf1074e56ab3a2e58f10f77587e2c20b43c0fbddc99134e61cb4c61770b471d1e936d2d8ee08c942aa5443a67c93f71f854759c008cd7852c3c6d67

Download Submit
C:\Windows\SysWOW64\Pplobcpp.exe

Filesize
368KB

MD5
b42bc7bd7c8cd69eb68f1159dfdad264

SHA1
c36ff858e3148e49e54ded236a7cba17f4ac6ae9

SHA256
df6668f80c37a022c26f0d58d9bce52fe5f2c7998e3c7d4736879aa18bfd0577

SHA512
5646966515b4a5afede46eb50d4fd9770cdac19495bf66dd537514461dfb0f2cb600c3a009ba171a5636eeac157ef30421bb64e4910d8f8dd68428692bed9a65

Download Submit
C:\Windows\SysWOW64\Qaalblgi.exe

Filesize
368KB

MD5
b05bebfee283918bf77a7fea7dfeef4c

SHA1
279b24a9161c809f51eea6ba544588aac4aafd18

SHA256
903a282d8ea5cab45a66e312a8849189b4835fa1cb643ac57f5f36aa21cdff3e

SHA512
77dbc654fb5cf2b29ea000c330488bf5f9b62e21abf05b3e12775dd1903c7a3633542101580cfb252484321995a0e0a11d2c3c05973c400d3cf47a9e3a58567d

Download Submit
memory/116-501-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/404-482-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/536-525-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/540-592-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/544-381-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/908-149-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/928-173-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1016-569-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1016-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1052-375-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1092-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1092-548-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1104-556-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1136-447-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1248-398-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1264-332-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1288-212-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1316-165-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1324-157-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1420-599-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1492-267-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1560-315-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1632-429-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1772-471-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1816-285-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1836-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1836-577-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1872-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1872-591-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1900-423-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2092-309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2100-477-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2140-585-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2340-564-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2352-550-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2496-597-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2496-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2576-125-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2652-189-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2660-405-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2664-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2716-489-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2720-320-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2784-362-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2876-393-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2980-519-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3076-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3076-563-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3096-435-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3120-495-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3152-302-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3156-578-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3160-571-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3252-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3372-88-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3388-252-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3416-84-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3444-507-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3488-453-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3508-410-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3512-369-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3636-221-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3704-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3732-261-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3820-104-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3896-327-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3940-116-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3960-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3960-583-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4052-237-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4076-513-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4148-555-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4148-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4168-279-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4176-204-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4276-543-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4328-459-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4336-128-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4436-416-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4484-229-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4576-351-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4616-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4672-181-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4700-441-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4720-531-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4804-357-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4812-297-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4864-273-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4884-192-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4896-339-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4920-244-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4972-465-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5028-291-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5096-344-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5112-386-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5116-537-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads