berbew | 483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103.exe
Size

96KB
MD5

80b93366233fd80e417cac9c5380d9c7
SHA1

8b550f3aa7b6f31c8f378247c29ab8624f000318
SHA256

483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103
SHA512

ed8f0bcd08692188d0810d8c505acb9b83254309a81de3b606953c2bee2bf04f6962276c47a8dc4002299fbd7653502faec988097b80438c1b13a104280c63dd
SSDEEP

3072:SlSa4nmX4iJFOkktaBUfClil9ifFPd69jc0vf:ScbmNXktahlY0Pd6NVf

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cljobphg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdfoio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peahgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnindhpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikqqlgem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piphgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibmeoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ipeeobbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djqblj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffceip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halhfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hloqml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgabcge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfdpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joekag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fgcjfbed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmqgpgoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkadoiip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bopocbcq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdfoio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djcoai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dglkoeio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgiimng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Giljfddl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpomcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olbdhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phganm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dpdaepai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enigke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdccbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmfbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddifgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pejkmk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkpdcmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nemmoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olanmgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahpmjejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opeiadfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjidgkog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbdiknlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glcaambb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpcfmkff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmgfedl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iafkld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aleckinj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
212	Eiildjag.exe
4936	Epcdqd32.exe
3572	Edopabqn.exe
2052	Fkkeclfh.exe
4460	Faenpf32.exe
1856	Fhofmq32.exe
2804	Fdffbake.exe
3656	Fibojhim.exe
4024	Fpmggb32.exe
4048	Fhdohp32.exe
3420	Fmqgpgoc.exe
4256	Fpodlbng.exe
116	Ggilil32.exe
3832	Gigheh32.exe
2808	Gdmmbq32.exe
368	Gijekg32.exe
5032	Gaamlecg.exe
4764	Gkiaej32.exe
1900	Ghmbno32.exe
4424	Gphgbafl.exe
3992	Gknkpjfb.exe
4492	Gdfoio32.exe
3044	Hnodaecc.exe
1284	Hgghjjid.exe
4988	Hpomcp32.exe
2004	Hgiepjga.exe
4288	Haoimcgg.exe
4260	Hhiajmod.exe
2100	Hjjnae32.exe
4036	Haafcb32.exe
1244	Hdpbon32.exe
2272	Hkjjlhle.exe
2532	Hnhghcki.exe
4688	Ikndgg32.exe
4588	Inmpcc32.exe
2348	Idghpmnp.exe
3616	Ikqqlgem.exe
4676	Idieem32.exe
4968	Ibmeoq32.exe
3204	Ikejgf32.exe
1712	Indfca32.exe
3928	Jglklggl.exe
2708	Jbaojpgb.exe
4864	Jkjcbe32.exe
3700	Jdbhkk32.exe
2208	Jnkldqkc.exe
860	Jhpqaiji.exe
4488	Jnmijq32.exe
2060	Jibmgi32.exe
2352	Jnpfop32.exe
964	Kdinljnk.exe
1364	Kghjhemo.exe
60	Kbpkkn32.exe
2448	Kkhpdcab.exe
3544	Kbbhqn32.exe
3560	Keqdmihc.exe
1660	Kniieo32.exe
1452	Kinmcg32.exe
2860	Lbgalmej.exe
4456	Lgcjdd32.exe
952	Lnnbqnjn.exe
2792	Legjmh32.exe
3388	Lkabjbih.exe
3696	Lejgch32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bmlilh32.exe	Bjlpjm32.exe
File created	C:\Windows\SysWOW64\Inlihl32.exe	Iknmla32.exe
File opened for modification	C:\Windows\SysWOW64\Ipmbjgpi.exe	Innfnl32.exe
File created	C:\Windows\SysWOW64\Fkikinpo.dll	Dbocfo32.exe
File created	C:\Windows\SysWOW64\Aiffheej.dll	Bddjpd32.exe
File created	C:\Windows\SysWOW64\Hhfjcdon.dll	Ajggomog.exe
File created	C:\Windows\SysWOW64\Eplgeokq.exe	Ejoomhmi.exe
File opened for modification	C:\Windows\SysWOW64\Mchppmij.exe	Maiccajf.exe
File created	C:\Windows\SysWOW64\Hemdlj32.exe	Hekgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Eqncnj32.exe	Ebkbbmqj.exe
File opened for modification	C:\Windows\SysWOW64\Nmjfodne.exe	Nbebbk32.exe
File created	C:\Windows\SysWOW64\Jjgkan32.dll	Omdieb32.exe
File created	C:\Windows\SysWOW64\Nmqmbmdf.dll	Ekdnei32.exe
File created	C:\Windows\SysWOW64\Gfheof32.exe	Gdjibj32.exe
File created	C:\Windows\SysWOW64\Ikbfgppo.exe	Icknfcol.exe
File created	C:\Windows\SysWOW64\Mlkhbi32.dll	Ilibdmgp.exe
File opened for modification	C:\Windows\SysWOW64\Jbaojpgb.exe	Jglklggl.exe
File created	C:\Windows\SysWOW64\Aodogdmn.exe	Aleckinj.exe
File opened for modification	C:\Windows\SysWOW64\Nghekkmn.exe	Meiioonj.exe
File opened for modification	C:\Windows\SysWOW64\Eejeiocj.exe	Epmmqheb.exe
File opened for modification	C:\Windows\SysWOW64\Lqkqhm32.exe	Lnldla32.exe
File opened for modification	C:\Windows\SysWOW64\Eclmamod.exe	Eifhdd32.exe
File opened for modification	C:\Windows\SysWOW64\Hlambk32.exe	Hibafp32.exe
File created	C:\Windows\SysWOW64\Lgccinoe.exe	Lqikmc32.exe
File created	C:\Windows\SysWOW64\Ekfcklij.dll	Coohhlpe.exe
File opened for modification	C:\Windows\SysWOW64\Gknkpjfb.exe	Gphgbafl.exe
File created	C:\Windows\SysWOW64\Lmpkadnm.exe	Lgccinoe.exe
File opened for modification	C:\Windows\SysWOW64\Nabfjpak.exe	Nndjndbh.exe
File created	C:\Windows\SysWOW64\Eecphp32.exe	Enigke32.exe
File created	C:\Windows\SysWOW64\Gfeaopqo.exe	Fnnjmbpm.exe
File created	C:\Windows\SysWOW64\Ikqqlgem.exe	Idghpmnp.exe
File created	C:\Windows\SysWOW64\Higjaoci.exe	Hcmbee32.exe
File opened for modification	C:\Windows\SysWOW64\Jgkdbacp.exe	Jdmgfedl.exe
File created	C:\Windows\SysWOW64\Lipgdi32.dll	Gbiockdj.exe
File opened for modification	C:\Windows\SysWOW64\Abbkcpma.exe	Aodogdmn.exe
File opened for modification	C:\Windows\SysWOW64\Knnhjcog.exe	Kgdpni32.exe
File opened for modification	C:\Windows\SysWOW64\Hildmn32.exe	Hgmgqc32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhnbhok.exe	Oanfen32.exe
File opened for modification	C:\Windows\SysWOW64\Poimpapp.exe	Plkpcfal.exe
File opened for modification	C:\Windows\SysWOW64\Kncaec32.exe	Kpoalo32.exe
File created	C:\Windows\SysWOW64\Nbgqin32.dll	Njfkmphe.exe
File opened for modification	C:\Windows\SysWOW64\Ebkbbmqj.exe	Eomffaag.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Fjdiliki.dll	Abponp32.exe
File created	C:\Windows\SysWOW64\Fpmfmgnc.dll	Ebkbbmqj.exe
File created	C:\Windows\SysWOW64\Giljfddl.exe	Gijmad32.exe
File created	C:\Windows\SysWOW64\Dfjpfj32.exe	Dckdjomg.exe
File created	C:\Windows\SysWOW64\Dpifba32.dll	Poomegpf.exe
File created	C:\Windows\SysWOW64\Dpglbfpm.dll	Mjahlgpf.exe
File opened for modification	C:\Windows\SysWOW64\Mnjqmpgg.exe	Mjlhgaqp.exe
File created	C:\Windows\SysWOW64\Ahpmjejp.exe	Aogiap32.exe
File opened for modification	C:\Windows\SysWOW64\Ppdbgncl.exe	Omdieb32.exe
File created	C:\Windows\SysWOW64\Okjnnj32.exe	Ohkbbn32.exe
File opened for modification	C:\Windows\SysWOW64\Aeddnp32.exe	Aojlaeei.exe
File created	C:\Windows\SysWOW64\Mnpabe32.exe	Mmpdhboj.exe
File created	C:\Windows\SysWOW64\Faenpf32.exe	Fkkeclfh.exe
File created	C:\Windows\SysWOW64\Fbfcmhpg.exe	Fdccbl32.exe
File created	C:\Windows\SysWOW64\Gdjibj32.exe	Glcaambb.exe
File opened for modification	C:\Windows\SysWOW64\Plkpcfal.exe	Peahgl32.exe
File created	C:\Windows\SysWOW64\Hipmfjee.exe	Gfodeohd.exe
File opened for modification	C:\Windows\SysWOW64\Hpmhdmea.exe	Hhfpbpdo.exe
File created	C:\Windows\SysWOW64\Ojdgnn32.exe	Ogcnmc32.exe
File created	C:\Windows\SysWOW64\Fmfnpa32.exe	Ffmfchle.exe
File created	C:\Windows\SysWOW64\Lebcnn32.dll	Oaqbkn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3200	1712	WerFault.exe	659

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgoakc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fideeaco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipjedh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgpmmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfdpad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gijekg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjlpjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pejkmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefgbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fibojhim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbgalmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbbnpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbplml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpmggb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dflmlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpejlmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akamff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcmbee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgcjdd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fipkjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gigaka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gphgbafl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhpqaiji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjlhgaqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmlilh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eidlnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgpgfmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibegfglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lejgch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leopnglc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oafcqcea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pifnhpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jepjhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckkfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbjkkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebhglj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpbmfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmcclm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doccpcja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piphgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aojlaeei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maggnali.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmojkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlhljhbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kolabf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdfoio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fffhifdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbabigfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iknmla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpolbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pblajhje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oklkdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epikpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Injmcmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgjndno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakdbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kniieo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipoopgnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfodeohd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhdcmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibafp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgpqgeo.dll"	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkgiimng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkpmdbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kcjjhdjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knfeeimj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bafehe32.dll"	Mmpdhboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdnpclpq.dll"	Jnlbojee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqmmqg32.dll"	Eejeiocj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Filapfbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkpkgebb.dll"	Laqhhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hlambk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhfpbpdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dckdjomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efepbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Plbfdekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbflncid.dll"	Hckeoeno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jdmgfedl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maiccajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nndjndbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkiongah.dll"	Fkhpfbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmcfjdp.dll"	Nckkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpbdopck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dflmlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnlinml.dll"	Innfnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmdlffhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qofcff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bopocbcq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ciafbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nadleilm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lplfcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mbibfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oiagde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aknifq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmmlla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ggfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ggkqgaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhlfgd.dll"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiikeffm.dll"	Ddifgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fibojhim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Camfoh32.dll"	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpifba32.dll"	Poomegpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anmfbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpifjj32.dll"	Mbdiknlb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Epcdqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnclimck.dll"	Qkmdkgob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilmjim32.dll"	Gmafajfi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 212	216	483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103.exe	83
PID 216 wrote to memory of 212	216	483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103.exe	83
PID 216 wrote to memory of 212	216	483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103.exe	83
PID 212 wrote to memory of 4936	212	Eiildjag.exe	84
PID 212 wrote to memory of 4936	212	Eiildjag.exe	84
PID 212 wrote to memory of 4936	212	Eiildjag.exe	84
PID 4936 wrote to memory of 3572	4936	Epcdqd32.exe	85
PID 4936 wrote to memory of 3572	4936	Epcdqd32.exe	85
PID 4936 wrote to memory of 3572	4936	Epcdqd32.exe	85
PID 3572 wrote to memory of 2052	3572	Edopabqn.exe	86
PID 3572 wrote to memory of 2052	3572	Edopabqn.exe	86
PID 3572 wrote to memory of 2052	3572	Edopabqn.exe	86
PID 2052 wrote to memory of 4460	2052	Fkkeclfh.exe	87
PID 2052 wrote to memory of 4460	2052	Fkkeclfh.exe	87
PID 2052 wrote to memory of 4460	2052	Fkkeclfh.exe	87
PID 4460 wrote to memory of 1856	4460	Faenpf32.exe	88
PID 4460 wrote to memory of 1856	4460	Faenpf32.exe	88
PID 4460 wrote to memory of 1856	4460	Faenpf32.exe	88
PID 1856 wrote to memory of 2804	1856	Fhofmq32.exe	89
PID 1856 wrote to memory of 2804	1856	Fhofmq32.exe	89
PID 1856 wrote to memory of 2804	1856	Fhofmq32.exe	89
PID 2804 wrote to memory of 3656	2804	Fdffbake.exe	90
PID 2804 wrote to memory of 3656	2804	Fdffbake.exe	90
PID 2804 wrote to memory of 3656	2804	Fdffbake.exe	90
PID 3656 wrote to memory of 4024	3656	Fibojhim.exe	92
PID 3656 wrote to memory of 4024	3656	Fibojhim.exe	92
PID 3656 wrote to memory of 4024	3656	Fibojhim.exe	92
PID 4024 wrote to memory of 4048	4024	Fpmggb32.exe	93
PID 4024 wrote to memory of 4048	4024	Fpmggb32.exe	93
PID 4024 wrote to memory of 4048	4024	Fpmggb32.exe	93
PID 4048 wrote to memory of 3420	4048	Fhdohp32.exe	94
PID 4048 wrote to memory of 3420	4048	Fhdohp32.exe	94
PID 4048 wrote to memory of 3420	4048	Fhdohp32.exe	94
PID 3420 wrote to memory of 4256	3420	Fmqgpgoc.exe	95
PID 3420 wrote to memory of 4256	3420	Fmqgpgoc.exe	95
PID 3420 wrote to memory of 4256	3420	Fmqgpgoc.exe	95
PID 4256 wrote to memory of 116	4256	Fpodlbng.exe	96
PID 4256 wrote to memory of 116	4256	Fpodlbng.exe	96
PID 4256 wrote to memory of 116	4256	Fpodlbng.exe	96
PID 116 wrote to memory of 3832	116	Ggilil32.exe	97
PID 116 wrote to memory of 3832	116	Ggilil32.exe	97
PID 116 wrote to memory of 3832	116	Ggilil32.exe	97
PID 3832 wrote to memory of 2808	3832	Gigheh32.exe	98
PID 3832 wrote to memory of 2808	3832	Gigheh32.exe	98
PID 3832 wrote to memory of 2808	3832	Gigheh32.exe	98
PID 2808 wrote to memory of 368	2808	Gdmmbq32.exe	99
PID 2808 wrote to memory of 368	2808	Gdmmbq32.exe	99
PID 2808 wrote to memory of 368	2808	Gdmmbq32.exe	99
PID 368 wrote to memory of 5032	368	Gijekg32.exe	100
PID 368 wrote to memory of 5032	368	Gijekg32.exe	100
PID 368 wrote to memory of 5032	368	Gijekg32.exe	100
PID 5032 wrote to memory of 4764	5032	Gaamlecg.exe	101
PID 5032 wrote to memory of 4764	5032	Gaamlecg.exe	101
PID 5032 wrote to memory of 4764	5032	Gaamlecg.exe	101
PID 4764 wrote to memory of 1900	4764	Gkiaej32.exe	102
PID 4764 wrote to memory of 1900	4764	Gkiaej32.exe	102
PID 4764 wrote to memory of 1900	4764	Gkiaej32.exe	102
PID 1900 wrote to memory of 4424	1900	Ghmbno32.exe	103
PID 1900 wrote to memory of 4424	1900	Ghmbno32.exe	103
PID 1900 wrote to memory of 4424	1900	Ghmbno32.exe	103
PID 4424 wrote to memory of 3992	4424	Gphgbafl.exe	104
PID 4424 wrote to memory of 3992	4424	Gphgbafl.exe	104
PID 4424 wrote to memory of 3992	4424	Gphgbafl.exe	104
PID 3992 wrote to memory of 4492	3992	Gknkpjfb.exe	106

C:\Users\Admin\AppData\Local\Temp\483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103.exe
"C:\Users\Admin\AppData\Local\Temp\483a01357833823708bcf8e60c9b16d3e1e4e1acecac27745bc4fed514fb3103.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\Eiildjag.exe
  C:\Windows\system32\Eiildjag.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\Epcdqd32.exe
    C:\Windows\system32\Epcdqd32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\SysWOW64\Edopabqn.exe
      C:\Windows\system32\Edopabqn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2052
      - C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        24⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        25⤵
        Executes dropped EXE
        
        PID:1284
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        27⤵
        Executes dropped EXE
        
        PID:2004
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        28⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        29⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        30⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        31⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        32⤵
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        33⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        34⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        35⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        36⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2348
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        39⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        41⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        42⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3928
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        44⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        45⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        46⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        47⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:860
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        49⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        50⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        51⤵
        Executes dropped EXE
        
        PID:2352
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        52⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        53⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        54⤵
        Executes dropped EXE
        
        PID:60
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        55⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        56⤵
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        57⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1660
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        59⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        62⤵
        Executes dropped EXE
        
        PID:952
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        63⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        64⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        66⤵
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        67⤵
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5020
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        70⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        71⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        72⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        73⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        74⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        75⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        76⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        77⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2756
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        79⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        80⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        81⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        82⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        83⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        84⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        85⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        86⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:528
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        88⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        89⤵
        
        PID:660
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        90⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        91⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3232
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        93⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        94⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        97⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        98⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        99⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        100⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        102⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        104⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        105⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        106⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        107⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        110⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        111⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        113⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        114⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        115⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        116⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        117⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        118⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        119⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        120⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        122⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        123⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        125⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        126⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        127⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        128⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        130⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        132⤵
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        134⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        135⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        136⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        139⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        140⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        141⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        143⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        144⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        145⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        146⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        147⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        148⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        149⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        150⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        151⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        152⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        155⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        157⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        158⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        159⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        160⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        161⤵
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        163⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        165⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        166⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        167⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        168⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        169⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        172⤵
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        173⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        174⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        176⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        177⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        179⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        180⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        181⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        183⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        184⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        186⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        187⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        188⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        190⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        192⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        193⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        194⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        195⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        200⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        202⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        203⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        204⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        205⤵
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        208⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        209⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        210⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        211⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        212⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        213⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7372
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        215⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        216⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        217⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7504
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        218⤵
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        219⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        220⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        221⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        222⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7724
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        223⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        224⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        225⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        226⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        228⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        229⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        230⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        231⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        233⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        234⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7280
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        235⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        237⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        239⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        240⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        241⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        243⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        244⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        245⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        247⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        248⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7720
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        250⤵
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        251⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        252⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        253⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        255⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        256⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        257⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        258⤵
        Modifies registry class
        
        PID:7296
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        259⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        260⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        261⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        262⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        263⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        264⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        265⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        266⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        268⤵
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        269⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        270⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        271⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        272⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        273⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8572
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        275⤵
        Drops file in System32 directory
        
        PID:8616
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        276⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        277⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        278⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        279⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        280⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        281⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        282⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8968
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        284⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        285⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        286⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        287⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        288⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:8216
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        290⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        291⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        292⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        293⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        294⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        295⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        296⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        297⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        298⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        299⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        300⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        301⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        302⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        303⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        304⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        305⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        306⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        307⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        309⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        310⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        311⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        312⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3788
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        314⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        315⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        319⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        320⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        321⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        322⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        323⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        325⤵
        Drops file in System32 directory
        
        PID:4152
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        326⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        327⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        328⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        329⤵
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        330⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        331⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8996
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        333⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        334⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:8800
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9240
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        337⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        338⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        339⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        340⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        341⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        342⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        343⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        346⤵
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9736
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        348⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        349⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        350⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        351⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        352⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        353⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        354⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        355⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        356⤵
        Drops file in System32 directory
        
        PID:10132
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        357⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        358⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        359⤵
        Drops file in System32 directory
        
        PID:9280
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        360⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        361⤵
        System Location Discovery: System Language Discovery
        
        PID:9416
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9660
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        367⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        368⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        370⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        371⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        372⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        373⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        374⤵
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        375⤵
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        376⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        377⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        378⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        379⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:9924
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10012
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        382⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        383⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        384⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:9580
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        386⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        387⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        388⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        389⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        390⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        391⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        392⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9964
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        393⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        394⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        395⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        396⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        397⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10144
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        399⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        400⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:10284
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        402⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        403⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        404⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:10436
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        406⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        407⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10552
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        409⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        410⤵
        Drops file in System32 directory
        
        PID:10628
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        411⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        412⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        413⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10772
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        415⤵
        Drops file in System32 directory
        
        PID:10808
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        416⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        417⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        418⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        419⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        420⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        421⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11032
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        422⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        423⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        424⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11180
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        426⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        427⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        428⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        429⤵
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        430⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        431⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        432⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10612
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        434⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        435⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        436⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        437⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        438⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        439⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11064
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        441⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11204
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        443⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        444⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        445⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        446⤵
        Modifies registry class
        
        PID:10588
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        447⤵
        Modifies registry class
        
        PID:10720
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        448⤵
        Modifies registry class
        
        PID:10864
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        449⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        450⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        451⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        452⤵
        Modifies registry class
        
        PID:10888
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        453⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10468
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        454⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        455⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11092
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        457⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        458⤵
        Drops file in System32 directory
        
        PID:10692
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11056
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:10796
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        461⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        462⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        463⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        464⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        465⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        466⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        467⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        468⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        469⤵
        Drops file in System32 directory
        
        PID:11524
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        470⤵
        Drops file in System32 directory
        
        PID:11560
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        471⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        472⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11672
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        474⤵
        Modifies registry class
        
        PID:11712
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        475⤵
        Modifies registry class
        
        PID:11748
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:11784
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        477⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        478⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11900
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        480⤵
        Drops file in System32 directory
        
        PID:11936
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11972
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        482⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:12044
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        484⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        485⤵
        Modifies registry class
        
        PID:12116
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12156
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        487⤵
        Drops file in System32 directory
        
        PID:12192
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12228
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        489⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        490⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        491⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        492⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        493⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        494⤵
        System Location Discovery: System Language Discovery
        
        PID:11544
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        495⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11684
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        497⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11736
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        498⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        499⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        500⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        501⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        502⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        503⤵
        Drops file in System32 directory
        
        PID:1080
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11992
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        506⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        507⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        508⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        509⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        510⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        511⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12272
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        513⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        514⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        515⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        516⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        518⤵
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        519⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        520⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        521⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        522⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        523⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        524⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        525⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        526⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        527⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        528⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        529⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        530⤵
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        531⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        532⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        533⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        534⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5012
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        537⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        538⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        539⤵
        Modifies registry class
        
        PID:11416
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        540⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        541⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        542⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        543⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        544⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        545⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        546⤵
        Drops file in System32 directory
        
        PID:3360
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        547⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        548⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        549⤵
        Modifies registry class
        
        PID:1284
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        550⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        551⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        552⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        553⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        554⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        555⤵
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        557⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3792
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        559⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        560⤵
        Modifies registry class
        
        PID:1196
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        561⤵
        Modifies registry class
        
        PID:12200
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        562⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        564⤵
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        565⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 408
        566⤵
        Program crash
        
        PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1712 -ip 1712
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aojlaeei.exe

Filesize
96KB

MD5
6b20acbe35b1e25bdd74e2d054794b74

SHA1
f01201258acc98c6a5c933e3ff16e26986556e52

SHA256
cbeaea63724c8af707fe5bb7db6fbd60f9bfc5eed2a7ca6493fb8fa739c09242

SHA512
467b859c36d735a7de857e66aa67996b0adbcd3cd98a1ab0c93cf9508de97df3bf89aab60bf43d1b8e0d74e8f1628c6a923923fdf0606ef1a42146e15b5b3433

Download Submit
C:\Windows\SysWOW64\Bcgpgh32.dll

Filesize
7KB

MD5
1c91f4bda47b75b50697c0507074021c

SHA1
51368e380ae06722a69fbdefb25dffeb7c90671f

SHA256
b70edba59f0b4840fddc5b4ae863d6ce8996ec52055a115c018eb1b9757eabc0

SHA512
c3c4248013f553760703a08e1bbd4cd00467c74ba5e1d70b50bac6d77a05e6d91f93672a81969639fd692ee362c59fa32b415f2ae78075a57b2fbf8acf6014d5

Download Submit
C:\Windows\SysWOW64\Bjlpjm32.exe

Filesize
96KB

MD5
2a83f250ffa36d55368b84f64434e3bf

SHA1
981d223cc7a7e32db4a3a9a3b8edd043ee277706

SHA256
e8d64e81afcd761acae024fd7e31fa1118f63c37f779d600ef0577c8ac904498

SHA512
bd8d6263a585f040d4bd8006d840ec2fe960c0b648aa37bec881eda3ce43ff5cab62334d4127d31a673968daedf5c8288a94ca2b8e083357734b4b4cf2a24ef6

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
96KB

MD5
9edb5c1ab9bb3a22e30b20746238c74a

SHA1
3110ca57f27aa4388f9fb35606b18af061366e76

SHA256
3ca98304c471b4c9f6eee24b0cb2fb1d07ed28ba5b5667f420dcee47d68a2a10

SHA512
ca8aadd37caa7ffc28fd38d379ebf90210d0b8e795269d1fb9a42a48a5223aea9a2271c578eea041c428a8caceaacf7b304c549924869a0f2706d119c4669bf2

Download Submit
C:\Windows\SysWOW64\Cjliajmo.exe

Filesize
96KB

MD5
57b0b4f1aee955d418cfc4457bd0d500

SHA1
97b1294b42866caa8593e952d5582ba1f382bc47

SHA256
692b6a1d64682d8c855f85f7b36b39ebfcfb1c03ef46b0e92b91f729fe31ce4f

SHA512
5318fa148016ddbf368fe94fc979bfef4e5d15f699b5e68daace2baee7cb805c998071b267d83775d68ae277b653ce422f0d8eed474de7cae6156a9b988c88d2

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
96KB

MD5
6cc85cc398fab86437c7dd41d940f8b8

SHA1
6c1df49d035a599dc6abf9644ceb921ccf458160

SHA256
57c816a5fcee8f170fbd11bfdd67604d8d63f70a6f751a5b064fe37441282ee0

SHA512
616fd9b93f6a9b213468d1a94fcd2138a23ce4fda9727a52cac3b018dff52219317a6261ae2c7f1ca07db1800c4517c471362aaf5331e618e8c0e9a373cc3ba4

Download Submit
C:\Windows\SysWOW64\Ckkiccep.exe

Filesize
96KB

MD5
ac0039b649da4c641b6d9d31a22ce6fd

SHA1
71cdd360fddc5c1affb88034f284f9ed4f2b4641

SHA256
42cce72810a6a68945df6c7b07b4ce4b6be871ab7c8acde580d136956277791d

SHA512
3435c3f12aedc0727acb76d70065ad7f24b6abf2d16b10d48011fba6d63170622955738df6aa745d49079b7e7ba8dde95d6043141dd35359986f13f2a8b9e8be

Download Submit
C:\Windows\SysWOW64\Dikihe32.exe

Filesize
96KB

MD5
9ab6b33b89687c5461b848db4a59d523

SHA1
3d296a6f25778009d293e2531c9191fa32f5d3b0

SHA256
22a9135db1f9047008840cd574f580011f82bff305387c495f823c013f9295f2

SHA512
6403c4f77bed420e7969dd0ef6eea756f5117e981f8e644fde346b4d078430414ddd52c72e1252490bb2ad8823b186a9acc375a9e593702274639f07fab7c991

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
96KB

MD5
60d07ead6d45409a0a8686e41e093b61

SHA1
48da6adb884af9b5d25637a197bf8b0f662d10c9

SHA256
6db1821bead56f2b2c0efe5e85116f6a2817b50649922ec2e6e8de537be87015

SHA512
af723f6ddd4cd903be2eda58438ad94b9645a2e52316623bb6db46caf58b86ae305160de54cc6e4157e62041fa9ed7a0971a7a31a5b1797562e8473a1ae3088c

Download Submit
C:\Windows\SysWOW64\Edeeci32.exe

Filesize
96KB

MD5
d9b438f8c79790ec03f20e374d7f4914

SHA1
20c15e7dd2434af221ef3562aec60e748c52757e

SHA256
4930094fa28cb2e94b432c768f2ae66402d9f81b37d8c49a57290ed3b1bdaf60

SHA512
104a7d3caf89375622e3d48b3487fd182605b34c407305b9970364724b7bf2b3cb57ae3f258d6ce417b151d51548419194e82b2f68391a137e47f33c165a2d1a

Download Submit
C:\Windows\SysWOW64\Edopabqn.exe

Filesize
96KB

MD5
3a822fc793abefaa82fcd87494a30a3f

SHA1
c99644be7c44646134b126294848ca8670a7dab3

SHA256
74fcfe005711d878a2980ef99acfa8aa73537490e3dc9f9463dc51ebb034cbeb

SHA512
573fec2138d403c12938f7456de0b9e93e23b6a0ea30cc0094c47d0bdb6167b7ecb19cacb167b28ac87b3b5fceceac21dceb2c12a5753fc40a442cd08a7613f2

Download Submit
C:\Windows\SysWOW64\Eecphp32.exe

Filesize
96KB

MD5
7e81996fba56023e463f96d017cd4e38

SHA1
d7875384e6c68c5021a3c8600a23bb6e846afd4f

SHA256
ba831e67df445217218f3b93435797bb57fcb42be74336db215bf3579e9772be

SHA512
83cd7c9cea6382a83eec3670416717aeadc1abf6b822b40bdb84a02783bf5c8004f147172be02c79a3d781e6235d039b3d062bba8bae95d90ebe38aad905137f

Download Submit
C:\Windows\SysWOW64\Eiildjag.exe

Filesize
96KB

MD5
12ee41ef96c40eba5e0e14aeb672e5b4

SHA1
14979b0c5255674173b12e419f59d196fb2fe8c8

SHA256
fce6981ea0e4329ab52eecaf702bbedd277e76af9bbd0eaf83d2ee4a5e1d4bc8

SHA512
3bfc24228ac9d673828a8a25bc648edb51b03819496ce8dad35e92bf8060a9d6577c600cded318e6f6948b7cb8f132d6c79d448ca84ac1c351d9ff62fe13272f

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
96KB

MD5
1222e532c1ac295c0a5c8e275d8f1da1

SHA1
a0d494068f693f2878a06a2017065b705488dbd8

SHA256
42a5dcef59cd8a0ada840c4994a38973eca7fd91b5dc4049ccaaa497cd54b41c

SHA512
8efe00f61c4cf837a727ed4954749b9db5301d6d021406f8d3cd497807ecff0f81e478b760182c18d7a9dfd78684218f0b921ca8246fb71938ab6894068ce4e7

Download Submit
C:\Windows\SysWOW64\Epcdqd32.exe

Filesize
96KB

MD5
3dd1e4306104a7ca4cfd46e5c8476f01

SHA1
54ab6f221c711ca970b64fb56ff929c5f8ee59b3

SHA256
56f76fdb05732deb13a8bd41b5716b5ee0742a837c74fedfeaba098e2b957479

SHA512
05f12520b988dabd832342ffc88ce783670ad9377040b3359b59ea5ed4502ab2fd51bbc4b8dca07b34810254001f8f9ac8478603b50471a65d3a772b968ad191

Download Submit
C:\Windows\SysWOW64\Eqncnj32.exe

Filesize
96KB

MD5
47dea4c3f9129ab7650e0fd7e4066604

SHA1
eff329ed157b335d03b85eb7883dc0dbd7db462b

SHA256
4d9d9cf83cf1b31255460b4b99bd4afa0940b728d7544898da5fd8c4d1d00f58

SHA512
c4929d4814b6b604da5e800fbbad16040389b5ed163656c63dfdc04ea86575007775d6a5e0bddd8b26e38be0bd5b0b13afbf1a029f6231e632338f25336f6afa

Download Submit
C:\Windows\SysWOW64\Faenpf32.exe

Filesize
96KB

MD5
9aa8d245bf99293a0b00d5814ebc1de6

SHA1
a58df06134a4d3ba1228d31dee83cad656c362a7

SHA256
3da9b722771d3f4691d45e23e00a63d75094499f9721dc7e2d67d121dd8e14db

SHA512
8bee0228f7dee5fd4364052fed620a7242ed61088ac633e98d226f380338dabfc695b48ce4dd9e75bff6ddcbe9f379db7d29a3a26627561303f49c5b9116e6c8

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
96KB

MD5
ff84196cc9a01d65bd9b1998b30bb55f

SHA1
02363d41017c48f58ba46cbcecbbf691c8f55320

SHA256
2aee5a81f544eb114250da0d1bf2b7da8b8c9a673b5fcabf09f0fa7f59fc21ba

SHA512
3cff5d94cc460d3506c3529aded701384af3e15a636146bce0b358326ade228a2dfdcca1599f7466e2f709eaaff74164d826686dfe5bf965ddcdc6f60d8e2904

Download Submit
C:\Windows\SysWOW64\Fdffbake.exe

Filesize
96KB

MD5
c5a3ea1064dcec136b5d98e1278513c6

SHA1
3320c05edc9b942d6108485c5251f882bd484c8b

SHA256
ec746351c62c668d2b92355625bc470dcff9cc81d808011a23a07b2e6a99a013

SHA512
242d3d322c88d83bbfa320700795bc806d34bcb3fcf9da7e6a1cb0140fe18539fd07f669bf41c7711fcc580833665a023903ba70d6aafae3c617289fd3c06717

Download Submit
C:\Windows\SysWOW64\Ffceip32.exe

Filesize
96KB

MD5
15d0b3cc51302ca774b2a1cb2b37f1ac

SHA1
984836a01edfa38e1c4397fe6e8d54ee012cf482

SHA256
40ae04a3521d3e1d82cbb47c6c55241f8a100c73fcebca8556e5409c3123c4d4

SHA512
7c5a7e468ff6d2f3d4a1c76a4ea8875cff3632eac3ca3c14fae3ee4783c63622e6a6467e8cdad15f69388b358799df8207f2e8e8324ac3dc1a00e7d096a7b700

Download Submit
C:\Windows\SysWOW64\Fhdohp32.exe

Filesize
96KB

MD5
af6528e09d4d3db3744f6fa3bb349d42

SHA1
c09f035fb8bedbdeb07eb7b37d5d5a59e2ae51e9

SHA256
26a3d03e3989117efe3f8b5d7059fda061d5d3e35d144248ca773cd390e92675

SHA512
5eedc21139487e7cde1a2871e06397297bb1079745299c3ba0efc52b1cf7d390bc340818ff634d6582a1ae3b6945f6ae9f5b4c41a6f8df15b3e9c708eb9974b4

Download Submit
C:\Windows\SysWOW64\Fhofmq32.exe

Filesize
96KB

MD5
2dda0ad59348e4d1e0fdf55cfd2215a3

SHA1
50c7b3f63da3ce0eaaa2a7d49e74c5b1cf310c5a

SHA256
768a7f61921611cfeed382ee99f43434aba3e73265cb24bafd7a88e1a1dfada9

SHA512
9514478333fc10f5c5abe9a9ee065b92706186dfbb9e816c8e72cda88cd7f80dca8dc18663dc6e54755f99b018aa72eccae19e20a4113711a74007c9562b9b03

Download Submit
C:\Windows\SysWOW64\Fibojhim.exe

Filesize
96KB

MD5
45c6547f860407d08fec353ddf7ad3d0

SHA1
2e7291d4d3d82c9a4d56f677b05ef27f7992be43

SHA256
9167177afd9585e77a8fb52bff0dbaa0351206a0190a3457a614d6a3137ff181

SHA512
f26055bd099f3f4c4418d6c6eb8c04951aa5f5b9778665ff3f91b9e5b193bb6dd8b7c7c2532efcb45970100831c5cae1ca3a342987237ee6936c53a3e98d6879

Download Submit
C:\Windows\SysWOW64\Fkkeclfh.exe

Filesize
96KB

MD5
feef530dd6be07e49141b81b99d72ae3

SHA1
11c08aa629e0743291ae54b32bb69ab8da1e5701

SHA256
d7ee6ac415abcbf67c18c5974ba4d5a30c3d74edc5f5ba399b2b5b750991f1d2

SHA512
8d9e86b12cbc91372c480e7cebcf7db50662b2559fd237da638d517c88ae79831b7fb95147a908f4632ea194b754e89f519c80b38eacaeea4baa9e3da56d0916

Download Submit
C:\Windows\SysWOW64\Flngfn32.exe

Filesize
96KB

MD5
23372a7b2af94d0e0d1383c6803565e3

SHA1
c34192904a806d74013284b424ca2eb90a247490

SHA256
03df21b7fb989a23bfad86feb5415502ac9a57f0c73d4d867124182d176fc46d

SHA512
9e6f4bb8b7d765f13eab626dba7cdb4f6e726a5bad58321bbe3e7db3df9671a31e14f587721f4d3b5b8b4ab9b890e19d9af1bdfffe9d084885dcf749a33ac374

Download Submit
C:\Windows\SysWOW64\Fmqgpgoc.exe

Filesize
96KB

MD5
4049b86a462375253edc23696d32263d

SHA1
c6db3e3bede8094564cfb45bffe55c24ffa81c7f

SHA256
443f4eca68ad79f7cfa89dd1de49ec9ae5929fdca410a079511524ace2de3f5f

SHA512
b726ad4802f7610106d2562b34302c20b384ddbf83050d10bb0e2972c6943325131ee4416c7ac566f001b6e2aacf4a2388c329debb87216f11751ff7d76f046f

Download Submit
C:\Windows\SysWOW64\Fpbmfn32.exe

Filesize
96KB

MD5
ede8a787ce7b3be2bbdfca134a245a20

SHA1
32216f379125d455bd36c207bae39e33080366ff

SHA256
6ebff9024c9bc8e962adb9f78ad15c01d7959778005742b35e4d50de51c5a86a

SHA512
6d2d476c983bf9dacddad206352567b33ac634db32f1b930c30fc129443f78f2ddba98accd11455e51958627994bb83423fb2e8075dc2c4ac97d3053eef0e6da

Download Submit
C:\Windows\SysWOW64\Fpmggb32.exe

Filesize
96KB

MD5
a5e81b06dca63e8e0a8a35c8b3e48817

SHA1
add7b9a834fbb766db3fcc883cac4da514805bdd

SHA256
e7b16c3cccc42c2502ddf1c6565b971160d14db7a86d0075583039d0d818b74c

SHA512
85f4d01efdf346eb999e46e01704206d19eaf43383b6589bbc31f23fcf12a0bcb6e5abe1e9384a5c4e8424b2f6746e3685e67bf9b1adbb295b89e1423429d628

Download Submit
C:\Windows\SysWOW64\Fpodlbng.exe

Filesize
96KB

MD5
e4912fd22635acde3a98d8ab4badd4a3

SHA1
52707b518fe4017569ae5d48a032ead4cfeef2dd

SHA256
f3f4c564498aa1532a4c6e192c679ce7b3be27b0583c51e2f74c2cd97f6eb5a1

SHA512
243f0885fdf91de5284baf931595827c517d68650e45b5eac053994b3d0ee83d0d70ffc6773610a71bd2dcdd35d36acf5855e0fcfbb1b749523580b81b3dd643

Download Submit
C:\Windows\SysWOW64\Gaamlecg.exe

Filesize
96KB

MD5
92a1305ecdfeed8448f2f2efc89a6852

SHA1
9b7a039fe6dee8fd19ac949587c576bb31845730

SHA256
2a280176af33a10058337bf5b2e6e9c915983ebd23a4b29407e7edecb14c0df6

SHA512
19db860bf8d5c7a1bbd706331a0192e5895b72ae5cdd2b3215dbd10499dfe2017f8411501a31d7b015364c24faa4690d8cba9960a939ef85d3907368a2a7e624

Download Submit
C:\Windows\SysWOW64\Gdfoio32.exe

Filesize
96KB

MD5
6861d1fe0b082c01ba23ba79d8641f38

SHA1
7e5386f59fb0e07d90e5ec4447888c37b89a0e5a

SHA256
7619156a49f3d04ba48b5b04108eb3bfad57e27e8368d5d82937fba84525b9e8

SHA512
6fbad95f747f10fae949e156480b4150bcd858486de71b0554c03e8bdf5e5591030414b8a7822c586f10834266e6aca4b62ccf21e24c7a024a3660bb3d5d56ce

Download Submit
C:\Windows\SysWOW64\Gdmmbq32.exe

Filesize
96KB

MD5
3178c20ad86b6f6ca8e98496a3ac45aa

SHA1
b5347130b9d4f749367985eae1384e784f634a3e

SHA256
3582ec0044fec6cc495481daa6719c93a6e24676820c0323d106058f7d5b0165

SHA512
5e9cc457603b47162aa6ee925404d57cd26635390729ee3c2624181102010769d9eb1030c20fd3e810ec5e9559361b06feccab305e13e432eb910ddd2059180e

Download Submit
C:\Windows\SysWOW64\Gfheof32.exe

Filesize
96KB

MD5
9b51a894c6e9e1f38bb77eec0647c38c

SHA1
477975b44fab897bbfed041174c3302ff0986e96

SHA256
78bd195f94090241c2b3ea83982156380cdfdc229d66f4dc6f7bc5981912adbf

SHA512
0b2d7fb833ac18fa03a3a25a0b0b40cae85606eb2c89968616b43250c7359d86fdc9b7d88ae7e847941e49055733ce34cd91b38e7bb64e9d3ad278f2d7dd5b74

Download Submit
C:\Windows\SysWOW64\Ggfglb32.exe

Filesize
96KB

MD5
b5705d9bfaea4d8b2272d53e0bbe4390

SHA1
1cf5de97efda80e1f90243371c2ee96a5ce3814f

SHA256
cfd8c6c6ade89f5cfc06e446bfa570500c2057742718bdd21781889c652a4d0a

SHA512
cd379a8d07cc2ddacac9ac5cf01c700178f2c14c580c60b249011c8cb2b72e86ea81b0d1945866dbf371409c26c8727d1817ee4e6dac4e94f671210be6dcc82d

Download Submit
C:\Windows\SysWOW64\Ggilil32.exe

Filesize
96KB

MD5
0f78c0ad7d640f19822d21624737fa6b

SHA1
923b874e0d01257a876837ee9811d448810e3b2d

SHA256
51b697fff766abedd20f6c8d9fb9b6f88b1eedc3f73eda9fbd97deb9b0c6c23a

SHA512
cf47e9c0364b57395d4a8c9ab7ceaa982d9988b3f9b50c3467c171f5c4c491c6bb4fe5c8928284344ff8e756b9cea6185d82dc1ebe6b8f3c3618e70638c54d9d

Download Submit
C:\Windows\SysWOW64\Ghmbno32.exe

Filesize
96KB

MD5
c62a6d3201e5d3187e138cb9daf1b773

SHA1
856ded4139d1a8f339eb6c1114fa12fdfad77e4d

SHA256
c797611570203091af53ae4251804bfc6ee2e0af65f1800124d384d02882f0b2

SHA512
1fa08cd93686df9b4679be255e1ff862f4c261d8205f8fff62cb98165e83a68c9e6c53f3335ccbad4d58ab6c9fc942d6d28f5ad1978a1203645699412682e5c8

Download Submit
C:\Windows\SysWOW64\Gigheh32.exe

Filesize
96KB

MD5
387e41c30505eb98e1d17058961d61ef

SHA1
c63253df13bb6e13a137844ed899a98183d6cc7f

SHA256
d558d84d8cf7739555045d5bf6ee4d26586d0b229516026832340b3d13661a42

SHA512
7f504f5d11d3e0bbfe81e63c5af0c8a77eff51dcda95acc32f13105de5b67e423454c274ecada902511067632ee605908e00f7991c421cdf17354b77146edc46

Download Submit
C:\Windows\SysWOW64\Gijekg32.exe

Filesize
96KB

MD5
2ce9dec1c50ddc10f8f886d5127bf86e

SHA1
220e6c1d21cd235115b617f830c3531635102752

SHA256
e9c843c96dbd31fb5f9c7361a0f6d42385c4e6b9707c7ae2f01563a066deec02

SHA512
d84c92be5ca873a91e59794737ef87a8cfa8d644081ba52d8f6f1a42b6eef2abb27528f2adadb446d4d19d16f40ee482e7fc3ab36717f3b3a223e932dd9d0903

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
96KB

MD5
9362d9a589411f5483cef5a6542e3956

SHA1
857ceec76bbf0aea4e7e23901b127dc9136d39a9

SHA256
9818587ac500c2ba34a1ee5fae7d229002c828f6bc9c6941a84b4b200c4f12c2

SHA512
34dee6f1b78d1810e73dfc057cb86ae3261270a0d63f03bf90abb76e229ccd87b9aaf3d7534006d53ac0df072649d2e5c5cb109ac63b91d3698d5d94a24c93e8

Download Submit
C:\Windows\SysWOW64\Gkiaej32.exe

Filesize
96KB

MD5
796af11826916d03b1cb06a031c45970

SHA1
efd351e69305d56885673551c573a6bba6782551

SHA256
e35df59f8f3dbbf4a1dd0ab15de6b66077f37ca40f8e540d6d93588968c632a0

SHA512
57102f958ad6229003aa4dc6677ff50e12db3238947f6ae0f304d977fc214c323570281cc762d0374373ed717f97890f0734b3f9442e32038b75535b54bf2ad6

Download Submit
C:\Windows\SysWOW64\Gknkpjfb.exe

Filesize
96KB

MD5
5dd201513f3f5d6d02ee98947ea9f843

SHA1
7e87d5fb8c646d4e2e804511c3694ff42afc4b04

SHA256
15ed74cec680b292b852840d831c74d8b8a7f8edb52d7f432807db85dbed1752

SHA512
e7e507ee2fef8fdf7b45b30007bcbec48901aef7e125ef273863cc5186ca0cc95438a0fc32558c484d47099de531d469c82483e8b39eb28ab6625c93ed7a9b5c

Download Submit
C:\Windows\SysWOW64\Gmafajfi.exe

Filesize
96KB

MD5
188952d4694feccdd6019c5eec4fe719

SHA1
9904a08e6037a2bb579a525f36299bee9e4cd061

SHA256
feaec12d70b77b67292fa4d5718b2acfbeef33b681d731a445b36c14cf90f548

SHA512
e77a7148dd58334cd1d3459c56a81163761b605fa31a2ccfb77658234a5dde17639f292d705d1e385ff376491bc98b3ef7a943ce3419316f68942f92771c529b

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
96KB

MD5
c40b878795c75597faf81ab869cba512

SHA1
602e9afb9491e2783415e2842b7ced645ed612eb

SHA256
081382fcfae4dd00c82471ac63b17014447b87b01874316928488cee3e67e7c5

SHA512
35eb8a734970de7cc0c3c944620c4d461d9c71d98654a3a0123f36864dd6088bfab99803992fe1d441e02f81a8be9a75b7e9146361ef02fd3c3a6f691a1edb90

Download Submit
C:\Windows\SysWOW64\Gphgbafl.exe

Filesize
96KB

MD5
15c53e3e09b75bb765e410ad98026a69

SHA1
6c5f1eaf0fe601e462782b2aeeb6a7bf8b466148

SHA256
7ad2d2824d8aaa62bbbe57a069beef527c7c3b85e068cc2eedef01d39e4ef6ba

SHA512
2e42fb9c629a9a6e81a4787de41b7207befe11af459a99fc191eeedc25a45b5a088c4eaadb592a1463878e64d31596dcd02eab6043a464aebb757c1b7ccf53d4

Download Submit
C:\Windows\SysWOW64\Haafcb32.exe

Filesize
96KB

MD5
7542e6cd317975811daae06961e1da1e

SHA1
e0ad625adfd146e13241b9763197deca1bb64119

SHA256
95d2b23795508076531dc5858a3863bc122618868ea44463bef6a6da1e7665cc

SHA512
10dcafa67e1f2c24229332d40eb1e762ee8190c01524811e5129ff4d46c6a1b180dfe99c778a64a8eb97a511c19a49d3722f7784b279e5108c688fc68631a7f4

Download Submit
C:\Windows\SysWOW64\Haoimcgg.exe

Filesize
96KB

MD5
c070b549dea2d0bf6cfddcc0fb1a447c

SHA1
00a7329b83314c93b031f24f705d696c4380d486

SHA256
a38398a6e46206e6639c099bf3d4810f9eb81beae0a38e93f96c3823af191ae9

SHA512
1f32c6a8250cc1eb51ae6319ba0cdd1e23cb4bb5d365dce93dcb58d84d7069cc3f9300715eb7e6476af08877fa3b73a98927a40bd3775974ebc0749e1f56eec2

Download Submit
C:\Windows\SysWOW64\Hdpbon32.exe

Filesize
96KB

MD5
9c143b7d83b9d035a19effa282c90ee8

SHA1
6d0b6d3f1c72a57f68cbb1bafd736fa1dea844b1

SHA256
c02c8829c8665e9e903714d23ecf266a8bbe9487f1f604962db340b45c121975

SHA512
41c227797969e80f53fdc7891e310790a45c21b553f3dc5df18f5072bc16cc5e28cbd0760038a77b841e5d99e5f8dbaf5661c0604c6cd9d6f6d5c004c3668623

Download Submit
C:\Windows\SysWOW64\Hgghjjid.exe

Filesize
96KB

MD5
03620d3c867c5e4a0bda12fc18e10ddd

SHA1
f5a000d6ee2d394518b96304113ebe3fffca799a

SHA256
5f1d5d4fb79d58a2a373197167821ccfb45e398ad65eba59cdb948b70693cdbf

SHA512
771f30e46b7a9e8c9ed1f0444d1569287855b8779d6bd4d8ac07fb155aab3a2526a1413c4c73236df0ed1f354331f86398da65f552e5be80a65c720d2b928edb

Download Submit
C:\Windows\SysWOW64\Hgiepjga.exe

Filesize
96KB

MD5
be3e7dbc6aeac770e03ca3e0680e5029

SHA1
d4d2d8c34b2e59430ff8a6c3cec65c4a694c0266

SHA256
ecd1396622383b242ebca1ec7d3cb7ba432f21ee6d8edd289181ef88e88f4fb1

SHA512
71812ea9a43bd5820ea4afddc01cf694050a8c36b51d4dcf1bd561862989aa3940cf10fa7b1901ed7678454197806add5a34540b10c59d3cd0994ffa7b95535b

Download Submit
C:\Windows\SysWOW64\Hhiajmod.exe

Filesize
96KB

MD5
4b2fa469a19ef660b9820933efc8a140

SHA1
7ed6abcec95c0f920e43f95f698c4614268e477f

SHA256
f52bcdd2868f3a84b808264ca64352ef8b8c52f2055df153b9095280c132bdc0

SHA512
ab2e9a6fb4c3dad50b4375314a28fdb4843fca4f0c09f3a56238441999168d781a9d01967a278a7a2850da9ee3c4769ba64f522d7a25a6f09da700ebc7a053d9

Download Submit
C:\Windows\SysWOW64\Hjjnae32.exe

Filesize
96KB

MD5
19093a8f21c5eca1a59a455d44a3bee9

SHA1
34231d2a60aac78a26084364adef5890dcbc4350

SHA256
f0f9493a8f09b5f2be4e00a70f0ced81abb1ee75c7ae01a53d3eb24ec906adc3

SHA512
f1823071d6a94f9d133729a23618f8d9c1ca66097298030672d3dc79fe79f44e8e9798e08d1b2d61466cbfdf871ecb2c80399d0285570854c6721550384c0826

Download Submit
C:\Windows\SysWOW64\Hkjjlhle.exe

Filesize
96KB

MD5
2feb759ccd22bf2bf86544f00a4ed6bb

SHA1
43350658b81824f5b2c9970f995ddf2ab20c769d

SHA256
a7324676e41066fa5f3e5e7fa2e43de6054d150da8cdfb680d1983cb7a72e6a7

SHA512
5cc998f267de626a40aba4e68aaccf101ee43250c032c091817e6b20c7a361bb3a62501e4e113469851bb428ffa8bf7e3aa71acf35a762312b0cf3d1f571d8a8

Download Submit
C:\Windows\SysWOW64\Hnodaecc.exe

Filesize
96KB

MD5
d8a6a94a2710a33fc04438ec8c52d53e

SHA1
4b1ce0b296fa69d311eef7abf91ab67e50b73760

SHA256
149bd20de8d5e63d3edf7a30068ea3dcd66531ccd43af129b3809be978ab9565

SHA512
c71fe6e8f7f6bcb77e4f30ea4e53b0737056d80475335a82348889db02cbaf602b700314b251cd142bd933360e0bc682c0bf3bc6ac40d1fee59f52ab3222c1e8

Download Submit
C:\Windows\SysWOW64\Hpomcp32.exe

Filesize
96KB

MD5
b5a9ff0c809d8ee593724e041055f706

SHA1
ac0c5cc178c4d7e601fd3da524332f61197308b1

SHA256
f988574e1c512a228e8b0ffcc18efcb66259982c4a1a1f748eb2e2bf06ca9d5c

SHA512
412d4f4813313624369e2a9acd2380bfe687f4b4934db26f1367ff43ebb2b8cd9e350b052dcd1124f246b93b5736a800617e25841b4a86d73932f1fa82aa2229

Download Submit
C:\Windows\SysWOW64\Jcbdgb32.exe

Filesize
96KB

MD5
6696aff6c2f1e31aef2c1e45d8643c43

SHA1
b80a90a70ea8c2eb0e371f086fc69765c0f126cb

SHA256
ebdadf35715ff72d78288cf2b1698a63a37ad86912c3069287afe17b5c6827f3

SHA512
8cdfd01cc51de27d4daf07f29430ee0379847e887bd50df4a950676b200c370715213510b1d5ddc28bfb47649745cf26d62b2617d8a6dd3c94efa320465ccab8

Download Submit
C:\Windows\SysWOW64\Jnjejjgh.exe

Filesize
96KB

MD5
fad69f4da9cb63bbc9112740fb4bc067

SHA1
297b5662a2dddb39613879e3d01f3e379bdbcf0b

SHA256
6c22b2d9697ecce327da84880589c2b414bd91862b69ad614c7ae78032026857

SHA512
7fb288a2f26a881a7b394ed2316e143d0dbb65bafcabbfee6a6ac319b035b7262c82b2d217dd6d94f888db5db2dc0c7ed2b645077e138a3c3d52f9eedd78cde5

Download Submit
C:\Windows\SysWOW64\Knchpiom.exe

Filesize
96KB

MD5
bca76d60db18883ac14190d3002c2177

SHA1
26a0e4b0eb230919e90678ef578c4cd09d226267

SHA256
fbc6e631d94aa1f50ad45b79c662571ec516f3a1035820cf579929a113c4d8bf

SHA512
dc3a72e294f93951dc2c6b55935f2f4b875077b3ec36ae5fbf83632fb04c93fc2943f1f7a59cf1c385b318b6c7db2e998b0825d5fdcadc4dab0b0055d4d4d238

Download Submit
C:\Windows\SysWOW64\Knfeeimj.exe

Filesize
96KB

MD5
0bb2e23e8cd16dc244122ba629279628

SHA1
f8b77dc27402c7b3dac2a0e6759e5bb424cc186c

SHA256
640fe9bfeb8808f98303765e227dcfbcacc746618119a0c040f0889f67be52e2

SHA512
82dd5a797d5ac3d90842616f00041c5dd46d00eb6dda59e7fcfc7a06d944a35f7b3c5553d1bbd8475900ac1aeaf96caaa95903698ae9228d122ffe2fef941675

Download Submit
C:\Windows\SysWOW64\Knnhjcog.exe

Filesize
96KB

MD5
bd3e9aeba7f9a04648a826fb6c5c971e

SHA1
cc3ff54b0d96a778210fd7b0387f6e002f5c7857

SHA256
6f1d1ee465f283c5541b2bb5dc5047024c3798a578069709fd5abc2b21c34aa5

SHA512
e4675272c37a739a3ccad5f5c4790b203d294bca111869af8c15ece00679f89135d397f1cc1ba73d433c9affc4f3bcabe7c3a005c51889a01f11168ed25e431b

Download Submit
C:\Windows\SysWOW64\Kolabf32.exe

Filesize
96KB

MD5
5cfc3022e04a004156180f63258bfd63

SHA1
5782a041e5cc17fba6aad6c3dac14ec99003e999

SHA256
5ba3da30cbb68d98a8738bb891c65eced0595c00d498d28973aa96a2f140277b

SHA512
7fdd81b618b5e0f575fe85780377f5c376030368c655f1fb1c0b999f31d97bb50987bda0427caf5bd1a9159548a4d48fd9f86125a7fa553eb4631f483d4917f0

Download Submit
C:\Windows\SysWOW64\Lgqfdnah.exe

Filesize
96KB

MD5
284e08079132f483b7904a214d921bf1

SHA1
152737130073f0561c0446eded374eaed61fc58c

SHA256
03142fa734a4a381b5133d1825376dc003aae2b6da6d1b0ec7c983e1a8d8cd6c

SHA512
c6f51c57fe89727a7d8a766583b0bc16a00f3e12dfc6ce778a54bcde3589c0433f8dea34b1697f08889da064d46a06396e1426bc91e3a78d1069bb5862432ca4

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
96KB

MD5
85166e795ff637bd9dbb1466655116e9

SHA1
e78effc63ba26657a4099146112bbba4a1264074

SHA256
d5f967f1760fbc150a0856f19c2c005e24520b7cfff7af3c54ac82c370505cff

SHA512
3dfe08c4ebfc4f366c2933feda4cdab29d132442ef9a097776fde7b671b760616acf8e06c7637a140aefca377a7445aeb0c476e89bb10742ba221ecf99e27213

Download Submit
C:\Windows\SysWOW64\Loighj32.exe

Filesize
96KB

MD5
ec01af72014cb28b8d89892f8126084a

SHA1
a986430251ead503d649a46668e1c91bce803ab6

SHA256
e2c727315e5fef73986347c244e527376f085c73dff1a9cb6b6bc847ef71ae85

SHA512
c8435ef519ee161ca8a6771f0e59280b3984e903a1b8bf56e7154dba041def6b225c7b4b23e490661b249eb2f4755f28ed0ab3077a36f94f65e2d988baa39b82

Download Submit
C:\Windows\SysWOW64\Mbibfm32.exe

Filesize
96KB

MD5
a6f6e55d59c5d4dd8732c5d297cf439d

SHA1
73e42fea9f19e239125616cd47703b21e90a208a

SHA256
af67419d72edd6544d9bd1540f7034e74466b940fcd3be8532bfb5b9d3553688

SHA512
ac67a8635b8e5067d3a8464afbfab3eab014c6382f4e9ca77dba5e9f05c9b7b4458f78faa399cd2e126b497c09b78d2e1e3370b5e5e01c3681029ee220e2f291

Download Submit
C:\Windows\SysWOW64\Nabfjpak.exe

Filesize
96KB

MD5
a3655db76fb0dbeeecdb316d63b5b44c

SHA1
65a0b57b462d88b7b0660a81bbce33f6b68e53cc

SHA256
84578d2165280d2a274c92e58ae03fe10cae8d35313e5c1a0ff744344c877ee3

SHA512
b79850a071e47d3159ddea65837491f31d96261278ad62c49353d855eb352d089d9b35bbaaf49bf9eb07a1736f15e46033221e77a1243b4da795d37ea7a9d375

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
96KB

MD5
964a9804a1f2b0edefed47e7ac61913d

SHA1
003b506df6c24d0a30054b7f01dc461ca5c2c760

SHA256
144b570baa08dfbe41e4a6b77a438c6e88dd7b0c2efeb357a74544fd11895797

SHA512
b9d335c3684a5c865ac3a0a4b1aca1d8baaf6222065193b47ae8e60c8140db85084cf63df7a4d37cde802bdf2ac5a245b8c9dee085cee3ee7b9563b5a7762b22

Download Submit
C:\Windows\SysWOW64\Njgqhicg.exe

Filesize
96KB

MD5
0b9f1dad8b978255d53e7721bba2b4d6

SHA1
f06ead5e98b2b3648e9962b95391ceefcd75c681

SHA256
3e947e53c1d264ec14d8a7b6f97d7d14fee2145d3961d22275db1e6712521f41

SHA512
3a96459de203e6c1067edfe12837931f2c64d8ae592fad9a2799ad21344ae3d5ea256c92b1273c09d52c90377813b714d00fc83b5ce2d87052dfc70e930de7e1

Download Submit
C:\Windows\SysWOW64\Nlmdbh32.exe

Filesize
96KB

MD5
ed80747f4606ec97ab993b86f4172d40

SHA1
83afe90d8a05bae8f824e62cb5805d16a8fc563b

SHA256
1db5236c1f498cc1ca5c514a2c208d0065dd42b7f123e043ac2d65cd9cbf6e32

SHA512
51980ed05a877e25356b371b43f6ed59b7f9d902332685224f68db4bb40faf206459f7c80287c837e7315862c37d86cb4f1d5eb4d108fba312e1125a6c1f283f

Download Submit
C:\Windows\SysWOW64\Nmhijd32.exe

Filesize
96KB

MD5
2ae81969c2dafb93f00290d1f8fdf71f

SHA1
47c52aa56d3b1c64cc667ad868bf1664f5851a17

SHA256
8b5914ed208cee3d4cf56c1df3b49d59c4bb92de463978ac692aff821bcd71c6

SHA512
e5cafff2b2d300f48653c90905e11dc5ba0940e48176f2ccf317e2149913e4a34e6f8e7be7600b2bdab954a305332d19109054c41ea0fa69242f7464608c66c5

Download Submit
C:\Windows\SysWOW64\Obnehj32.exe

Filesize
96KB

MD5
7f3f95ec8e58d5a39553bb74e28945f5

SHA1
ce55631a4a800651065c12be17715b1f468615b3

SHA256
629cbb9ecd96aed8805bc0b44ec3e6ea4448da109d6230467c1036cd9bd2e9d1

SHA512
e9af45353245aaed220ec1ee70eb6ae827c1c85ee10bede56f2ccb31ea03353fdf27cef650a6487875298a9610f66f1f60a1d116cf1661cfcc671cd687fdd712

Download Submit
C:\Windows\SysWOW64\Olanmgig.exe

Filesize
96KB

MD5
46fe253ebd8423f9dfe71b35dd99ba2f

SHA1
f0a29514d5a86f653d773bac4399261489e5b3a8

SHA256
71be67542f92c47aedbe8a135bb23d6471876f6863ae251cd5ea833f9ca83d99

SHA512
6b2ef4bfe89c8422445e8c2b746429449d556b1c72fba83a7d7a18b8ac3325e1755b8f265a0267f81d2f459e2ff6c9c7ea47b0c28ba5c7293f2f1366942fc7e3

Download Submit
C:\Windows\SysWOW64\Pemomqcn.exe

Filesize
96KB

MD5
f551a68f2c116ae61c784f1723febd81

SHA1
f9d1e67c8c6a1c9a0b1171f0e898c78af86638ad

SHA256
5711f3d08018104addd6d90f92d7af77b65c8a2f6883a0662a50c221e413f754

SHA512
824e1411291458c53c91b665b41b5019cd504b4c955233f2b35e1ad1865548337c1d964794c96ccc21b0655b2ad84635d255f1ea88b2864eaa9fb778e8b7240c

Download Submit
C:\Windows\SysWOW64\Plbfdekd.exe

Filesize
96KB

MD5
199f9b41c79507c9c5d6da2df466c447

SHA1
a40f3c7b30fd12a562d390550b4c3556b9fad26e

SHA256
70de939310f14f163f57d867d1a6eaffd6dd05b2445a1873b5b75da32d749451

SHA512
b134347fcb821e6721c5aa0fbb55a0b8ebd705cd03286055eea5a37041ef9518f3ab3a4ead9a9803662fc262744c96ba2d55b35024d2354ae4eb2f0c81734ecd

Download Submit
memory/60-387-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/116-109-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/184-580-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/212-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/212-551-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/216-544-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/216-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/368-128-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/528-587-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/552-573-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/860-346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/952-430-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/964-374-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1192-464-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1244-252-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1284-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1364-376-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1452-412-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1660-408-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1712-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1856-586-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1856-47-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1860-519-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1900-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1960-559-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2004-213-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2052-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2052-572-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2060-358-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2100-237-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2208-340-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2236-490-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2272-260-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2300-508-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2348-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2352-364-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2448-388-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-322-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2756-530-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2792-436-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-593-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2808-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2860-418-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3044-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3128-532-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3200-484-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3204-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3388-442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3392-545-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3420-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3444-476-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3464-496-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3536-520-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3544-398-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3560-400-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3572-565-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3572-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3616-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3656-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3696-448-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3700-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3800-566-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3832-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3928-316-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3972-482-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3992-167-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4000-538-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4024-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4036-247-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4048-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4256-95-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4260-223-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4288-220-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4372-454-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4392-507-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4424-159-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4456-424-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4460-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4460-579-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4488-352-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4492-175-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4588-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4676-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4688-272-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4748-552-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4764-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4864-328-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4904-594-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4936-558-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4936-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4968-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4988-199-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-466-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5032-137-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads