berbew | 55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408ac

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/12/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408acN.exe
Size

923KB
MD5

a65a83b5ac12f65bb6d29c7b702326f0
SHA1

6f68ce1bcf1adaa43374381e8398a1dc952cc563
SHA256

55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408ac
SHA512

9e40b782c7ea98fbff5040e465bfbb0cd54da2bba1b77e8e826679e19b64772d71df3bb03ebff84d0ee7f5f698b2ca24d7a35caa3016e2417add16382d5b4ffd
SSDEEP

12288:zjYkjv/Ng1/Nmr/Ng1/Nblt01PBNkEoIa:nYQUlkcEpa

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnlodjpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aamknj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipoopgnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqdaadln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmikeaap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgninn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lekmnajj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafppp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpkknmgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhqcgnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gipdap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcikgacl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hloqml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjjnifbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkfcqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blielbfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nelfeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njinmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljpaqmgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjccdkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqbncb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdlkdhnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fideeaco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fefedmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fofilp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obgohklm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Codhnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Innfnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nccokk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibcaknbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncpeaoih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhijepa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plkpcfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeehkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmpjmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjokgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmlddqem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqmmmmph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcelpggq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eciplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiloco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldgccb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjccdkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdkdgchl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaonbc32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1320	Bkkple32.exe
3664	Bbdhiojo.exe
2864	Bfbaonae.exe
1948	Bfgjjm32.exe
4440	Cjecpkcg.exe
3328	Cmflbf32.exe
684	Codhnb32.exe
2160	Cfcjfk32.exe
3840	Ckpbnb32.exe
1420	Ccgjopal.exe
2356	Dfefkkqp.exe
3640	Djqblj32.exe
2444	Dkbocbog.exe
4848	Difpmfna.exe
1588	Dkdliame.exe
2436	Dfoiaj32.exe
3704	Dimenegi.exe
368	Dlkbjqgm.exe
3628	Ecbjkngo.exe
964	Efafgifc.exe
1796	Eiobceef.exe
5004	Elnoopdj.exe
4968	Elbhjp32.exe
884	Eciplm32.exe
2012	Efhlhh32.exe
2308	Eifhdd32.exe
3776	Embddb32.exe
3324	Eppqqn32.exe
2960	Ebommi32.exe
2180	Efjimhnh.exe
2464	Eiieicml.exe
1904	Elgaeolp.exe
2824	Fjhacf32.exe
4872	Fmfnpa32.exe
3120	Fpejlmcf.exe
2264	Fbcfhibj.exe
3240	Fjjnifbl.exe
3656	Fmikeaap.exe
1300	Fpggamqc.exe
1216	Fbfcmhpg.exe
4476	Fjmkoeqi.exe
4344	Fmkgkapm.exe
1968	Fdepgkgj.exe
2712	Fbhpch32.exe
4732	Fibhpbea.exe
3308	Flqdlnde.exe
1576	Fdglmkeg.exe
716	Fffhifdk.exe
3028	Fideeaco.exe
2272	Glcaambb.exe
2732	Gdjibj32.exe
2304	Gjdaodja.exe
3728	Gmbmkpie.exe
3516	Gpqjglii.exe
5016	Gbofcghl.exe
4600	Gjfnedho.exe
3420	Gmdjapgb.exe
1512	Gpcfmkff.exe
1592	Gbabigfj.exe
3644	Gkhkjd32.exe
1748	Gmggfp32.exe
4496	Gdaociml.exe
1092	Gfokoelp.exe
3992	Gmiclo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jcoaglhk.exe
File created	C:\Windows\SysWOW64\Gpqjglii.exe	Gmbmkpie.exe
File created	C:\Windows\SysWOW64\Kcpahpmd.exe	Kqbdldnq.exe
File opened for modification	C:\Windows\SysWOW64\Ckjbhmad.exe	Cbbnpg32.exe
File opened for modification	C:\Windows\SysWOW64\Hbjoeojc.exe	Hoobdp32.exe
File created	C:\Windows\SysWOW64\Gahamgib.dll	Dheibpje.exe
File created	C:\Windows\SysWOW64\Ekaacddn.dll	Ojhpimhp.exe
File created	C:\Windows\SysWOW64\Himfiblh.dll	Ilfennic.exe
File created	C:\Windows\SysWOW64\Jeapcq32.exe	Jpegkj32.exe
File opened for modification	C:\Windows\SysWOW64\Gmbmkpie.exe	Gjdaodja.exe
File created	C:\Windows\SysWOW64\Kdigadjo.exe	Kqmkae32.exe
File opened for modification	C:\Windows\SysWOW64\Kkeldnpi.exe	Kgipcogp.exe
File created	C:\Windows\SysWOW64\Nlmdbh32.exe	Ndflak32.exe
File created	C:\Windows\SysWOW64\Ooaafghm.dll	Hpcodihc.exe
File created	C:\Windows\SysWOW64\Idahjg32.exe	Ingpmmgm.exe
File created	C:\Windows\SysWOW64\Hjpefo32.dll	Ojdnid32.exe
File created	C:\Windows\SysWOW64\Gpmomo32.exe	Ggfglb32.exe
File created	C:\Windows\SysWOW64\Gbqcnc32.dll	Gpnfge32.exe
File created	C:\Windows\SysWOW64\Oppceehj.dll	Nflkbanj.exe
File created	C:\Windows\SysWOW64\Eifhdd32.exe	Efhlhh32.exe
File created	C:\Windows\SysWOW64\Fjjnifbl.exe	Fbcfhibj.exe
File created	C:\Windows\SysWOW64\Lejomj32.dll	Gpqjglii.exe
File opened for modification	C:\Windows\SysWOW64\Inlihl32.exe	Ijqmhnko.exe
File created	C:\Windows\SysWOW64\Hlglidlo.exe	Hpqldc32.exe
File opened for modification	C:\Windows\SysWOW64\Pdenmbkk.exe	Pccahbmn.exe
File created	C:\Windows\SysWOW64\Debcil32.dll	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Pfigmnlg.dll	Nijqcf32.exe
File created	C:\Windows\SysWOW64\Fcgeilmb.dll	Dlkbjqgm.exe
File created	C:\Windows\SysWOW64\Jgeghp32.exe	Jcikgacl.exe
File created	C:\Windows\SysWOW64\Hkpmpo32.dll	Odmbaj32.exe
File opened for modification	C:\Windows\SysWOW64\Iiopca32.exe	Ipgkjlmg.exe
File created	C:\Windows\SysWOW64\Mlhqcgnk.exe	Mablfnne.exe
File opened for modification	C:\Windows\SysWOW64\Maiccajf.exe	Mmnhcb32.exe
File created	C:\Windows\SysWOW64\Dohjem32.dll	Kngkqbgl.exe
File opened for modification	C:\Windows\SysWOW64\Lqkqhm32.exe	Lnldla32.exe
File created	C:\Windows\SysWOW64\Ofkgcobj.exe	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Hcpojd32.exe	Hpabni32.exe
File created	C:\Windows\SysWOW64\Jnjejjgh.exe	Jklinohd.exe
File created	C:\Windows\SysWOW64\Dmennnni.exe	Dbpjaeoc.exe
File created	C:\Windows\SysWOW64\Bgkiaj32.exe	Aopemh32.exe
File created	C:\Windows\SysWOW64\Ememkjeq.dll	Knooej32.exe
File created	C:\Windows\SysWOW64\Iekkfckg.dll	Kqphfe32.exe
File created	C:\Windows\SysWOW64\Pijmiq32.dll	Kpanan32.exe
File opened for modification	C:\Windows\SysWOW64\Lqhdbm32.exe	Ljnlecmp.exe
File opened for modification	C:\Windows\SysWOW64\Cjecpkcg.exe	Bfgjjm32.exe
File created	C:\Windows\SysWOW64\Gmiclo32.exe	Gfokoelp.exe
File opened for modification	C:\Windows\SysWOW64\Ingpmmgm.exe	Hkicaahi.exe
File created	C:\Windows\SysWOW64\Jcphdpff.dll	Igbalblk.exe
File created	C:\Windows\SysWOW64\Jbagbebm.exe	Jpbjfjci.exe
File opened for modification	C:\Windows\SysWOW64\Objkmkjj.exe	Obgohklm.exe
File created	C:\Windows\SysWOW64\Dokmlmhl.dll	Hmpjmn32.exe
File created	C:\Windows\SysWOW64\Bfllfd32.dll	Kjjiej32.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lmgabcge.exe
File created	C:\Windows\SysWOW64\Ablmdkdf.dll	Kibeoo32.exe
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Mjodla32.exe
File created	C:\Windows\SysWOW64\Jdaaaeqg.exe	Jpfepf32.exe
File opened for modification	C:\Windows\SysWOW64\Mnfnlf32.exe	Mkhapk32.exe
File opened for modification	C:\Windows\SysWOW64\Cbbnpg32.exe	Cleegp32.exe
File created	C:\Windows\SysWOW64\Dkodcb32.dll	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Kqdaadln.exe	Kmieae32.exe
File opened for modification	C:\Windows\SysWOW64\Lggldm32.exe	Lclpdncg.exe
File created	C:\Windows\SysWOW64\Boenhgdd.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Ggkqgaol.exe	Gbnhoj32.exe
File opened for modification	C:\Windows\SysWOW64\Fdglmkeg.exe	Flqdlnde.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12156	11760	WerFault.exe	608

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emmdom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpoalo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmhgmmbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jihbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpfepf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmmolepp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgobel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkohaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbepme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfgjjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efafgifc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kglmio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klndfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekbjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elnoopdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmikeaap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcmbee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnfnlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbejloe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqmmmmph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqgedh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcjjhdjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbfcmhpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jknfcofa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcggio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlkgmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omgcpokp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqgmmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdaociml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlambk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkdjfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknojl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfgkffn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nndjndbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkbjjbda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qoelkp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jkimho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oelolmnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcoaglhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkndie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpfgmnfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlkbjqgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbhpch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oejbfmpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmhpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcoccc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkdliame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqbncb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaqbkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcgpni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiopca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Likhem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlljnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdaaaeqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndeii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmennnni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enfckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eomffaag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fofilp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gacepg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikbfgppo.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fffhifdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmechmip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idahjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjahlgpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oldjcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phaahggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npdpachh.dll"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhpapf32.dll"	Fkfcqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbagbebm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jddnfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knchpiom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nblolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llgdkbfj.dll"	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anaemfem.dll"	Jddnfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Objkmkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkdliame.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohlljcfl.dll"	Eiieicml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idcepgmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcdciiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcbd32.dll"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlbmonhi.dll"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hojpmg32.dll"	Olicnfco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqhdbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enkmfolf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iamamcop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfgjjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlkgmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fndpmndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaodc32.dll"	Gacepg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nclbpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edgbii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenqhaga.dll"	Eiobceef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjfnedho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgeemcfc.dll"	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odjeljhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoepebho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aobbbd32.dll"	Igpdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipoopgnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqikmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbenoa32.dll"	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enfckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbhijepa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbokg32.dll"	Hcmbee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occgpjdk.dll"	Hcpojd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmmolepp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filclgic.dll"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngidlo32.dll"	Lggejg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1320	2288	55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408acN.exe	85
PID 2288 wrote to memory of 1320	2288	55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408acN.exe	85
PID 2288 wrote to memory of 1320	2288	55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408acN.exe	85
PID 1320 wrote to memory of 3664	1320	Bkkple32.exe	86
PID 1320 wrote to memory of 3664	1320	Bkkple32.exe	86
PID 1320 wrote to memory of 3664	1320	Bkkple32.exe	86
PID 3664 wrote to memory of 2864	3664	Bbdhiojo.exe	87
PID 3664 wrote to memory of 2864	3664	Bbdhiojo.exe	87
PID 3664 wrote to memory of 2864	3664	Bbdhiojo.exe	87
PID 2864 wrote to memory of 1948	2864	Bfbaonae.exe	88
PID 2864 wrote to memory of 1948	2864	Bfbaonae.exe	88
PID 2864 wrote to memory of 1948	2864	Bfbaonae.exe	88
PID 1948 wrote to memory of 4440	1948	Bfgjjm32.exe	89
PID 1948 wrote to memory of 4440	1948	Bfgjjm32.exe	89
PID 1948 wrote to memory of 4440	1948	Bfgjjm32.exe	89
PID 4440 wrote to memory of 3328	4440	Cjecpkcg.exe	90
PID 4440 wrote to memory of 3328	4440	Cjecpkcg.exe	90
PID 4440 wrote to memory of 3328	4440	Cjecpkcg.exe	90
PID 3328 wrote to memory of 684	3328	Cmflbf32.exe	91
PID 3328 wrote to memory of 684	3328	Cmflbf32.exe	91
PID 3328 wrote to memory of 684	3328	Cmflbf32.exe	91
PID 684 wrote to memory of 2160	684	Codhnb32.exe	92
PID 684 wrote to memory of 2160	684	Codhnb32.exe	92
PID 684 wrote to memory of 2160	684	Codhnb32.exe	92
PID 2160 wrote to memory of 3840	2160	Cfcjfk32.exe	93
PID 2160 wrote to memory of 3840	2160	Cfcjfk32.exe	93
PID 2160 wrote to memory of 3840	2160	Cfcjfk32.exe	93
PID 3840 wrote to memory of 1420	3840	Ckpbnb32.exe	94
PID 3840 wrote to memory of 1420	3840	Ckpbnb32.exe	94
PID 3840 wrote to memory of 1420	3840	Ckpbnb32.exe	94
PID 1420 wrote to memory of 2356	1420	Ccgjopal.exe	95
PID 1420 wrote to memory of 2356	1420	Ccgjopal.exe	95
PID 1420 wrote to memory of 2356	1420	Ccgjopal.exe	95
PID 2356 wrote to memory of 3640	2356	Dfefkkqp.exe	96
PID 2356 wrote to memory of 3640	2356	Dfefkkqp.exe	96
PID 2356 wrote to memory of 3640	2356	Dfefkkqp.exe	96
PID 3640 wrote to memory of 2444	3640	Djqblj32.exe	97
PID 3640 wrote to memory of 2444	3640	Djqblj32.exe	97
PID 3640 wrote to memory of 2444	3640	Djqblj32.exe	97
PID 2444 wrote to memory of 4848	2444	Dkbocbog.exe	98
PID 2444 wrote to memory of 4848	2444	Dkbocbog.exe	98
PID 2444 wrote to memory of 4848	2444	Dkbocbog.exe	98
PID 4848 wrote to memory of 1588	4848	Difpmfna.exe	99
PID 4848 wrote to memory of 1588	4848	Difpmfna.exe	99
PID 4848 wrote to memory of 1588	4848	Difpmfna.exe	99
PID 1588 wrote to memory of 2436	1588	Dkdliame.exe	100
PID 1588 wrote to memory of 2436	1588	Dkdliame.exe	100
PID 1588 wrote to memory of 2436	1588	Dkdliame.exe	100
PID 2436 wrote to memory of 3704	2436	Dfoiaj32.exe	101
PID 2436 wrote to memory of 3704	2436	Dfoiaj32.exe	101
PID 2436 wrote to memory of 3704	2436	Dfoiaj32.exe	101
PID 3704 wrote to memory of 368	3704	Dimenegi.exe	102
PID 3704 wrote to memory of 368	3704	Dimenegi.exe	102
PID 3704 wrote to memory of 368	3704	Dimenegi.exe	102
PID 368 wrote to memory of 3628	368	Dlkbjqgm.exe	103
PID 368 wrote to memory of 3628	368	Dlkbjqgm.exe	103
PID 368 wrote to memory of 3628	368	Dlkbjqgm.exe	103
PID 3628 wrote to memory of 964	3628	Ecbjkngo.exe	104
PID 3628 wrote to memory of 964	3628	Ecbjkngo.exe	104
PID 3628 wrote to memory of 964	3628	Ecbjkngo.exe	104
PID 964 wrote to memory of 1796	964	Efafgifc.exe	105
PID 964 wrote to memory of 1796	964	Efafgifc.exe	105
PID 964 wrote to memory of 1796	964	Efafgifc.exe	105
PID 1796 wrote to memory of 5004	1796	Eiobceef.exe	106

C:\Users\Admin\AppData\Local\Temp\55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408acN.exe
"C:\Users\Admin\AppData\Local\Temp\55176cd8fc3ee59aef9edcf44e4563cc259615c3efb425ade16d71108f5408acN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\Bkkple32.exe
  C:\Windows\system32\Bkkple32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\Bbdhiojo.exe
    C:\Windows\system32\Bbdhiojo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\Bfbaonae.exe
      C:\Windows\system32\Bfbaonae.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
      - C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        24⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2012
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        27⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        28⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        29⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        30⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        31⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2464
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        33⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        34⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        35⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        36⤵
        Executes dropped EXE
        
        PID:3120
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2264
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3656
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        40⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        42⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        43⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        44⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        46⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3308
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        48⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        51⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        52⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2304
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        56⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        58⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        59⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        60⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        61⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        62⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1092
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        65⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        66⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2360
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        69⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        71⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        73⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        74⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        75⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3708
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        77⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        80⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        81⤵
        Drops file in System32 directory
        
        PID:1972
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        82⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        83⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        84⤵
        Modifies registry class
        
        PID:1596
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        85⤵
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2384
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        88⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        89⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        90⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        91⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        92⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        93⤵
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        94⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        95⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        96⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        97⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        98⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        99⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        101⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        102⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        104⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        106⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        108⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        111⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        112⤵
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        113⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        114⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        115⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        116⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        118⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        119⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        120⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        122⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        126⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        127⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        128⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        129⤵
        Drops file in System32 directory
        
        PID:4184
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3804
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        131⤵
        Drops file in System32 directory
        
        PID:4480
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        132⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        133⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        134⤵
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        135⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        140⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        142⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        143⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        144⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        145⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        146⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        147⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        148⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        149⤵
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        152⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        153⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        155⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        156⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        157⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        158⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        159⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        160⤵
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        161⤵
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        162⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        164⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        165⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        168⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        169⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        172⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        173⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        175⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        176⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        177⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        178⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        181⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        182⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        184⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        185⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        186⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        187⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        188⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        190⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        193⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        194⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        195⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        196⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        197⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        198⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        199⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        201⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        202⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6760
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        204⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        205⤵
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        206⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        207⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        209⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        210⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        211⤵
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        212⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        213⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        214⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6868
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        217⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        218⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        219⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        222⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        223⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        225⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        227⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        228⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        229⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        231⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        232⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        233⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        235⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        236⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        237⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        239⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        240⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        242⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        243⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        244⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        245⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        246⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7748
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        250⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        251⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7932
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        254⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        255⤵
        Drops file in System32 directory
        
        PID:8084
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        256⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        257⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        258⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        260⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        261⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        263⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        264⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        265⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        266⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        267⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        268⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        269⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        270⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7204
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        272⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        273⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        274⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        275⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        276⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        278⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        279⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        280⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        281⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        282⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        283⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        284⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        285⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        286⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        288⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        289⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7732
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        291⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        292⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        293⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        294⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        295⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        296⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        297⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        298⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        299⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8328
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        300⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        301⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        302⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        303⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        304⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        305⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:8640
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        307⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        308⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8812
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        310⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        311⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8984
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        313⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        314⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:9160
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        316⤵
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        317⤵
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        320⤵
        Drops file in System32 directory
        
        PID:8496
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8580
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        322⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        323⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        324⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8972
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        326⤵
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        327⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        328⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        329⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        330⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        332⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        333⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        335⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8584
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        337⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        338⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        339⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        340⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        341⤵
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        344⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        345⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        346⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        347⤵
        Drops file in System32 directory
        
        PID:9156
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        348⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        349⤵
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        350⤵
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        351⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        352⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        353⤵
        Drops file in System32 directory
        
        PID:9456
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        354⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        355⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        356⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        357⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        358⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        359⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        360⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        361⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        362⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        363⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        364⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        365⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        366⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        367⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        368⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        369⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        370⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        371⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9352
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        372⤵
        Modifies registry class
        
        PID:9420
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        373⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        374⤵
        Drops file in System32 directory
        
        PID:9568
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        375⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:9728
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        377⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        378⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        379⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        380⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10140
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        383⤵
        Modifies registry class
        
        PID:10208
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        384⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        385⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        386⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:9800
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        389⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        390⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        391⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        392⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        393⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        394⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        396⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:10144
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        398⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        399⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        400⤵
        Modifies registry class
        
        PID:10024
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        401⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        402⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        403⤵
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        404⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        405⤵
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        406⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:10480
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        408⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        409⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        410⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10688
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        413⤵
        Modifies registry class
        
        PID:10780
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        414⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        415⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        416⤵
        Modifies registry class
        
        PID:10944
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        417⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        418⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11088
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        420⤵
        System Location Discovery: System Language Discovery
        
        PID:11132
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        421⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        422⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        423⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        424⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        425⤵
        Drops file in System32 directory
        
        PID:10352
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        426⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        427⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10588
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        429⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        430⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10724
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        431⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10820
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        433⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11000
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        435⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11120
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        437⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        438⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        439⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        440⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        441⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        442⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        443⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        444⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        445⤵
        System Location Discovery: System Language Discovery
        
        PID:10916
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        446⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        447⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        448⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        449⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        450⤵
        System Location Discovery: System Language Discovery
        
        PID:10468
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        451⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10684
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        453⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        454⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        455⤵
        System Location Discovery: System Language Discovery
        
        PID:11256
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        456⤵
        Drops file in System32 directory
        
        PID:9956
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        457⤵
        Modifies registry class
        
        PID:10772
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        458⤵
        Drops file in System32 directory
        
        PID:11116
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        459⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        460⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        461⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        462⤵
        System Location Discovery: System Language Discovery
        
        PID:11248
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        463⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        464⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11176
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        465⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        467⤵
        Drops file in System32 directory
        
        PID:11368
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        468⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        469⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:11488
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11544
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        472⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11632
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        474⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:11720
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        476⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        477⤵
        System Location Discovery: System Language Discovery
        
        PID:11816
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        478⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        479⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:11948
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        481⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        482⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12084
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        484⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        485⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        486⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        487⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        488⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        489⤵
        Drops file in System32 directory
        
        PID:11332
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11408
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        491⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        492⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        493⤵
        System Location Discovery: System Language Discovery
        
        PID:8076
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        494⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        495⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        496⤵
        Modifies registry class
        
        PID:11728
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        497⤵
        Drops file in System32 directory
        
        PID:11788
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        498⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        499⤵
        Modifies registry class
        
        PID:11912
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        500⤵
        Drops file in System32 directory
        
        PID:11976
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12032
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        502⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        503⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12208
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        505⤵
        Modifies registry class
        
        PID:12252
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        506⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        507⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        508⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        509⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        510⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        511⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        512⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        513⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11760 -s 400
        514⤵
        Program crash
        
        PID:12156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11760 -ip 11760
1⤵
PID:11984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aoioli32.exe

Filesize
923KB

MD5
351e4b082b017ee6d3b743039110fbf8

SHA1
39066651164241ea17270a838c281fb7ee67e77d

SHA256
0f6ad025bf77bc7913144fc873d5cf1e39b841a6265e9069689e2d90d56e0d55

SHA512
8dff0a9f53d719e8ee118a69df921dd262b210a0d47e6223ee291055c2bf01d59236a79a5f0dd8e7b1aa8c3713d2e7930b2079eee5f621473eed2dc8adb4c73d

Download Submit
C:\Windows\SysWOW64\Aopemh32.exe

Filesize
923KB

MD5
13a2204e2d3265894450a675cca06d6a

SHA1
e46feb3353bca7c30084a6ea42b7a43e3df38cee

SHA256
d7b479547b65fa9b2a11dd562076754d6c9d66e4488aa60e3e400dcb1ead72a6

SHA512
550f65c5adef302cd13f73a686ac83aee84abef807dab7c268c7571cd15a1dfee334503338d2ef1f97e2fd57819396a6c07b320dc94126aeb7fa31ed07cf7a72

Download Submit
C:\Windows\SysWOW64\Bbdhiojo.exe

Filesize
923KB

MD5
3ed07cfcdb987a5d80466a4d7f045d4b

SHA1
43a857974adc21c5bbd607c94fc1b23cd4f0b120

SHA256
39bbcf20198502245f058233766b8d5da5481753ecc370c5d106f02ded3d41fa

SHA512
842fc08072a723aa601c0536e09acfb2fa9eb9595ac2939f049ec9513ecc61722c501bb5f49ec52321d6b02c5339173aca802ef6872b0e63fca5f3e3d00b7c79

Download Submit
C:\Windows\SysWOW64\Bfbaonae.exe

Filesize
923KB

MD5
8d0ee2fbcd26684f7f207ce590871055

SHA1
63eafe36d179bbc3446771b7be674b89980021a6

SHA256
699f91f7ab85a8053a9adc34c41ee037208cfda1115cdbb4507b11c65ecf0935

SHA512
0206b8cb1541cfc052cc02542d928c4d99138a0a8c7a652c55c5aa6b726bb3f447b9593e83088db420db5ab46c5402d95d3fed9fd98ce119686790dfd6e34e45

Download Submit
C:\Windows\SysWOW64\Bfgjjm32.exe

Filesize
923KB

MD5
c6b4a6a146cfee582a2d4a1cc2359bba

SHA1
8c20cef2ab3a61f0ee226ec49553a8a79cc82759

SHA256
891a458b56398050407b4b1b5ed20d0835e056f546d8fbc7d71e85bef698058a

SHA512
177bd6f83d38448d7cda9ac56712368ff78358fccf2f56c8afbf66ff343f5526bc4992dc952c2b5a326cf1a53de2621c1983cb2dbb0d71179de0aec27ecd15a6

Download Submit
C:\Windows\SysWOW64\Bkkple32.exe

Filesize
923KB

MD5
e00090eaa0d606da7b9e53bb051c3307

SHA1
981c201b1a740cc4955e0c375b8d90938109d504

SHA256
d60730a8d29989f2162bfea5c3f8dcb12fa4e301067669a520ce464481d80a96

SHA512
c3ebcc574fe572c89a9e05cc0f4590a456cc62a050218202f3d6995159d37722b48a772824cfbb3da461a3e9385a7a8a78753e370e170cc5be864e9013b2791b

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
923KB

MD5
4e8b7974823a9c03fe7b3c7df17a4704

SHA1
aa25ed2baf2288b8914fc4ea2ddc8bae821b7354

SHA256
dcfc652f75a6f42e9712e238a676b4d2fb54af230bc405f0b97eaa2510661f5b

SHA512
9ac6603b0cc6a84df549596c137b6f2ac38c44254c80dbc3481e59333df0e46062a9761c08447915b59fec7eb569c4bbd7b14bdcd132118671c7481a2cb734d3

Download Submit
C:\Windows\SysWOW64\Cammjakm.exe

Filesize
923KB

MD5
ef7a29aff387199aa3decc5ae40463ce

SHA1
eca0faba6f4e6104bb4927e041bbda583409924d

SHA256
33fa15beb498412fef6392c8bfd814388562f957066292b677cfaa110395d1cc

SHA512
5c6992a93a4c0dae83ee23ee8346feae59d1d2ce25e87f5d0be3778a343ba2fb7222420b52318b0f55e7b598d76e465cfa687d4b840a409a33e9a1349ae7f629

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
923KB

MD5
6a6618ad8bb852948442a0e5d313de89

SHA1
5049cb380af82561b03580089faba191159308f2

SHA256
b3363fa5655c03dce5438ffbd6233a7c2ca59c5bdd69eca1f165a20a9293f93a

SHA512
1404a7ea7b9478786f6bfcea95cc4f5899f59065a65426cb28bff96a95877a3e8fd113fedca8f09b4b0f382d4078170a4264130ebdd484c9d0897785803cef98

Download Submit
C:\Windows\SysWOW64\Ccgjopal.exe

Filesize
923KB

MD5
5a57df0b75193e20f5e4dde5b4dc2357

SHA1
0be9e8b0f2e24223700d598ef59fc6dd8bb07677

SHA256
20d84c36fc0a85c937cfdd05865c90240205ce6bf4bd8ee411f7d1d35148f2cb

SHA512
24819288cedd0f7ea7fc2cfe0ff9d03d88617abc2d411229904914a5f30155602e582573b47501f24f76d043a34c0c50e35830d98f633e134b8776571a57ed89

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
923KB

MD5
639259b2b1fc7c4a9ef6edb5384cad2c

SHA1
36dd4d144e4e7ceb3779618efb242b99d089cf46

SHA256
55934a8aa486417646e1d0b0d512922caddd8b5632346a6f24ddeb6bd323fa31

SHA512
faa53c9425d986370a6e216b1ce3d933086ee5bd32f88e38364ee4b6e8a99c4f04dacfdd2662ee9a33fba1efad5dbec83d21255b156a2356ba79c641c3c623f3

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
923KB

MD5
eaa68a183f4d637043aa4ad74346d3a7

SHA1
c1205b8bec3f84f097b61b323345510e040b4d28

SHA256
51758e727b3003839e5b92a184b42bc336ed55a812c6d69d2970f0d9ef5e2a9c

SHA512
2ab5876825c236ae3c9764309cd84452990e65bc09222cc45400a08c579c02d578741fa45a0c4d9bc2b3904b0ce645fcf519c185e2cee43b8d91780f442de08e

Download Submit
C:\Windows\SysWOW64\Cjecpkcg.exe

Filesize
923KB

MD5
de8790354a871f12e5552ff48cae2d14

SHA1
3083d8e8ba7a04116a36bc4e2d91a6cce3809aa2

SHA256
5a20f8852fdf3ff154c987f6c7b67f89f9ba6fcd000b6a5680a8715a00d431a4

SHA512
7e70acad0e3eb64c02390097670d0302d3c28a2a605869c6315a4a6b7225685173f27b849e625ed805fc0638713d283f0587921ad6876ee825f41b27274c3a7f

Download Submit
C:\Windows\SysWOW64\Ckgohf32.exe

Filesize
923KB

MD5
736297f6dd10aae798d512679fc7ecae

SHA1
ec75e86febede877b8f5147d7a6ccad440296e15

SHA256
220c7085662ffa8b5c229a20c84a5e1e185794c028370e78845ae2860eba81c6

SHA512
58dddbabee986805fff0af28f85c4637765420338d6877bd7e9ca661cce1e7ad4a35ab6ce460bbfc47c28a74a2a0cd6a37578565a9631714fc25e283e3d3badc

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
923KB

MD5
8d7f2ecbdb2abccff34a172febb900bb

SHA1
5360e64d64a624967fd75f451bd34fc1e496beee

SHA256
35d291e67d3882a4be40f8ebb26466568837691b07973bb86c27a07fe70ee9b2

SHA512
6249afdf1a88bdaaa88b74150798a9405ba9ccf0e35c3b2bc66b8cf3034974c0001905e9b4bccc016594c3c3603d8b2ce11165bbcf41bdd5ac3ba0778219e32d

Download Submit
C:\Windows\SysWOW64\Cmflbf32.exe

Filesize
923KB

MD5
ffcfa480f4790dc55793a1c82bb12b2a

SHA1
867f19c892ad6ccdb8dadfd827698f96169bb6b0

SHA256
6812e7b0e4df3311373e13d395e9f6e09f78dc0040ddaffd71a98ae47199897d

SHA512
028bd5948f95779b9853c3e4f273c3e1298910fbc2e4efe67b4143f451d601f30d88f39b373b539c08319f25c18832966adbb27a15db8a3d34151cc7cfa06124

Download Submit
C:\Windows\SysWOW64\Codhnb32.exe

Filesize
923KB

MD5
b9f436f13accabb80a7ab0d56640e511

SHA1
f840f9b706152ca0b97c198608c6caac4ad2e2b3

SHA256
a086bb42f8904bc101e7f26b4e722687bcaf85eb99d9f5ffab8df635325ec258

SHA512
2ef97abc2ea2b663eb7828944281c40ef6861f5101a553c06b406acd67d040b624631db36a1db21085328fcf13d2a7b44ad79dfd4f0179d53c0fb2540596c16c

Download Submit
C:\Windows\SysWOW64\Coohhlpe.exe

Filesize
923KB

MD5
a1f177d5aad301c658228ab93fa5fcdf

SHA1
98116cac3a48823cb9101c1e78aa278939e9b899

SHA256
151df9dc2ec8d22230da8c59a2f50b6904c471a4e87f09e95a7882d7dfd6f87b

SHA512
7888c43e965ff3ad19f30b4d95024494dc5d27631559a187e3843f1ef1e46e6e281342bec3a2a7223c544efd3fe8b383c2111277ed8f9bf4e8c3324864c7c2c7

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
923KB

MD5
80dab418c94ae37ecec675350cd9c040

SHA1
c9e29fa36176242619deb30ef6fc29690d1166b8

SHA256
a642d98b37d8f7fa9301b2f3e734b58a7138b0dd997fecbda8b39c5cf7077e1e

SHA512
bafb2ea66a299222fdea7d10218f8472066adf64268497b632e8f4b9e447d7a2d63bc37a55b21394b9e48367c9e4c8e15bd3a2dfd25067d52eabc72c62481238

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
923KB

MD5
6eeb20c73cc0d636d04b48bc5f5f8050

SHA1
3f983a2ae195960ae0c618df05f2a9bbd9954be5

SHA256
d7e36ad27d159d8688ef4327f761e7757d76a196cfe0c1d11e4646b4932fbf89

SHA512
3056eeaba1031269e2839130db4f8473a510a68cb13f08de785061687daf2fb06d9ce1d2a1218ef543079dc74a24db0d42fe4f486f561ef3188419949057c539

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
923KB

MD5
484272ab4c10221c87a50e74f63a201f

SHA1
06fb0dfd53d6ed3d1ccd3a0494a2097f65f2e2a7

SHA256
772ee6c162b67e122b5e6565b779d68e5c3569c1bb5ff53c03f20721e378b952

SHA512
2ceac20fd44857836e37f4466fd7a428bdad02a65295fc81c24061c16d5fb823825864794a084cb2872f486a896cf658cdc60c1de439410aa7e5a2901705bc95

Download Submit
C:\Windows\SysWOW64\Difpmfna.exe

Filesize
923KB

MD5
7604bbf38d207f34d94d6dff0956d565

SHA1
12973f0e1554a441487616e8a6f0b7c8e46baf5d

SHA256
4374b7e43f1dc43439e0942bb88205f1c599cd7548c26c13c6cafa43c087d001

SHA512
4674e9ce07ade4c89c93ce529ac429ceb46506d0c7c3fa6952ea8923ba3b543b3bb520d394cc9203ec7a1590eca36f49629995ef16938d63ebf495521774f236

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
923KB

MD5
1a213cbfcf65fd88dcf60900aec6ddb2

SHA1
afd0c734da88625510babc03302ca42681236223

SHA256
a1063f446d72dbfa0b72c9c9409012f3df3bdd2904a7d7eb6b44748e69cffc87

SHA512
d083c605da60fb6cad35c5b9fcb14a176ae95f068f4caf209141c36dabbeb1740fa12aec603c6555ebbae62a53f18547525b670d88dccd7dc813123c510ce81a

Download Submit
C:\Windows\SysWOW64\Djqblj32.exe

Filesize
923KB

MD5
e662371a0262b7b396fef5b34d52aa7a

SHA1
f02992c59482f8aef37c532153cf5eab38ebf224

SHA256
817f6dd5d2438a13d6a494311623d25c52536ba74281b9df387ef9846a422c0f

SHA512
212d70f18117426685330866978d1443cd9aaa7f748924f3d699c4a92f1b4a3163ad68ef06b0e93452382f80efb8e2c85ee95c12508475eab2b81638753341b0

Download Submit
C:\Windows\SysWOW64\Dkbocbog.exe

Filesize
923KB

MD5
b56c88ed7fbd5100f0253f2d9a3a7807

SHA1
6d242f6fa31f4f1ed711b53a973f79050cff2c97

SHA256
b02c17cd46999695a302c00466cd7cd8f4814aaa32634868c19d534d3a32f09b

SHA512
6520c285564f748eca49407269ad462d954886013ff22d05af5314031a0ffbaabfe159f761f2c235fd7b93ed945a6719c645cccf898a71ad0c69b9c37551be15

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
923KB

MD5
ace1c164528572fd45549368ed1e50ac

SHA1
a76018e45725c6ffd0f3b1276d59f17ff87f44c3

SHA256
d6f39e9c3cdc804c5dfc174baa7d377a5a91ec555ad9a1f5d041bf6ef268c8cf

SHA512
47e366a6b1e7a88bbf8715bedb9d1df169e234a3c6bdd37a190d318fa3a81de90ce4f54bcbdd8158ff47b5a0e15b6fac73fd557004fea5464be51fecae6402ef

Download Submit
C:\Windows\SysWOW64\Dkekjdck.exe

Filesize
923KB

MD5
f1ccf7e1229df67415272e8fd74e987c

SHA1
f6c41083284a8057885f081f8d5de6c2437373a4

SHA256
82f5850db948b45487613ed2b73a8ce48e2631c2661d938e549adad480d264bc

SHA512
e807aea429e10760b3b84f0dcc6549dd6f84961949b26cd3b3aa2a729cde72554596437a1ef0fb0880050678ce8f2dce31a949927d0abbaf3272b324b9eb85f5

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
923KB

MD5
256a7719efb0476a7ab3de68726d2b7d

SHA1
701bde08bcb3b736312013edd614c3dc4af5acf1

SHA256
f328d2300908a5a32fc2e9f3ea3add5fa8cf6058616bfa7233b7452c7cc5d5ee

SHA512
c341f2cb1536bbe35aaf1d705b483f5ed77e5fbe22e3a495d1721381855dd44abcd7e0b07874d354fe152eb5c3f0276cfb29a187f73279cb9a3d09ff9a9603d3

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
923KB

MD5
038f24828e6380a9eb88236aa36314cf

SHA1
b729d76ec3b7bd215b1b53b6459f58aee86d8a7c

SHA256
d942bf632c87f366c2c2e212dac2e52e990ea451d04fc397163b9f8cbf0121f1

SHA512
b574de1bba85042243c1b2ddd3d51355535223a90b46181dfa7641830aeed2dbb9b8ef2661360c0fed2fec3b51ccb8e3c5f2dfb0d96560f4f917d740c4bc58a1

Download Submit
C:\Windows\SysWOW64\Dqnjgl32.exe

Filesize
923KB

MD5
0d537ee443e515c4e3888bba5b626504

SHA1
7794285bf1f27ab0ed85ac51a3a52c1f02466f10

SHA256
5122dcf411f36c47995ad9f54c977ebcf6271a25f06b0aee7e01b544e8becdce

SHA512
66eb5972976a6fc21fd26033e2de4a5724ca2df37c48ad5e5280bad98dc9e38ffc6fc200192525fcf56071eaec78bddfcde5a5db4ec156817b63ee1ad3417d37

Download Submit
C:\Windows\SysWOW64\Ebnfbcbc.exe

Filesize
923KB

MD5
bab97b67c576fd650809cd7f34693659

SHA1
538c8687e3b060211afd0287d14f84e2125744f5

SHA256
940dfdb83a59702b914b419676da2e80eb2d17dfc87e8919b05760544a6fb88a

SHA512
3c0e3a5b226e3de19f0f7cbec3e7343ff42cdb106acb4f9aacfc9cab206179444cb88a21ef7b5b77d1e60094f02e54dd75bdceb2f89193eaa22facca4479feb4

Download Submit
C:\Windows\SysWOW64\Ebommi32.exe

Filesize
923KB

MD5
9daacbe68527c0cb4db1f596a45d1d38

SHA1
5fcd87c5589e7e9523aad9a2aed1ed413d89cc56

SHA256
9621856ec15b4829393255fdd2edade251b07f7972c9b7984ef9d9abf8d8e1cc

SHA512
e267d4cf59c88012a6e3b588d9e860fffcd8eed5c1b132c6a48aff2fbf4538ecdcb666a4355d16770c96a56f00daff3562f1e9d99e6b89a16e28d9024a8450d4

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
923KB

MD5
294a98632c93e073eff13f4e9f0aa2dc

SHA1
249a9fb1655e94c1078edcacc5ccf41bb000dd60

SHA256
8532add1e65beea0ad39bc972470a22637cbb557a6f9ef48dfa0df9d0a5c2b52

SHA512
1781b77d2b9ef063f8d002013f10398e789e93e5cd53e19d69b7ee9008b402540d4ea38346184ee31e6f4858fc53a3f99c988d560b900059feb2a7b89a34afe1

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
923KB

MD5
60eebaaa36e4b58cca4e0bee64d59e91

SHA1
06434ac2d7e85d085cf186605eb0210c9545bc1d

SHA256
8648cfbf1b9c8823d8e8f323927b69b68942b2004e40e66d658581b3526d822d

SHA512
64f488c2ace63b4dcc33dedd05f9b59764cd19c9d59c5a93efef0e940a7343a66e3c2b0e6907c1e01d25351877520e6952a7d0df14b33189eca2eadfbba424cf

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
923KB

MD5
8d22fc8c8d8db1746c3c17d5e129af8f

SHA1
28a3dc4fe3874edffa9080eeee1f912d57bf9eb0

SHA256
d7f458acd21ac88869b92cadda24c97c5ef276247e46fb57014c65d61672ef2f

SHA512
997a7fd5a38267f0122d0b1d5c91a844ad9dfdeeb09eceae0a4dade4517f879de26dd1493a1d9b1985af3cca808351d46a14a13b5f982e89408d51c6bedd6005

Download Submit
C:\Windows\SysWOW64\Efhlhh32.exe

Filesize
923KB

MD5
919cd5445d73a13138d740098a611d06

SHA1
c115f4ec06eae9bbab806a114fe7b1d9882a0420

SHA256
933d57bc24158c24ec3c12154fc3c53472ed3afde56d81a013329ce72712cda0

SHA512
55ed992d1270ee76f1452e08a927fb48b33af090f1172aef5940707c3594fcb4a33badbb42e7f9c48d7581f1a6855d9414c65682cc671a0591922360527b5875

Download Submit
C:\Windows\SysWOW64\Efjimhnh.exe

Filesize
923KB

MD5
2d43f5e5380b796ab9653c7b26b9e7c9

SHA1
2da80028e966c8a986136a50c04408a10dcd429b

SHA256
17c57fc2d9dc76dcb79705fce959688390511b34c497611e48c9199f03526e30

SHA512
b88ddf77c0c71cb5fd309f093d259fdf77d8703e666e7f00b7ce922723fc7b3c7839a02ffad8d3fd62a2e45f8df632b3bdb5f0b8a41115e8c22682ef742ea1fe

Download Submit
C:\Windows\SysWOW64\Eifhdd32.exe

Filesize
923KB

MD5
9e3cb194be7e7c1bffc0cd825ad24a45

SHA1
7c08409496b55177d69d95b2ed29f10d0db7d720

SHA256
844ce36ffd32fe842053440786697c14aa1635586713096336fd549ce6cbc5ad

SHA512
89cf6bafadf15ae0c2c98a5482075dd80fd4005063bb197bf2bce32284c45f61d67b87b7e90371c56b8f28a79a2b0c0f6b2d00885b4030508d96072fe41024ea

Download Submit
C:\Windows\SysWOW64\Eiieicml.exe

Filesize
923KB

MD5
af1ca8fb511151599f4e52c8eb9c42c2

SHA1
9bdcb2de9c8390119b6ac3c3ef5e0764558fb0d5

SHA256
e0136eb0823d43a44b37ad1d0cdf77e78c437b970188703b8ed2f4aea80a7f33

SHA512
8a49863821e73a6d8d09148de2c7018e182218b4572bba0b80eb72ef4892a895cf447aa01ca44cca3045a32e4c70d8078c03bd748e9dfbc7019d3324bfd22992

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
923KB

MD5
04e06b372770fdef94340a8fb9e71d69

SHA1
b72cec59dcf2381c8c70918acce87038ee740229

SHA256
61cf84e61f5025ad65493512d576742f04ff7a3282da2b3288e399d9ff1c4302

SHA512
b37ad560abd32cc845695525881cd966aa5be2f5b0cbefed3ae8e91fb23fb09fee496244c559ec5444bcfc924189a68bfc9ecb546a08a52b586289724a6c68c9

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
923KB

MD5
9735494d3dcb2afe3cee52f5a65aad0f

SHA1
ac755f8067d1bde471d85380f6b5f728efd911c5

SHA256
960809cac64543030263734b2615a739e954f5b248e7ce741aae7e8bb6ff7596

SHA512
b746f6db89ac05ed032da8b283399fc51aa6f0f06a55bf09377743b1a123a884004c07f38619ab38b96860e411fa394d92607d85df0ac1f304eda89b4bf51bde

Download Submit
C:\Windows\SysWOW64\Elbhjp32.exe

Filesize
923KB

MD5
f251225e80d7b74ebe5d4737b1bd5520

SHA1
4351580ab8b625383717f902d72ec3574e3ac845

SHA256
be3dea0424c32d9538da5703ddec4d3b52d22a694d76a6185278c3054381b09f

SHA512
970f4287e5c8769cf1eb4121ff8d2c94df6ebd2ac358491b951b4ec3a6415804b2468a7ee71eb9c1f4dd8312aeceaf2662f1173dbaf9b0f1c795138cc1bd7e59

Download Submit
C:\Windows\SysWOW64\Elgaeolp.exe

Filesize
923KB

MD5
5bd3cca497c764620e6487818aeb03cf

SHA1
986849afb8128c95ce9366785422528fe655dea5

SHA256
ffba5cc8f1d31d6d63cf391c394fde6520d818429567293d452a3b9e14c7ea96

SHA512
724d20bb336c6b25c6504dbae959933697cf4ca7c145ded836713b00baec08d3c3943965450749a197c5f24870625800f1192c30a63f6787590d81d0996d0150

Download Submit
C:\Windows\SysWOW64\Elnoopdj.exe

Filesize
923KB

MD5
2480cb094705f9e8a146df2148e9563b

SHA1
3d4e301cd6e9241f204baf29c3b6ded617afc526

SHA256
40f46ca472090f8e7c369deb17b1f4eef61049b10aba6d2ea21088a00dce28d9

SHA512
1a567aa2adab658cd4236ec3dad3337c7dc4d302301cc9dbb47c4af32fd30958ca9be5c15398aebbd74eefe2a0456f292ea75ed14ff2665f6e81557b59a320ce

Download Submit
C:\Windows\SysWOW64\Embddb32.exe

Filesize
923KB

MD5
3c1e2076910e3bbfc8c9cc1438088a50

SHA1
c37300332743db30fef33858b1d808eea43000b8

SHA256
e2f9475992391ae5b6f68e4bb456ef2fc60149d147d64e76ecb67dc3930c9dbe

SHA512
4bd4ba5afc3f891a8debb4c417254b3584db6ee944dde389b44a6727650868870742fabd32a56e2c794a4b962512e930b3b008331cd2d2c8bc16abe19f6a3661

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
256KB

MD5
ac4716cf636c301605ab4bb847acc748

SHA1
66538ba247e8cebae6af26efa45b3c71f54b1bd6

SHA256
f90f32bd920f959d51ba7bd8bc29fdf3151afd4d6b1b0f6a82d888fc971051c7

SHA512
49379fe8093a49c545e58b4d172b23cab776623e63c223e046549199bbb6a252fdbfdbffc19b17ca42c6651ba416434d2d026aa021218030c5ab22564de16e94

Download Submit
C:\Windows\SysWOW64\Enfckp32.exe

Filesize
923KB

MD5
76df51f61524eee6b1d90cf5847b3dc3

SHA1
1e2b50d93a7ae47082fc864b1861469ecc0ff94b

SHA256
429a09f622b44f5882365fb45b0437e9620cb2e57d06f1072db7704fb440508f

SHA512
d4742faace3cf521581c2f861e3670b1c8a33b33889705b070d067d404a50314d6fffba0ec666e25474b28530dd82bc618edd87fab137d5975af86a3ac5888ce

Download Submit
C:\Windows\SysWOW64\Eppqqn32.exe

Filesize
923KB

MD5
0ba95dcdffadb46cb1d69a6bb4a6d1f1

SHA1
2a3465424ea20ec1ff15ea732a60a262cc3b3f64

SHA256
65a88dd7b5e82c8f9b3aef3019df1faf56e3a4cdce856abf5d70f2dac8f278e7

SHA512
7944cf102a8f80aaad23529f7ecb8f2a69e6cd333cea06be5029f3f9155dca6b8ae8f3d6c46990442e951619d6e345069d440a190c4d0365bff5c074ad097b82

Download Submit
C:\Windows\SysWOW64\Fijdjfdb.exe

Filesize
923KB

MD5
9f643b43917515414e2a439fbcbb11fb

SHA1
3d145df1704b6fb586b3ea2ef395000a2a0abf68

SHA256
774a4172b37bf249b54260f9453ad91aeae1452a20fe82ea21f1adc99db5b50e

SHA512
59d01d506d6c73079b11b267308a909ca0764a46995dc6fc4822d175cd84eb8a4760cbb6b319bb4d48c063dfce1099d487a951f71f14100c2ecb3a8e72025542

Download Submit
C:\Windows\SysWOW64\Fijkdmhn.exe

Filesize
923KB

MD5
5693d40bf0ad5dd92587ead8bf6daa47

SHA1
e078c399deec7d707529d5332a23a221eaa98471

SHA256
0d546e418e88debe494ad6001200dd750b20439bf97f115f67b5600162934c2e

SHA512
c1c333df44cb89393fa9e7203cb254e9ab8c54bd131df3aefa7d6f039d262cc969e6fff4cac354fa12056e25417c26335a3b5466348668ab1198d1d6aefdaa18

Download Submit
C:\Windows\SysWOW64\Fkofga32.exe

Filesize
923KB

MD5
feb5d7426ea9f8889eff15ac40682160

SHA1
68d7cacf31829a9f78f20fd7ff8bf448a06ef5b4

SHA256
659fc8c3de8f3dc1f86b5bb211d7a5c83d9211ee5f7cbb485bde9ed1327b1a74

SHA512
d49bdba01083ee1f759127e143457fa1ef9ae56aa23988fc0408b26c3fc0e5f919264beeb2ec76e472a7e081318680f8a347f05a54529121e45323baba2a4755

Download Submit
C:\Windows\SysWOW64\Ggkqgaol.exe

Filesize
923KB

MD5
39f94faa62f5b8c52d7136868318df8a

SHA1
0521188b6e83c983f7c32c59f231ee3a47df2a8a

SHA256
b62213b0f93970a915ff16ea51d7d4e2a380f7dc0f1b980d4d2799eef2df8787

SHA512
f7f32469d753a95f327d16d51020d34d828d6395f4742bdadb58b184320b9d17e30dc1283eb547ea9d00c36daec3fe779a9ab854a7891b147df88c0b3f697234

Download Submit
C:\Windows\SysWOW64\Gikdkj32.exe

Filesize
923KB

MD5
e4f411e6162d87c8bd5989f6f9283e4e

SHA1
8eca160087631952fb6282a2a5c6f9fb1ba13255

SHA256
59dcca2413e3dc42a1c876fe0500de81f9195dbaeb95eaff4a3511f75ebef6cf

SHA512
757ddd3975221b79b4864c0c73364f035edad6f8818e196ac530a9cc6b41be57c7a10c5674a32105856eb2d35640e717a45baf84419eabda409ee6d34801845e

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
923KB

MD5
bee8c8ac85dca4d71ff92e67a8200e64

SHA1
258288bf96e3b8bf9025f83372a5d37efc4209fd

SHA256
d922d82686a588e212dc13d7b706578c8bf2c41fb16bc3d2289361693608feb1

SHA512
8d23c1c7ac72fb5a67cf54c05bd5749fd286ff4aadc8a2ad9a73cca1681e5c4735de17254a733ecce84005110306e66f2d9f222086440c76d8673379947a8b18

Download Submit
C:\Windows\SysWOW64\Hicpgc32.exe

Filesize
923KB

MD5
751d5d8eca2d036e71aec9260564e334

SHA1
459d51939a28988ca43afa02329865d1ffd7f766

SHA256
47f7c39e568f56bc440830eb0fbd382dbda8b1470dbbcad0de33d38c8b4e2456

SHA512
b57753a3686f158841ad3efd7ae0d9acaf669d8b0a725b40a494ba3c3db8c572ff8c97b579bd644e93352501ca1ed7ffc0c42d5633c034ef7423746163989497

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
923KB

MD5
4b04851a9284543eb1b4ed5e03ae8531

SHA1
5f6110809b4b358ba0a436ecc5fca9c63c5e157a

SHA256
271db354e54b5cf6a1993be2e2881fc6e109bf05349fd895854798cde8c8ace9

SHA512
7f045cb2e3ad48f83fb5b6128fce7d7dba92039ebf654387c152277c4bac1d4cc0639897411251fc0bacc6a06411e03ae623f553b997179f17e1bd1868dfc004

Download Submit
C:\Windows\SysWOW64\Iamamcop.exe

Filesize
923KB

MD5
8801d417c8bb53be55896d94ba2ee677

SHA1
0a60f4c58aa7bbce199fab9e66bb1a0db1ec18b0

SHA256
7303466ab605673e92488380c0cbe1b0acfe9f10316b8ee266e8ac68beea69be

SHA512
4da6ae68052b276d9db75478a8164b5c2f23e517d055064d8638a64b2e4795d510dfbe2ce40583ff8888d4fb169827f7dd05d86a73b583e9896d911a1bbc4149

Download Submit
C:\Windows\SysWOW64\Ibcaknbi.exe

Filesize
923KB

MD5
07bd9a8d1be0a5777c62e3686bcf992b

SHA1
d97646242d015aba2bb194aab1dfb2eb675c7a32

SHA256
9a18541f08543f950f0f6138de785b2b79d766f09ca9849aa82ffae3c75d206b

SHA512
e9a740634ee5dd47fccb2fcfb482ccf76e33f050a460253ef9ede14bed4d2aa996d9f4d5e0c13c7f717675b1c6fb719d3df1e3706586a94d226a6b2eb42f9262

Download Submit
C:\Windows\SysWOW64\Iiopca32.exe

Filesize
923KB

MD5
d4da104cbd09d4a05c3017a6ae9feddd

SHA1
f123e0dfd79a856ef978df421f1a401ca2b0c0ec

SHA256
9a759c8d7f7f3a157ad4587c059d528266d6c3993d4f4bcc90c63bf110531324

SHA512
5be9f8ddbfab765233ea307f20c96ec54e0ac2800133c0785a157bcd5699c92d24c0fbbb9ad5057d8afad6902d9d70c272a0cc2d2554c45d3413e4f7e99e9532

Download Submit
C:\Windows\SysWOW64\Ilfennic.exe

Filesize
923KB

MD5
5f1502dbb38aa0d2d83857d0a29c7b48

SHA1
cdd7f1c87e5bd7bd94fe9de78bce0a323e93fe35

SHA256
f266f77b46b74342c4edfddc2a74b737f9545f344dd2e4b202ef0d7fae8a5589

SHA512
6d9fe7ed6bed18b60d573b8a9024106e78524f3b2bab7e3099da13c8137118e938e487eb80830223b3b50e72700a98d4612fb4c6333d2bb6a5a22424ff7aa592

Download Submit
C:\Windows\SysWOW64\Ilnbicff.exe

Filesize
923KB

MD5
259a3e6565e7ee800ffd30838aeb8755

SHA1
483071f2cecb85d1a593f7b55af0302f64058833

SHA256
e62bcb4a979c2d17f9f7991e959d620f14700710e3a56e1348420dde0e379301

SHA512
20571c661bac0c87ee5662bfca5290dcbd473d667945a1980fcf5104573693e1c92fe3a4aff7b344fdc69fb06400536e0cb64d5e44925d3a1bb8656dc0a778fd

Download Submit
C:\Windows\SysWOW64\Jbagbebm.exe

Filesize
923KB

MD5
8b1706ff6953f32a3f33cca342e8ed04

SHA1
8dfcc98d795c1c539c231c00638a40a7df35714c

SHA256
576b98db2f275b02e569edbc0930ed0566cbe64070bf538476ba9c46fa61bc3c

SHA512
e2d2e0bdeae1624a0e97391fd65549a1e5fcaadda3b2e618ab6732849d38bf7878ceb43643abf00e9a6508d8de1dbc7c3479f978ad4e3bf0b711dd48f4d27575

Download Submit
C:\Windows\SysWOW64\Jcoaglhk.exe

Filesize
923KB

MD5
8176b4bdad3d11f2c73a64137d35f666

SHA1
4d7a7039302f7bec5294932bdcff4cdc3ae1bdf8

SHA256
a54cc04c99129a0b28d7476e7be125fe49ec0cc6590565014d671baec2471b18

SHA512
34764ce67c655f598f324bb3ebe999cf2226511fec1fd3b53d75ea68041bccb58de41ef4c6c985b85c4108307abd78488e89bc5e109bf901239f5107cddd7556

Download Submit
C:\Windows\SysWOW64\Jknfcofa.exe

Filesize
923KB

MD5
8f95028b5d9b090492204b0812fad5e7

SHA1
45505a211fbb5ee3f3b288fa57be228bb9af22f5

SHA256
109fbca078d05e7dba1b9de7a104506fac2765e40e754a6723a2c9a0dec20777

SHA512
12c27b59a3e19059ea87e09a496b169fbfd40b5ddcb0106fcef6fe3ad447c78d6e1d4910c3f7fd58f40d09869ebe4207710b35f4115aea26f1a73f29eedb8fa9

Download Submit
C:\Windows\SysWOW64\Jpegkj32.exe

Filesize
923KB

MD5
0412f0ea40af31bc3399598d7a75a050

SHA1
cbbc22a57cc2672f6db1a75742a65c7b99c89e5c

SHA256
85094c76d950431a621ad5ddce7e44cabb80c9e06262871c53b079eb0e1f56f1

SHA512
97621bfb9a21ec25f8047b8bda6c400c86844b24003730fcfa2a55b551e3d94c83c04c7e9e6a6c04878810b8b6c6254173afb954942678a9cbb3051077dfe025

Download Submit
C:\Windows\SysWOW64\Jpfepf32.exe

Filesize
923KB

MD5
52a3af0abe50aad1d8e40df448a49ab2

SHA1
ad9cc224a79a065b8385f0949f7df80241c69246

SHA256
78b5f16dd5ae010649cde6cea02d464be65a7ee1e6d3af4458d4f026e0e93431

SHA512
c2071f7e4f9a87a676f0a695217516553fd8b391d6896d9aaedb9f5cd9e66b274ee5051bbc1b9e3f3f30e72a0356840faaf1b0efcbb4b3e61f4d63c11dcaa983

Download Submit
C:\Windows\SysWOW64\Jppnpjel.exe

Filesize
923KB

MD5
38ad47ffb2001cab8b28d4f6d4362735

SHA1
ea776659f3fe0b92e2bc2606f965aa9e97b89593

SHA256
672ca240b62687a072497da3de841ebe9ef22a07f775dfc724e906a095fa4b2e

SHA512
00d7b3595668585252a83499428dd5705ca0bc08d84e1f24407cbf2023758f3977bb5fd7eaf4319811777ed7ddbd855cd222fe9fd657de0dd774caaa9fb6696a

Download Submit
C:\Windows\SysWOW64\Kcidmkpq.exe

Filesize
923KB

MD5
c4ffa389a4004c484a476918df087afe

SHA1
f7246bd13a5ad220a099423044314931d4dcc25f

SHA256
4889c9ac46fa9fd8c3bd2fca0ff3afcb03e1be95f1ad288d3156ed49babe3721

SHA512
fa39662924b12ac28e2db40ee20d0748cdfef0e03e6e254ebfb8eb17feb034a7f89cf73089e5d50b087d031e99e8a64da55b49f9dd8d746b6eb06e75ce827ba0

Download Submit
C:\Windows\SysWOW64\Kglmio32.exe

Filesize
923KB

MD5
992f64a0c31620c3825c0e3e894cf97c

SHA1
bbfbe26426ac08d42d2510ecbe37e26cdcceeae7

SHA256
8d9879642e346238dd8dcef18b79bbd1de5ad176481a88a79910fa7726616dbf

SHA512
fdc06fecfb36865684df032c985e6df21336e946ede092b0cabeedc17c96e4e59c2e55ffc49a1b36e748d077734c9b1f35b6437095ec9e96fde012422bce90b5

Download Submit
C:\Windows\SysWOW64\Khiofk32.exe

Filesize
923KB

MD5
a4a04860325526216ef305c676462d98

SHA1
27755b63ae861b285fbcf535af92c1e749f2defe

SHA256
42561e5bb63161bd890cf0684861709c4d5b44f986f99ab6406a7dd34eded50a

SHA512
780399581e8f2d7620adcf6a661917e988571cb1410ce5ca1b819904143f5d3521952141d71bbfaffc41119bbf34b94c7f1a1fb1cd6ad39939341067c9220d54

Download Submit
C:\Windows\SysWOW64\Knnhjcog.exe

Filesize
923KB

MD5
0e3487501477db82427835b60f51770c

SHA1
fddaebded5e77e3724e6f2ef1f3ff70f7be6764c

SHA256
5e25f89c7314c3b3710c8c6b36b85f95ce0199c263cd2f06077daafed9eb36ac

SHA512
c24696887bd66a4e1543a8824aef5ec855225e33fd99fe1185b7ff3a32d16c49edc1c999709aad781aaf1d3d9b0f96c4d2dddb08550d220e266bdfec6dbe058a

Download Submit
C:\Windows\SysWOW64\Kqbdldnq.exe

Filesize
923KB

MD5
83276bd7e6986465cdddbc6e842917e8

SHA1
0496a1a9d5dfa6fcf6bbdf8d6a2999317e339641

SHA256
ca36d60020f96e36dd16408935e37b2fd178b41da58a79e233edc6aa77091a2b

SHA512
9b35ec2f8b651b96d2910446b8517bbe207eb2bab2a69d0933a84b32db83f7ed4112cb1e41c257c71906c4caa62f8a9e15d8fd3b5832597fae0e1b734338e128

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
923KB

MD5
2de43b313b2bfb98faa6eed0982283de

SHA1
57d64a4d61b94b98cafaa3795d60f9cde8fe7cc7

SHA256
9165f9d21075fd276be072f271a948ba461ed659530de6a9b99a9d9835200a90

SHA512
4dfe2c4fb2c9283a423b08c9191950de1dc0063227f5c22797b4579a0d2cd62c7cbfc09aa47e5258d3db41442a6e29459ddb52a60299c11cddda13de07f9116a

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
923KB

MD5
6fcce8e8a501b9afc934b71a35a9ad06

SHA1
433ca2894465d4d3fd824836b60d0263d4cfe71a

SHA256
ecb2d40ff1f3deefcccf82d8d4db6cdb8285ec5d4d6b7d1baaad01965f8eb592

SHA512
117af6814c68e5f310eb26f2b1c41392cfb34dc1fe2e4f118a7a893b3930fb276f5a32b51f50303f029624b8ff49b7ac7c166be45d93e1c470a6b66bf29f5114

Download Submit
C:\Windows\SysWOW64\Ljeafb32.exe

Filesize
923KB

MD5
0a124c456eac20715aab441e19247ff3

SHA1
17359870f77b5873b48982b2f92bca8f571f1916

SHA256
a65512b4e1c4a31d95ec81a4225aff6d76a98136a2a3ddefdd6e5d76dec2bc0d

SHA512
c015388a9903cf4856fbfdd4b14423b4b54d6f069e4942018f685757bec3b6ee9f4f7bba5316358e12201050bcdda92da45548b534926f41fd08f7874aaabc7d

Download Submit
C:\Windows\SysWOW64\Llcghg32.exe

Filesize
923KB

MD5
e7cffc1dea615178459d0f352facf48f

SHA1
233de301b242eb3916f5ee5f86ed95425766d776

SHA256
65702b7ad90ca055015df6605c85d79dee62840489f71bfa5f55292156c41dda

SHA512
6dcca89cf58e967edcab57bebe6fd34c939ed4c7e2261fa4adebc707101cbc07eda5ae16d6ad2c5021144113a1554442e53864522cb7463c77335037a8f60c28

Download Submit
C:\Windows\SysWOW64\Lllagh32.exe

Filesize
923KB

MD5
6400998c730d358209c7df573899c53f

SHA1
ca6a019a4035699f4ca4e3644681bd5364794d5a

SHA256
aa759e2ec570800f026ec850bf19f6de00eb81a3759e710d92336e05e53407ba

SHA512
713767c84a877dafb37693a39aa005c4bab74bab2882200e8e1032e7953e03f0b7050d9b0e344a2d2bbe7ce0fe82eb1aa0614d67f2fff9f8c9cde7d3a5894778

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
923KB

MD5
97bcb7769470157fd265505cb4d38367

SHA1
461ec0a8aae0a1d981d003266b963bef4d534943

SHA256
d6ebd8cb6bae02de9d96afb164f6a7247eee23577c949c06a2ab9028fc849474

SHA512
f4ddf5287fbd7d40b7cbcd3863ed6cb0ef759425062954148936700c98e95512d3999d4d8565ed019d738077eae9e04e09bd9696e29b3fe60b3d753205febb2b

Download Submit
C:\Windows\SysWOW64\Lqbncb32.exe

Filesize
923KB

MD5
a308cadd7d5fa5cc903b4ad2ad6dc5a7

SHA1
9a773be5d382e651da11a6d676ffca95ae6e603d

SHA256
2c06dc28a43cf2ed3c61034952c51ae00d083b68fd4a9ffa72749fdee03ee3d8

SHA512
1733f53faf319df4799354a5776e2423486833716ca486af3e6e8bec8f06becacd6d56e119cdd1c6208c0ffbda72fd479e1a2a1f3dd9e115dd07d0d3dc9c63b4

Download Submit
C:\Windows\SysWOW64\Mgaokl32.exe

Filesize
923KB

MD5
57c0306515baed9edf5b8d715f39bcc1

SHA1
7adacbd3a3ea7b289ce299635bd17f45f5cf26a4

SHA256
4ce3fe2bd60aab52a3b28bff101c916206508893479295ffc129e1c711e0476a

SHA512
a18373ed3df94707f8669c260fbe7c3586ad4d38636d891c719c8b4f93af83fc31d730e3fa0e1236cd2d8ccc28d4a2ad0cb20929b7ee81beb977d967f79fbd1a

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
923KB

MD5
b8d6a8cb02edc9e2d5a317dde38ee91a

SHA1
f336bb9c68eae5234e5491de32f1a61e2d132ae1

SHA256
c65013e31653a72bc2421776238a7be31c1164c17c2b79de398df49b99ea31b9

SHA512
30a3f7dc93667d3831bb3da7a9da9ed409c8769fb5a2d08c4a920c9a3f9cffb8317422b8111463abf68f61e8617f9f371d23147296b51514bfd6307466860955

Download Submit
C:\Windows\SysWOW64\Mjahlgpf.exe

Filesize
923KB

MD5
1b9e0a4d26421aca573ff20b200c832d

SHA1
8788d8c31f28effbbafe3fa481a7cad233e001be

SHA256
9cb4106c9205a134f6207c0ec216bbb88810e8fa4b8192ce941ca4aa592fa4c8

SHA512
b23d97e4a4deab4a493a7f8d117ce5c97c17a164625b792d5d0483d7d4204bce2a3a2fbe1519e9079720e139f3d6d41d75d9b541c580462ef6bfebb8c6f06b0a

Download Submit
C:\Windows\SysWOW64\Mlhqcgnk.exe

Filesize
923KB

MD5
8b653ee5f63fca6c0cf0aa4299e1795c

SHA1
2bd0a1e0c0a96a60503d75e171472ae92b0ac36e

SHA256
b75e653d0f445ad577e69ad968d1495f13d2981ede6efe8ab142995aeaec9659

SHA512
37871bbd760a29d3e6e6bf560c07a1b3beac29537efa62c804776b0f3f1d4a419f2fe9bab6a75027b829fe3f6a7ff92e686e7c6ecb13a19101fc9585ce288a94

Download Submit
C:\Windows\SysWOW64\Mlljnf32.exe

Filesize
923KB

MD5
aafd57251be3da979208188287cbba4f

SHA1
2c9e05fdc6d139d0fad03d3d295091d71c7fdcc0

SHA256
4bced1246ebb413a4f3b0063a95e5cdf59bbcae7c35feb54bf7964888c107c8b

SHA512
4714ae6419cc0e20bdebcee7e0f51e4364c430bad768d7e87a81723865acdea3aa07def4d79043bafa299488ba9f3d540b3010a749535682b77f96b3f1157a66

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
923KB

MD5
eb7504558180f42461563516e1d9bc85

SHA1
866637f83ac0e998ae2eab2c42c10d73dcdc4f7a

SHA256
831c705a03702b4c76d0016517e0ceff71925d7f94133bb7b38244ad200ebb13

SHA512
6d5d1b2776174e28ae97bab956ff56707d06de79cad693203da72058c7e381bf85354ddced54a2871dbc5fc09db6a0ca7186d81005056057e02a8987924897ab

Download Submit
C:\Windows\SysWOW64\Nagpeo32.exe

Filesize
923KB

MD5
f20156f92f6004058f037100ca351818

SHA1
ae042d55c82efbaf758d49a39fca4186f35e3a08

SHA256
520be22f3e19e071cc0a652df03b7b1e1ecb19ab9518a6f95714dcfcfbdfc64f

SHA512
00bb82cd33b3fdc03118c0d388f5bbed223ff771b7c5fca407a1e10511aa5c5dcc222ed2808455dbf764a0724fe62642ac055c110b3cb5b3fd7183847dda9d40

Download Submit
C:\Windows\SysWOW64\Ndflak32.exe

Filesize
923KB

MD5
afa5e788fff5fbcceee85af66e611e54

SHA1
0b61b8d08fdb5b7233995e7de166ce0838c64b30

SHA256
89cbfbf08c53cc5aed7062a3115fb2093ac60e3a2dbe5a3e93bd5e1d867d2118

SHA512
e553cb55bbdb9139a6c59e10379e7394369362be5d67cea27bfa2db3bab6463070d6f330fc12ace2c56e6684fad57cf31dee4f82d52baaa56a2729e7e390f279

Download Submit
C:\Windows\SysWOW64\Nijqcf32.exe

Filesize
923KB

MD5
e133815b513a673b848437d3ce51f05e

SHA1
b162297666c1be8e04df5196c95a8e49e146c3a1

SHA256
35174da7a00649f52077b53f0c34946ebd625f865c726e60eec4671cf02c9ddf

SHA512
9c2ee3e7bd0f3a527c87b2da828c1af683f49936de9b13fc0b9c76d23c1f192145e754a89aac3af7e44ffd8488bcd288e21663ee4e263d3620e5e2a1e67dd271

Download Submit
C:\Windows\SysWOW64\Ocnabm32.exe

Filesize
923KB

MD5
7d1115fc3eaeb580d1c70b4f30ba7f8d

SHA1
a980880d0623d1f553f032cc32b8324f9f08506e

SHA256
3bd3948d5aac2f9b4d497eb70d8881066a501496a4558e20aafd7b9a158173e8

SHA512
454974d2d57cccb7bf45ed2c9eaa5ad8702e5b9ed069d6a17f808f3527be4fa2e41128b64e640e04aed144396ab32671b4557ca47f09676a43f55a17326b910a

Download Submit
C:\Windows\SysWOW64\Offnhpfo.exe

Filesize
923KB

MD5
3dd7fc64815c3a7d0be8b155026ed6be

SHA1
f334ce2444850bdf7e58fe3c5e7ae4bb8ac0a599

SHA256
86cd22cf1c163045338886df89227cc2c551f39945e921c8f2ceac903e787543

SHA512
321fc6f4ce3ebc730b4b2106000addcc55a8642ef58eff8d7f17e4764894576b357b844aa4ce11be5ee790eb937cc5c1aab1295828e81879c5c2e919f6f70ff0

Download Submit
C:\Windows\SysWOW64\Ohcegi32.exe

Filesize
923KB

MD5
0784f1a73b576982082d7537c233ad2c

SHA1
085fb64bdf00e910d70ef6ca9a020bd0676c69d7

SHA256
c8a53c3baa565d5fdb344a6c0ffc5b8570d3d772aa0e1c5d312be6a81da86d55

SHA512
7463d4b68544b7edba907b07bf1260a6d6cdaf6d39d3fe649abe008bc362f24697da9331d1614ff5982e2d9ef9a597769dca55d7c13b0dd03b0a37b6a0ab7545

Download Submit
C:\Windows\SysWOW64\Pccahbmn.exe

Filesize
923KB

MD5
845259f2a96233379046f2e84c85ee88

SHA1
319d7e220589fe9bcc054e488ae6327b9ab3f82c

SHA256
1f496cb9f3f21851433b1445ab2d511fd2ee810a7163a336424ae8b010945b1f

SHA512
a76dd864a39f4c45bdadbce11ddad47c2a6aa7536c5557cecc73d9f94b6e7eee516d6391d337bed220e888e311ad7e91d596bf6641bfe8fff668fcf34ae2e442

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
923KB

MD5
8cdad6fb2686a69445a07aa975daa24a

SHA1
423c7ff68b2dd4df22572757b1237d1d007ef0c1

SHA256
22d5d9b74c4ec51aa912b27722c643433586e6919001f1171842e954dbb523e0

SHA512
2a10136cb2d5016d990689bc6aefd2bfc33d2a24d20640eace2a424997cf307a540ceacc08a48e590eac16399ed3c2314b8ef0d70999d468370d41e36fe95096

Download Submit
C:\Windows\SysWOW64\Pfccogfc.exe

Filesize
923KB

MD5
97a5e1ede7d31e44940e3f5f087319f8

SHA1
a200ebc92051bd13bc457fad7a5fe02300c61edf

SHA256
2acd669a6445459568f24d84ab38f88fdb23cd54cb1fc012c24e67ba389daa9f

SHA512
2d37ed1468adb7ea574be94ea3a47b0a440485f0512c017d67e60e6adb1a6f84b3a4e3c4eeac73f8c305e1f4af003e997d0fca13d5608e6797c6b053dee049bb

Download Submit
C:\Windows\SysWOW64\Pfepdg32.exe

Filesize
923KB

MD5
e5360e8006cf1aa5551bd22c8ba5dac6

SHA1
4e4a398503d6557d16bb26a2232f41ee8c45dd25

SHA256
7b5fac79bf995e54b79d9a2526e942c5efbd7551c01d7186f5d1a773e96154b4

SHA512
eccfda31338b4aedf3ba5b408ba15c2bc3d44636e5f14eee74f929b448c08b856bec28e950a1a9543ce197ff3705b1dead07d1969185c0e04f2a2e30108671ae

Download Submit
C:\Windows\SysWOW64\Pjdpelnc.exe

Filesize
923KB

MD5
75f4bad485c9ab265abc51a22f2f0d30

SHA1
a3887473ad7769a66103c287526ac1392c59cb85

SHA256
3a77e97c5dd37fa8121788d300ab5a349a6f1c6e95fdc300a72a55774ebd5926

SHA512
e19d6065e2a1ce5c569698f5975bb5184fa3bdba62501695ba1f0deba31fcb50295f0c0c1a6080ae5ea44c1c42d8a53f9a871b07a501fbf3c33fa3191373f114

Download Submit
C:\Windows\SysWOW64\Pkbjjbda.exe

Filesize
923KB

MD5
333d89feba15115d526a2ce7ae2fe1c5

SHA1
fce619efb8e9caa860c4efd48fcb5efd256aab38

SHA256
e310987f1e501a30aeb1020476642edbaf9ce853a1096768d606ec2a806671be

SHA512
eb70ff476a7da981cdf571abe364c2a3b99935db3ecf427cb82f34ec107fa38d059c86fa99b59114268be189c7932e18fe4797376ef3766cfca99d03eb9af19b

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
923KB

MD5
fc26019bfee0c0aa565078842e17a83a

SHA1
187e9449f8e78cc9346331960482f32ccd64e91e

SHA256
73e794279bbd6a319b40aa1991f078e130a4e3e76931cf398156ba6a0863edfb

SHA512
cfd3f94c4cc803b33813d65eec382304591002a9a18a11f301c65131f421f4a43c2ffbca285c869d3fb847ad1089b186355a0160b69440c012d6a294f5094e87

Download Submit
memory/368-149-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/684-599-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/684-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/716-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/884-198-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-165-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1092-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1216-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1300-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1320-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1320-557-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1420-85-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1512-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1588-125-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1596-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1672-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1748-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1752-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1796-173-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1968-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1972-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2012-205-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2104-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2180-246-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2264-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2272-369-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2288-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2288-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2288-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2304-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2308-213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2356-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2384-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-133-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2444-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2464-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2712-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2732-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2824-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2860-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2960-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3028-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3092-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3116-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3120-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3240-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3308-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3324-230-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3328-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3328-592-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3444-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3516-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3628-157-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3644-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3704-141-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3708-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3728-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3740-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3776-221-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3840-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3992-453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4124-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4440-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4440-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4496-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4508-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4600-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4732-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-117-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4864-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4872-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4968-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-181-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5016-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5032-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5160-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads