berbew | 99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694ea

Analysis

max time kernel
94s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe
Size

923KB
MD5

f38b694d97fb6842ea83cadd81d27a10
SHA1

0ce5cfadba750cc88568395177dcfc71e46c1014
SHA256

99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694ea
SHA512

af88886cc6b1c86b9b4272504782774f8205554b456367bfc97ff97e9abcf21a82d171053efa880863df77ec2e1c84c65200cf71585e7b2328f079968072ec98
SSDEEP

6144:Zy6sJw3lPQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5frdQt383PQ///NR5fKrj:UwA/Ng1/Nmr/Ng1/Nblt01PBNkEoIa

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbqmiinl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhqcgnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjhcjq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pefhlaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qebhhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haaaaeim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlhqcgnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iddljmpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niakfbpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoabad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hekgfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojemig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oampjeml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbeapmll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfokoelp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckjbhmad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mogcihaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbbhqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnhpoamf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjkblhfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meepdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhknpmma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfngdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fffhifdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqafhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjdjoane.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pemomqcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmiclo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ganldgib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckfphc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnnjmbpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpbjfjci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Indfca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niooqcad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peieba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejlbhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgflcifg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efpomccg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnnccl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eomffaag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gacepg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfbaonae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfbaonae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjlmclqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pajeam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkceokii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igedlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lghcocol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodjjimm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2964	Gaefgd32.exe
1724	Ggbook32.exe
4756	Hpomcp32.exe
4884	Hpbiip32.exe
2260	Hglaej32.exe
1244	Hnfjbdmk.exe
4556	Haafcb32.exe
4816	Hhknpmma.exe
2036	Hacbhb32.exe
4760	Igqkqiai.exe
2292	Ijogmdqm.exe
3116	Iafonaao.exe
2276	Iddljmpc.exe
2152	Igchfiof.exe
3692	Iahlcaol.exe
4284	Idghpmnp.exe
4616	Igedlh32.exe
2112	Ijcahd32.exe
3016	Iakiia32.exe
4312	Idieem32.exe
1028	Iggaah32.exe
4916	Inainbcn.exe
2156	Iqpfjnba.exe
3860	Ihgnkkbd.exe
4384	Ikejgf32.exe
2788	Indfca32.exe
4424	Iqbbpm32.exe
2184	Jhijqj32.exe
3724	Jjjghcfp.exe
4400	Jbaojpgb.exe
3128	Jhlgfj32.exe
2592	Jkjcbe32.exe
2060	Jnhpoamf.exe
1432	Jqglkmlj.exe
708	Jhndljll.exe
1424	Jklphekp.exe
4588	Jbfheo32.exe
4188	Jkomneim.exe
1100	Jbiejoaj.exe
2472	Jibmgi32.exe
4868	Jjdjoane.exe
4120	Kqnbkl32.exe
4628	Kghjhemo.exe
4540	Kbmoen32.exe
3888	Kelkaj32.exe
3676	Kgjgne32.exe
4888	Kjhcjq32.exe
1848	Kbpkkn32.exe
3416	Kenggi32.exe
732	Kgmcce32.exe
2316	Kjkpoq32.exe
2020	Kbbhqn32.exe
5112	Keqdmihc.exe
1284	Kgopidgf.exe
1456	Kjmmepfj.exe
940	Kbddfmgl.exe
1300	Kecabifp.exe
3964	Kgamnded.exe
1712	Knkekn32.exe
956	Lajagj32.exe
1904	Liqihglg.exe
1960	Ljbfpo32.exe
4700	Lbinam32.exe
2884	Legjmh32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Qlggjk32.exe	Pemomqcn.exe
File created	C:\Windows\SysWOW64\Locfbi32.dll	Jllokajf.exe
File created	C:\Windows\SysWOW64\Nmdgikhi.exe	Nopfpgip.exe
File created	C:\Windows\SysWOW64\Fbgbnkfm.exe	Fecadghc.exe
File created	C:\Windows\SysWOW64\Obonfmck.dll	Kgamnded.exe
File created	C:\Windows\SysWOW64\Jofabneq.dll	Naaqofgj.exe
File opened for modification	C:\Windows\SysWOW64\Mfqlfb32.exe	Mogcihaj.exe
File created	C:\Windows\SysWOW64\Ajdjin32.exe	Ackbmcjl.exe
File created	C:\Windows\SysWOW64\Haaaidfk.dll	Lmpkadnm.exe
File created	C:\Windows\SysWOW64\Ldpnmg32.dll	Monjjgkb.exe
File created	C:\Windows\SysWOW64\Fgijpe32.dll	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Kbhmbdle.exe	Klndfj32.exe
File created	C:\Windows\SysWOW64\Hnfjbdmk.exe	Hglaej32.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Jbqaei32.dll	Dihlbf32.exe
File created	C:\Windows\SysWOW64\Kldbpfio.dll	Eehicoel.exe
File created	C:\Windows\SysWOW64\Gojiiafp.exe	Gpelhd32.exe
File created	C:\Windows\SysWOW64\Lejgch32.exe	Lbkkgl32.exe
File created	C:\Windows\SysWOW64\Pcjiff32.exe	Pkcadhgm.exe
File created	C:\Windows\SysWOW64\Qlgpod32.exe	Pocpfphe.exe
File opened for modification	C:\Windows\SysWOW64\Bajqda32.exe	Boldhf32.exe
File created	C:\Windows\SysWOW64\Ceifibod.dll	Qljcoj32.exe
File opened for modification	C:\Windows\SysWOW64\Fjohde32.exe	Fjmkoeqi.exe
File created	C:\Windows\SysWOW64\Peieba32.exe	Pcjiff32.exe
File opened for modification	C:\Windows\SysWOW64\Aodogdmn.exe	Aleckinj.exe
File opened for modification	C:\Windows\SysWOW64\Cjnffjkl.exe	Ccdnjp32.exe
File opened for modification	C:\Windows\SysWOW64\Cmmbbejp.exe	Cjnffjkl.exe
File created	C:\Windows\SysWOW64\Gddmgi32.dll	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Ooaafghm.dll	Hcpojd32.exe
File created	C:\Windows\SysWOW64\Kelkaj32.exe	Kbmoen32.exe
File created	C:\Windows\SysWOW64\Befhip32.dll	Nahgoe32.exe
File opened for modification	C:\Windows\SysWOW64\Ohfami32.exe	Omqmop32.exe
File created	C:\Windows\SysWOW64\Jhghaf32.dll	Oobfob32.exe
File opened for modification	C:\Windows\SysWOW64\Moipoh32.exe	Mmkdcm32.exe
File created	C:\Windows\SysWOW64\Lielhgaa.dll	Aonhghjl.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	Bmjkic32.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Cogddd32.exe
File created	C:\Windows\SysWOW64\Njgqhicg.exe	Noblkqca.exe
File opened for modification	C:\Windows\SysWOW64\Iggaah32.exe	Idieem32.exe
File created	C:\Windows\SysWOW64\Ljalni32.dll	Bbiado32.exe
File created	C:\Windows\SysWOW64\Nojjcj32.exe	Nlkngo32.exe
File opened for modification	C:\Windows\SysWOW64\Gmiclo32.exe	Gfokoelp.exe
File created	C:\Windows\SysWOW64\Mqafhl32.exe	Lncjlq32.exe
File created	C:\Windows\SysWOW64\Jnchkf32.dll	Iahlcaol.exe
File opened for modification	C:\Windows\SysWOW64\Ljbfpo32.exe	Liqihglg.exe
File created	C:\Windows\SysWOW64\Bgnagk32.dll	Kqfngd32.exe
File created	C:\Windows\SysWOW64\Piomhofd.dll	Iafonaao.exe
File created	C:\Windows\SysWOW64\Haplhc32.dll	Kjkpoq32.exe
File created	C:\Windows\SysWOW64\Gdmpga32.dll	Ombcji32.exe
File opened for modification	C:\Windows\SysWOW64\Mlhqcgnk.exe	Mledmg32.exe
File opened for modification	C:\Windows\SysWOW64\Nbcjnilj.exe	Nklbmllg.exe
File created	C:\Windows\SysWOW64\Amjjnh32.dll	Neafjdkn.exe
File created	C:\Windows\SysWOW64\Mmmncpmp.dll	Ieccbbkn.exe
File opened for modification	C:\Windows\SysWOW64\Klndfj32.exe	Kiphjo32.exe
File created	C:\Windows\SysWOW64\Jqglkmlj.exe	Jnhpoamf.exe
File created	C:\Windows\SysWOW64\Fjbhpb32.dll	Kgmcce32.exe
File created	C:\Windows\SysWOW64\Igegpo32.dll	Ajdjin32.exe
File created	C:\Windows\SysWOW64\Bokehc32.exe	Bmlilh32.exe
File created	C:\Windows\SysWOW64\Ojomcopk.exe	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Njbgmjgl.exe	Momcpa32.exe
File created	C:\Windows\SysWOW64\Jbaojpgb.exe	Jjjghcfp.exe
File created	C:\Windows\SysWOW64\Jgamgpme.dll	Lbinam32.exe
File created	C:\Windows\SysWOW64\Efficj32.dll	Kbpkkn32.exe
File created	C:\Windows\SysWOW64\Bnoknihb.exe	Bhbcfbjk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5188	2952	WerFault.exe	639

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inainbcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnlnbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhlgfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oidhlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lncjlq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmbjcljl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdehni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnblnlhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oekiqccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lobjni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nimmifgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgbqkhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaefgd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkmmaeap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilfennic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iafonaao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plbmokop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckfphc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihbponja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Indfca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nklbmllg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbnmke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kadpdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bokehc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckilmcgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkeldnpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mledmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmmbbejp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hienlpel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkpmdbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpepbgbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkjcbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nobdbkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niooqcad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pchlpfjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojqcnhkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbqmiinl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplhhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnnccl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iakiia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbphdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpfkpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgjoif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ombcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooibkpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjkpoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnbklm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlphbnoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgnqgqan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iggaah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikejgf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohfami32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nflkbanj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Majjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pocpfphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcddcbab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpjlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfjkjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojemig32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pngfalmm.dll"	Fjmkoeqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjlbppk.dll"	Jkjcbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lajagj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pedlgbkh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pefhlaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlgkbp32.dll"	Pcjiff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaoobkd.dll"	Cjjlkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmafajfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mejpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kloeol32.dll"	Oaajed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcjiff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgkfnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgiiak32.dll"	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecbfdd32.dll"	Lghcocol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niooqcad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhldpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmlilh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafipibl.dll"	Jcdala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlllhigk.dll"	Lncjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjonng32.dll"	Plejdkmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfifmo32.dll"	Dbndfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glgjlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikpjbq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqhoeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpkdfd32.dll"	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbkkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdmqp32.dll"	Lejgch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oafcqcea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkhpjc32.dll"	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niakfbpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pemomqcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qebhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpemfc32.dll"	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqglkmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecqieiii.dll"	Ajpqnneo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edhjghdk.dll"	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljklo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Majjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoabad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heffebak.dll"	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhoahh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbmoen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgapfg32.dll"	Ckmehb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbibld32.dll"	Ckjbhmad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aepjgm32.dll"	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddifgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llcghg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2964	4136	99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe	82
PID 4136 wrote to memory of 2964	4136	99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe	82
PID 4136 wrote to memory of 2964	4136	99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe	82
PID 2964 wrote to memory of 1724	2964	Gaefgd32.exe	83
PID 2964 wrote to memory of 1724	2964	Gaefgd32.exe	83
PID 2964 wrote to memory of 1724	2964	Gaefgd32.exe	83
PID 1724 wrote to memory of 4756	1724	Ggbook32.exe	84
PID 1724 wrote to memory of 4756	1724	Ggbook32.exe	84
PID 1724 wrote to memory of 4756	1724	Ggbook32.exe	84
PID 4756 wrote to memory of 4884	4756	Hpomcp32.exe	85
PID 4756 wrote to memory of 4884	4756	Hpomcp32.exe	85
PID 4756 wrote to memory of 4884	4756	Hpomcp32.exe	85
PID 4884 wrote to memory of 2260	4884	Hpbiip32.exe	86
PID 4884 wrote to memory of 2260	4884	Hpbiip32.exe	86
PID 4884 wrote to memory of 2260	4884	Hpbiip32.exe	86
PID 2260 wrote to memory of 1244	2260	Hglaej32.exe	87
PID 2260 wrote to memory of 1244	2260	Hglaej32.exe	87
PID 2260 wrote to memory of 1244	2260	Hglaej32.exe	87
PID 1244 wrote to memory of 4556	1244	Hnfjbdmk.exe	88
PID 1244 wrote to memory of 4556	1244	Hnfjbdmk.exe	88
PID 1244 wrote to memory of 4556	1244	Hnfjbdmk.exe	88
PID 4556 wrote to memory of 4816	4556	Haafcb32.exe	89
PID 4556 wrote to memory of 4816	4556	Haafcb32.exe	89
PID 4556 wrote to memory of 4816	4556	Haafcb32.exe	89
PID 4816 wrote to memory of 2036	4816	Hhknpmma.exe	90
PID 4816 wrote to memory of 2036	4816	Hhknpmma.exe	90
PID 4816 wrote to memory of 2036	4816	Hhknpmma.exe	90
PID 2036 wrote to memory of 4760	2036	Hacbhb32.exe	91
PID 2036 wrote to memory of 4760	2036	Hacbhb32.exe	91
PID 2036 wrote to memory of 4760	2036	Hacbhb32.exe	91
PID 4760 wrote to memory of 2292	4760	Igqkqiai.exe	92
PID 4760 wrote to memory of 2292	4760	Igqkqiai.exe	92
PID 4760 wrote to memory of 2292	4760	Igqkqiai.exe	92
PID 2292 wrote to memory of 3116	2292	Ijogmdqm.exe	93
PID 2292 wrote to memory of 3116	2292	Ijogmdqm.exe	93
PID 2292 wrote to memory of 3116	2292	Ijogmdqm.exe	93
PID 3116 wrote to memory of 2276	3116	Iafonaao.exe	94
PID 3116 wrote to memory of 2276	3116	Iafonaao.exe	94
PID 3116 wrote to memory of 2276	3116	Iafonaao.exe	94
PID 2276 wrote to memory of 2152	2276	Iddljmpc.exe	95
PID 2276 wrote to memory of 2152	2276	Iddljmpc.exe	95
PID 2276 wrote to memory of 2152	2276	Iddljmpc.exe	95
PID 2152 wrote to memory of 3692	2152	Igchfiof.exe	96
PID 2152 wrote to memory of 3692	2152	Igchfiof.exe	96
PID 2152 wrote to memory of 3692	2152	Igchfiof.exe	96
PID 3692 wrote to memory of 4284	3692	Iahlcaol.exe	97
PID 3692 wrote to memory of 4284	3692	Iahlcaol.exe	97
PID 3692 wrote to memory of 4284	3692	Iahlcaol.exe	97
PID 4284 wrote to memory of 4616	4284	Idghpmnp.exe	98
PID 4284 wrote to memory of 4616	4284	Idghpmnp.exe	98
PID 4284 wrote to memory of 4616	4284	Idghpmnp.exe	98
PID 4616 wrote to memory of 2112	4616	Igedlh32.exe	99
PID 4616 wrote to memory of 2112	4616	Igedlh32.exe	99
PID 4616 wrote to memory of 2112	4616	Igedlh32.exe	99
PID 2112 wrote to memory of 3016	2112	Ijcahd32.exe	100
PID 2112 wrote to memory of 3016	2112	Ijcahd32.exe	100
PID 2112 wrote to memory of 3016	2112	Ijcahd32.exe	100
PID 3016 wrote to memory of 4312	3016	Iakiia32.exe	101
PID 3016 wrote to memory of 4312	3016	Iakiia32.exe	101
PID 3016 wrote to memory of 4312	3016	Iakiia32.exe	101
PID 4312 wrote to memory of 1028	4312	Idieem32.exe	102
PID 4312 wrote to memory of 1028	4312	Idieem32.exe	102
PID 4312 wrote to memory of 1028	4312	Idieem32.exe	102
PID 1028 wrote to memory of 4916	1028	Iggaah32.exe	103

C:\Users\Admin\AppData\Local\Temp\99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe
"C:\Users\Admin\AppData\Local\Temp\99edacf4f72f31095e23275ef5e1560ed0593f012c74d0e4a21ba8a12c4694eaN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\Gaefgd32.exe
  C:\Windows\system32\Gaefgd32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\Ggbook32.exe
    C:\Windows\system32\Ggbook32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\Hpomcp32.exe
      C:\Windows\system32\Hpomcp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        24⤵
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        25⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        28⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        29⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        31⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1432
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        36⤵
        Executes dropped EXE
        
        PID:708
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        37⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        38⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        39⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        40⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        41⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        43⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        44⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        46⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        47⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1848
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        50⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:732
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        54⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        55⤵
        Executes dropped EXE
        
        PID:1284
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        56⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        57⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        58⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        60⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:956
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        63⤵
        Executes dropped EXE
        
        PID:1960
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4700
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        65⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        66⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        67⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        69⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        71⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        73⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        74⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        75⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        76⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        77⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        78⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        79⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        80⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        81⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        82⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        83⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        84⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        85⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        88⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        89⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        90⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        91⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        92⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        93⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        94⤵
        Modifies registry class
        
        PID:1132
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        95⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        97⤵
        Drops file in System32 directory
        
        PID:3508
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        98⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        99⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:116
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        101⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        102⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        104⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        105⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        107⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        110⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        111⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        112⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        115⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6108
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        118⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        119⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        121⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        122⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        123⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        124⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        125⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        126⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        127⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        128⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        129⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        130⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        131⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        132⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        133⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        134⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        135⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        136⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        139⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        140⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        141⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:4580
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        144⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        145⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        146⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        147⤵
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        148⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        150⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        151⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        152⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        153⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        154⤵
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        155⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        157⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        158⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        159⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        160⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        161⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        162⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        163⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        164⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        165⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        166⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        168⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        170⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        171⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        172⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        173⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        175⤵
        Modifies registry class
        
        PID:60
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        176⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        177⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        178⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5400
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3396
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        184⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        185⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        188⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        190⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        191⤵
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2208
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        193⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        194⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        195⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        196⤵
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        198⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        199⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        200⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        201⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        202⤵
        Modifies registry class
        
        PID:4340
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        203⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        204⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        205⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        207⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        208⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        209⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        210⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        211⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        212⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        213⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        214⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2624
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        216⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        217⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        218⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        219⤵
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        220⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2180
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        225⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        226⤵
        Drops file in System32 directory
        
        PID:220
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        227⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        228⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        229⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        230⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        231⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        232⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        233⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        234⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        235⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        238⤵
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        239⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        240⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        241⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        242⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        243⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        244⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        246⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        248⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        249⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        250⤵
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        251⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        252⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        254⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        255⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        256⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        258⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        259⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        260⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        261⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        262⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        263⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        264⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8016
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        266⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        268⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        269⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        270⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        271⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        272⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:7436
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        275⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        276⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        277⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        278⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7804
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        279⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        280⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        281⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        282⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        283⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        284⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        285⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        286⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        287⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        288⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        289⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        290⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        291⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        292⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        293⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        294⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        295⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        296⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        297⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        298⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        299⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        300⤵
        Modifies registry class
        
        PID:8096
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        301⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        304⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        305⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        306⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        307⤵
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        308⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8616
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        310⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        311⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        312⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        313⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8856
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        316⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        320⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        321⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        322⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        323⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        324⤵
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        325⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8592
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2736
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        328⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        330⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        331⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:9032
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        333⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        334⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        335⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        336⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        337⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8844
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        339⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        340⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        341⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        342⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        343⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        344⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        345⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        346⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        347⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        348⤵
        Drops file in System32 directory
        
        PID:8220
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        349⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        350⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8580
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        352⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        353⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        354⤵
        Modifies registry class
        
        PID:9228
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        355⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        356⤵
        Modifies registry class
        
        PID:9316
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        357⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        358⤵
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        359⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        360⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        361⤵
        System Location Discovery: System Language Discovery
        
        PID:9540
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        362⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9584
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9628
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9672
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        365⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        366⤵
        Drops file in System32 directory
        
        PID:9780
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        367⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        368⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        369⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        370⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        371⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        372⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10140
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        373⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        374⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        375⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        376⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        377⤵
        Modifies registry class
        
        PID:9420
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        378⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        379⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        380⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        381⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        382⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        383⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        384⤵
        Modifies registry class
        
        PID:9896
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        385⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        386⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10164
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        387⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        388⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        389⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        390⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        391⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        392⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        393⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        394⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        395⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        396⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        397⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        398⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        399⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        400⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        401⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        403⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        404⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        405⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        406⤵
        Modifies registry class
        
        PID:9912
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        407⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        408⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        409⤵
        Drops file in System32 directory
        
        PID:10244
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        410⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        411⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        412⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        413⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        414⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        415⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        416⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        417⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10704
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        419⤵
        System Location Discovery: System Language Discovery
        
        PID:10748
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        420⤵
        Drops file in System32 directory
        
        PID:10792
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10848
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        422⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        423⤵
        Modifies registry class
        
        PID:10940
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        424⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:11032
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        426⤵
        Drops file in System32 directory
        
        PID:11076
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        427⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        428⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        429⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        430⤵
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:10304
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10380
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        433⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        434⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        435⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        436⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        437⤵
        System Location Discovery: System Language Discovery
        
        PID:10760
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        438⤵
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        439⤵
        System Location Discovery: System Language Discovery
        
        PID:10892
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        440⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        441⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        442⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        443⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        444⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        445⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        446⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10348
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        448⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        449⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        450⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        451⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        452⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        453⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7556
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        455⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10372
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        457⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        458⤵
        System Location Discovery: System Language Discovery
        
        PID:10788
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10908
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        460⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        461⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        462⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        463⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        464⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        465⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        466⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        467⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3104
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        469⤵
        System Location Discovery: System Language Discovery
        
        PID:10856
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        470⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        471⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        472⤵
        Drops file in System32 directory
        
        PID:10576
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        473⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        474⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        475⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        476⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        477⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        478⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        479⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        480⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        481⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        482⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        483⤵
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        484⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2532
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        486⤵
        
        PID:32
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        487⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        488⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        489⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        490⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        491⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        492⤵
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        493⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        494⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        495⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        496⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        497⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        498⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        499⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        500⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        501⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        503⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        505⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        506⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        507⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        508⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        509⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        510⤵
        Modifies registry class
        
        PID:672
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        511⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1308
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        513⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        515⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        516⤵
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        517⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        518⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        519⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        520⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        521⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        522⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        523⤵
        Drops file in System32 directory
        
        PID:3936
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        524⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        525⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        527⤵
        Modifies registry class
        
        PID:888
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        528⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        529⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1188
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        531⤵
        System Location Discovery: System Language Discovery
        
        PID:10684
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        532⤵
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        533⤵
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        535⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        536⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        537⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        538⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        539⤵
        Modifies registry class
        
        PID:11228
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        540⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        541⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        543⤵
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        544⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        545⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        546⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        547⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        548⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        549⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        550⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 400
        551⤵
        Program crash
        
        PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2952 -ip 2952
1⤵
PID:6280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aknbkjfh.exe

Filesize
923KB

MD5
96845ddea6d01f3d9d7d8e35c2774957

SHA1
aa515a5b3a65324e835034b4644974d718bf3abe

SHA256
94c38d2e1fde92d544bf8d0155dd2097a432323e0ca95716b5db44c1ada44a4a

SHA512
804d967411418b36ea7f51e2812df8b00c0117346318d2fbe1fc80e20a07dc841c13e6839708f6d382a22378800ef466213d43c46ef5ed3fea0360015fe5e210

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
923KB

MD5
0f39f39398f7018e6119b358a72276e6

SHA1
4eee22e5cb4573fdd1b31716fb73033b35a39cf9

SHA256
a4bd9bb2e8cd5698d667a97430c348042502d77bb93d3c2e013a53769addb0db

SHA512
e4f21d659175ab7a6ee7edbe6a1484f5986f8d176cc8d95d9ec945224164aec8d35401b225dd36b452a96474b97374759a95155c8359aa2de246907516c79c25

Download Submit
C:\Windows\SysWOW64\Anmfbl32.exe

Filesize
64KB

MD5
7adffaa2d1be2ee568a8a203a6ef794b

SHA1
9a4b22a97ed0abe143f506356ea6635566820849

SHA256
ce6e84fc1330e79f5ef98d9400f7528058fb19c086d65cc91c9a069f3b3c450b

SHA512
83037abd1554e34386e5459ad4f044b049055fc61b5fc330548d364479c056eb38a7e9634907445ce3da51361266ee9a79f9a627bea1d914191c1d0ee9816b4e

Download Submit
C:\Windows\SysWOW64\Aogbfi32.exe

Filesize
923KB

MD5
632c43e3fb3b27f69940be90acd3c1b8

SHA1
72e4b6b6b9b05729148ecf405252bf8a03fea06f

SHA256
f6c916607275ba4c35ef2aeb638b3e151b22555f8edd7959f9ff797b08d52a93

SHA512
41970bfcbea5cb3c3c3d123f7320c55b987766041f0a841aec153aff3d3e78b4a77816bf2115714c8bdb9d8371b45e25ad6917644b3d922100f369a13ef92af2

Download Submit
C:\Windows\SysWOW64\Bhmbqm32.exe

Filesize
923KB

MD5
29235f0b5ca592eebf6550043a81e28b

SHA1
5be243c73ac5e85042bf02505062fc410dd8eda3

SHA256
4e81a1de21a6dd99ae4b593c7e7f3d694cb5d88ae08950f3b0b11606650779ca

SHA512
5ed6cce9f0aff5aceb1f37269d0fe2629a40e34561b5f29e8ea105dc93904d6ba48635a5907d78f5adccf64dc3ef8212abcffda3371069aeaaa6c84db9c57df6

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
923KB

MD5
348add6d8c68e6d4f72d8823226067ed

SHA1
b44bab86589847b9aa09be474fc5735a3700da2d

SHA256
4a6549c0d8577d9b895ae02bfd8d41ce600b1325dca55fbd2122c9947b3e7c77

SHA512
d840b729be81be590034b50f24d14eecddbc300e9a7345ceb39c455d2b3a0ea220c036c1739a34e4947292d465beafc5953fb65303b593efda7247043ab47f61

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
923KB

MD5
8076f1ac1292211410f42e75209695e6

SHA1
7d138c44fc200c9a6971a1c6579b04fa307721f0

SHA256
6934478838efabafe30c210b4c701252a6a279b96fec75bbe0133cf16b3c9d9c

SHA512
fead2591f8b497e6e5b13ebe7f26b83b8fb10fb5cff63b1c6450b82b6f9af548ec0c4df684750108b34ad1649d25add590c38f918ead3be64fa20a3137bce9e5

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
923KB

MD5
643e0cce7f9aabaa801393cf8b206a36

SHA1
67b4114e350a67f300d4b72765596a1814d207ea

SHA256
6bea3257fdd900e55a3d0ed4a051b767c60212e873ba0cb463e150c771a6d326

SHA512
71148d59b74a32fd76e58aa29addc24badee6bfd594ea513a72fbdeeb5b92036570d79b093aaf88c673c1e3ed6282e05b0861e670462def3da8843edba9c401b

Download Submit
C:\Windows\SysWOW64\Bojomm32.exe

Filesize
923KB

MD5
317633fb9cfc118024edd8f787d56000

SHA1
f3a55b04e3d21f1557a46adbfb063d36e9733ee6

SHA256
7920a587c2bfec1b8212033f930e645e5350923b970c549e18a9af4ed93ab047

SHA512
90f3eb681f86a1288809656a0a8548ad894d06c818150ceef782f44bfaf7006c82d8603bf1f213ce4471fae1fd47d789b48f08052aa8d652de2f7d6f7b78e849

Download Submit
C:\Windows\SysWOW64\Cgnomg32.exe

Filesize
923KB

MD5
d2c526cfd1ee6e8b1e79c9ab00c5d7fc

SHA1
e892df018a3ea409a14dbde1941cad18c5514e3b

SHA256
7eb17edb7bb72cc04e784e780d8b0a06fcf9180db12e25824db788de168e65c3

SHA512
e5c7957b728d5b9f2d7eb3f6ae45e27fd1f1c8c53d2267020244e9ceca05047c40627399327508ca19c521de14a6cf3ace4bba9a1c5c2f6648073600e39ecfe1

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
923KB

MD5
586a3b3936db6858653c0705d26bdc87

SHA1
74ec02f28de546cf9744c6cc5a36ba236fd586e3

SHA256
e11e94bd476fd4ff48a97e8bb4d42d3e3529875699cd3eef0a962fdf20a53502

SHA512
8c7d560a03af4b28cfde133798eaee315722238dee02971f35b4762de2c938d38204a790a7fb3ece6bb362a7daa02d84816407ea21f82d059484f2f3f9bbcf29

Download Submit
C:\Windows\SysWOW64\Cnindhpg.exe

Filesize
923KB

MD5
71d90d781da8d649a701e844ade0c8a8

SHA1
c06d718239a1e12de62766b4074e6a26148d5503

SHA256
90e1f7370270978d18f39e3ebfb4accb6f93fa9188063edb7b972115189da638

SHA512
96cf3ec2abd8de9b19a835128d8f4c2440b1e6227998ead6cc8af742607aee8ee572c15b2271b361578e15797b8d15f9eae73c49c5593f50dfc3ee6bee90f5dd

Download Submit
C:\Windows\SysWOW64\Cogddd32.exe

Filesize
923KB

MD5
7b34a9adda1e1db99e194ddb6adffee1

SHA1
af3344a63789146e6dcfeb872d4b27f93ff40fbc

SHA256
ca5ba83744a2152f51e3d14b0f2c6a55e5e4c375b571a2d1f4e43865a233bc06

SHA512
0feba04d62ad115e00994ccab6ec8da09b0641af5d97bc53994ed3f7dc4b96a322215842792f93c15f35a8c0505db722c3ade0e3bdbe91a7b19043a6291330b5

Download Submit
C:\Windows\SysWOW64\Dhclmp32.exe

Filesize
923KB

MD5
3df5e21539a61c835ecb187bce3ca4ea

SHA1
24dedfd09a50cb633db1aaa502391984703e64f3

SHA256
8629d2def19a19ee1baef0375773b7050d698bab0137157b72180a0ea07d1f84

SHA512
675c6e4e6bb1dfeb5373aae33b5fa0aead087ef24769fbe062cf6d513ae3cd38fa0b67e8dc7288f5b35d2a71f8b2d50fb1f96140f6d2885c20b836c999230d98

Download Submit
C:\Windows\SysWOW64\Dkhgod32.exe

Filesize
923KB

MD5
2eb1feb500e3eed6f47d4abd6f94ecf9

SHA1
2a230495af983ca10f38d6362a10d457284da7e7

SHA256
8e6c22c30b7003873e805894289d6a2a5b4162f662193d339faaaffab79e837d

SHA512
664022c0ed3d541d92527cb0d180a873adcbe56f2471200dffc5684efdbecbbf487e0169bc9990d9bee962ceaa91b152b09c4f0111c1f17b722cc11ce30058f6

Download Submit
C:\Windows\SysWOW64\Ejlbhh32.exe

Filesize
923KB

MD5
70f6296f56c66565215ec741817e122d

SHA1
a4000ac4148eabdb69e8dee468c4c58bf8fdcdf0

SHA256
ba2d9b7aca9f473a3fe32064fd9d79ebd5f21ce9ebf325f1400f04956aba7649

SHA512
f427c0eb71ec4ec8a3afe4d6e9d9983e95190e28431f97d029580eb71c9741f7279752292651d417f7003233cec43eaad55c6cdda1472ca3aa237d180b3efb71

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
923KB

MD5
471b41e3c2bed4ac50e2a7047142ce75

SHA1
ad2faf6c4641841ff5672b5c6b1724df1beec293

SHA256
365016e2034685b58a798e234f3a806d7e5e77ee0782bee247482d79cb654bad

SHA512
aa21cff6084100818b84d4ce803b29cefb063463632a37a7563c7609c65ac787cfdc6ec1fa5f2683abc8057a25105a375f5e0a10c6aa69301d3d7a131a9f15c9

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
923KB

MD5
a27c0f0a8b9d02a846e27b1533b5b788

SHA1
9d33cfe9af186bd20538b0d11e9daa033738dc16

SHA256
c0f23c0fbf4a29e3bd17851eb1c65f4c93f0003584f71894a9c7fa256505c5eb

SHA512
16fa1398d7e40aa9951c66540aa01cbad89465435d1b03f686d9bf315578b6831f60efaa53534c0600c02a54c8b54dae01a0f421983c6bf5ba54c2e69ad2ab79

Download Submit
C:\Windows\SysWOW64\Enpmld32.exe

Filesize
923KB

MD5
f0283584c66af40bd9d42ccc93fe15b0

SHA1
60ee2705358d0e30cf1434c0b664edb55d455b67

SHA256
ee9098b349a94a0cddc7be7987b4b9932d74cc937a9d6fbbc5bd901f7c99372e

SHA512
6288e29923044ac8c746cf033498e2f7be0fcb596044a9cdf692120722bad206e99856813ea8dadab59549711aa2c40de0030ae49b84666cea24edaeb711f65e

Download Submit
C:\Windows\SysWOW64\Eomffaag.exe

Filesize
923KB

MD5
3579b48a88e7cda35868b98efb240784

SHA1
2d8ae5af2b7adf3e00d57a16d515127670961df5

SHA256
4170b87a777132571c25a1838aa9202cd231fb5e3ee6e9d9a2bf2759912ef389

SHA512
bc965c01e28c2882103776e7725691b54ba80cda604ce9387b5a5245ef40bbd1accdc0e2c5e9365d127d7ce3d2f54958e6f98985142a9fde0cf0d0fcb9105ac2

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
923KB

MD5
af1ca8fb511151599f4e52c8eb9c42c2

SHA1
9bdcb2de9c8390119b6ac3c3ef5e0764558fb0d5

SHA256
e0136eb0823d43a44b37ad1d0cdf77e78c437b970188703b8ed2f4aea80a7f33

SHA512
8a49863821e73a6d8d09148de2c7018e182218b4572bba0b80eb72ef4892a895cf447aa01ca44cca3045a32e4c70d8078c03bd748e9dfbc7019d3324bfd22992

Download Submit
C:\Windows\SysWOW64\Fbgbnkfm.exe

Filesize
923KB

MD5
65c96a485b70e111a932f534a7de69ab

SHA1
caa93adf7f829afca5810f8f89519936aa3e9d14

SHA256
c310fecb3107fba5bc0ea92d633b84455a4d0e43b4d844fd080fceb2f2331101

SHA512
dcccc33fe6617047c7265123e6279390b2ca0cc8a1c86fb37205c7c58a96ae0a7e392c80c11936413430db5fcc6909d37cc76bcf1c99911e857c72e5f46c2a17

Download Submit
C:\Windows\SysWOW64\Fimhjl32.exe

Filesize
923KB

MD5
87d5c7ff1c9a8cd94df80ae54fb135a8

SHA1
44c3336d96e1886d38016814261a16500d16afd8

SHA256
6ed5477f59c55962eb6ea24624dcc76cf2dbc5b4a32d7cb3913c9370676f008b

SHA512
4bb21afd1e18af156d96cb30178e15500a101589004cf092512e847efce117af54292b853edb289d18cd1210e7479856f0e4b117e511aa8b7d1dd249f60b1fc7

Download Submit
C:\Windows\SysWOW64\Fjohde32.exe

Filesize
923KB

MD5
0a5d66b216a73c18da45a58f7a91ff14

SHA1
000522d1ce3f46cc6ff0c767474cbef638c9f305

SHA256
a87449648975374bf82c01aaa81a115b8f5fa3b0535646f67ef1cc17963a11e5

SHA512
cc22ba8992eb9cc9bfbcf1075db2f16432e75c1d4e0ebd44123e8a5d1b95c21c6f9c07404ab9d47d5c7755963d6497ea7f49a7bdad748bee1b8ce5be3d73d7f9

Download Submit
C:\Windows\SysWOW64\Foclgq32.exe

Filesize
923KB

MD5
0ed3dddfa0f791b506fb505fee915c34

SHA1
9e1587e90c3576711893491cee02af47b92cc28f

SHA256
6ea648eaaa383f3a380d535ba3430e284cede8e9527910377e390dd66f1f5803

SHA512
63cff83e746e6f251877c3fa865aeb6ec82060a47cecd9326204dfdba0e92970f19b1680504712b77cc37d104e275ef529538bab289726378dc43d86d5e9ab04

Download Submit
C:\Windows\SysWOW64\Gaefgd32.exe

Filesize
923KB

MD5
9e1e5c1dde4cb05f461b6f22fa5818f8

SHA1
b8156fb68245d6d7e317c1d3c803236f56f66055

SHA256
e0081fd55cbae061ef253c8771a2ca3c933f5c652aefa9d05c11eddf86d7632c

SHA512
b63ae95fbd41b553039f5d8b1a697aef4ef158f75487f41d2802a21a7ad672b7ff293b472aad32c0ffcdad882275aa21cebe77d9ea9c8265ba62360d4a46350b

Download Submit
C:\Windows\SysWOW64\Ggbook32.exe

Filesize
923KB

MD5
924024fdc858c84d47621c16517e6531

SHA1
000d23518c34ba37ed5cb5f77129a28d609be457

SHA256
a0b5fc9cc71ae15f1c0d436f4ceaf95edcc1102755739f91285ffb68b16efca8

SHA512
e70fca6eccbb142910ea9b1fb445a430e050ec37048b611c60b9f28fafb1b862b08b1b43f478001fca714db39592013020a70b740f1607a83716b8f14083c7f3

Download Submit
C:\Windows\SysWOW64\Gikdkj32.exe

Filesize
923KB

MD5
b8425c0d043fff4956df32a53a350423

SHA1
e0595a79a677f5f5f6fd1513a12f265c582774e4

SHA256
76056bbcdb243fb778b0b2929a8399e8dbb19234533b5e47355310c2c08bb4c1

SHA512
5c50154bcb3fba79bcb70078e083e4838e7c541ed343fb3208e20575b7748a30f0e726c822fc74c9bc6f89e082e2fcba154494733a2dc71f6f9bcea247fda366

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
923KB

MD5
7e2966b5369fec361ce8f57973c597bc

SHA1
122549fe89def41b5aa6bd4c397f8598a51ed293

SHA256
7089342bf2c7590c97ca52ae915d093483eb0db0c300477c8cd415dd8b46bda4

SHA512
01a2175d0a2c0681ed8ee80d59316c40ca299c4d8488d8a75487439ab640b07c03d7706201311ef70ce28fa035eca8ced2fd6f0e4243e01a23c09c054499ae0d

Download Submit
C:\Windows\SysWOW64\Gojiiafp.exe

Filesize
923KB

MD5
83df0e4ad653d025392f3e3d4ba65de3

SHA1
573da65b904bf337853c4593d475ecd011d2c745

SHA256
47b0ea06da5e644a8a3453943ebf0390114973acbbcb2234df5a26a02e6b0b0a

SHA512
030435762f6f60508d87632da4466afb338ab71f443443df2fe2d4a5faed5caf8294d469803f26c2cfa270c34b24b9187d2f26ca7e40a8d4fa2883ad700e54b2

Download Submit
C:\Windows\SysWOW64\Gpqjglii.exe

Filesize
923KB

MD5
558a98b977fed27986424276d4862ed0

SHA1
6cf018467b33972e39afc44eb5d581914be16bec

SHA256
7a8b01baf19ba8af692ef267958829186b11dbcdd9e744cadf1d0994a8fbfab9

SHA512
ffb12d48a82f348f305e40a36f447c93232aead6ed04cce98ba58f07a55ca02a4d8fc0033a92f7284d182defe4cf02c71603ec2e84f559d0ea4f753d33088fb8

Download Submit
C:\Windows\SysWOW64\Haafcb32.exe

Filesize
923KB

MD5
a38bd0ac0eab72e7f4ad1d747259ed03

SHA1
5ec8414234c63288eaa44bdb2bb0fe116f76cab1

SHA256
be2be5243f5866b6222d8f2ecc04ad9c37f3c2c8f2cb617b36c3a651d4b3b594

SHA512
f2a627905ec1b75917f7ffeacd2372285becc7cf4ebeb54a51b08be048ef784748abcc5364f2f4500f1b3ee49f7aebbcb22e04cf9f5f2bff87e04d00a6e7e988

Download Submit
C:\Windows\SysWOW64\Hacbhb32.exe

Filesize
923KB

MD5
b4ac05c16701020f46a1e0c683684ccb

SHA1
cab697b853dab1f44887678255473c5aa13c7ea1

SHA256
be26f12aaec85e4adee9e4281539d84146b5967826166914d5c8afff6f9f74e9

SHA512
358351a01d3870a327c781616a263deadd29cee9a3eb010ea73cf24c510742ad790977d85d36a62c54b09afe3b1deaac491ec734974a720abd37b9802041bc7e

Download Submit
C:\Windows\SysWOW64\Hcpojd32.exe

Filesize
923KB

MD5
d7b2a445dabcba865fcb176b6c15f9a2

SHA1
677cbe2a5da8f32fb8c88641ef61432b731359ac

SHA256
48f510372bd902032ef31a74f581a34b2cfe00e4cd08597ac90f3082438c92f5

SHA512
90e58b2409be66a612e8c6ad38ed7d18c9a6dad470ee0eabb04b97ed88b3c27e02fea208d0e26c38cac6a6dbff771066038a15c15e972884142887ed2dda9f6f

Download Submit
C:\Windows\SysWOW64\Hfjdqmng.exe

Filesize
923KB

MD5
42bf8fe2b64db6e05f51a5534d505da8

SHA1
b27ca3c07ce7925ab2fc42d4f876ffe0853a3d18

SHA256
658f9d57c487c1deea486d8d1e1185a026c14663c94706faa14f2a06e705128f

SHA512
11e45c27c23621e315c157beb03ac54549870ee41dcc7e36aa0ce04a2cb53753f5a2e7f6178e959f00ee8fb4853a6d0760369b99f64c49d6c0513c2d0d5aedfe

Download Submit
C:\Windows\SysWOW64\Hglaej32.exe

Filesize
923KB

MD5
ff64f008f0609c135181efcae4116e5a

SHA1
22e3f55aaf96ca09007c421bfba4c65d98d51c15

SHA256
29ad28fd8e5c8b6e7d184e773c05b8ce09b1ac87d091e13b51ea67900b41816e

SHA512
d92104e68a4ca9c0c92c5e88f06bb1bc6bbbf9ddd9c1ff1bdcf38cb6c5b8b773b24326045fb8ec57148ea351733ede255e9dea79805146b786c143033aaf973d

Download Submit
C:\Windows\SysWOW64\Hhknpmma.exe

Filesize
923KB

MD5
18ef0258c8b0382cfd6d491756490782

SHA1
4a515f04724ce1826c96c2b981e2fc24fb0f3899

SHA256
47ed5c7df756afd9188bf99cca6bd836b1d204855655ca33f82965c681a8cdce

SHA512
28bfa6701b646cfbb99e5c9a054289d0d19ceef90709b890d82ffc6e53e53fe520662a07b873f3f03b5180613dff798aab6232c91b9265d208555f8fa8a39995

Download Submit
C:\Windows\SysWOW64\Hnfjbdmk.exe

Filesize
923KB

MD5
6e0f41b34d3ce2a20a73b37c17fdd86d

SHA1
e05fac305d34cf35ac832fdba7d80a5fb8aeec27

SHA256
d27ed370948519f4aeecb28bdd6215c45e601c4304590a1c1d284801bbe8ddae

SHA512
1e6c44d92323fdb4c775d0750dabe7d9305e15c141c5cda1371d11b105a8792ae62d88c44cae7b3f2ed574deb8c1285254d678dfeecf2a88b9026d3a6e1ef9c9

Download Submit
C:\Windows\SysWOW64\Hpbiip32.exe

Filesize
923KB

MD5
d92a39866a104cdb5789f025ed7d5966

SHA1
3031315eb7938cd21b74348550a74830bce9ca62

SHA256
6b75346c2aea89c19987662f0dae84276977b568c41bbd2080f17231f24a0fc0

SHA512
55dcddc0f2e9849ba0dfaba2e7c3fb0275bd2d5d96b1384b6b21347fc2777d683fc1ff5e7bdf1474f1a82e71704792d3b150cedc4d297fe38e3bc7ca1edec6b9

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
923KB

MD5
cd83515b94ef4f1ff0979254b4efd059

SHA1
8c3b6652ab63d84133e5f1644815cfef7cc1a2b7

SHA256
5ab7b9a1d63a5f45e67b8312bfb7162a3e74b97b15b228d28bc64ea537c1d028

SHA512
c8401c0c9598fb0c309863a363eea6c586d6e78a72f406f97942f7399041703f47d6e23a5bc0977068079a99471fdf9e8e69361c624be4803b970ca44c2c2d6a

Download Submit
C:\Windows\SysWOW64\Hpfbcn32.exe

Filesize
923KB

MD5
2979e4a47244e5b261ec10df342a3e84

SHA1
6a21e8ae13ff70971d3ef4753fd967d9e16e1732

SHA256
5d5b31828bfa247581f0ae48d92dc581a077d00f007a132fc4b574d722070e58

SHA512
80edbfd105a993b71f275c75f0b02687259506654102a80cd0c3e1c2f13b94804ac64b909fceac5a4a6ddffc538b6275c3d4b4280da75de10bf98bddcf226306

Download Submit
C:\Windows\SysWOW64\Hpomcp32.exe

Filesize
923KB

MD5
063b6747b8fb69016fc25c23dd6b475a

SHA1
901ea6db252fbdabba2019e6075317a0bb7a8e80

SHA256
3dd5268854525a683a857d057bd75f767930f86a122ae3ab81d39488755c4833

SHA512
f1ef17cb5e5500d83d6541120800b2942124f405ce1f3442b45c7ab3afeeb210f2565e9b70f689dd033dfbb8e9b1ae30ddd399c0010e0126484061551c95dab4

Download Submit
C:\Windows\SysWOW64\Iafonaao.exe

Filesize
923KB

MD5
595fcbaf32684fc9c7a63d894d11023b

SHA1
bd2c12113af949301e5d6662a91d8b5de30e2bd1

SHA256
37fd2022be8dc46672df49ad09e265222d21d8aba18fd05c762d11e3fddd10b8

SHA512
64003fc23aabcaad07e12f5fa1af8057350953e87134bd8b37a8e688531ca7a304d4f09be19a4dedfbbd6820e12be2fcfebc4f11038c1a2dcfbcbb600c79eda4

Download Submit
C:\Windows\SysWOW64\Iahlcaol.exe

Filesize
923KB

MD5
b7192bbb8278e88c1eb7f7eef106b17a

SHA1
529a58bed25dabd944212ac8f2350fe23b5a8939

SHA256
666ec8bb3cfe5aa06d6ca7fa1b435ef0159f75b9db43515908b3ff956af18148

SHA512
6fb5f8e68458a2ed51de74bc82c6c7a009ddf2d3ebb46de7ecfb0d41b96980f5543ba605bcfc4a03345dd7249c10b4abd5eff2858b7dc1c63ecdaabd144b57e4

Download Submit
C:\Windows\SysWOW64\Iakiia32.exe

Filesize
923KB

MD5
143179f04c434418cf84934920cab554

SHA1
8b0e540df5ace6c80e3e7613c402c8a11cfb58b8

SHA256
e05ff8974266d77b6ddeaa54c114199a161fddbedd383b7f886212275883b7f9

SHA512
56e57fbde6ecc9d4f320ae1ab5bb6fa834c75b5e01a1b82d1d1cc536938039dc69e44beccb1ba70156f367ca00330d62cdaca2b1bb2e53f7c2c0df789a978e0d

Download Submit
C:\Windows\SysWOW64\Ibhkfm32.exe

Filesize
923KB

MD5
88b308f76bb369a2e5c9acc97f55fb00

SHA1
afee01b89b6ceea241785132090be566f821fa2e

SHA256
1079b193ba1dd94a64fa7ed320fcb9eebbcc4022daa62793ca114b6f425f9561

SHA512
70c4a9aa57266fcf12eda94161a4ded57a4a9d18f66d248165bca5aa000d77b187ccdb10edc1b4277d409f762147046899e5db4db2ca0f8eba99b9f91ffeb793

Download Submit
C:\Windows\SysWOW64\Iddljmpc.exe

Filesize
923KB

MD5
b3c64ef4de422c5b9fea29124b77b307

SHA1
ec4defb965d39de20005a1750aa651ffbad8ea33

SHA256
818700a2c302a3ef94183d6ae4748f437f08b6e1bf3b85aa43cf818fbc4b07aa

SHA512
449c70720091873ad9dcd4ca687dd331b9e734641b647290f9f53562b1450b75634d26b6d7c4f7da8dbadd0cc02ce742d03002b5fd9bf62208c3bc571d10b0e4

Download Submit
C:\Windows\SysWOW64\Idghpmnp.exe

Filesize
923KB

MD5
2cb98d4df0e8e9da7d21165ba3090fbe

SHA1
8d17fc9195b55f526db56b6d71631681382b515c

SHA256
ea58271f0f4c08c1e63d9516f0dba279c5cd64ffd1167c0c4e26ea382b3ae366

SHA512
1381a9c40e3ed320510321a68499648842668c1b4eb8eea6f79de40ad7b4549b18322be7ab865d682aebd34670c6da083e35564edc3b04f63e0a8fd7c55c0d54

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
923KB

MD5
aa89262802043756da3eb1f5663f0699

SHA1
835632563a63245506e4ad9c1b355440b3af9121

SHA256
d0b515e907f06c370300de208fb43fe5a4cb29e7b21a65f174e64dd6efaa3e2f

SHA512
1b2a3296bbcc13cd96d01c1b1088a566ba0aabb27dc7f2bf585baf6a7396fc4b9074b6c0f2275263ccfccaa658479b8d178927d2f9949015c487364b8bd0e3ec

Download Submit
C:\Windows\SysWOW64\Igchfiof.exe

Filesize
923KB

MD5
ffe35ea8e824271cc51c19436abbc4ee

SHA1
21ab57a33878464e67ffde3e187661c7e2cadbe8

SHA256
44faa03c0aaaf27323291e00c25c676d750926bf95436f9d391b2cd40575c6e1

SHA512
d9d2f15efc8ee853b5b9bcdcbe39bb6972b7de25d45bb1faabab3c52ab5dea93f203db32059222a1e29d74b150e97f1bdc0ce0b8bcbeba659ea870c586a9d1e0

Download Submit
C:\Windows\SysWOW64\Igedlh32.exe

Filesize
923KB

MD5
4b311ef0fa3229297ff1484a704a9efb

SHA1
5f4116567a40086355471e58ee4830ea3be12de0

SHA256
a16ee59e76a4e01e21649b42e0a640ee32ef38bda830bd9fa73b51fe81e8151b

SHA512
8ef90401947351d65dc1dd694d2da7e044a2f83c301ff6ab13ac72df11cbad865c5dd74b77556a63e3b09915f29280ce48d0a676b50d333105da3ef96d808233

Download Submit
C:\Windows\SysWOW64\Iggaah32.exe

Filesize
923KB

MD5
2666ea26f325c7d3a11327fea7fa194a

SHA1
46ca2757b5184431335c9e3bb0895da7b1e25e34

SHA256
7a64e4add4ac535d4f6b4b1b689366154392aefd4424352c3aefc6923c9d2198

SHA512
c4b72a35f7501cdcb9e377704dd830fb75a5210f825c66798c4f68cdd22d87d1de782f6fcdb0111eb3610e898e2cb6c118f14f3103a32ff65ab4eed46598648e

Download Submit
C:\Windows\SysWOW64\Igqkqiai.exe

Filesize
923KB

MD5
ead5b892a9d1d917d8019147fcbdd149

SHA1
a92a424ee1194d049d9e136e4bbe832b7aaa41a7

SHA256
48596c79ed3abd8f1061df16f44f09bd61da8118cf1e78b7988d5f338d0ba404

SHA512
518e52e20824363034cd960374ee1e1871cbd23c3885031c51839fe75595c1483cf983a6e7951404da29fd22ee8edfd6f3eba6e4b617260e07870293fe671911

Download Submit
C:\Windows\SysWOW64\Ihgnkkbd.exe

Filesize
923KB

MD5
22f61ba516420b946d8f25004b7d71e1

SHA1
c375a92e0c2336d56001b64ff226c729a1839ad0

SHA256
892607836a061b418a78b5ab86b1b097ddd9a71556bc69709702a5d24b11a1db

SHA512
4ee06b9f752a1074eae1aac0a654a094cf3e2b3fbd1df4eae1c0dd95bc71f83f9a1f33e059bfc3eb69c1e47c3cef982ddb82bfffa2b1dd5c07f6952091094236

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
923KB

MD5
373e6bfb90f4c738ec42dcbe7ea84829

SHA1
e70d4e8c5faaaaa70a8480468c709c935144b339

SHA256
411e313a4153c7be1d048b089ba044e66813616d351971f3c234c46c50d88d06

SHA512
3ed4c1d5a47950289ea07237588a94528874b325a2c9ba053aebad39668cbd0897fcc49c1a240a5acf66db00fd78369f2b7cc62a0a37bde9b8372621b65d8f96

Download Submit
C:\Windows\SysWOW64\Ijogmdqm.exe

Filesize
923KB

MD5
a0bcce5a43f3f6c7bcf0e3200a29dc65

SHA1
c8f2f0b4d315cc7f97942aac6c16fb0a071e13cc

SHA256
dd98ca2dfbe680022d2045c01a6e20aa1e8e1a07b9e9998784e75577de7b10e7

SHA512
258ea44005e5c927738282cc972f7061ff41e4ed20f30a57524860923c7d9c5b2503df14bf6eee3081c2389157198124c87b2b9dc0c7eff10b857aa7ca666e24

Download Submit
C:\Windows\SysWOW64\Ikejgf32.exe

Filesize
923KB

MD5
156a90ef4511e6e35caad3f52a954bb4

SHA1
9625737b7530351adeb0ec0b2b8ca463474654a9

SHA256
664a791b6a7aac03996e7ba8a2fa8b681a6f85742e7bb6cfdbba7e21aae9f327

SHA512
58dd22c5d279aaf0a1c5bd67ca7b7896ae4820d7906ca9cbc0a0ef428f04771827738994eea465ab910d9eccb4c42dc7da7fc99c4d64feebb56ef57ec3376ef7

Download Submit
C:\Windows\SysWOW64\Ilfennic.exe

Filesize
923KB

MD5
446758918cac63b043aa24ffbdd26476

SHA1
4f2404073109bb00bfee0be87dfc3caf63c5e291

SHA256
74317c71e6440b74a2b8f5345a85437e690dfb3a39ad1691fe969e1cceb99d5a

SHA512
7fa4e9166f92795e0c20fe487e79c487b8985df56b4d60e9a480c82ffd11a7efa94c96afd5b2b9e6c2ec77c4c82a448ff4c3f7def7ecc5df86a8856f76f45998

Download Submit
C:\Windows\SysWOW64\Inainbcn.exe

Filesize
923KB

MD5
eacd71d3fe22a670d2008192e135dc46

SHA1
b375e8d37ef745428326637148787209c4ab0051

SHA256
8022bf62a42a88e4878ba24ac7978d9d34c36cb60589fc720316c031a20107b4

SHA512
ead38fe32d933c6be060c053adb52a87f9643304bcf456fb4198ed23530798b41435cbb703d2c9140ae9f8b158952140f14d280f0f0f6fd9a5a94c38f847da64

Download Submit
C:\Windows\SysWOW64\Indfca32.exe

Filesize
923KB

MD5
269d74be01c586d906a2dedbdd208371

SHA1
abe3cbbf11381ca3992979cb31d590e4565da04a

SHA256
4ad553ccf81db25f75e9cd79714c3293e46c7861f243ace9f20f1aca6ecfaeeb

SHA512
0f8c4ff858fd37ee5eb8657c29cfb71680498881eec117f21d3d51eb50eff51cee9229a9aef590203f0ae634cb1a6e5d6e1e44cc6a7a4e05c8b70f5fe1dec53a

Download Submit
C:\Windows\SysWOW64\Ipkdek32.exe

Filesize
923KB

MD5
203db6f2689ca9ae4c86ce5afa8d3a6b

SHA1
e59740a4e1ce1cc70e863b187f51711aaf9f520e

SHA256
167626ee53831b3d66fc4d45d16349884874344dfe088a92550796d9c04a4003

SHA512
64a7a6655b8e6daf59c2365a0f9cb865c2547b61d71faa47bbfac5e706d59186ec315eaca72efc8a9c2f00ba8f1ced1798461f437f90bd1dd69e6b137854c3e4

Download Submit
C:\Windows\SysWOW64\Iqbbpm32.exe

Filesize
923KB

MD5
44d4b4152d26d6365890b46888a745c5

SHA1
b199f28a08750de0620c383d12676daf76af3730

SHA256
685f4266073ff832237cd5b75e0725175cdb5ae44669c817a567211dee516864

SHA512
742af9d283233d1fbb637719c74f4aaecfa0ea3c732d7e5eaee74e9a39380ce3ffc75dcc1e26dbd7e70ab83e7972043d20e6c9372591d08a12824ee213366453

Download Submit
C:\Windows\SysWOW64\Iqpfjnba.exe

Filesize
923KB

MD5
a5ec64a36190942d7c0f2e32b795589f

SHA1
49459ae5823f582259e4d23c1c54a351469e67e6

SHA256
dcbd1114a7311382399bd46b8bcd64aace232bf7fd81afd5586911677449e99c

SHA512
55ab25118ffd6c782bf143261492c811395df6c843320d1d2a6015260651dcc73b87192e8a328eeaad16322b14181171fe5d0739d66474690969315e520f3943

Download Submit
C:\Windows\SysWOW64\Jbaojpgb.exe

Filesize
923KB

MD5
174e13ce4cdbc39610f1226da18bfd2d

SHA1
5f45cc86afc77f9b15bcbd542220ae701a4deb6d

SHA256
ae3b00c1e2032ad505feb8be1c212bdaccf885baf34bd10796ebb4085d6b9a5d

SHA512
238ddd84fce4d4ce94a2d57d3a8d4a346637edff197a7451fbdd19caf1df68cde5c70e6e081137ac83ba3bd3d63736f142687d9d1abb038f775c3f71280510b0

Download Submit
C:\Windows\SysWOW64\Jhijqj32.exe

Filesize
923KB

MD5
cfdd51e024c9c0c9fdd1a372e20d1dfd

SHA1
b855fcd9299314bb4272be38b71592f7a3e0ff95

SHA256
19249c8e2b04ba5da36512fd10868d044050ba36d4a63b9fe792443523392792

SHA512
87a85d8ce70323a29ac169fbc47bbd640c71e5e0c6754bb34c1cd8d8acaa6b83d4ade1d3855c0b4e3c354b0ac1748d78897619400f3fe89c58594152e2ca569a

Download Submit
C:\Windows\SysWOW64\Jhlgfj32.exe

Filesize
923KB

MD5
65044b504fdf44a513e563da2a6a4ce3

SHA1
9a4c311fcb9cd2159f6e30a79a4b1400763041fd

SHA256
75b3db7b4c0637aca35b75a384e89c7a8a8377947feb8ea661028b1ae214c574

SHA512
09a43066a28a4c64192657265f73319e1d4a65b607a3dbb4aaf079b4b993997392053bbc5bff6d0ea147e5e0011ebe15af0052bce9041b2e1bd9cc0e8f6f9e83

Download Submit
C:\Windows\SysWOW64\Jjjghcfp.exe

Filesize
923KB

MD5
0df4ea7d1927defe00554eab46013ba7

SHA1
54fbdf7ee34b15a086624e505a7022139800a560

SHA256
f1873445ada5b037fa856e9eceb1dc4b871348d4b70251f504377005f1f2d6cd

SHA512
e8bcd91789658705bdda6872fc1134ffe63ff13837a6340ac2d992bec1342321e0cd23d2c9c3c649fabca0336bb79d1458d5f9b6e45762c7f384b00d41666cbc

Download Submit
C:\Windows\SysWOW64\Jkjcbe32.exe

Filesize
923KB

MD5
c89f0119cdd78dfa685df9f417457c36

SHA1
9b20cd1a4120667f276c9b0aead98667f1d6367d

SHA256
00e75967b40394d3e5d29538868163f1fd55f3bfaf362c93245db3c92fd70255

SHA512
84c8f84a1922611abcfbddfde5d5ac27b3670d033e4fd136d61627f4411013fa56a11ea8398e8a0e054f765f52ea38fdc5e7e86581300b1a2002a399832e8f95

Download Submit
C:\Windows\SysWOW64\Jldbpl32.exe

Filesize
923KB

MD5
a6dba41c57c078a8b553307e14eed9b2

SHA1
57515678b308868256e08ae32ef27c3760f77314

SHA256
5c2941a26434f537b70751092d6a422fdb408872e01e883024bb04f3ffbbdc8a

SHA512
fc0db183182a84750f6ef1bdda687a44a3e11d74f77ea4a7721bb167ed91e93b2a257126c085e2bdba4d4ac6b8950c03ac0f0aa4f1f2b4d24ba465d09e1e123c

Download Submit
C:\Windows\SysWOW64\Joekag32.exe

Filesize
923KB

MD5
df91a4113e2fa7e5931a03da8b128615

SHA1
bfec61c87b2409ecadd8c218272a9e92169555d4

SHA256
ba21701efcf9fa1da8a796540727e46fd64535f45375d4a0c89d0fc1ec819caa

SHA512
12d2e153ddaca3dc9a0dffdfb7a01944050062ad7f9be75de9dbf81bcc2461dea1d4e035f6edc7e995b8a7d096ff093373cb9845ee6c162ba4f4e4ab6027c583

Download Submit
C:\Windows\SysWOW64\Kadpdp32.exe

Filesize
923KB

MD5
6e5318716ff6ecfc1a0a24d679226fd7

SHA1
dec7c4c7ec5839bf334b470ede1bcbab21c3b975

SHA256
16c576eaf63e0bf4de68cc73f4a7a2b8b4170dcbef0c5a790b3d6144794fe376

SHA512
d9eb03e8ac50761761b0ab9a4365f8c6e5923667ee76ab720e2b80b30bd2724b663df2b514f2b8edf0f3e978c5bbab9d4c17eda6deec6de601473d481720b41e

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
923KB

MD5
a2994b6c080a423d5eb75131aea00ffd

SHA1
35aeff0b9a5d82fad902396f7d535fb724fd5f4b

SHA256
e200874a99751c75d1c8c43f5fb26beb4a0f0da38ebd75a977eaf566ee6069ea

SHA512
862dbed99aed50b5ce7c01d93739033b5cf1fc65a321e74e8c18ce5951425005bd77a1e47e620fd66bf2dc3e7b1158d4250d8fe56dd71fb1d8297947d3600a71

Download Submit
C:\Windows\SysWOW64\Kpcjgnhb.exe

Filesize
923KB

MD5
50cc0ae5a6349657fb70b17e9074ea6a

SHA1
8a72d82c7bd3430a45f5b314ec42e9d03e9454ef

SHA256
4284d06bca2794444e3361e71ceed641a92a414d411c505fcc3275ed24414665

SHA512
32c405306125e87daedca174561809b904ad6f36ff8f0c992a2fe594899a704c4b94060d1f6cdd5f6e450659ca3f485071babe9c69c5e66fd4de02b128032bfd

Download Submit
C:\Windows\SysWOW64\Ljbnfleo.exe

Filesize
923KB

MD5
8700c31af4250affe39fd308a72db865

SHA1
1596eaad903f7aa4650555f56eaa60dadd565ce0

SHA256
734c64ae9a465c540942d2f3abb0613f05aab750af36365eaca11f9eb74a064d

SHA512
db00013c18475399c5e10535a08ba9aac731a809447b272701c3409c3cc0037bba2c937be3eb0c76cca1d94ff3986c3cb17ec39bf82c62e3c62849168f826d12

Download Submit
C:\Windows\SysWOW64\Lmbhgd32.exe

Filesize
923KB

MD5
803f211b2d07d0beb6b9d33357a6d672

SHA1
06429c8bfc0dfba15b0b1ecbb833b003e3962731

SHA256
502dccea0a3ae77a27909eb5f8e67009b19f3b10c9f623412bed91ae7b47d7d6

SHA512
3c27e3413955cf3b565ca191e7958775df074ab7989965fcefb1ffa73394534dae81600ee867fadb0a3962c501e9c054974e610834e6cc62c4bd2ef762a2a0d6

Download Submit
C:\Windows\SysWOW64\Lnjnqh32.exe

Filesize
923KB

MD5
65f43d9a7f6182d006fe288369e39151

SHA1
215b093395bd391bd1c5e66b08dbaa09d4049453

SHA256
d8423cc234ccca68e4d58995725b72800d2ad045598b8f26b2db3c12ffd837a0

SHA512
bb2a730c724ae40c63aaf691c5a835937f9b5bf6ce060fa03ddb4f02b88dfb9a10018efa93dc83faf7bfc339d501357aafcb02825390ffca58a68fb491debe3e

Download Submit
C:\Windows\SysWOW64\Lnldla32.exe

Filesize
923KB

MD5
15e4cfb0e184a72776d4faae9d54a73d

SHA1
03a3cf08cc3d2ebbfed46e76a92cd959ca656012

SHA256
a0498765d25339f004cf6b3cc0d0da270a910d44603b51b5155239f147a97102

SHA512
43c26929abf36747709301e024fdeaa9aed8ab87072f66bef9252f302c83b8dc188a641fb607425558c1b3dc301febbd04d31fe91f4ce8bafd6460279f72474d

Download Submit
C:\Windows\SysWOW64\Lobjni32.exe

Filesize
923KB

MD5
5cf0503f7f6983235c947a4be1516e38

SHA1
1b17bb8637f3fc4e5060877990eea23004f81e56

SHA256
5ed9973c5c77ef2a1b108082c093c9ec25abd5a279d4b633b4ba45f852b65780

SHA512
fece1a75d72e00046da47a8ede316c863bdb3f0afacb5d501d11afddce804fe8ad1c54a7cd0c5f1537543dcb6c143c744a247735a7fb4451d5d4db5d2e4830aa

Download Submit
C:\Windows\SysWOW64\Loighj32.exe

Filesize
923KB

MD5
1f610ebbd97615e66c47e45840210e04

SHA1
5363ec016c751295ea3c848d019383ca99bbcc01

SHA256
67b691b22037c6ab2aac5e7a3a1c92267d31d4c24406d3b05b28bdf0eb8a9db0

SHA512
a6db4f2b5768e0a8daf074a2d951d4573b221c9340df9d8461c013dd5233c850d14fa948d81f22c17f27de137e36aa606ecb446e1440ea5a8c5424b9693e79a2

Download Submit
C:\Windows\SysWOW64\Meiioonj.exe

Filesize
923KB

MD5
fe4845f8e8317f399573038e53686205

SHA1
ca4771b8210fbaaa1994d333bab0e0ac8cabce38

SHA256
47e885a4aad76e88b011cdf70400421b4dffd3355ce8249fde3f7e2ad07fde60

SHA512
eed77e8d581ef66f1f7b62126543d28a440d6f99cb4a6c3c649e31af8878d72f6dabb13375ae416619ab802e1367a21ce6c2e96b9ddb56a04c6d629ce298acad

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
923KB

MD5
6dff5fd4a3f33c4a5caec990a06b9fc2

SHA1
f0987d20bcfbd5abd6c7d4efd272d73acf7ddd9e

SHA256
80b70f29da04d579e89f7e8600097afc17ff4024be85745ab2a5ec29862b8204

SHA512
0e06c09398d072455fc8e74d91bfd0a9244b5d16ff8bb4c0f7cb96f8a4ae315444c994f1e8328b95eaf2b80a49cb9863cf886b4738189b17e068260df4f813d8

Download Submit
C:\Windows\SysWOW64\Mqafhl32.exe

Filesize
923KB

MD5
0bd7f8542b94afe05e3ee237fdf54f1c

SHA1
8ec282867a8d09bc2ef12d25526b0e079c525633

SHA256
e8a9d54ec66e18e2414047157e5c6e0b8c82b91ccb4839e7d88295c397bf5451

SHA512
6dcafdc4a9bad51e852047d20c0b245aa04823dce56aa9ce4233cad1e1f3930d501b0e31c407d04e38b49f81d62d900322787c85c23955a9db598252efffbb71

Download Submit
C:\Windows\SysWOW64\Njgqhicg.exe

Filesize
923KB

MD5
7b0bbb23673b35d798d3caaba76f03d4

SHA1
9d0cc4883fba946bd062e0694d3ab64353e496a6

SHA256
9b4204774b7b5d822cc76e54766e58c113914dc7ab5c3ba8bae1933b5829b5ce

SHA512
732708f9f3bd2fadbbfb20dfae00729ef1ce0d51136daa9d0199fa00bab949ded4adc760e864e6b36018c8cc2b3486a6189afdf6924218fc11b30d1a4ca9e001

Download Submit
C:\Windows\SysWOW64\Nnfpinmi.exe

Filesize
923KB

MD5
e869bd21657a5d417b25c53b953c6a10

SHA1
daf141e1806e7437b14664f77b36609535d4ed76

SHA256
de06062fb6ed4d848a94c8a6a986f0b6cf3a44f7df17c45cc4485ff7072ded22

SHA512
305780e0f69b43095b4e88f6c6c3632a9d32cfce105b4aa79b20f1354c4403bb37c38a6c708dd65ee4231cf5fdf1c243914c756450045ec0a3d0f9467af41165

Download Submit
C:\Windows\SysWOW64\Nopfpgip.exe

Filesize
923KB

MD5
16dadc22849ac2edb05215ebf2194326

SHA1
d81755435fc83b230550a38d38816b6eae16f9cc

SHA256
70dd7e2ef8110f867fff855c3382620ade0fb1362ba6a7ed4e4d0290f7fa4acd

SHA512
9c2909513bb15bdb4dfcffa9318635092ff800dfe7643d90e1f3b086a4d1adbe77fc4dcbf4f891432ed0c25156fefed193ddee8770e55185eda1516c3ac37793

Download Submit
C:\Windows\SysWOW64\Ocnabm32.exe

Filesize
923KB

MD5
5ecf0f92b1c0a331eabfbd4f59eeb56f

SHA1
0a36edf47823b9785f1a531891560ae3f54b48bd

SHA256
e7f7c557ce36a88daac4d0078a8bef9a25cf9cba91c5bf38c3c88b757062a4c5

SHA512
1ae7516f2444ed05d6766b4c0f27768f59cdbeed527525aca699a4a04dc10b8d69562c5785cbbd388b2e36aa4bccb07ad9620154394afb92976583aca786eb3c

Download Submit
C:\Windows\SysWOW64\Ojajin32.exe

Filesize
923KB

MD5
b9fd6ab1519518a1a7f28736f1cb69c8

SHA1
55ab36884eccecb7b3a59388b2845fc9697a975b

SHA256
7f40c5272a9c67426c5bb4f3b408787eea0a16aa28bb126ee8041790bbf53095

SHA512
8545303e196434d339e6ce6616ef132171de5eb1641af3719e19c920efae4ab3717dabf8d395fa2fdbd4aadb6b6e684fdb682df2ebf866fa52da7528a97106b0

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
923KB

MD5
1a29b007f70abe7261e735b6067dd977

SHA1
cde36085661c960326cc33be2c23b279d284ddb5

SHA256
6d782e823311f1ced52443b54c18de53bfe1a89a5fc723a61f023b38634a33c4

SHA512
8b66e25ad1256d2d07c117008d7ccc34a317eb90a0c5a12abd4a2e64e8fe8f1718e9b07f83a9f61e046ff14c3b516dbf88384940861782bdfa553f8b6f903bdf

Download Submit
C:\Windows\SysWOW64\Pccahbmn.exe

Filesize
923KB

MD5
9fc932eebd599e50a1f06eff8ed5871f

SHA1
0af4c4953f5a16d76d917b9e2c08edf0b0d60679

SHA256
a934599d9b10c98b8fcdba55007f968f7e64413883c25bc4342937a4e6eda5b5

SHA512
6c248bd652968d25b5ee3d40eb8729b8525a2b40c939f40bbe0ec6ef71bc7f346029273438f821fa271b342d5c3d862ca5a72476af2097371b0d033e760cef5d

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
923KB

MD5
ba959cab94cd0761a9c8fbad1136921c

SHA1
faba2b2c3dd0bd43c5d62e060b820131832d0b41

SHA256
84f4d66a8f2f3b2cae7d0d65238c2982c8f87c41538cd1d55cd4f04d48a99fa0

SHA512
3ce667a788b9cb05205a4c8d6ad4cbf7811d717e27a0207a1c2894aa4a8becad8cf0255fc26e97479857bdc3ceb63a3aa16aeca0c06f32e8692b76c9175a2d96

Download Submit
C:\Windows\SysWOW64\Pmkofa32.exe

Filesize
923KB

MD5
8294ba098f4fa5e39f61326f05331a50

SHA1
9305703c9933ff1f28307047c28b0b18da076269

SHA256
9b122e9afea05879fef0b2bc7e56c59602b9968e99f6e53002eea705e5c92f8f

SHA512
85b6681f8abfbfa59e2af5bff453bebef288e27615038791b886f7a1b68cc7e3533ca51f8e75c0405eaa112c5520526069b16fed273aeca68ffc6d28f27799f3

Download Submit
C:\Windows\SysWOW64\Pqbala32.exe

Filesize
923KB

MD5
d9f1160ded52903ac48bae991b45afe8

SHA1
56d1a6451862477f470783bb0f8d73b78be083b7

SHA256
58d6087630419c5023500e153c05f2776edb4c5d4ff0543be3e7045a97eb4597

SHA512
6930a91594891c28cac8c5c8baff13a16959ffb343a91fc0628c8091e86cb4a0d49a2aba96cb32e3ca89b6f9b378b4c41f9aba2c8404e44b083a2063bd567b37

Download Submit
memory/708-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/740-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/940-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/956-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1028-173-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1100-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1244-591-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1244-50-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1284-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1300-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1432-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1456-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1724-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1724-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1848-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-78-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2044-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2060-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2112-150-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2152-118-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2156-190-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2184-230-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2260-45-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-109-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2292-94-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2316-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2472-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2592-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2788-214-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2884-453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2964-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2964-557-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3016-157-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3116-102-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-254-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3416-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3676-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3692-126-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3724-238-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3860-198-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3888-339-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3964-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4120-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4188-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4284-134-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-166-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-206-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4400-246-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-222-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4556-598-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4588-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4616-142-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4628-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4700-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4756-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4756-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4760-86-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4816-70-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4868-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4888-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4916-182-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5112-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5148-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5188-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5228-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5268-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5308-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5348-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5388-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5428-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5468-519-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5516-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5548-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5588-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5628-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5668-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5712-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5752-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5796-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5840-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5884-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5928-592-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5968-599-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads