berbew | a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe
Size

409KB
MD5

c4b7204e26dd9a2ec2e26ba8bd138cb0
SHA1

9db2f5fa9dae389053e2b4a15fec049a346172d6
SHA256

a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65
SHA512

a27799c2c0cc4122415b0f45edd6f06da3ae0926a6f13f430384bfd8cbe1b78a83146fb11c0cd9941c0714c6a02d34078ba6d8d5ec61a43a574dad7ba6c2bea3
SSDEEP

6144:62hAR8ZgZ0Wd/OWdPS2LStOshOWdPS2Lt:zSF5fC55

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hckeoeno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpphjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbndfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmedjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebhglj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdccbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knhakh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcmfnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnicid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjeiodek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epffbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glgjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hildmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpfepf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfdpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imgicgca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnnimak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bokehc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phigif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmhdkknd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adfgdpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfjjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fikbocki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojbacd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcnqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmkgkapm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omjpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dblgpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cleegp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmkigh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icdheded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfkmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpcpfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejagaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acokhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlieda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eplgeokq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccmhdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhkbfme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqdpgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blgifbil.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4916	Aoofle32.exe
2236	Afinioip.exe
516	Acokhc32.exe
2824	Bfngdn32.exe
1612	Bfbaonae.exe
1800	Bokehc32.exe
4128	Bjbfklei.exe
4564	Cfigpm32.exe
1636	Ccmgiaig.exe
2216	Ccbadp32.exe
3724	Cjliajmo.exe
3764	Coiaiakf.exe
5088	Cjnffjkl.exe
5068	Cmmbbejp.exe
5092	Dmoohe32.exe
3996	Dpnkdq32.exe
4288	Dblgpl32.exe
3360	Djcoai32.exe
3612	Difpmfna.exe
3768	Dkdliame.exe
2052	Dpphjp32.exe
2420	Dbndfl32.exe
3044	Djelgied.exe
3020	Dmdhcddh.exe
3712	Dlghoa32.exe
4076	Dcnqpo32.exe
4456	Djhimica.exe
4792	Dikihe32.exe
2396	Dlieda32.exe
1388	Dcpmen32.exe
4376	Dbcmakpl.exe
2504	Dmhand32.exe
4644	Dpgnjo32.exe
1184	Ebejfk32.exe
4776	Ejlbhh32.exe
2248	Emkndc32.exe
3328	Epikpo32.exe
1864	Ebhglj32.exe
4140	Ejoomhmi.exe
316	Emmkiclm.exe
4612	Eplgeokq.exe
2936	Ebjcajjd.exe
1904	Ejalcgkg.exe
4204	Emphocjj.exe
4380	Epndknin.exe
5024	Eblpgjha.exe
552	Efhlhh32.exe
4384	Eifhdd32.exe
3376	Eleepoob.exe
2172	Eclmamod.exe
1220	Efjimhnh.exe
4316	Eiieicml.exe
2192	Elgaeolp.exe
4532	Fcniglmb.exe
2372	Ffmfchle.exe
2784	Fikbocki.exe
3224	Fpejlmcf.exe
2460	Fdqfll32.exe
3320	Ffobhg32.exe
4928	Fimodc32.exe
1792	Fllkqn32.exe
2676	Fdccbl32.exe
4308	Ffaong32.exe
852	Fmkgkapm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jcoong32.dll	Epndknin.exe
File created	C:\Windows\SysWOW64\Bnmoijje.exe	Bkobmnka.exe
File opened for modification	C:\Windows\SysWOW64\Chnbbqpn.exe	Cbdjeg32.exe
File created	C:\Windows\SysWOW64\Anlkecaj.dll	Pmhbqbae.exe
File opened for modification	C:\Windows\SysWOW64\Binhnomg.exe	Bjhkmbho.exe
File created	C:\Windows\SysWOW64\Omjpeo32.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Oqadgkdb.dll	Chqogq32.exe
File created	C:\Windows\SysWOW64\Nkbjmj32.dll	Kegpifod.exe
File created	C:\Windows\SysWOW64\Ocaebc32.exe	Ojhpimhp.exe
File opened for modification	C:\Windows\SysWOW64\Lepleocn.exe	Kpccmhdg.exe
File created	C:\Windows\SysWOW64\Odibfg32.dll	Pfojdh32.exe
File opened for modification	C:\Windows\SysWOW64\Pmkofa32.exe	Pbekii32.exe
File created	C:\Windows\SysWOW64\Gbdoof32.exe	Gpecbk32.exe
File opened for modification	C:\Windows\SysWOW64\Mcjmel32.exe	Mgclpkac.exe
File created	C:\Windows\SysWOW64\Nlkgmh32.exe	Neqopnhb.exe
File created	C:\Windows\SysWOW64\Poigcbng.dll	Domdjj32.exe
File created	C:\Windows\SysWOW64\Lepleocn.exe	Kpccmhdg.exe
File created	C:\Windows\SysWOW64\Ldfakpfj.dll	Ajaelc32.exe
File created	C:\Windows\SysWOW64\Hojpmg32.dll	Omjpeo32.exe
File created	C:\Windows\SysWOW64\Fdqfll32.exe	Fpejlmcf.exe
File created	C:\Windows\SysWOW64\Nnbnhedj.exe	Nlcalieg.exe
File created	C:\Windows\SysWOW64\Mlgjal32.dll	Bebjdgmj.exe
File created	C:\Windows\SysWOW64\Fmggcl32.dll	Jgbchj32.exe
File opened for modification	C:\Windows\SysWOW64\Koaagkcb.exe	Kjeiodek.exe
File opened for modification	C:\Windows\SysWOW64\Cpdgqmnb.exe	Ckgohf32.exe
File created	C:\Windows\SysWOW64\Dkbgjo32.exe	Ddhomdje.exe
File created	C:\Windows\SysWOW64\Knooej32.exe	Kkpbin32.exe
File opened for modification	C:\Windows\SysWOW64\Ioolkncg.exe	Iibccgep.exe
File created	C:\Windows\SysWOW64\Lcgpni32.exe	Lqhdbm32.exe
File created	C:\Windows\SysWOW64\Ngqagcag.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bobabg32.exe
File created	C:\Windows\SysWOW64\Bogkmgba.exe	Bgnffj32.exe
File opened for modification	C:\Windows\SysWOW64\Epffbd32.exe	Enhifi32.exe
File opened for modification	C:\Windows\SysWOW64\Plmmif32.exe	Pecellgl.exe
File opened for modification	C:\Windows\SysWOW64\Jaajhb32.exe	Jifecp32.exe
File created	C:\Windows\SysWOW64\Bdeiqgkj.exe	Bagmdllg.exe
File created	C:\Windows\SysWOW64\Adppeapp.dll	Bdeiqgkj.exe
File created	C:\Windows\SysWOW64\Ekgqennl.exe	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Nlljlela.dll	Emkndc32.exe
File created	C:\Windows\SysWOW64\Kqmkae32.exe	Knooej32.exe
File opened for modification	C:\Windows\SysWOW64\Ojbacd32.exe	Ohcegi32.exe
File created	C:\Windows\SysWOW64\Akkffkhk.exe	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Lmlnmdij.dll	Gmbmkpie.exe
File opened for modification	C:\Windows\SysWOW64\Hlegnjbm.exe	Hkdjfb32.exe
File created	C:\Windows\SysWOW64\Onnmdcjm.exe	Ojbacd32.exe
File created	C:\Windows\SysWOW64\Albpkc32.exe	Aonoao32.exe
File opened for modification	C:\Windows\SysWOW64\Bnhenj32.exe	Blgifbil.exe
File opened for modification	C:\Windows\SysWOW64\Bkaobnio.exe	Bdgged32.exe
File created	C:\Windows\SysWOW64\Gmojkj32.exe	Fnlmhc32.exe
File created	C:\Windows\SysWOW64\Kofljo32.dll	Nckkfp32.exe
File created	C:\Windows\SysWOW64\Ocdnln32.exe	Nmjfodne.exe
File opened for modification	C:\Windows\SysWOW64\Pbekii32.exe	Pmhbqbae.exe
File created	C:\Windows\SysWOW64\Epikpo32.exe	Emkndc32.exe
File created	C:\Windows\SysWOW64\Gajaoo32.dll	Fllkqn32.exe
File created	C:\Windows\SysWOW64\Ioolkncg.exe	Iibccgep.exe
File created	C:\Windows\SysWOW64\Bagmdllg.exe	Bkmeha32.exe
File created	C:\Windows\SysWOW64\Mfnlgh32.dll	Ccblbb32.exe
File created	C:\Windows\SysWOW64\Eafbmgad.exe	Ejojljqa.exe
File opened for modification	C:\Windows\SysWOW64\Enopghee.exe	Ekqckmfb.exe
File created	C:\Windows\SysWOW64\Emphocjj.exe	Ejalcgkg.exe
File created	C:\Windows\SysWOW64\Dgegjnih.dll	Opnbae32.exe
File opened for modification	C:\Windows\SysWOW64\Fkmjaa32.exe	Fofilp32.exe
File opened for modification	C:\Windows\SysWOW64\Ookoaokf.exe	Ocdnln32.exe
File created	C:\Windows\SysWOW64\Fefmmcgh.dll	Ofegni32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10460	3944	WerFault.exe	594

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdccbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkdgchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kegpifod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fideeaco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohmhmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpjjmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccbadp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkkgpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfgcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeokal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleegp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnhcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookoaokf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhkdof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foclgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plkpcfal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imgicgca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmeigg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgnbaeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknojl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emhkdmlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpejlmcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbabigfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqbdldnq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibfnqmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epikpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdgged32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knooej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doaneiop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abfdpfaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knhakh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffcpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnbbqpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdeiqgkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gddgpqbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gipdap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilmmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkcndeen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjhkmbho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofefp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikpjbq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjliajmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kclgmq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoiqneg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodjjimm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpjmnjqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbdgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnjejjgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqmlccdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkbdmbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbcmakpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efhlhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffmfchle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifomll32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahdged32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efpomccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcekfnkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfkbde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chqogq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfedh32.dll"	Foclgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejqna32.dll"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkmeha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpphjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcjcnoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcncmnn.dll"	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nofefp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcpahpmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqikmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chlcgfff.dll"	Odmbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcidlo32.dll"	Cmnnimak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dalofi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emmkiclm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkconn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kegpifod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emhkdmlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ialjan32.dll"	Emmdom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjnfdhk.dll"	Gfodeohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgddkelm.dll"	Bdfpkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbndfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckoph32.dll"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnjejjgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bemqih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dooaoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idkkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nagpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abklmb32.dll"	Chnbbqpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcniglmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Comjoclk.dll"	Jqhafffk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlcalieg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejceb32.dll"	Fglnkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odibfg32.dll"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolphl32.dll"	Ejojljqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afinioip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffobhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fofilp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epikpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khoana32.dll"	Nlkgmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpdennml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iikikigb.dll"	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emcnmpcj.dll"	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofljo32.dll"	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebejfk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4916	3644	a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe	82
PID 3644 wrote to memory of 4916	3644	a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe	82
PID 3644 wrote to memory of 4916	3644	a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe	82
PID 4916 wrote to memory of 2236	4916	Aoofle32.exe	83
PID 4916 wrote to memory of 2236	4916	Aoofle32.exe	83
PID 4916 wrote to memory of 2236	4916	Aoofle32.exe	83
PID 2236 wrote to memory of 516	2236	Afinioip.exe	84
PID 2236 wrote to memory of 516	2236	Afinioip.exe	84
PID 2236 wrote to memory of 516	2236	Afinioip.exe	84
PID 516 wrote to memory of 2824	516	Acokhc32.exe	85
PID 516 wrote to memory of 2824	516	Acokhc32.exe	85
PID 516 wrote to memory of 2824	516	Acokhc32.exe	85
PID 2824 wrote to memory of 1612	2824	Bfngdn32.exe	86
PID 2824 wrote to memory of 1612	2824	Bfngdn32.exe	86
PID 2824 wrote to memory of 1612	2824	Bfngdn32.exe	86
PID 1612 wrote to memory of 1800	1612	Bfbaonae.exe	87
PID 1612 wrote to memory of 1800	1612	Bfbaonae.exe	87
PID 1612 wrote to memory of 1800	1612	Bfbaonae.exe	87
PID 1800 wrote to memory of 4128	1800	Bokehc32.exe	88
PID 1800 wrote to memory of 4128	1800	Bokehc32.exe	88
PID 1800 wrote to memory of 4128	1800	Bokehc32.exe	88
PID 4128 wrote to memory of 4564	4128	Bjbfklei.exe	89
PID 4128 wrote to memory of 4564	4128	Bjbfklei.exe	89
PID 4128 wrote to memory of 4564	4128	Bjbfklei.exe	89
PID 4564 wrote to memory of 1636	4564	Cfigpm32.exe	90
PID 4564 wrote to memory of 1636	4564	Cfigpm32.exe	90
PID 4564 wrote to memory of 1636	4564	Cfigpm32.exe	90
PID 1636 wrote to memory of 2216	1636	Ccmgiaig.exe	91
PID 1636 wrote to memory of 2216	1636	Ccmgiaig.exe	91
PID 1636 wrote to memory of 2216	1636	Ccmgiaig.exe	91
PID 2216 wrote to memory of 3724	2216	Ccbadp32.exe	92
PID 2216 wrote to memory of 3724	2216	Ccbadp32.exe	92
PID 2216 wrote to memory of 3724	2216	Ccbadp32.exe	92
PID 3724 wrote to memory of 3764	3724	Cjliajmo.exe	93
PID 3724 wrote to memory of 3764	3724	Cjliajmo.exe	93
PID 3724 wrote to memory of 3764	3724	Cjliajmo.exe	93
PID 3764 wrote to memory of 5088	3764	Coiaiakf.exe	94
PID 3764 wrote to memory of 5088	3764	Coiaiakf.exe	94
PID 3764 wrote to memory of 5088	3764	Coiaiakf.exe	94
PID 5088 wrote to memory of 5068	5088	Cjnffjkl.exe	95
PID 5088 wrote to memory of 5068	5088	Cjnffjkl.exe	95
PID 5088 wrote to memory of 5068	5088	Cjnffjkl.exe	95
PID 5068 wrote to memory of 5092	5068	Cmmbbejp.exe	96
PID 5068 wrote to memory of 5092	5068	Cmmbbejp.exe	96
PID 5068 wrote to memory of 5092	5068	Cmmbbejp.exe	96
PID 5092 wrote to memory of 3996	5092	Dmoohe32.exe	97
PID 5092 wrote to memory of 3996	5092	Dmoohe32.exe	97
PID 5092 wrote to memory of 3996	5092	Dmoohe32.exe	97
PID 3996 wrote to memory of 4288	3996	Dpnkdq32.exe	98
PID 3996 wrote to memory of 4288	3996	Dpnkdq32.exe	98
PID 3996 wrote to memory of 4288	3996	Dpnkdq32.exe	98
PID 4288 wrote to memory of 3360	4288	Dblgpl32.exe	99
PID 4288 wrote to memory of 3360	4288	Dblgpl32.exe	99
PID 4288 wrote to memory of 3360	4288	Dblgpl32.exe	99
PID 3360 wrote to memory of 3612	3360	Djcoai32.exe	100
PID 3360 wrote to memory of 3612	3360	Djcoai32.exe	100
PID 3360 wrote to memory of 3612	3360	Djcoai32.exe	100
PID 3612 wrote to memory of 3768	3612	Difpmfna.exe	101
PID 3612 wrote to memory of 3768	3612	Difpmfna.exe	101
PID 3612 wrote to memory of 3768	3612	Difpmfna.exe	101
PID 3768 wrote to memory of 2052	3768	Dkdliame.exe	102
PID 3768 wrote to memory of 2052	3768	Dkdliame.exe	102
PID 3768 wrote to memory of 2052	3768	Dkdliame.exe	102
PID 2052 wrote to memory of 2420	2052	Dpphjp32.exe	103

C:\Users\Admin\AppData\Local\Temp\a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe
"C:\Users\Admin\AppData\Local\Temp\a141496cffe53962986b8279259baae79fcb069fdb0e0af784ffa9da1e80ea65N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\Aoofle32.exe
  C:\Windows\system32\Aoofle32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\Afinioip.exe
    C:\Windows\system32\Afinioip.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\SysWOW64\Acokhc32.exe
      C:\Windows\system32\Acokhc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:516
    - - C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2824
      - C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        24⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        25⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        26⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        28⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        29⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2396
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        31⤵
        Executes dropped EXE
        
        PID:1388
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        33⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        34⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        36⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2248
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        40⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:316
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        43⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        45⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4380
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        47⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        49⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        50⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        51⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        52⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        53⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        54⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2372
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2784
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        59⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        61⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1792
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2676
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        64⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        66⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        67⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        68⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        69⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        70⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        71⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        73⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        74⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        75⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        76⤵
        Drops file in System32 directory
        
        PID:64
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        77⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        78⤵
        Modifies registry class
        
        PID:708
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        79⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3800
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:1900
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        82⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        83⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        84⤵
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        85⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        87⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        88⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        89⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        92⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        93⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        96⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        97⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        98⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        100⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        101⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        102⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        103⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        104⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5984
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        107⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        109⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        111⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        112⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        113⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:632
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        115⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:3964
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        117⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        118⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        119⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        120⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        121⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        122⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        123⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        124⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        125⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        126⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        127⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        129⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        130⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        132⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        133⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        135⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        137⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        138⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        139⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        140⤵
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        141⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        142⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        144⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        145⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        147⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        148⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        150⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        151⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        152⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        153⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        154⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        156⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        157⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        158⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        159⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        160⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        162⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        163⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        164⤵
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        165⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:916
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        169⤵
        Drops file in System32 directory
        
        PID:4136
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        170⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        171⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        172⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        173⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        174⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        175⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        176⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        177⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:5624
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        179⤵
        Drops file in System32 directory
        
        PID:1224
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        180⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        182⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        183⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        184⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        185⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        187⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        188⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        189⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        190⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        191⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        192⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        194⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        197⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        198⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        199⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        201⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        202⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        203⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        204⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        205⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        209⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        210⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        211⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        212⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        213⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        214⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        215⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        216⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        217⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        218⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        220⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        221⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        222⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        223⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        224⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        225⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        226⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        227⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        228⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        229⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        230⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        232⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        233⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        234⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        235⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7184
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        238⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        239⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        240⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        241⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        242⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        244⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7600
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        247⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        248⤵
        Modifies registry class
        
        PID:7672
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        249⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        250⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        251⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        252⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        253⤵
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        254⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        255⤵
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        256⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8120
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        259⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        260⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        261⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        262⤵
        Modifies registry class
        
        PID:7328
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        263⤵
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        265⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        266⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        267⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        268⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7808
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        271⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        272⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        273⤵
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        274⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        275⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        276⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        277⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        278⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        279⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7536
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        282⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        283⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        284⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        285⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        286⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        287⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        288⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        289⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        290⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        292⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        293⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        294⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        295⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        296⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        297⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        298⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        299⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        300⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        301⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        302⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        303⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        305⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        306⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8872
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        308⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        309⤵
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        310⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        311⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        312⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        313⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        314⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        315⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        316⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:8264
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        318⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        319⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        320⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        321⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        322⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        324⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        325⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:8868
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        327⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        329⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9108
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        331⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        332⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        333⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        334⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:8660
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        336⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        337⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        338⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6408
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        340⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9160
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8516
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        343⤵
        Modifies registry class
        
        PID:8748
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:9008
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        345⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        347⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:8716
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        349⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        350⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        351⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        352⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        353⤵
        Modifies registry class
        
        PID:9080
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        354⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        356⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9344
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        358⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        359⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        360⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        361⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        362⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        363⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9628
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        364⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        365⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        366⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        367⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        368⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        369⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        370⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        371⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        372⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9996
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        374⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        375⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        376⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        377⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        378⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        379⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        380⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        381⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        382⤵
        Modifies registry class
        
        PID:9376
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        383⤵
        Drops file in System32 directory
        
        PID:9416
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        384⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:9516
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        386⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        387⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        388⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        389⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        390⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        391⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9872
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        393⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10020
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        395⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        396⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        397⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        398⤵
        System Location Discovery: System Language Discovery
        
        PID:9260
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        399⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        400⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        401⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        402⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        403⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        404⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        405⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        406⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        407⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        408⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        409⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9636
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        411⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        412⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9224
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        415⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        416⤵
        Drops file in System32 directory
        
        PID:10116
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        417⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        418⤵
        System Location Discovery: System Language Discovery
        
        PID:9452
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        419⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10256
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        421⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        422⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        423⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        424⤵
        Modifies registry class
        
        PID:10400
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        425⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        426⤵
        Modifies registry class
        
        PID:10472
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10508
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        428⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        429⤵
        Drops file in System32 directory
        
        PID:10580
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        430⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        431⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        432⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        433⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        434⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        435⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        436⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        437⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        438⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10964
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        440⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        441⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        442⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        443⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        444⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        445⤵
        System Location Discovery: System Language Discovery
        
        PID:11216
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        446⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        447⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        448⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        449⤵
        Drops file in System32 directory
        
        PID:10420
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        450⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        451⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        452⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        453⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        454⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        455⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10840
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        456⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        457⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        458⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11136
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        459⤵
        Drops file in System32 directory
        
        PID:11200
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        460⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10248
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10360
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        462⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        463⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        464⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        465⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        466⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        467⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1580
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11128
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        470⤵
        Drops file in System32 directory
        
        PID:11208
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        471⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        472⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        473⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        474⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        475⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        476⤵
        Drops file in System32 directory
        
        PID:1308
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        477⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        478⤵
        Modifies registry class
        
        PID:10532
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        479⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        480⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        481⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        482⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        483⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        484⤵
        Drops file in System32 directory
        
        PID:10336
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:440
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        486⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        487⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        488⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        489⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        490⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        491⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:60
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        492⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        493⤵
        Drops file in System32 directory
        
        PID:1956
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        494⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        495⤵
        System Location Discovery: System Language Discovery
        
        PID:10980
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        496⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        497⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        498⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        499⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        500⤵
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        501⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2940
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        503⤵
        Modifies registry class
        
        PID:1100
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        504⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 404
        506⤵
        Program crash
        
        PID:10460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3944 -ip 3944
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aajhndkb.exe

Filesize
409KB

MD5
f75050eea77269bd0f63e08190fa3eb8

SHA1
e3dcc9bec33e758553e470451b3e11b4131ae6b2

SHA256
a23a364e3a161f63a0ccb5acfd95e629e4f84b0cbc4a0d3d59cb06ab93de0bfe

SHA512
0fa2438665a08b8f66f387bc5c7210ae8cdd53fdb9f626e76d625642af68ae7ae81b94bf92b59b7936bd4e877e8f7ede434dd6e4cf15b16e40103b8336dcdad8

Download Submit
C:\Windows\SysWOW64\Acokhc32.exe

Filesize
409KB

MD5
fedc7729e6dca8fe8081ff58b5c4ab60

SHA1
955964efa85d6e4026f2f988de925c4054836639

SHA256
44f221199b40b550ef0416c2d37971a0ec0f006b404e4aba5773afea1f88ab8c

SHA512
e3da53c4089e61acc8e816eb2303719a50272894c98ec23ec4a89eb9fdbc865f1e2b793437621c06b979d314a1ae1ddd620e163f9f1b7b479ca159f4d2a91808

Download Submit
C:\Windows\SysWOW64\Afcmfe32.exe

Filesize
409KB

MD5
359b9c638119e7c3d857249525ba2869

SHA1
ff2585fbe477af553d23479c166658c984d9cd64

SHA256
e54c77d6400ef0533033e8bb56f217fa6b88a2a69f0f88d0f3e142d0e404ee9e

SHA512
e32ee8212c4e85c074e5f3b7d40b143b6403501a1d5b6e5537c99f5afa7bf55dc883b46400a5ef62cae0be0862f343a1c35a8271cde43dc08f8eeee4d71bd73b

Download Submit
C:\Windows\SysWOW64\Afinioip.exe

Filesize
409KB

MD5
06c19bf3af7056d94b5382cbdb2ed1d5

SHA1
a2caaa61f00d9cda5f064d9875519ede3f6b6c88

SHA256
0a9be74f5bc159b8f16458c05a38903e34d94f1636cc1ac9df4521068e833831

SHA512
2145bd49f59ffce3c3c764422fb0a9a3f9ef11214f3832123f9dbe594c81b4f87057856198fc196bf653c1dfda587dfdd6921911cfd10affcc367352b72c81f0

Download Submit
C:\Windows\SysWOW64\Ajaelc32.exe

Filesize
409KB

MD5
931096d763c9ba524c7fba654c028c67

SHA1
4bed3489ede99647585908d52c54aff2a28056fe

SHA256
8126e559533d82e10aeff2a27a9f3a3f3f93411e08e9e3e5a0551ed049d55197

SHA512
b2d2360ec2b072144456759bcb39790932ab6ddc469005291bda3963353b90b7ca4f2aac36a54a1b6b6b040d3c56a32a3a982e063b0c86399ee89ea337e1db25

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
409KB

MD5
38b48f3daee8b9eccb4baa40d42c8933

SHA1
0bd3cf5e8816e61e70ecba1c064f87347f05c587

SHA256
082c3b0605c5072119cc61ac6dab257c9ad29aa4c76b4f247bab2972c51466dc

SHA512
45fc07dcfd58591000f6a1405e798d9353d252089447458f80887d0c57578c0cfd5392971fc6edfd57fecd98d2ebb929c178886d404c718dc5ccc5fc62db5b1a

Download Submit
C:\Windows\SysWOW64\Aojefobm.exe

Filesize
409KB

MD5
1cd2441ffa7dc297676dc7f881f96225

SHA1
2fdc7a7b158ee9934e4756b1c620df10805216c4

SHA256
f2d807089ad6808bf2dd8334ecb583dfb7ac71d79770d0bae8048a2ee17aa2a8

SHA512
a3df47493f25d4c67824248ba487754fb05ef8addbc38bb274e331857ae396e08e4a3bb88f0b919fa52d2dcb67df17959254503c48b7f59584be6a1631a613b0

Download Submit
C:\Windows\SysWOW64\Aoofle32.exe

Filesize
409KB

MD5
0e3ee86a7b3710bf09cdda7e8b1d3a92

SHA1
789416564fee85f8eb1ca969bfff13352ec24065

SHA256
499f7052d4a3a062e1a8227b1eea8a61a6451aa8f55cad329fd74afbbb38a25c

SHA512
ce283f832355f85ecc56bfe5060be3d5c5d794298a4987e704a46949ac993e25bb69c284a0c35f1c3356df9d033c40760d1f7a1f6099adadd46cacfb3805cac1

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
409KB

MD5
37d977f119eebc060cb0f2995fd51fff

SHA1
b8f5214bcd65efcb738c68a925bdc128ffe11724

SHA256
17357fa6e544e45254e85572e602b2c4a9e5243e7e7a89af7eb34e211e4ed1b6

SHA512
c9d6c03ba40f9f4c00322c18481b35787df7bde7fc8456e949909d09f1ec6cc598ebc415ab3d05bfa4443ee869230a579ee4d5f7e7991449169b9e173afcec6e

Download Submit
C:\Windows\SysWOW64\Bfbaonae.exe

Filesize
409KB

MD5
5e582870a4d9c3959579a112ba65d43b

SHA1
91ed49cdd1a643358ceb92dc704378f9e898df5e

SHA256
47942a3ac80685a5bf9db1a9573d779c2cf623a79136f208e131d4911c7b3c3e

SHA512
baf94c96665da81035e4441991ce1fb0e3648ddfbc0d5c3b0fa8873fa5101bc7056ef00e7ce704dc86de7317fde7b7dba8d8b1b4cfa80185182a59142c355313

Download Submit
C:\Windows\SysWOW64\Bfngdn32.exe

Filesize
409KB

MD5
82c5a1a580a80524730d5d456e70588a

SHA1
79fd1f780f26fa5a1a82afd8c5721e4afebad4c0

SHA256
8d26e681fff0b99e16bad249cece208cfcf02d2c2676af86b2806da6fc90b608

SHA512
851948f5fcdc480f5f1a022e7c9f9bade7bc11706e7f593348408cda1939be708d73d4658e8d38974a04072ddea6f62155eb9a71352dd792b4a7ee2401bd663d

Download Submit
C:\Windows\SysWOW64\Bjbfklei.exe

Filesize
409KB

MD5
d1364789fa94d2bb2ccde83b04cacae1

SHA1
d555b421d48bd9901f8f3e4fb67f60e8fe7eb9b4

SHA256
172be87831b463481fd245e6addeb609365ed1742fc6f6d8d19a0476ea226706

SHA512
814e6ecb2de072dd6bf2da0d5885d1d6e4baa20c5038182973f9eef6af3c10303a2a0bef8e63f42fafb42b78be898dd3f9ff276302471090a55a8ffd7019d5d2

Download Submit
C:\Windows\SysWOW64\Bjhkmbho.exe

Filesize
409KB

MD5
0aa16842dbff03a92cb704eab3274f16

SHA1
e2e0d028ebeac53db437ffd839363571fa5d8191

SHA256
9de283356da15bd376dc9af38ae0c8e871f960e29ae2e782e17afce83120c879

SHA512
bba7e4e45a504208375d8af866394fe85224c71cc86dd6e973cec770a2c541a6a4e71851f5e2e89787010435cdb2d12d524a00cc01529397849d0ec2c2fe246b

Download Submit
C:\Windows\SysWOW64\Bknlbhhe.exe

Filesize
409KB

MD5
85877ce83d4001393814bdf39bf859ff

SHA1
ec7dd1a8a663c8fd0f04ef02859023b667ccdae1

SHA256
289ed664fe7694a6a7a68539dc2cf9c3ce82d88fac1359a39eca5ebb4cfa35e4

SHA512
0f9d36c718d05e316cbdb90e01ac7db0986b619c67f9c8d4e4da2c480b6ac537841bb3a5e758ef361a312db17f777f0314a54649dc9963dcafac5c482022a5c3

Download Submit
C:\Windows\SysWOW64\Bogkmgba.exe

Filesize
409KB

MD5
dcc08db6bccc734b9fb0666bcbe6cb29

SHA1
37454718f7846b9846d37268e7b4a726c968c1bc

SHA256
96992967e369f7aa87867df72cd8d1e1e44338603ce3256b859c37bd4a1f57f5

SHA512
c9bf2fc2a8a1428bed48660d518cdbf570a16e5c485f5bd70c8bc6a6830de675ff8f03f5d345e1d203605641853c09128c2eaed5f6986b4c589bc6ad6cf08e1d

Download Submit
C:\Windows\SysWOW64\Bokehc32.exe

Filesize
409KB

MD5
ef6c1e5bc4b9ecb1f5e57564f1d03dbc

SHA1
37282547d835a36cb98c773b4664b7494bef156b

SHA256
fdfb1e2ef28f96aa485a1a4c3790fb7cf4db5bd5da0ce8b474319182053ee9f0

SHA512
395cd5cbf64cc2f4aec7ea4b6e3c75e1c4b2eb823cb667435dbb15a700a7d4589afa8181bdb1f51af86746f82d9164c45bf18d71dbd6409d138df1e77337cadc

Download Submit
C:\Windows\SysWOW64\Bpqjjjjl.exe

Filesize
409KB

MD5
d1ab19608ef44d2fa74b39f8e867b3fd

SHA1
b1e9208b8803c51a5c0f4bf2a13e8b37cb681bd2

SHA256
9d86675554d84ae05d76bfb6c5f7a046c1ca864a91fa5898fd8b639800154aaa

SHA512
4809bba466236f63c814a95446cc0eebe911939e4fc5a87b96c4961df668956069e4c8033d730979af3251cc8ed4f24553defbc4ce17a592716acb45749f29e2

Download Submit
C:\Windows\SysWOW64\Cammjakm.exe

Filesize
409KB

MD5
fc79af72f68bb5cdf9592d67bbce75dd

SHA1
d1e5ad44b49906cc783cf6b70fd7971f52da786e

SHA256
b2d4a05cf1568d1c85068b7a9dd480aad4617d71d4dfd216612fece8c772175e

SHA512
cfb5a94ea00aa26507b30299977a593fca2bf743f9971642348b41b74a4d82e5bf33181460dc5578b30639fcedcbba47dc8d8b66e8dd2c216809eb6a1aab6766

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
409KB

MD5
42f41692f13367afa4ed908546e1bef4

SHA1
0db4c3769ccc21f59225c450f605ce65f11608ee

SHA256
b8096f9a21d5f84fe09a1062af4d2c547c08bcf451d6abbf09c4133a063cf489

SHA512
4a0036f38801ffdff0813445c897ad4d390d3859ffa86cf0772bf1cab0a45fe8c6c6a24bcaedf99249410a1be17e8583ae45951c2acae583a148e12f36530edd

Download Submit
C:\Windows\SysWOW64\Ccmgiaig.exe

Filesize
409KB

MD5
8a209948d1ae619dc242ae70093a4ccf

SHA1
e48ad513822479c643bc9f7981eeb2362c0a7ed9

SHA256
1e562607cf0b73c44cc4e19c8958846289363e64747432654c15ff3bfeb6cc7c

SHA512
4152a7bfef154953805cba3a164c158064d5599024a36588b37195f756fda1d294036e2121d9f016b2741a6dfab713b8b867a70ff4a3ca4e8a4462ab562f3419

Download Submit
C:\Windows\SysWOW64\Cfigpm32.exe

Filesize
409KB

MD5
6077f9a69d012067fa156f0e63a0d712

SHA1
2d0875d28f7d679c0afe9f2312323b2864c4fbaa

SHA256
a37b073d9f6c6a6bde6ba2d33e6b285cfcdfcf5bada8b3ea000763bb8386f5af

SHA512
583c7a0154415cadaaabf939b709ecd301f258496361589d304409e8e5427b7773b0b0899bbd46486e0140525fecf8d3183d3d0e908ec0ea64c4a29ba49bbb21

Download Submit
C:\Windows\SysWOW64\Cgmhcaac.exe

Filesize
409KB

MD5
ca38176ac0929ccae8651197b0a4fb3b

SHA1
43ef227c8c482c68a957b5ad11c12261a1cb0ba1

SHA256
d5dd1c53d231d4bfde8f1704853bdae82414abda278400cce3f76c3361a74246

SHA512
b5bfba18694e1a82b27455c1c0488708eb3f4f3f26e88c7a585b31470d434b159aacd7f7b40fb07d9ee0f5ba21a9ec5b2712fb956ba80e65338e3f898f90c967

Download Submit
C:\Windows\SysWOW64\Cjliajmo.exe

Filesize
409KB

MD5
8f6aa445171ebb3c4995f1fa2c8b3471

SHA1
578f968f480e7e2a88a23f5ce4474cab8066d60b

SHA256
f6f0013a3b3b42129d45861b716aa6f034c1bb183aec5512d1391741cecdfe0b

SHA512
38c316fa5aa3d7853be759175fc06784a00bb6867b27368896325e4208a2cfb899d6cea1cbd660b17a3ddf5fc38d72058e1588b8d5cd3d954e61f8ac92237ee5

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
409KB

MD5
828dbea227d898b4ee1a285b768c445b

SHA1
a6e9f235483ccc4384f22a67cac87708194a2069

SHA256
4064c2a1be81e26a0d22a15291b7b8a3d118a45eef9fdc6b05bc6bea0d555a47

SHA512
a4c7c019b1f6bfc50f25e05811ae80634b48788048b9dfea8093d39b026f75f41c8976f26282b4b4df64f372207132179f72cc66e405eaec2083b31ff400565b

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
409KB

MD5
165985eef861e82a1d0d0af51a415e60

SHA1
aa4c937fe132c494e8669fc02e33b21351bfb7e5

SHA256
e0f5d31364d927c3e1e57a50b8c3b20efc9b65f8fe2a22f1781b0d9fae917225

SHA512
41801a95edd27342a9dbdd3fc391385e226545f611fc850aa877bbca51925459322d4cc9976d8573b45894f4a19a91740d6dd5e083307bd98475f3ce9bcb99f5

Download Submit
C:\Windows\SysWOW64\Cmmbbejp.exe

Filesize
409KB

MD5
dcee23606935319182422ec6b04317d0

SHA1
ea6d814edcb548b6f422017167fd17735b8bec87

SHA256
7cc4f8a4e46093b01c1c9c9c7db90438cee3767f41dcd30b7c7e59791d443e6e

SHA512
33417129601a4825cc631396d9ac1645d65c48fecfdca8988fd85cbc1c0a7e79ef657d24ad41d89a9914af21d13371f8c156260c2751fca733c0b56fd14640f8

Download Submit
C:\Windows\SysWOW64\Cmnnimak.exe

Filesize
409KB

MD5
6546fc766c95fe91e53923a68be58888

SHA1
ab27edbfb84c50cc50d56e06f4975dd3bc5b9553

SHA256
104d5c3db65bfbc67dc547cd40b20ab184462df2e851c530b70d9a84a37804e9

SHA512
76eff80f7538bbb3026845718c6b688ce80e2b48971a5f91c7f136316563240e51a18d5d5f872ca9c63ce238e0321b2194b6e14d5fce5de0556f99a921ecbdf0

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
409KB

MD5
f922c417537887eed063bbbf2d76fe8d

SHA1
54ad7855ccf1712456a87f5cab71499fc5b40449

SHA256
8129d75d5a7e7834619b45ddf4ecdc9b38ef7122f1edeeac370398832ab67a8a

SHA512
d492c7b76c3df95b141c406792ad1ac9d1e41d6a3ac68748c348209a13c7b7a153d68d7835b01130d230ff636ed95a28aa5a383edbf0080a0f4965dc7ae79900

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
409KB

MD5
9e1073ab87a0fa0659f38a0b677baa5f

SHA1
56740bae756a5d9d2532d2e58022e8e369971ba4

SHA256
5d823bf8276fdf2860240c9472f89d8abeb0c61a76ef3b9e6436e321106350cf

SHA512
6acd5a6a9758bd54f6d01d9c53fa95b94c02268c8a51d114a7abb13f0cd87ee3218e184bcdefb47c1caff4fa258898a52059d83312f387ce267c623e2d932b80

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
409KB

MD5
0bafadd49428b376cb4c8dbf180a250f

SHA1
1d9d4fc23b1058778b882884f8be1b2b47b2ac6a

SHA256
3fd031f006579969d2070b908ea67485f779231b9082db0266617a4fa15e8304

SHA512
bc4f68b7ef222ccbbdffd53aa4d80170403fc764e830960b2c6e66a3d22f468c30b9c6ce96ea0fe0df6cd585c5037173f09771d0d41c452faa5f3d46ae91c50f

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
409KB

MD5
62d4371385ba3d68b280ce7d75fad0ff

SHA1
8a4d8492756ac34b72e88951f25fdb1318518760

SHA256
b24b03a2f961c5bc39832f1312bd94e1d8be30c76e74a65a1cedc02496959312

SHA512
fb6925c94b6f55e5a7a3c9056bcd8583408034ad06df9b33213dc934aba340dfb018e6668e8a192197b9517f061430f890e922fcefabc3cb285a03b0832d0b9b

Download Submit
C:\Windows\SysWOW64\Dblgpl32.exe

Filesize
409KB

MD5
2565542b835306017801f993c8139ea4

SHA1
47cd01f6656b8313767b1313c720cb30df4b4d4c

SHA256
4a2ef774a0db0d725aa4c404801cafee284f2945d1c96768c8a612126847f8c4

SHA512
b859f492bbf920aa1375a0a7433de76aacd6e666c3e2c5e4646f84e30760dce36a2717fdee8efff56b787081e72073182381698f10d1e8d001567344db5c5b99

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
409KB

MD5
913e02febea2798aa3d92b4661361b95

SHA1
891a244eb2fb6fabf85dd57a6b93c1755bb4f899

SHA256
7b9af26d3450b17752d9b085f423260f3e86b3430f362ecd3c9df59cabd63ddc

SHA512
4615bca210c7f27e2cf7ad270a46fbd1577eb5e77f12c8c71ae5894f7ca62682d4925d3a26169e13332ef6cafcfc0e7778eface759df866fa7f6fb9f780d5aa5

Download Submit
C:\Windows\SysWOW64\Dcnqpo32.exe

Filesize
409KB

MD5
d7208d497a7e2320801ea1f7b1505377

SHA1
b1295fd1cff1ba414ec2efb4d5f42d9301444cca

SHA256
1b9fcb513e12838abc418c1916e3b725e87a75891c4009911aac2a1112d8d158

SHA512
df8c0bce6acd95d38b3162b335ef727bcb1748fd00da9934d446d444a0f8672d275554488fb1f6808b74bf02ec45a18f6b478aa94c4aa6df39d8741696774a6c

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
409KB

MD5
fc2bb2f9423008e30548e292c7c06b26

SHA1
a256e25fc4243afbc46d66fbba0189e5d13d4821

SHA256
22175bbd779c43632271f608faa45d8aab5574e4dbd55429959c89365055a514

SHA512
c5314b3e319ba8d82e2887ceebc17ff31f5e551df9a160efc63e221040f553c199e38858c21cea215ae80e0f4a58f8c004c0d669582fbb3f3b6ba7eed8fcb207

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
409KB

MD5
d6e32bc760e59844f178984d12dde77f

SHA1
cdbff5eeaf7a45f07d682d2f2691d714b95cb068

SHA256
ad58aef8d2feaf210143bc728510a9cc4da981e6abbeeecfee3e8f6440026ccf

SHA512
b29cf372afb1e1d2151f4c6fc7d962451da0f25f46668ecb2cbcfefe394084b19df4c5972a893ce1274cd2338d85cbf75619bb90b79e96ba699b86b27daccdd6

Download Submit
C:\Windows\SysWOW64\Ddfbgelh.exe

Filesize
409KB

MD5
2b6d94b4d2351ec295d8bb8d0c4f7511

SHA1
3d8b0a34376b434a1312608ff849dbfddbe4854d

SHA256
3a5baddc8c1e8a2831a3b9cbaf64dc31e21f67bab68340c584900853fc2f235d

SHA512
b1425fa0bb8ec4bf5c51afcdcb79c2ab1c02741fba1726627eb3813c437d482bf8993bfe0b18c1e2358a6ceec19766c6731bde7e7816970292e3797d06aca583

Download Submit
C:\Windows\SysWOW64\Difpmfna.exe

Filesize
409KB

MD5
497442d85415ef0ab59e07cf42b93d6b

SHA1
8aa1cae7738d4daa36ed444579e51ec89d72b049

SHA256
28bdf524ba1a210de6a13973de07543ba9b8b90da002531309800fe3b664a675

SHA512
4528806a2ec35dcbca0fbf24f845bd7f66f09c09b04d111fd3436e42260ac41e508c1b090364fa17df6ea1b3b38907006827c9d237415934b0ff81e4e210bb99

Download Submit
C:\Windows\SysWOW64\Dikihe32.exe

Filesize
409KB

MD5
20db875296d936067c60a727265d9a01

SHA1
fb323cf33b626ccf75c4bd257895d099a6770136

SHA256
6940ef2aae7e5a1a8cc207d164c80912c6f311e21b21ebc2baa13eeff46f5c60

SHA512
f01e9082580472c7049a684c7d3285bdc05ef02f8430344b9957c8fb1a19ddc0fd50a8f66056a9f1385ed93af163450dac656f1343d1f57fb2bc905cdfb0fd7b

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
409KB

MD5
af0a9034b6c74d3d0054ea76bb08fb14

SHA1
a904adc2d4671133717efa014b0bb7a6c69c7afa

SHA256
cf1b530c137e5f2987688516412706ef4905ebd2468278ff31bf8b43d98058a2

SHA512
8f07cb44eec24b094200c25b32a92392ed93aa6f7c67ea481a6e8fd8052f0f51956ccbfe498e7b9a4ceea77b3139f19d4fcf25ca29664e58f09c6f743cfacdd7

Download Submit
C:\Windows\SysWOW64\Djelgied.exe

Filesize
409KB

MD5
e91dbcb0e1d2718a3028e5a4c701f888

SHA1
c52db07c22d5ab53d69429f922f620e693630c59

SHA256
22f2abe6b936038b2e05f0a4f77447742866b2da3137e0bfc92524196509ef50

SHA512
7c8907b79acb7c621862d3ad666671c59dd4c6b1c8ccf3b3829162a8cb6393bb11d96383cda98ca4253e47a2b55b099e0311665bcbc808b0afabea8128cb1acd

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
409KB

MD5
f144c7c434b0b505b54bdef052103f43

SHA1
7b77a4ac1aee6b0a02ab34e9981592efbd9e2102

SHA256
008be7dc27705a8ca3344fa64344a030cf9a66455715c641998535449ca421bc

SHA512
9f9edd7faf7e16a66a70fccebb46fb33df3f0d51c5479d4aa9054bdb3c9abe5fa06484e514f23167138be728be1afdbb158e62966d2424f3fff89eba9638597b

Download Submit
C:\Windows\SysWOW64\Dkbgjo32.exe

Filesize
409KB

MD5
9de4f2288360595bc771bb1e8f1b9a91

SHA1
a4730e730c005ce5b44b13b4853b0bdf7d5e224f

SHA256
191e197b3580e85978324e4057ca35ced4227aa33aad8bdf131b07e621da576f

SHA512
6f8a318b1300f1a2f27a159b0b20fd9223dc91ae748e3ad2731c30faff2eebea55bf275fd863492f498b9b14c6716c24f82c3157340cce05e4d842ec61ba9f83

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
409KB

MD5
2b39260ee616408a5e65e89fb020769a

SHA1
940bdc34a8e4a2e19b3ae26048f1a1d6a5fd1965

SHA256
30d8ee2cb9d7261e5c04ccb25100d19577de4ab468719a4c5a94d26a6b016543

SHA512
2b945a634f89153d59550807b9e24f67ae8dc2e350ed8e70275becb8a94ddf9eb9c1742adc8bbb1017c00bc7734e4e121b8a752b8bb1904cbeb49df5068c1d31

Download Submit
C:\Windows\SysWOW64\Dlghoa32.exe

Filesize
409KB

MD5
e667a91aea45fce18bd2b0c755f115fa

SHA1
7566ec3e150b81ba9e394e34148813e7863709bd

SHA256
789972e82de5f911bc1a1cdc6066399dbb57a31aa4ea5877fddf2451ddcd29f1

SHA512
54f82cb26adc593ebe82b573798f2021f28c878f2bf3c05f6e5ae9f08de19914b77e7bee4748ccacb8b130bef17ab9ca9a700c95dd49ee2b5aeb2738922fed26

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
409KB

MD5
813cd2997f213f2a0d87076636c3f152

SHA1
24680435cc9c6fa4b6a4f809d02053b0dc3721ec

SHA256
93ab72364885904e55d51d5ddb4112acb638d34406fb103f3336d3b8740ee92b

SHA512
6b7b8ae9023632af96d9d566ffb5b790de0f2efa4e05a35456316b33415f9f8f4d405a8cf10960380fab308d2e244c8a8d037d757b37a43b41b603bb2cff6c08

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
409KB

MD5
b30d2e92cb7ec5319a74d41483be4c69

SHA1
bc134b5bd4483637269d6c12bf81873d847023b3

SHA256
4da44f4a1c7dd06971f670d0bbf1a46495a8835abe2d3f25eb07f709c645c73d

SHA512
e2241cbc40954789ae8cbfaf5bdf193bfd36be4550b279011a78fd11c9c8200160de414f1afad1e0e2d747936dfece4d8e9d78319144d24739778bbe5a95ea05

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
409KB

MD5
a01c51f9cd3394633e24367ddeeb2722

SHA1
7984250efbe46709979e76fd97386ac362278108

SHA256
5d02663ccb730614464f40f6e239ece860f06dbc4ff8dc424f4ca6b8dd6c650b

SHA512
85dbcfb37cb41109f9d7d840b4e41d0c50e6b76258e382d2eb1adb8a5cea8ce1225028f628ec3ff2a506287112bcb21fe72f4dd3e2af5872009c738809fbf23c

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
409KB

MD5
94cdda9ed9e6aaac70e84e6292198b47

SHA1
15996a8611582f1ffb90f2b9de459809a90ba37f

SHA256
74992e8bf4e070d8a7f8a0a4368b5af8c1eda9a258110bcde8aca07bbc1e6b52

SHA512
aa9ecf6c2b7247a140d89825b41c512542db6e3a9aaf5a73bad30ac16aade0cbd2b9298927b40c49c0023cd6de66f53bf51cc40dfdaaaaed812bfa29a0a83b97

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
409KB

MD5
ce358a9f234583052b4f77ff6a62fcdc

SHA1
894e9627b88ff06494b61b9a9a5060f45a8f3902

SHA256
133656723029d1feb38edd6b43308de3df8269e9badf19b60c5c105ba5e236d8

SHA512
b4cf6e5c157ae0ba8a43f369d087719bb5ef485beda9a20d5c0103278b9ec1591ad4f5f46fcd7358d27e7a74cfde52163696fa5c71cc9581e4240ece9925c0ad

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
409KB

MD5
b15a074a4b44f7a1983f245c7c9a1c91

SHA1
7ba312cc1f254e3739198f2a76cb62b155e547ab

SHA256
758882f504a913355d241c02e5f9d1e0cf4402e7faed1029650a136a78e7e2a8

SHA512
8b0a02fa7be4c2ab775a0413b09a5791887bfb4c6041d5a9ee59688d726aeb9a9b5e280d874ac07143c21dec2f35cef9d9e24a76047d5326298f10c8b6e9eaa9

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
409KB

MD5
86242d8fef09b51f3b7c9c0a9110bbce

SHA1
4c0fa49cd32af6527093d08d52ecb78f44446097

SHA256
3ddc4baa336772cabad91dc2ea725ea6e2027787f757b804e747df564fbf767b

SHA512
211316cb8f8664d764c3f1e397f1a3f458902c25c5508d7855b872b50826682c2cf1b61cb26c46870f74384dcf7c95cbe0ff39f265665a6ad383d747d61d5e8c

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
409KB

MD5
2a56834055f4e7eca3a8fde47e04689a

SHA1
70c3eadcd25ae3efa0c289cafa7ea25e7e080d59

SHA256
46317c577c4221a0936f0ed6a0ce26dfffdff254eef8ce475d685a66f9cda54c

SHA512
70a60321ff55622c50cf59c3c25cc8b77c25d698c4ca012a7a0719c6121e1c39d10638097f64e490eab8023965c36cf653891a3c73a3578095c2da28496a2238

Download Submit
C:\Windows\SysWOW64\Ehpadhll.exe

Filesize
409KB

MD5
942b472442e9ebf51fbf9c6fb03658c2

SHA1
a5821a3950f489819f1d094c1f2a6f3acec6e679

SHA256
20544a741f7473c24bb4ec216f275acdc81284740de9c4e94349c4ac7ac572e9

SHA512
de02a06488db43a9e1b1c5e29daecb474ef169b479d41ccc3fad693ebaa4aa72ea9a2dda347e0777cf6c1d3a6ce460665aea849b00f94917e97c4b4131e58880

Download Submit
C:\Windows\SysWOW64\Ekaapi32.exe

Filesize
409KB

MD5
4b9f097f751f405d3b227e9da939a772

SHA1
c37e815fc0b5fa64bb2cc3b42ffb12528bbccce9

SHA256
637d52197f6e986c9342434bec3951b9a1d3dcdda5b373072a7d38bb5b6e9eeb

SHA512
79966255c7203aff37dd7f6f32e46eec38f8dd32611f277f38e2003f34b00870345b917aeeb08c5948b14dd4baa8026a1891c71b95f8a2c9693836c1c26b14b9

Download Submit
C:\Windows\SysWOW64\Fdkdibjp.exe

Filesize
409KB

MD5
79928d466b74d1a4227411c5e112575f

SHA1
207ba9092f19aabf6ae94c46c5782b1c09038911

SHA256
b5ec72d4aaa180c50c7d950e1e35c474b367cf09c840a01fb9f5dcce4e2fd76e

SHA512
98508f7c953972db988071cd1a7d00687cb8b027bd44ee1b091b27528dba65d81c07328a4968e828a76beafbc976dda5d04fadfd6b16dc14f5f9d26737e05f1e

Download Submit
C:\Windows\SysWOW64\Fnkfmm32.exe

Filesize
409KB

MD5
2091ee6aad56b4c57b7e626c92baefbf

SHA1
adc7c9c61772d205f20847a19963bc170047b097

SHA256
07125b10babe3ea393ce17331917c0899b82cf56f96a4b46fd382eb74ad1ea84

SHA512
91619fb41a213ad1fb5cfa71a1e9bd1b059a242d829d34952ce4c89dc12ca2415304f25ccd075b97892110ab2a029f3f3f1a4d82afbfeb4d012594f35fd198c9

Download Submit
C:\Windows\SysWOW64\Fnlmhc32.exe

Filesize
409KB

MD5
6b9ce315a9f697cfb5ae112543745132

SHA1
e330ef6847b7788454aeb260059aca5d5ba1bbe1

SHA256
b01d69aedf82fd3de989811693207be5fe59922305e3b0d46fc323298a362a63

SHA512
c857af29e929991212f96e31dc5ab89400e4d6a612d1b475aa9e7980938e3b6d0b6794d0f2fac915f1e8bff2cabc399c769a340a9e8803e8c9ce56d137935167

Download Submit
C:\Windows\SysWOW64\Gddgpqbe.exe

Filesize
409KB

MD5
bb5b59beca82bc215722467ac2865a3c

SHA1
74ee5512b0c74e4e6be78c80867e2526e8f72235

SHA256
cba3eaa4d94075a078f740c9783f7dbf231a6e9c5a4ba93611d9b197139eb448

SHA512
19a9a207984b1cb0ab8d8b8b0fe4411523237692b4639b43a309d595383bd41185cebbd82989da73051cd1f80306f447334e9990ea9b0d2f329a6272c0a2ebf9

Download Submit
C:\Windows\SysWOW64\Gghdaa32.exe

Filesize
409KB

MD5
511ec4b17905d8881ce0c659b625cd9c

SHA1
b262cdd587d814d80f064eff442c87d278f50902

SHA256
ae3d8bcc9539b01e5b4f8deda2da486a51d96d9abe6b02b68f99113d8ec3c8be

SHA512
5a3179a5d1f7ff8c0f6d8d0c6f645dbe4435acda9a5052448aac4648d244097e287d288c000c76b0e57d2aea5a90b883559aaea7e686f7ead76920605d4bc05a

Download Submit
C:\Windows\SysWOW64\Gmojkj32.exe

Filesize
409KB

MD5
a94d0af399f187d171a7ce1f7cfa0cef

SHA1
63e8a3641ec5f89261e92d01629e061dd8fb5ed0

SHA256
74a0eca3a20fd2846e75a2e1fdb76e18b94f7c5e2a36d7ad34eb9fbafdfb9f80

SHA512
fd17690c40e330c8af6c420db1089e376a8816af46d1f7956f665ce7ebe4d98ed9716fd3b4d488f0ddbc0e5192947ce82c4ba34b23489dd3f491cfbbad0ae2ac

Download Submit
C:\Windows\SysWOW64\Gpdennml.exe

Filesize
409KB

MD5
d9333f17851e5d5ea388f9ad2156d0eb

SHA1
86830dd6b35dd8e862eed17bb032ac8a350f87c1

SHA256
6db35bb82794d0e9c5e01a68a42105b537feecdac08f29833c067dc9e2213557

SHA512
e6d4306bc665a16fa00e40bf1390bc2dc951cddc398ae9dfd399933e70682d87548887f06e6ec7501e86e19a55344272f9f0bbddf80638802dc005b9704d68d0

Download Submit
C:\Windows\SysWOW64\Hahokfag.exe

Filesize
409KB

MD5
a26be0cfcfa1c2454bf39df219ccc750

SHA1
e216a298220c87a9f0dd46b41ec7d86d2dbe93bd

SHA256
1df8c8dba7a938739b9fe22d37a251d91e120d6aaa4c88139eb1752468b3a590

SHA512
ae822cdac2ace08951b99fd6c0a6b609976e2e7762086c4b61c535f79eec11fd7725db2c25e2d0e9cbd821dcc4f102ee3fad57de3264a7cd471a7a8d02c018fb

Download Submit
C:\Windows\SysWOW64\Hldiinke.exe

Filesize
409KB

MD5
d382a6b384ff9d7d9d1dff44b13b1539

SHA1
307ce22db33570f1124a3389f33ce5e8d5b6eef8

SHA256
09901ca85d98b3c38e02da2a7005941ff1e8d0975c2d6a6dcbafe6072f0e5792

SHA512
2e09a66c37361d0399a27de1e2812dec3268edc65b96afc2ac39e072a00e5b11b47dd413a1306fd93f2b2033d766557488de11a40a40b08e107eaf50ccb0d722

Download Submit
C:\Windows\SysWOW64\Hpiecd32.exe

Filesize
409KB

MD5
582626452f33e480b869f7d70ff6bf52

SHA1
8349b99e91eaec1a03a63a5d4da3e3a134527b7f

SHA256
a9eb5dc27436488323d496337100a89138f1ddc55945c7ed6a5e4db86d985889

SHA512
7f460cea1a7a9e30fdb2c1bea7817ee28ac49bd5938acd51b4d3e253246528e7396439128332fc1130bc35ac06ebdcf8fbe968c95b93a5dbaec56938d5a94d4b

Download Submit
C:\Windows\SysWOW64\Iondqhpl.exe

Filesize
409KB

MD5
39986fddb820c4fcf42ef54c5ee0c2d7

SHA1
e4afdcc4f936f55973ed03207aa6f5fd6ab4af24

SHA256
92c0a4b5ba38ff7e209b1cf8ed96f72940c4ae04dae726943e6cd9696a394baa

SHA512
9dd829f40da3d10d84e5aacd610e8995a172f6005c701692d5065c1905a02a676b69e448ef4f7a0f865fe6cf962635d182472d5023f69085dca40c5e8d65d039

Download Submit
C:\Windows\SysWOW64\Jllokajf.exe

Filesize
409KB

MD5
68b0b094e10c715c716fbb7c3acf02df

SHA1
40ff4ba9d74337537976dcd3bf3f9238cfca5482

SHA256
e5427a19a72662ffb1fbc5f6a51a380b628cd8a7f56754b4338f524744a16a53

SHA512
9b955ac30109265fbf3f5fc0603a40e35ff18934e0f5424741ff4d4e6a8d2bbdea7277c5ba55832687bc9f193f3f3e5e3c97bdddf870d0fe13c68d4aab98a66d

Download Submit
C:\Windows\SysWOW64\Jpegkj32.exe

Filesize
409KB

MD5
f324ba2f6e63f940062e237bec9145ac

SHA1
2808df0dfb166a3c12149173e69945e5f9983f30

SHA256
43b9a00b673f4edffe5a1c6e8e8b7ed82963808e5f2b81443265f002cfc818a6

SHA512
7d9652b1b58a537fdf8ae4e9d3d771f28491822d5e8c8319a5c32a44291ec86e4552760d711f87f8fa98312524e0205f4750e8e367b96777cbd8dd6e9502fa0c

Download Submit
C:\Windows\SysWOW64\Kcmfnd32.exe

Filesize
409KB

MD5
2d117b5a2ca4136d5a57140519d74d10

SHA1
7dfa07bc73b3544a973051be9ce24f1f21127b3d

SHA256
978e770b9738c5aa7462783e64ed845ffa256be26abadcd6613f17f0fed9eb39

SHA512
d5197d13f5ab1a08a0777edf6c12b7b4ed71d858566058f073a2f446cf99f3d80536b20b4c5a08c9b92af1431843600221a6b4e8f1c33a62465a24791733ba10

Download Submit
C:\Windows\SysWOW64\Kgkfnh32.exe

Filesize
409KB

MD5
f7aea1d97e7ea81cd0f8a07eceed4ee5

SHA1
a784a8fa0f4fdc397d4729ee9e8d6a004dabbf21

SHA256
65ed2e655c6f461cdabbce9c1792e2ab08febaf727927e492e1ca84d58299616

SHA512
d57e9088f4dc62a9bc99fb813e73f2a2933952b35998177c249a1aec64f002cb4f5fe4c7af33e5815f833f1cfcfbb66322667dc8ccbd4fa596c64e671429a8bf

Download Submit
C:\Windows\SysWOW64\Lafmjp32.exe

Filesize
409KB

MD5
5aa3cb3c8dfe130131300387127d8e39

SHA1
cb48a1aae22ba7c3e2eee36790e54858082dd1f1

SHA256
0c5d5aae97bc8e47d2f8d827defafd8c29c42ff4500c1d86782547363c826e66

SHA512
e409aabe44737c5807854b5309ba7c9a78eba08997b7ac603c6f7be2ef4538aedeedd7c3a165dc52cbdf27ac10888b143daab0558169f7ba572d34aa3f5ca940

Download Submit
C:\Windows\SysWOW64\Lfeljd32.exe

Filesize
409KB

MD5
70362cfdad4156e2039e0a1914194373

SHA1
64e574f4e40ea903948b42022ed6a6d3078df764

SHA256
7b33b8c8bb28d653261dfd64c29a23704253c1949ee008823a1052a34d2bd824

SHA512
9ce204b109f3b1c31d9979f999fa721bbec94eb2b3ee05b8990b9913ac655f302d129ff286fc1799ff7733071bafcf0a4265d6c296afe9aca4d22293f053c8b0

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
409KB

MD5
a891e93a376584e9763a18a38dab7876

SHA1
3b9e09d9ae639a00d76dcedfd26db19a634f156f

SHA256
df4298ae4faf49f66fce82ec5efcf16933556bfa62b902c85a18e326ff33a006

SHA512
b796fa1e0d984beb054bcf42d550cd168bdecd4886e78ffa47860d42d5f79d185a55fa8f17f2f3e4071608de833bc450a0d95cf5b72f943579c690d59bb64af8

Download Submit
C:\Windows\SysWOW64\Lpjjmg32.exe

Filesize
409KB

MD5
0838390c6fc12b9e52cd9922b2a19c38

SHA1
c245bffda99b55dac69df180a8666b98d5185ece

SHA256
aa1c17cc1975ded79120b5a10b9df21cdb128d3aa464c558ee41b3dba189f4f5

SHA512
4b02e4da2b40bc280627ff0c1f262e5622a29d1798e3499bbdbb1cc7604c47b605b363fb6d8574c54e089e181e75cf755f545b3efe5beb02ee224e2da3b9df01

Download Submit
C:\Windows\SysWOW64\Maggnali.exe

Filesize
409KB

MD5
fbf903e7ed284a80005d431d153fdf3a

SHA1
add2fca973efb13909531890c5dca10a9f24b3d0

SHA256
fc1237d9a96013ca36ef1d353a62ce1396da42ee4d2554892d05aeb78d9fd11a

SHA512
3a2e78adf180102a0a729eda1bca845738721b724ea0e69269d1446c2b3678b62b83b93e05570dd9dd9f123a5c4adf9a51f097c306ac32074842592d5fae47ac

Download Submit
C:\Windows\SysWOW64\Mcaipa32.exe

Filesize
409KB

MD5
7801aac85e81990c39d15ef5b4f57d8a

SHA1
1448e2d8af8aa97cab18dcc96b9d49770074d471

SHA256
32f023b4661518c1d323ca44e215451f57c45005c57efa2ab46f8bd6c0faeff0

SHA512
79d182dc8e3d9075579e644396f564cee0160937bb2a2f623ea6c5d82ea4a89967c761382dbe898c3544e68f15a353dfb462fe2b09243842721f201256321e59

Download Submit
C:\Windows\SysWOW64\Mjcngpjh.exe

Filesize
409KB

MD5
a5a32632c163bf96107f4f9379d38562

SHA1
8fdea34538ece229a2f8a3f022a3d0ce9036ff79

SHA256
73ff8eb3758380866fd953edebdcbd724e538259e8096add879ef401f0f2c7f1

SHA512
716d6ee3431bf97f66719ccee3c332153c6311237a3eedceace6845a00b13ceacfd3d121110850331620d03945bee458525056504582072f32eae19a91d393f9

Download Submit
C:\Windows\SysWOW64\Modgdicm.exe

Filesize
409KB

MD5
c16e3d473c0f81c851325d3b5f675563

SHA1
012a94ff5f71c720a7784ccd68f0df26955bd05f

SHA256
6d1c25a0266b45b2684b3fb45d101deb4f7f83354f01ed008ba941daf3ec7e06

SHA512
c0ee446f64a5d03537a246580e994c722e36d22ac8d184980bebbfece181f9fbcfe3d926213b25ec26667a3fa80b329989d5bf5b22f28afb258e5021a09ea9f0

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
409KB

MD5
8ffb6340f01fd6917084de0ce2112013

SHA1
b40809970f5987c567f093f70837fec9aec9274c

SHA256
0f97d1d132b60bee4911a04ce7ebcf731a53777378e707a2d823f128c5ee696f

SHA512
72238b5d9a1c76ca02a176ab4d7fd03e75884d19851f837daccdd1dc61de223f1e312131c8706ce9df6066cbb40b0fde8b9bc60f0ba8976e53f5ec3ab5966c02

Download Submit
C:\Windows\SysWOW64\Mqjbddpl.exe

Filesize
409KB

MD5
50f174dc070d4e62c6c694bf4cd58e0c

SHA1
af6a771f4b2c33f8e6917f8b1d803f77b1ff866d

SHA256
da504abfa9bb850e7175046e1000ad9f2d64c415c036f31f517a4237890eea5f

SHA512
89b0a320053b0f247567a059edf4fe0d02177f21b70642374106b885e0c9373660dedf470dd7a02f42463108e791e36e10dcfd4673aab1866377c87fae10c816

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
409KB

MD5
f02cd13986400628ebe44228f7aac241

SHA1
4b81cd5ec57e97259315dc1ac385c1b5d08e6336

SHA256
b7616b7638a8c09b846529333a6d79ccda4eda6b926ebd4a08d2f31bfd01af68

SHA512
777fc8329e0dfa7eeb44b83ca71bca6c4df0ba021b0e7fd60342908c01eac301a193e5f5cba8fa013a59a52ae10233e4f6aadce4871266c8566949c62d5e6dbe

Download Submit
C:\Windows\SysWOW64\Nfldgk32.exe

Filesize
409KB

MD5
b1185aeacabd25f1771d23420f1eb5a8

SHA1
b134caee11dae50f91ab8c8e1aa37af89f4850d5

SHA256
4a2ff59b9ae11ae2a64fd9156deb0f7d7ea952a4ec5428f851eb03a34ea816b7

SHA512
23e89a58dd6125375ec31c4d4d7be4b20b9236aa0a43e30bb350e98740a620d214cb08efd6a8e40fa58f2a1a776e21e3cf14c73b93045f9f868db9d621745c33

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
409KB

MD5
7566b20327ccd6ac6c4933808835237f

SHA1
8f7394667692fe94237e8e041ed3204e06d51d7d

SHA256
ba91485d292f126eb67ebda2c3c9f3b99fd3aa5b303faf4911b093cda1cc0a4f

SHA512
d167a10d3ff8545626b8f0659ab4f188fdd19ef6c50115c73ab12099a95e3008101ae786a80c2f292dae4beda67f0088f0e00c135ac4e8a5f0fd485483049f45

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
409KB

MD5
6427a14110d43ad7f2cbd9788cb8ccf5

SHA1
7e91c4ae3298e0f03bcb515810f8f9a003ec0e25

SHA256
fb019dc551adea6fd2a71e61463d47f6279a9a6b960c842ac1510ffec27a3903

SHA512
7c5e4589d3003f0ae00b44d8cb286878dec89874b542cb45c890d2ff915f58aa02ddf5f5d81e93f4a86f2f617a80493227074a0a9a88f42310aecddeff13f2be

Download Submit
C:\Windows\SysWOW64\Ocdnln32.exe

Filesize
409KB

MD5
00d7b6ad4a6132fe5391208a4a96a334

SHA1
efe6db30f4396b7465d8ded5a0e0ef6e4b70c5fd

SHA256
33ac25c3e7750abb0cac541e5b0f63e10e7b672eb457f58e1c05038326f01083

SHA512
7254151580b657e19657ec24b2909cc7b949129ed3e93570399fc4f4a381ea41ee24c1f53ae45e1a98fc5f2e7364b25c217f485617f54b9c47dac8620264aa30

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
409KB

MD5
f8c0f9a61d58b3a978fd587db9d4de95

SHA1
f3f7322b7ea0484f623177aa5fef0fbc4ff3dac4

SHA256
9921321bd379f831a9a127519b02b8f469214c9a6c9d96bf9c07c3d9e87b99fc

SHA512
60ec6e0701969c3921f11b86c8f80d5b126b80724edd76935f9e2f6d422a7e353292954eeacc5b6dc5c5e4b8e2204a36ed24692e837edcfd96e9b5a16673faa4

Download Submit
C:\Windows\SysWOW64\Ofkgcobj.exe

Filesize
409KB

MD5
f7ca541551dbdc5ff5003469763849bf

SHA1
e6cd5df8fc0b3fec1cbe8ab7b98ffc135e6dec12

SHA256
6875435b3659030cddebd9ad8f18619c315f091c71537cbe537a6c7b6b187f69

SHA512
62a3dd8b14c5544eeb5ff3a37bdaefc7b1dbb30c642d601254f96a0581db70dcc9c181485a967f639e2033b71c96a16f8c47b25ce4b07864d45e83cefde13b5a

Download Submit
C:\Windows\SysWOW64\Oflmnh32.exe

Filesize
409KB

MD5
419edd52cea8246d8ea5088add041d08

SHA1
8778e135ac04dd2dc70ea2dd082d1a179955061b

SHA256
65c70935fe03e1c90b9cb8ffd05ffde9c0b1dbd7d96f39780bf5a45e6ef38892

SHA512
db9181adde3e107656a2c7c822cd3a4f2c0983923e7f14678f176eca599d8498efff1a21efadb0124a154f80b0da0406778c8eb546cda3f1a64f2fb828a6d000

Download Submit
C:\Windows\SysWOW64\Oifppdpd.exe

Filesize
409KB

MD5
0f8fb7df54d5bc8a29c419a94a98a5ab

SHA1
e06c1de52ca3ee1044759b6cb58f0385ea1fb099

SHA256
ad77ffe86d3302339e3b2c1da4d0fb4cc2b7ef438c139fcab922a0d4d011e7fa

SHA512
f7b2e2c614aaa35607546f1aa57ce80ef879a79626513071f983e94497047ca96b10c118cf680947b984b1c2270a7e85619a29ee0e81838462234b9312f25665

Download Submit
C:\Windows\SysWOW64\Omdieb32.exe

Filesize
409KB

MD5
dd0ea081542b239884ade394828fa07d

SHA1
83effa8c9c662c618e16da2aaed84f61a15c259f

SHA256
62b0026ac8f8e88869c9e378003d6aa1ebe84fdc02a290e83c462912b5c26794

SHA512
b6d6eb81dd7dadc12e92a6597d27d399d0446ac6e2c8108a12d848eef9120fc4a15073600c461fdc7ced5d1e38d79fd6b082014c1b66f258cdddc561945df99d

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
409KB

MD5
ffc844284bac30bc46c6e714346ec392

SHA1
ece7987c7a20df98ba289677f6208f98ee949ceb

SHA256
69e0c4e1dc2831c2cdc26bca673db97373741c43217f31307dc8fa6b9429e7cb

SHA512
8af289bdb7733148dd451ae72694396d9db6698951200f3cc3bf653d1d5113219341793b222c7e942bc755b9218efc4a15adba43970a54ddd43f312810b53571

Download Submit
C:\Windows\SysWOW64\Pdkoch32.exe

Filesize
409KB

MD5
40faf45deef907f2b1665d485e7cc05f

SHA1
0032ed0986b270ef7d4958672e9ee2109882b204

SHA256
3f73732a0910fca8d6bd700adcad3cd0847785c864acb30f600037c923df50c7

SHA512
7c52bfb7624fdf2d8bd8d72798b186d7f4e831594a56daa4f086847998d1a1ea40ad4401413659fd70f3aa750a5a24eb341a3afde293d88ac4c44ad24f324518

Download Submit
C:\Windows\SysWOW64\Ppnenlka.exe

Filesize
409KB

MD5
2dbe4a33a88d4e901ef8afb11dc35b6f

SHA1
8664c3b61bf14dff2d83c733fd1f2fb21c30b554

SHA256
06aa37555937e5a6689e85d028ff25463006d529a9fedc2fe4091fa521e939a3

SHA512
a588f2d6fe77cb80986f681a5046ec809a2fa9e37d764f99c1b03e1e514256dca1016db935793c7d15dbe91149be6669b84593f82aa16980d7c7752a443480da

Download Submit
C:\Windows\SysWOW64\Qfjjpf32.exe

Filesize
409KB

MD5
4b57d6aad633719893d29965cb33bc4b

SHA1
06d3f9c70e15361dc713994ad1d19087eff81faa

SHA256
9490533bf8385b24e8fc3fcf6fff04ed71a250180711da00d0626f1f50b17621

SHA512
7b866f13772fa07c71127f9d0768ea06f710df0dc83a61f6dba4b554947e805e58e8d2524d20217ed022968f5a9f035553ec896d4f405838890383a571a5efed

Download Submit
C:\Windows\SysWOW64\Qhmqdemc.exe

Filesize
409KB

MD5
e94d9ccae3cd0b3f78ac7c6b44fe77ad

SHA1
5829cfb994349d78e8b5e1d91aff228aaa97501f

SHA256
7940866954d35910276edf640e28bcbee0a8e9fd510ab0cec25e922a9646e697

SHA512
7f5627bdbee65b42f284e2e14afaab9a5fc00da768180bf2b192ce81f4a4a5ad429b0df34876deda32da9b06186f04b91e6de1348b534216cc2508b5bf353dea

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
409KB

MD5
dabb1f4cbde365ff5a35328da9f55c7f

SHA1
a5718198e2bb3af8ec2d153bc85bde08cb6fa4fc

SHA256
f9722fa024c4f9c9902b015ffdc6739e2d78eb79fe467c501035f85e9a041ab1

SHA512
11e2213ed04719cb08a24b7b8b26c2203d14e2a95ffb569a2155bb2f2092f56cf51880f1193d0550410dfe5d211154dfc374eeb2ee39ee8d784a4f17d639d080

Download Submit
memory/64-3257-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/64-506-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/316-306-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/372-453-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/516-554-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/516-28-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/552-347-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1008-471-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1184-270-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1220-371-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1272-473-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1388-242-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1464-3909-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1524-562-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1612-40-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1612-568-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1636-71-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1636-594-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1792-430-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1800-575-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1800-47-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-294-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1888-3191-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1888-489-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1904-323-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2028-555-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2044-523-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2052-172-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2172-365-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2192-383-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2216-601-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2216-2817-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2216-79-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2220-3315-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2236-15-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2236-548-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2248-3005-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2248-282-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2372-394-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2420-180-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2460-412-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2504-258-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2660-459-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2676-436-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2784-400-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2824-31-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2824-561-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3020-196-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3044-188-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3224-406-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3320-418-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3328-288-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3360-148-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3376-359-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3572-465-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3612-156-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3620-3344-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3644-535-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3644-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3724-88-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3724-608-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3764-100-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3764-614-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3768-164-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3800-529-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3996-132-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4076-211-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4128-581-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4128-55-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4140-300-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4204-329-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4288-140-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4304-512-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4308-442-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4316-377-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4376-250-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4380-335-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4384-353-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4456-219-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4508-483-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4564-587-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4564-63-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4612-312-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4620-543-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4644-264-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4776-276-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4792-227-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4880-500-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4916-8-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4916-541-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4928-424-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5024-341-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5068-626-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5068-116-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5088-620-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5088-107-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5092-124-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5092-632-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5156-569-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5288-588-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5328-595-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5368-602-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5448-3875-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5576-633-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5608-3943-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5716-3947-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/5876-3932-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/6988-3741-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/7404-3653-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/8732-3561-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/9008-3490-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/9376-3446-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/9564-3423-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/10328-3398-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/10420-3363-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/10832-3380-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/11128-3338-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads