berbew | 3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe
Size

302KB
MD5

b11ce0dad760d5d1c5bf7550fd31c54d
SHA1

308da4073ae68129f9422a695d1fafffdac429e3
SHA256

3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8
SHA512

14f41cdcffe636dcd8addab82f2c558d5a0fef2e483d7119c90ba042001e7389f2975606e447f28456d663a0dc7fd53aa8b4f3d5a7b3250992891cff700505cc
SSDEEP

6144:hNTB1w+O/vHpio3FF7fPtcsw6UJZqktbOUqCTGepXgbWHp:hN9m+4f3FF7fFcsw6UJZqktbDqCTGept

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lekmnajj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpfbcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlofcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecefqnel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njmhhefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnlmhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enkmfolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pknqoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfhndpol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iplkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpoalo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jljbeali.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdobnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmkkmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkgcea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iefgbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klndfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojemig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbajbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcdjbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckiihok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Galoohke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iohejo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ockdmmoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmmbbejp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gigaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odhifjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgkiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmdemd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paiogf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbgnemjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gljgbllj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpecbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilafiihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mfpell32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcpmen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpcfmkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmlmkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Panhbfep.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
408	Cbgnemjj.exe
368	Cmmbbejp.exe
4232	Diccgfpd.exe
3664	Dfgcakon.exe
5112	Dckdjomg.exe
4000	Dmdhcddh.exe
1440	Dflmlj32.exe
5056	Dcpmen32.exe
3052	Dfoiaj32.exe
1412	Djjebh32.exe
3916	Dimenegi.exe
3636	Dlkbjqgm.exe
1324	Dpgnjo32.exe
4216	Ecbjkngo.exe
4280	Efafgifc.exe
1720	Ejlbhh32.exe
1596	Eiobceef.exe
4896	Elnoopdj.exe
1536	Epikpo32.exe
4736	Ecefqnel.exe
2648	Ebhglj32.exe
2592	Efccmidp.exe
2640	Ejoomhmi.exe
3048	Emmkiclm.exe
208	Elpkep32.exe
3696	Eplgeokq.exe
3136	Ecgcfm32.exe
836	Efepbi32.exe
804	Ejalcgkg.exe
2612	Eidlnd32.exe
1232	Elbhjp32.exe
3840	Epndknin.exe
2796	Eciplm32.exe
4328	Efhlhh32.exe
5096	Ejchhgid.exe
3192	Eifhdd32.exe
3144	Eleepoob.exe
3320	Eppqqn32.exe
4936	Eclmamod.exe
4180	Ebommi32.exe
4412	Efjimhnh.exe
4464	Eiieicml.exe
4828	Emdajb32.exe
1044	Elgaeolp.exe
2276	Fpbmfn32.exe
4484	Fcniglmb.exe
4792	Fbajbi32.exe
1848	Fjhacf32.exe
4404	Fikbocki.exe
4952	Fmfnpa32.exe
1628	Flinkojm.exe
3628	Fdqfll32.exe
2248	Fbcfhibj.exe
4124	Ffobhg32.exe
1792	Fimodc32.exe
2620	Fmikeaap.exe
444	Fllkqn32.exe
4128	Fdccbl32.exe
2704	Fbfcmhpg.exe
3504	Ffaong32.exe
4276	Fipkjb32.exe
3496	Fmkgkapm.exe
4488	Flngfn32.exe
2896	Fpjcgm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bgmakofh.dll	Eppqqn32.exe
File opened for modification	C:\Windows\SysWOW64\Ffclcgfn.exe	Fbhpch32.exe
File created	C:\Windows\SysWOW64\Plbhknkl.dll	Hlcjhkdp.exe
File created	C:\Windows\SysWOW64\Ikkpgafg.exe	Idahjg32.exe
File created	C:\Windows\SysWOW64\Npdpachh.dll	Dfnbgc32.exe
File created	C:\Windows\SysWOW64\Ndmdae32.dll	Hefnkkkj.exe
File created	C:\Windows\SysWOW64\Figgdg32.exe	Fdlkdhnk.exe
File created	C:\Windows\SysWOW64\Momkkhch.dll	Fdglmkeg.exe
File created	C:\Windows\SysWOW64\Hildmn32.exe	Hdjbiheb.exe
File created	C:\Windows\SysWOW64\Paoinm32.dll	Foclgq32.exe
File created	C:\Windows\SysWOW64\Foapaa32.exe	Fkfcqb32.exe
File created	C:\Windows\SysWOW64\Pjmmpa32.dll	Hhdcmp32.exe
File created	C:\Windows\SysWOW64\Qmhlgmmm.exe	Qoelkp32.exe
File opened for modification	C:\Windows\SysWOW64\Ibgdlg32.exe	Ilnlom32.exe
File created	C:\Windows\SysWOW64\Ibfnqmpf.exe	Imiehfao.exe
File created	C:\Windows\SysWOW64\Bmhocd32.exe	Bgnffj32.exe
File created	C:\Windows\SysWOW64\Eccphn32.dll	Hecjke32.exe
File opened for modification	C:\Windows\SysWOW64\Gdjibj32.exe	Gpnmbl32.exe
File created	C:\Windows\SysWOW64\Hgfoqnae.dll	Lndagg32.exe
File created	C:\Windows\SysWOW64\Lgnqimah.dll	Odhifjkg.exe
File created	C:\Windows\SysWOW64\Ajhapb32.dll	Njbgmjgl.exe
File created	C:\Windows\SysWOW64\Nlljlela.dll	Elnoopdj.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jcdjbk32.exe
File created	C:\Windows\SysWOW64\Lpiaimfg.dll	Inebjihf.exe
File opened for modification	C:\Windows\SysWOW64\Fdccbl32.exe	Fllkqn32.exe
File opened for modification	C:\Windows\SysWOW64\Ahdpjn32.exe	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Fpmfmgnc.dll	Ekajec32.exe
File created	C:\Windows\SysWOW64\Bnoddcef.exe	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Epllglpf.dll	Efafgifc.exe
File created	C:\Windows\SysWOW64\Olanmgig.exe	Oalipoiq.exe
File created	C:\Windows\SysWOW64\Geohklaa.exe	Gnepna32.exe
File created	C:\Windows\SysWOW64\Jencdebl.dll	Lncjlq32.exe
File created	C:\Windows\SysWOW64\Dmncdk32.dll	Baegibae.exe
File opened for modification	C:\Windows\SysWOW64\Dmcain32.exe	Dooaoj32.exe
File created	C:\Windows\SysWOW64\Dkhgod32.exe	Dndgfpbo.exe
File created	C:\Windows\SysWOW64\Pfejnf32.dll	Iciaqc32.exe
File opened for modification	C:\Windows\SysWOW64\Eqncnj32.exe	Ekajec32.exe
File created	C:\Windows\SysWOW64\Lmlnmdij.dll	Gmbmkpie.exe
File created	C:\Windows\SysWOW64\Cqichhmn.dll	Poliea32.exe
File created	C:\Windows\SysWOW64\Koaagkcb.exe	Kpoalo32.exe
File opened for modification	C:\Windows\SysWOW64\Ganldgib.exe	Galoohke.exe
File opened for modification	C:\Windows\SysWOW64\Gfhndpol.exe	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Bhpofl32.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Mjnnbk32.exe	Mbgeqmjp.exe
File created	C:\Windows\SysWOW64\Fpgkbmbm.dll	Nbebbk32.exe
File opened for modification	C:\Windows\SysWOW64\Nmipdk32.exe	Npepkf32.exe
File created	C:\Windows\SysWOW64\Ganldgib.exe	Galoohke.exe
File created	C:\Windows\SysWOW64\Mneoha32.dll	Jhplpl32.exe
File created	C:\Windows\SysWOW64\Jlhljhbg.exe	Jjjpnlbd.exe
File created	C:\Windows\SysWOW64\Migmpjdh.dll	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Ljqhkckn.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Lmdnbn32.exe	Lfjfecno.exe
File opened for modification	C:\Windows\SysWOW64\Fganqbgg.exe	Fqgedh32.exe
File created	C:\Windows\SysWOW64\Nchcpi32.dll	Ckmonl32.exe
File created	C:\Windows\SysWOW64\Qimkic32.dll	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Focanl32.dll	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Cgpfqchb.dll	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Knienl32.dll	Efjimhnh.exe
File created	C:\Windows\SysWOW64\Adfnofpd.exe	Aojefobm.exe
File created	C:\Windows\SysWOW64\Qhjmdp32.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pimfpc32.exe
File opened for modification	C:\Windows\SysWOW64\Fjhacf32.exe	Fbajbi32.exe
File created	C:\Windows\SysWOW64\Cjpekc32.dll	Pdfehh32.exe
File created	C:\Windows\SysWOW64\Cnnjancb.dll	Gbpedjnb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12800	13284	WerFault.exe	680

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmmolepp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkgcea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llodgnja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfkqjmdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokdnjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eplgeokq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpjcgm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikkpgafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnlbojee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnfnlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehbnigjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkbdmbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Damfao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jidinqpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kidben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jncoikmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnbgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgpfbjlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koaagkcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aopemh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edeeci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjfnedho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikpjbq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijegcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcimdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaoaic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icfekc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jinboekc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehlhih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfpell32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iohejo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmfnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efafgifc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdglmkeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkkgpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neclenfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmhlgmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjjpnlbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qlimed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdqfll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddifgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dimenegi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebommi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fllkqn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaamn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfchlbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejoomhmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahdpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giecfejd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhdcmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibhkfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nclbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dolmodpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiieicml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbhpch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgfapd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhnkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibaeen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgbloglj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Koodbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iimcma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcdjbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpcjgnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdfggeba.dll"	Elpkep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmdgikhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaiemli.dll"	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpipfd32.dll"	Dimenegi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckdpj32.dll"	Eidlnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpclce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhkmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmfqknfm.dll"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emmkiclm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohlljcfl.dll"	Emdajb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbjnik32.dll"	Fdqfll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmlmkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhnikc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmpcbhji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elbhjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Doojec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkeekk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lljdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbflncid.dll"	Hgfapd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenqhaga.dll"	Eiobceef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgmakofh.dll"	Eppqqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iljekoej.dll"	Eiieicml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fnkfmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Likage32.dll"	Ojemig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iljpij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddooacnk.dll"	Ikkpgafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aadafn32.dll"	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fimodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mohidbkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciggeb32.dll"	Bnmoijje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kcbnnpka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgccinoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Focanl32.dll"	Fnbcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gndick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eidlnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgkan32.dll"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icnklbmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Linhgilm.dll"	Fmhdkknd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aojefobm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cikamapb.dll"	Hifcgion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mjnnbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqmojd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 408	4052	3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe	83
PID 4052 wrote to memory of 408	4052	3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe	83
PID 4052 wrote to memory of 408	4052	3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe	83
PID 408 wrote to memory of 368	408	Cbgnemjj.exe	84
PID 408 wrote to memory of 368	408	Cbgnemjj.exe	84
PID 408 wrote to memory of 368	408	Cbgnemjj.exe	84
PID 368 wrote to memory of 4232	368	Cmmbbejp.exe	85
PID 368 wrote to memory of 4232	368	Cmmbbejp.exe	85
PID 368 wrote to memory of 4232	368	Cmmbbejp.exe	85
PID 4232 wrote to memory of 3664	4232	Diccgfpd.exe	86
PID 4232 wrote to memory of 3664	4232	Diccgfpd.exe	86
PID 4232 wrote to memory of 3664	4232	Diccgfpd.exe	86
PID 3664 wrote to memory of 5112	3664	Dfgcakon.exe	87
PID 3664 wrote to memory of 5112	3664	Dfgcakon.exe	87
PID 3664 wrote to memory of 5112	3664	Dfgcakon.exe	87
PID 5112 wrote to memory of 4000	5112	Dckdjomg.exe	88
PID 5112 wrote to memory of 4000	5112	Dckdjomg.exe	88
PID 5112 wrote to memory of 4000	5112	Dckdjomg.exe	88
PID 4000 wrote to memory of 1440	4000	Dmdhcddh.exe	89
PID 4000 wrote to memory of 1440	4000	Dmdhcddh.exe	89
PID 4000 wrote to memory of 1440	4000	Dmdhcddh.exe	89
PID 1440 wrote to memory of 5056	1440	Dflmlj32.exe	90
PID 1440 wrote to memory of 5056	1440	Dflmlj32.exe	90
PID 1440 wrote to memory of 5056	1440	Dflmlj32.exe	90
PID 5056 wrote to memory of 3052	5056	Dcpmen32.exe	91
PID 5056 wrote to memory of 3052	5056	Dcpmen32.exe	91
PID 5056 wrote to memory of 3052	5056	Dcpmen32.exe	91
PID 3052 wrote to memory of 1412	3052	Dfoiaj32.exe	92
PID 3052 wrote to memory of 1412	3052	Dfoiaj32.exe	92
PID 3052 wrote to memory of 1412	3052	Dfoiaj32.exe	92
PID 1412 wrote to memory of 3916	1412	Djjebh32.exe	93
PID 1412 wrote to memory of 3916	1412	Djjebh32.exe	93
PID 1412 wrote to memory of 3916	1412	Djjebh32.exe	93
PID 3916 wrote to memory of 3636	3916	Dimenegi.exe	94
PID 3916 wrote to memory of 3636	3916	Dimenegi.exe	94
PID 3916 wrote to memory of 3636	3916	Dimenegi.exe	94
PID 3636 wrote to memory of 1324	3636	Dlkbjqgm.exe	95
PID 3636 wrote to memory of 1324	3636	Dlkbjqgm.exe	95
PID 3636 wrote to memory of 1324	3636	Dlkbjqgm.exe	95
PID 1324 wrote to memory of 4216	1324	Dpgnjo32.exe	96
PID 1324 wrote to memory of 4216	1324	Dpgnjo32.exe	96
PID 1324 wrote to memory of 4216	1324	Dpgnjo32.exe	96
PID 4216 wrote to memory of 4280	4216	Ecbjkngo.exe	97
PID 4216 wrote to memory of 4280	4216	Ecbjkngo.exe	97
PID 4216 wrote to memory of 4280	4216	Ecbjkngo.exe	97
PID 4280 wrote to memory of 1720	4280	Efafgifc.exe	98
PID 4280 wrote to memory of 1720	4280	Efafgifc.exe	98
PID 4280 wrote to memory of 1720	4280	Efafgifc.exe	98
PID 1720 wrote to memory of 1596	1720	Ejlbhh32.exe	99
PID 1720 wrote to memory of 1596	1720	Ejlbhh32.exe	99
PID 1720 wrote to memory of 1596	1720	Ejlbhh32.exe	99
PID 1596 wrote to memory of 4896	1596	Eiobceef.exe	100
PID 1596 wrote to memory of 4896	1596	Eiobceef.exe	100
PID 1596 wrote to memory of 4896	1596	Eiobceef.exe	100
PID 4896 wrote to memory of 1536	4896	Elnoopdj.exe	101
PID 4896 wrote to memory of 1536	4896	Elnoopdj.exe	101
PID 4896 wrote to memory of 1536	4896	Elnoopdj.exe	101
PID 1536 wrote to memory of 4736	1536	Epikpo32.exe	102
PID 1536 wrote to memory of 4736	1536	Epikpo32.exe	102
PID 1536 wrote to memory of 4736	1536	Epikpo32.exe	102
PID 4736 wrote to memory of 2648	4736	Ecefqnel.exe	103
PID 4736 wrote to memory of 2648	4736	Ecefqnel.exe	103
PID 4736 wrote to memory of 2648	4736	Ecefqnel.exe	103
PID 2648 wrote to memory of 2592	2648	Ebhglj32.exe	104

C:\Users\Admin\AppData\Local\Temp\3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe
"C:\Users\Admin\AppData\Local\Temp\3dd6a9616b6afd422b40f4721798ee7d848423173bab9deccb93c0e3077b11a8.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\Cbgnemjj.exe
  C:\Windows\system32\Cbgnemjj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\Cmmbbejp.exe
    C:\Windows\system32\Cmmbbejp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Windows\SysWOW64\Diccgfpd.exe
      C:\Windows\system32\Diccgfpd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4232
    - - C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
      - C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        23⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2640
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        28⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        29⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        30⤵
        Executes dropped EXE
        
        PID:804
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        33⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        34⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        35⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        36⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        37⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        38⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        40⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4412
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4828
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        45⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        46⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        47⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4792
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        50⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        51⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        52⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        54⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        55⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        57⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:444
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        59⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        60⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        61⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        62⤵
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        63⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        64⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        67⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        68⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        69⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        70⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        71⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        73⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        74⤵
        Drops file in System32 directory
        
        PID:3856
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        75⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        76⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:616
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        78⤵
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        79⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        80⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        81⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        83⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        84⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2700
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3096
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        87⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        88⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        89⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4844
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3928
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        92⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        93⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        95⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        97⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        98⤵
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        99⤵
        
        PID:180
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        100⤵
        Drops file in System32 directory
        
        PID:864
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        101⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3232
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        103⤵
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        104⤵
        Drops file in System32 directory
        
        PID:2008
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1452
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        107⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:1128
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        109⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        110⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        111⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        112⤵
        Drops file in System32 directory
        
        PID:4036
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:228
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        116⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        118⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        119⤵
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        120⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        122⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        123⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        125⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        126⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        127⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        128⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        129⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        130⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        132⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        133⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        134⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        135⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        136⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        137⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        138⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        139⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        140⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        141⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        142⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        143⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        144⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        145⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        146⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        148⤵
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        149⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        150⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        151⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        152⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        153⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        156⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        157⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        158⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        159⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        161⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        162⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        164⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        165⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        166⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        167⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        168⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        169⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        171⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        173⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        175⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        176⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        177⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        178⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        179⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        180⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        181⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        182⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        183⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        187⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        188⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        189⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        190⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        191⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        192⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        194⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        195⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        199⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        200⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        201⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        202⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        203⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        204⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        205⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        206⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        207⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        208⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        209⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        210⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        211⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        212⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        213⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        214⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        216⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        217⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        218⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        219⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        220⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        221⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        222⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        223⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        225⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        226⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        227⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        228⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        229⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        230⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        231⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        232⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        233⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6180
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        234⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        235⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        236⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        237⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        238⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        239⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        240⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        241⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        242⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        243⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        244⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        245⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        246⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        248⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        249⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        251⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        252⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        253⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        255⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7920
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        257⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        258⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        259⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        260⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        261⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        262⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        263⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        264⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        265⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        266⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        267⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        268⤵
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        269⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        270⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        272⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        274⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        276⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        277⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        278⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        279⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        280⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7536
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        284⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        285⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        286⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        287⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        288⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        289⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        290⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        291⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        292⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        293⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        294⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        295⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7916
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        298⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        299⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7540
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        301⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        302⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        303⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        304⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8380
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:8424
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        307⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        308⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        309⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        311⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        312⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        313⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        314⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        315⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        316⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        318⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        319⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9008
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        320⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9120
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        322⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        324⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        325⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:8464
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        327⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8696
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        329⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        330⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        331⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        332⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        333⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        334⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        335⤵
        Drops file in System32 directory
        
        PID:8368
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        336⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        337⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        338⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        339⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        340⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        341⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        342⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        343⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        345⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        346⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        347⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        348⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        349⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8956
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        351⤵
        Modifies registry class
        
        PID:9220
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        352⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        354⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        355⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        356⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        357⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        359⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        360⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        361⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        362⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        363⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        364⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        365⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        366⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9924
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        368⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        369⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        370⤵
        System Location Discovery: System Language Discovery
        
        PID:10048
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        371⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        372⤵
        Modifies registry class
        
        PID:10132
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        373⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        375⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        376⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        377⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        378⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        380⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        381⤵
        Drops file in System32 directory
        
        PID:9616
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        382⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        383⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9820
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9916
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9992
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        387⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        388⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        389⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        390⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        391⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        392⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        393⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        394⤵
        Drops file in System32 directory
        
        PID:9776
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        395⤵
        System Location Discovery: System Language Discovery
        
        PID:9896
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:10016
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        397⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        398⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9432
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        401⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        402⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        403⤵
        Drops file in System32 directory
        
        PID:9976
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        404⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        405⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        406⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        407⤵
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        408⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        409⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        410⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        411⤵
        Drops file in System32 directory
        
        PID:9232
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        412⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        413⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10264
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        415⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        416⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        417⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        418⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10488
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        420⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        421⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        422⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        423⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        424⤵
        System Location Discovery: System Language Discovery
        
        PID:10716
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        425⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        426⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        427⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        428⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:10948
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:10996
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        431⤵
        Modifies registry class
        
        PID:11040
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        432⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        433⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        434⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        435⤵
        Drops file in System32 directory
        
        PID:11228
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        436⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        437⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:10432
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        439⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        440⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        441⤵
        Modifies registry class
        
        PID:10680
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10772
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        443⤵
        System Location Discovery: System Language Discovery
        
        PID:10844
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        444⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10972
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        446⤵
        Drops file in System32 directory
        
        PID:11068
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        447⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        448⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        449⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        450⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10464
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        451⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        452⤵
        Drops file in System32 directory
        
        PID:10748
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        453⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        454⤵
        Drops file in System32 directory
        
        PID:11004
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        455⤵
        Modifies registry class
        
        PID:11096
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        456⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        457⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        458⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        459⤵
        Drops file in System32 directory
        
        PID:10884
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        460⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        461⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        462⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        463⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        464⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        465⤵
        Modifies registry class
        
        PID:10328
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        466⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        467⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10868
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        469⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        471⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        472⤵
        Modifies registry class
        
        PID:11352
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11396
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        474⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        475⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11524
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        477⤵
        Drops file in System32 directory
        
        PID:11568
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        478⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        479⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        480⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11700
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        481⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        482⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        483⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        484⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        485⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        486⤵
        Drops file in System32 directory
        
        PID:11968
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        487⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        488⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        489⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        490⤵
        Modifies registry class
        
        PID:12144
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        491⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        492⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        493⤵
        Drops file in System32 directory
        
        PID:12276
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        494⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11392
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        496⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        497⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        498⤵
        System Location Discovery: System Language Discovery
        
        PID:11588
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        499⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        500⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        501⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        502⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        503⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        504⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        505⤵
        Drops file in System32 directory
        
        PID:11976
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        506⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        507⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        508⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        509⤵
        Drops file in System32 directory
        
        PID:12208
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        510⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        511⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11448
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        513⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11560
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        515⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        516⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        517⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        518⤵
        Modifies registry class
        
        PID:11988
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        519⤵
        System Location Discovery: System Language Discovery
        
        PID:12040
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        520⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        521⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        522⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        523⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        524⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        525⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        526⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        527⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        528⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        529⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        530⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        531⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        532⤵
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        533⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        534⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        535⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        536⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        537⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        538⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        539⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        540⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        541⤵
        Modifies registry class
        
        PID:12488
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12524
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        543⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        544⤵
        Modifies registry class
        
        PID:12600
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        545⤵
        Drops file in System32 directory
        
        PID:12636
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        546⤵
        Modifies registry class
        
        PID:12672
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        547⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        548⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12780
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        550⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        551⤵
        Drops file in System32 directory
        
        PID:12852
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        552⤵
        Modifies registry class
        
        PID:12888
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        553⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        554⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        555⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        556⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        557⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        558⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        559⤵
        System Location Discovery: System Language Discovery
        
        PID:13140
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        560⤵
        Modifies registry class
        
        PID:13176
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        561⤵
        Drops file in System32 directory
        
        PID:13212
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        562⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        563⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        564⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        565⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        566⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        567⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        568⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        569⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        570⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        571⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12776
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12848
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        573⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12916
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        574⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        575⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        576⤵
        Modifies registry class
        
        PID:13096
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        577⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        578⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        579⤵
        Drops file in System32 directory
        
        PID:13300
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        580⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        581⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        582⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        583⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        584⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        585⤵
        Modifies registry class
        
        PID:12956
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        586⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        587⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        588⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13284 -s 232
        589⤵
        Program crash
        
        PID:12800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 13284 -ip 13284
1⤵
PID:12512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahfmpnql.exe

Filesize
302KB

MD5
7c85324c83b2e08175c9c41ffd15c337

SHA1
181712dfefad67fc673734097443a1134b726528

SHA256
7ee9c5c54c7853fdd93a97d8ae9879203b3150f28101f590fbded6465f4c4305

SHA512
8d2bef592f4bf9f60561b7d939ac7dc9c154397dc1815609c006aff2ac32854b9ba50d2952d66a2738c0d8e0b5ec29870ead2a11d8749be440004fed94ca0a58

Download Submit
C:\Windows\SysWOW64\Aojefobm.exe

Filesize
302KB

MD5
9d5dd730305acd7a9dd0e791976fb593

SHA1
a621715320462c843ff71b6d44541dfec55aa487

SHA256
2563fb023b3e4b59e5b5b04390a37c830ce44ace6279c459197122116ac3ba66

SHA512
94d83cd92ebefa675b4c329b1eefe414040de28288cd42d72c1ea03adba7862984f39bd259df76cc9e191f601a467c735fd2488b1c7a017bd7ddc910c701f61d

Download Submit
C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
302KB

MD5
d4e62e1581f4167c1713a579fa9605ca

SHA1
7d339f208a9a9b3736e9f013d76b2101ef5946b5

SHA256
10f7678b2d84ef13970c53a984542084e72af39439b925344a02d4e903134864

SHA512
66aae0fe90693a5bb691402b5fd99edb6849ee62a2798d49cd21b5b03317b81683966235eadb97dd4a08edfb8d3a26f4de2ca7ef946ea1215e3551f128d0e8f8

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
302KB

MD5
812f91284a8f0a0c4c124070d88f1bd4

SHA1
07115cf4ec7682a2e5568eb04c6b120b71149bfa

SHA256
6a43d8628ea5a51ea40673a91372fbe98825f6d32b159618f659a3943f86f3a6

SHA512
fa5ff09f0953f8a3360785a032fddc2f1c1d0176e3beb6c7218c320407c65c4eedf5c3f7d78d646e0c1af137e6b9c6d01e3d856d925a6065216c9028f6686982

Download Submit
C:\Windows\SysWOW64\Bgkiaj32.exe

Filesize
302KB

MD5
a5003eb9b87fbfa90f261d5a770c6dd0

SHA1
5fae1aa584fcc4af770f57d849c427dec5f3be43

SHA256
fd0e3aa329108948690a5caeba4b177fc9d70e42bd0f0d61d6a343ee54d3c9ec

SHA512
dd5ca255921d96db5d2910c4e1c619946d37b2b84e5e87fe3934012e461698fbe44e9461da6260c77095669242d055db09a1d719e8ef5e605c98555bcff1f795

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
302KB

MD5
417e66a86a631721b9bdf70dfeee26a6

SHA1
d17a5106f2165f978e0020eab49745d054faa080

SHA256
321249ec887e5233e5ec26c813e1f4dea29b414c462984fbc952ec421b9362b4

SHA512
bd88edbe6427e159521a452c0cff247ca5e746c0c12f47bd575a9de1cb59869dfa8eabf2391b274242aecbe18dc09cc5153d5cc851db1e0f5fef80f4ecab8ad8

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
302KB

MD5
4c1d4a0195c2a5d9a0e1fb68cdbcada5

SHA1
f2d4b54366807367a4694014cb88e759a08ae66f

SHA256
dac806094b8f6ac80d35ec538c16932cbaafcb4ad3ec1093bd933c124e6b970e

SHA512
c4ff9e219f8eb3656861ed4a831a791333e4546b69a62b6bfe07c78d7a0bcd0baeec8239e3f7f5ca4a9a8be3af1d4bea58262a6750b48066f92d2d5bae231124

Download Submit
C:\Windows\SysWOW64\Bmhocd32.exe

Filesize
302KB

MD5
81a789725f2fdc7219695b26fec812a0

SHA1
c0687f4b9ff433af1ef2f5013946f5084f1bc7ad

SHA256
bd80e563dd8bf9c042d5b6e303b0b878eb62843275a48e6dc9d73c091f5d93ca

SHA512
a94aa6fdd15ea5a83a82a1f6e4f30a3e671020e41f3a88a7d4d0110d1ecba71eca2008fcdd20b00a4d6a9c1abd010cc8158973d129015aa69623ca75cb8f37bd

Download Submit
C:\Windows\SysWOW64\Bnoddcef.exe

Filesize
302KB

MD5
92d5ebeee4ccb530ba9c020b1e6a9efb

SHA1
ef5cdb472487365eacc78442383b06ed12fcdfa6

SHA256
5404f7fd8f769b4d5c1294d2dbeb16d391fabe9ca30498a0bf50f37db660183a

SHA512
fcd4991877a5a20dee247244913043fb6d5d7d15487da11602b50535466afe089ea8a76d7ae33d82405aaabdacdeaddf228d45c0b8ac07d15c107c15fb8715d2

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
302KB

MD5
a9a017b425af5a953bcc3b3b873eee67

SHA1
ca137a23150cb7607eb360c692270410a76a66df

SHA256
55b871c67a4f75848f0bdda119c2c85365501e3229467422cf20e01e2d9efb28

SHA512
df6d5316f7d76fd2341aef7ec8c2802ca6ad5cdf3d339816c26d3fccdb199956c94477fc59ed17a5ed22eee96cd8328b93d9f8926f3caee00f81bb0cca755ff2

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
302KB

MD5
bedd3888e64ff39f2910e39dd2f0c52a

SHA1
63e63c1577fafe253fda11eb44ab990314c5109c

SHA256
283f1191ee92547c086febdb110cbcab437e9873f0af245c3069ef64bfa49173

SHA512
bc744010c8b330bdaacaf00866f9950d72cdab929bafa09badac95b7b008939f24136081575cc8ec85a5ba52b1a3fc008220306ba1437e04c1871c519769916d

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
302KB

MD5
d5f44b9f022c5a69946943d0e67adaf5

SHA1
6807fe90aa79e7aaefa5895d9cfd4f3218417dbe

SHA256
66a50fb6e6b26094e29aabfd4de0d3f30b351b8edd790fc884301bba054ee216

SHA512
f196e24a87cd16b08f22ea8aed5ee6777a45e3f2c021f2162e3243ae0c172f519869cfc60be8ba36ea8cc8ccabeb844bd2e1d68dcecdd3151ce42d4e6fda5c9c

Download Submit
C:\Windows\SysWOW64\Cmmbbejp.exe

Filesize
302KB

MD5
93c8f8a08b3d065d729ca12da1bf17a7

SHA1
bc2043f7148d63f2f637f8f07ab571231c3d3dd2

SHA256
223891ac80d2c54b248065fd8af1891d313decb5652a0c11d8575ae971ca7791

SHA512
2fc6db039688526aa5b01d7f3931e1ad21d9368552fbffbc7b0b36ee8fee1a81e3eea49e0bce319b710d9d89c19575d1f02faecec7f6db3e2012271dee8b31db

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
256KB

MD5
3d69333937b3e52943c94d0a9424b220

SHA1
bc1a9dbdd882134ebd7881858b92276bcbef1c17

SHA256
ed691f6ad9d3c260dadc78d31efe6ba470208d5b5787d423ab834da316311558

SHA512
d325c4078996b5aaf93f925a570a43f2f18e0c617ac74a05e06d72cad49bfedaa4585248a2167d7498e581c2eeeec4aa96514222825168d1634ae0e6ffdd0edc

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
302KB

MD5
ca9e4c07ad61f1da14589f6140475bf0

SHA1
e173e647cf5ac7374e4952867ddf920776f608ec

SHA256
092cbe0cb357371f9c66449901f2230b311f47e48b7d745c6fafb9e5ff60407a

SHA512
cc2959922c5aaa9a9098c5025d397647fb8c9938e1fcfc62b7e57189106870bbb18cfbb185ecc3f6f71bdde0f57cc64783302ada787c6560d4fb9d5aa49afab8

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
302KB

MD5
ea87356d3e4bf03d780db34191d0fef9

SHA1
bf55e93a5a44bba7a1fad0cb76cfbccc593e52b0

SHA256
fda23be9c00b60f5f350fea90300f6120bc96f5af2ca1fc197e5cf83816c3c1e

SHA512
3320f3a694c1c4ce58549bc5e723041c04fa1a7c1a2f08e54c0d2264a28d06d702df1c1da4b83a46b08ea85dc62d181ffde240b95860e3aa29fd89980190678a

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
302KB

MD5
f1a428e7e500db41b8d95033c0d7c61e

SHA1
5461daec1ce1193e04398c522808141c192c7fe3

SHA256
bef15d5c8464fbb7bcf5e5ea2ba5074b54301cd382c385d5f8cfd40d14267919

SHA512
2713731e4f80d84f8bf0dffef37c08986d484ce201fb117f5a74dd28f9166c161fafd75a6a39a065d3691672810ab288bf3387af8e8a8dc7da3064d58e49d6c0

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
302KB

MD5
49f02a97eacd6c3b6ea221571792f2b6

SHA1
6098990e4b19c2775d5ffe1c8ca04efb1df25089

SHA256
7c5fa30ebe620fcfc04a5d6e43e2d7aa608cf8f4cf204f36aa53998c2c018c7f

SHA512
272d2edca582b2bf038b77aca6525f701233323a05c4dfe1ec1214a3b4de14484b209e5ce62e9d6dd7d74575c6e3540f900317ef43bb24b4496b88d37a34fafd

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
302KB

MD5
5a1dccec584d897d7a17bd9b90350447

SHA1
425f7ceb584fd91aaf6577dc36bb2f59f240a6d2

SHA256
2bc2e09a860f97978b3f6339b7b5b0499129eb7c86d56a4061f34571d0c3d9bb

SHA512
0563d52ca162ad27f3a5ecfb7c0bbc4d0b451873e0f3cbde4d369cce0d594dd91edc6b6829c65302292b1a3c291279f9df67079c622adcd1f062be15544d6f9d

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
302KB

MD5
d20bc90cfb7c4512e0fdb05227f6b83d

SHA1
fde9847756ad9d92e8be21c0d67ea6623a5a23e2

SHA256
08fbc078b931341acb0e379c8e5e1a9e69757f0deec026f06b395e680ab075de

SHA512
f12110b92bcfb813bc304507e07aa7ae7ae871e0d89137cfe5c87a6740cb7b5d8676d7e2c85e2c33966bbe4ea2d90780bc5ffdb0877526ae2240debf02b059ff

Download Submit
C:\Windows\SysWOW64\Dgeenfog.exe

Filesize
302KB

MD5
7a8b0e52ac4fd48b85509a0438399914

SHA1
6d8e3fd97c6622d0936953b435f231c851a986c6

SHA256
ce4719c9e396197c4cd1bcc89c48ae0dce9b4de7e5274160382062fa95669ef2

SHA512
44dc0c4ee4bc90d22b07dfc774b226bd9358c5114b8fe37b1975036e182c18c73af45b57d52c10ec70271a18cdd1b7d6908d772b0b2fe65bcdfd68cc91a883e4

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
302KB

MD5
5e6150b4e27f80313eb316fb632d04f7

SHA1
6c4e79ccdaabc878307b3d9ca2ecb5eda4a6542d

SHA256
8d1138cfeb31c63aa12abcb3c25f56468b43a09e561acaba2210c35d0008b61d

SHA512
1c692575c5961b22d41251507bfe87de812b6e022b5160c680e7fb51799e83b1da8f07ccf1c7759af32d584e83e4298d49489ad2bd21e1a33204d17e4c35edeb

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
302KB

MD5
3378bbdb7e50d3fa3f1ade7280034c00

SHA1
fa886aebcad57aad1a44e65e04c1289cfd0b6a9f

SHA256
80d2fdf512cc9c5f99136c77cdda01794e7974d3dc16db372dbfc36faedd9d0e

SHA512
10df60359ac0a90dca6ea6d68231c2817db35ed35b0b264b8d356e8f5a06b6aa0ce84a501b13063a636d29bd5d7d6a8c1e5896f7f3f1e0719f446883a9bde595

Download Submit
C:\Windows\SysWOW64\Djjebh32.exe

Filesize
302KB

MD5
2b44a8c5c419bbeea1041349a2742217

SHA1
2b46627b835918ecfe4c54996ddbb7b4691d8749

SHA256
658363d320758c7d7aca08a255625e27d24c460656d6a63159cdfba02ed439d2

SHA512
2b6f1e1bee59199b00a6b6ea7c1d8203f9bd3d56199df0d3a6e7856e3e4d9518211fcb35f175222c11f430e88bcd30df27fe14e1e8dde7766e927f2514159581

Download Submit
C:\Windows\SysWOW64\Dkndie32.exe

Filesize
302KB

MD5
b37e6e9791017c534d9d4a2fa183962d

SHA1
b76dfb2b512f52c46d7bdc604a5f4afa76a637c1

SHA256
8fda26acc98897cfeadcb4ad2496e505eaa6e5a9f99ad23a15cd2d6396c4f691

SHA512
f796bdf2e5fc68f580a38b1bb6f5f472eb8778e2b81e5821c880c98a54bc3effb2233d3811bba0d270cb4ac8b7c35e60654bbcf43a4d5adb78deff9f2e678c33

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
302KB

MD5
5c4841d20dc9896fd25ed1c4383003c0

SHA1
dcb763dea49b47dc8faadd6549d12e4a86c2b5f9

SHA256
dd6756b96c2a94323ec3a895bcedf9165c225fca51b8971caeb2f7cf2cbd0903

SHA512
90d6ff4f6cbaae19c612999459032df25310c57a33701767706b86aa3d009483b17cd2a591002a1b98c7df2fce383657f7a71647c844210bbb1426321d459312

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
302KB

MD5
9f6981146b34233bd257df8e2349dab0

SHA1
ebecddaf5ea8f17a18e24b20840d421b68ee975b

SHA256
f83967eff0eeb6a8f373fea6744e479238a73c28bdd593a8410a4dfee23956f8

SHA512
04ec3382909a2e392f5d82104e1f380ab16bc0391e58affec633dfa69f2bbc1c8cd4a1f1ca01cd944ee0d4d43f828476588428f4b54e06d1d9d2c7281c96e864

Download Submit
C:\Windows\SysWOW64\Dndgfpbo.exe

Filesize
64KB

MD5
a9eb9484519bfeff3a27a03e8bd957be

SHA1
5d44a8e815b44147cc5e0ebb6d7e5a47a1a54a38

SHA256
d6fedd7bdb2a29d1cf9700b80f3f6fbbd1c7574ee51b96e61fc6f5e60b048582

SHA512
5851b8cb0baf03d00b4a6c4b370d53f8ecbd2ad656d0977d69bc8e946f099b410d6e6e51c6a298833412e47c58d88aaa57b174f078b72e9ea379adb28a945314

Download Submit
C:\Windows\SysWOW64\Doojec32.exe

Filesize
302KB

MD5
47f130a184cd864c869fa0f505362a18

SHA1
ca17a34c6728a2a82527de857231b3a80f84f818

SHA256
b341778d2686cb5ff4740507c035cfc662d14657c19a2d91403ec07bacf6cd5d

SHA512
556e873f3a62ea9e8e4097da8dffc2a68e646feadbaaff7b3a87b585b5cab0bc5b0b6cb044b0601a609ed7e4f6103d09622b5fb0d62d31d13c8521285dc64d2b

Download Submit
C:\Windows\SysWOW64\Dpgnjo32.exe

Filesize
302KB

MD5
257bc58e9ab7a1a4a3c925f638ed4bb7

SHA1
1bb857d6d7e5c0169b59557bd78303dc8248d7e6

SHA256
570990d2b6b7aae4d8120cd17e8be6ba5612f0a0f9c01cd8e4dfb46a11b4a90d

SHA512
525900903f15019e73807fc0dcf7212889020dbfdeb6478b9c3f81985a001b0d54620303494cb5372157b8d99a3ef9a45379b5125d10b7138fe909c04f71c9f5

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
302KB

MD5
6a5b001ffde9c8b270dec44f488ac88c

SHA1
15741d5263bbaf3e24a92c496c4787956821c594

SHA256
773bf39518c9a58ebed05d4adca9127e6871cf12515b61e3e0ea53528d42e877

SHA512
238b03679ba751c27fd7b15b1e9ded9bc23b3a17e42a895c6d5c060a0a3bd92fd09eb6906e47b97613eef267e41ea19ca28f7686b7dacd072a21ec5a82bf56f8

Download Submit
C:\Windows\SysWOW64\Ebhglj32.exe

Filesize
302KB

MD5
0735b6886424e4353f1b66c393effae7

SHA1
36378848f36c23241cb98f55ec9c50c3ce4433bb

SHA256
21c25552c3e21420114ff9555a80514846bfeb57640b815995564de109aba82b

SHA512
99836cb5fa8e2458249b9494b906cc930481ba2ef7df1a59294877d9c318a689cb3f9ee686944d3884210f04f2095e3a33a4bae6bfd94ecad587971f5431c9ab

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
302KB

MD5
2feb0e030bcdc12972102efb0016e281

SHA1
5ed93a593b0e0d3e5774cf05148178c99835e0e0

SHA256
12469eedd47477ec43f395e75eb2df15009c618a22f21f73bc1fbf34b37c54ee

SHA512
2943a6c40cda39021f25309679c07896ae17879308a118ae4eef6edc109c5fc836e5c6a07fa8614e0d7de0321cf5477691580d95b66436ce702055fcaf15be79

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
302KB

MD5
a6aec00fa6d05acf97a07b8c2329c594

SHA1
2635b867aa9f7f2af1bb70a89f4fa00daa1bc3a8

SHA256
b5259ed96fc0a6e5e41107140ec833026404613be7aafe00286608feb9aa2a71

SHA512
d3fc1faab7e7096649ea187a6c3d05aa58e16f3e38ab944419929a5cd72e78e53a98b7f334c19ca7f958656af183d311216350a5340416164ee03e8904e0e39f

Download Submit
C:\Windows\SysWOW64\Ecgcfm32.exe

Filesize
302KB

MD5
54b27ae65d2b24c80832e03c2278e616

SHA1
186493bda7016b5a101dc6442853eb4995519eb0

SHA256
ba9051dec4800e5f10fd27ba08eb0f416859e43ce4fd44bd3a268c71613c6f73

SHA512
834bf42a0975fc31a69a3a5452ca21b767d6374a90104c4f367dfc42bf0f6af75405237d76e292ae7218a741dd77a5e588a82d3bdaac0916068b9ed41a04a46f

Download Submit
C:\Windows\SysWOW64\Edeeci32.exe

Filesize
302KB

MD5
0e3501a990bee12a2ff4b84dee829031

SHA1
d4357564ab329cc88e4d786b75b5b25b72a6ed53

SHA256
6c152a28d0c02a4c3a99133aaa4c7761c3144b5ef7fac3e162812030bc3aefb4

SHA512
72e42b721530effbb01781f83e077c98ac0d7b13381b0457e14ffc1a0c6ebefba1b753cb56b7b6d756f3695841c68a33a1866f448d722a3a248e1a7e2491b50c

Download Submit
C:\Windows\SysWOW64\Eecphp32.exe

Filesize
302KB

MD5
587ae3ac73039a1513694807c86eaf15

SHA1
045c537e152e01c4ae15274bcf2a028aacf626ff

SHA256
fb93327d5b95608c5095ff7d2f1ad902173a10ef8ee917d886d15ee41f341891

SHA512
9d9b56ed3cae8da601ca06859d2dc4cb58d92823762fae25c6a46375d675dd8e740b8cf940a1f32d6aa35c5eaaa560a9dbe6a9c68ef5b8d3fe69259431cce98e

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
302KB

MD5
394800d6e1513564936e04a9eeaeae37

SHA1
f6270e3cbd784b3bf463410d516a7943b488c152

SHA256
e5d6fd6be6fadeded8f894d52dbd5c1fb3183265fe957c6f49d0360b7ec7d565

SHA512
b1b7307cca5499702e53e29c1b790d0466b5863eceda3d7de5b2ddf59da65fc168d1bd7f1b2cdd87f9fe869218a51bc36cde3a819ccd31ccedfea1375d17c744

Download Submit
C:\Windows\SysWOW64\Efccmidp.exe

Filesize
302KB

MD5
c86f0396684e3842c2bc277135bd2586

SHA1
82d21858ae25d235c9648196449391c14321f48e

SHA256
9c8df4e3e85920803b5b7af6a442b394f491698d7cc7b7b805c9bfdf4c2d9ec6

SHA512
e521b6057372a56b0443e2402e7ee93ecbd976f0207cdb1658f9f6614e83724be6fb1f2bdba1a0ce57d70e8d2d2453a8f19ed4e7c84fa8229710d516866c959b

Download Submit
C:\Windows\SysWOW64\Efepbi32.exe

Filesize
302KB

MD5
24d0dd0bb4dc9bef19d020a86803c22c

SHA1
0d21bce6be32d95632406ac1bda0d91d21630694

SHA256
10a55e901514b4a4b7b16a223dafde9cce3ba9a85b563044ad194912dd476909

SHA512
c3ac5e93fc9a7a7a65f97e7db442ae0919c5ca85196e126d57f2342f68a7812b1dee34eb8063816af3db4007ba83869080338755f99173f2b7c8daff2f7cda7b

Download Submit
C:\Windows\SysWOW64\Ehbnigjj.exe

Filesize
302KB

MD5
ac4c23f776df63e6036350cc68bc7309

SHA1
5126fc01920d628e630e91ee9668bf0578e484f8

SHA256
fa734a686e4c51f525538aaa027652de61c6c5ce2adea6c6032ff16ad8ea6d12

SHA512
aadc616c2686989cd12ade229bdc95eae88a1a1d69b4377661b2672ffdd188f02a194c2795b1c4b91767787a28738bcd678dd7a373d553f82c168c84adf2fd13

Download Submit
C:\Windows\SysWOW64\Ehlhih32.exe

Filesize
302KB

MD5
e02d8849187be8d1c39dd8229269a16c

SHA1
4f5b1fc880403483742d419bd5e7cd411c2de384

SHA256
11664b4e0ad45fa274d45c83d9cc4a782b487cf97be505517cd3436c7534568b

SHA512
ef57e97d5af4b834ca193451f0574503abeb7e914ea5df66091146dcb575ef4c6a6f84c924296c021ba103f32d07ebf93f54fbf507051e0a951b82ce6baef36f

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
302KB

MD5
4d12f41d993785945339014afc765400

SHA1
e97eab5456b2f2f51452723c068038ccb16ac571

SHA256
9b5ea8f60e9001a14249d05b2021654f3eab20d50e7dcef2c1cec8024bd77cd7

SHA512
c07ce9f437276076e60d52c914ed3fff7b5a0137454cf90137685dd0db3774f225130931ddbb4e7915bdad542158bb2a46b77f1117ea0ac92c3e7f184e398393

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
302KB

MD5
974fd82397eacaa25171c69f7b05cd32

SHA1
2a60bbd115bed64373d4ce2970a1c05463c9eb03

SHA256
ebf1e084dd9121f6beaa026728adc2bcdbeeb3b159984e6db9d8fbe606451fa7

SHA512
21f5e8c5c1ceb3008fce04dea0d8731c3726805f95486dd8300c16771e6814caf4417ac1abb082ae9c409e495a1440e6f94fd133ca3ef75b9a677b9b477eea2c

Download Submit
C:\Windows\SysWOW64\Ejalcgkg.exe

Filesize
302KB

MD5
cd986b5a055036146ff82297ff70d5fa

SHA1
1d92500033733b7f33b8dfefef5386b2cd773b73

SHA256
f6466a966f084c9d0160e9bae60dda220c604e49863c405edd669cc21d9ccc67

SHA512
68b4addda184e8845ed59337c19e4edcf569512923cceb25d8ce47a5ecb9e276287a8c5b07ff5a8086f6836a93c2b662f67bc2de049fcc16bad10d66a27c2dc1

Download Submit
C:\Windows\SysWOW64\Ejlbhh32.exe

Filesize
302KB

MD5
32242dc1e7da36f486191f48001882a5

SHA1
5c25fec2761b04fe22a819510972f8e0beff90ec

SHA256
6d417b11031ff232681b79cc83bafc48cc20cc3f7eed74f8968264590a3574e9

SHA512
ac6fc542728b86114a4b1102c167ab639b907f756b357e77968f21875ddfd075611a9b317594b2da09ccfcfde7b4f9785c04d4d95adf0b4935598556ad2a9f06

Download Submit
C:\Windows\SysWOW64\Ejoomhmi.exe

Filesize
302KB

MD5
b0423b07cf3bcf224cda0785f0e94763

SHA1
24748b37bb75c8700e58eec04d7a46cfab858ca7

SHA256
e05c783e048653973c2cf6af678ab3e38e6a771d84edb2ae98377f8bdfe1afa0

SHA512
7703eca17a8fcfb27a63765f6b549433c6ae1778c1aa951a60668ef64354e821169ddad647baebc05f51db7ce21c53f698346a2651e257ffabfa635e363ac028

Download Submit
C:\Windows\SysWOW64\Elbhjp32.exe

Filesize
302KB

MD5
9a47b22a8d28c955de73791d56ffd6b3

SHA1
4a36a4b955e99e263a7033dab9ba5d5521dbd0d9

SHA256
7ef0d3bf7c8843feaae54c4a2b357442e5d77c423800307c9d99742effc23493

SHA512
23240d9965c767e801116d752f26bed0107901a2254fbc0c75a0bd821a48e278598f64ab46ae64e7ff5464a9badff44003c0d09d962aa40194962be6ecda93ce

Download Submit
C:\Windows\SysWOW64\Elnoopdj.exe

Filesize
302KB

MD5
4cf4d10f304274e81c5649302fa0897a

SHA1
010cc6a5e9b9e72f343157a7860cbebdab9aa7c5

SHA256
0f9067ef78934fa4307b6ad81adb81dee58274498211a6b45446f284e57547d0

SHA512
ae77eb5360e0c6049ff72150ac8d284344a58ed96cc9539baed2cb9ba28aa7c30c79aa6636bfa84a39aed846eb2d145fa09e50127d81121c17fb979f06c22245

Download Submit
C:\Windows\SysWOW64\Elpkep32.exe

Filesize
302KB

MD5
efc020e439bcf9ff185bedad2c2c1a1f

SHA1
9f861a1c59928bf136e9b354a402989e772c52aa

SHA256
c7648ce700243cbf2e7ae653b652086aa1f17070776332cb16e84ec37866437c

SHA512
1b47faef8c7102218e9781bb7c0525265e347d410d6521cf1f87a79e4a6c39e9f415f5e09bf7e9d38c4401840e64d61834f3be9d9c0f5e373e40f3be4afb620e

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
302KB

MD5
f774799e2a7f0aa97c2bbb152296fe06

SHA1
493f448e1190a83b5c4469d91ba6358a499821d5

SHA256
69d5893386bf9c7088285c60fa9d90699c943143d042661cd35416c41b106b24

SHA512
b5b174af2aa1c5f89ce9b3113944fa1ff6b660fac617c218c3c7b401cad2b944da03c68f50a044d72ba7f3d418dfcfe75ed5d9a4989a53586a9f13be5290eeb3

Download Submit
C:\Windows\SysWOW64\Epikpo32.exe

Filesize
302KB

MD5
2ef3f9dcc5e81a22fdec9cb443b38934

SHA1
2fda882ee1ced6307f53b00d30d452830622758b

SHA256
bbcecb366d7dfd00137cc1dce3c830960f4394287af5412bec623d2d605d675c

SHA512
ee4963005eb553f0f1bda0db0a99ea44c9c18f6f91b4c8c4ff9aaeef96fe4a1b0c2f2952ffdaf8ffce7da46d0f24e43067a469e3b4eb4ddba2475363b5269284

Download Submit
C:\Windows\SysWOW64\Eplgeokq.exe

Filesize
302KB

MD5
82338a65a7ee8db38f6ae8889d2da2e8

SHA1
d86da105a9cb64a638ffdf4fc27d7d4ea988f764

SHA256
10170750d744c46d015c73da908d66b43d9d76dc199960e51cc6255f1a5e3e17

SHA512
2b9d079b6d878f6233d066034b525cee08edd849dce8063fee0e1b66c6c8236cf2ca4986bcb0a23c70def68c56e7c7d4fe7a5d386188aa095f852b00dd21447e

Download Submit
C:\Windows\SysWOW64\Epndknin.exe

Filesize
302KB

MD5
21d50c98e16168620d33658e66b2dbd6

SHA1
02a9302581f1a6d380d3e0f865f201288d0541e3

SHA256
db78709c2d88701b78365178dcfc148048e1d5a5fa744159d5b7707fc39aa7ca

SHA512
75d0accf57ec9b2acae4ab748fde8eff53515f9be800d7ec59b750ff714ee00fecaad8d07577ef86b35a5f07b3c5d06a2629b75e783c4d2a7a62458ab786001e

Download Submit
C:\Windows\SysWOW64\Felbnn32.exe

Filesize
302KB

MD5
04f38d84308c31ff8bc3e689b3bf88ba

SHA1
124b7ca43ac4c1aed7459723729c49598d1c1cd3

SHA256
a17b7f47eec867db5375ad9d5757b0bfa42cc26e5317928d98adae0b828d9356

SHA512
61baa2527b0ca2506dd909b88bd4859e96347c34dd36a52f2ab43bcad2744fd6c69face361eccd513903258c64deab794bc9d06f5ea24ebbd1edbe8864efb32b

Download Submit
C:\Windows\SysWOW64\Fmhdkknd.exe

Filesize
302KB

MD5
e765b0f183b7d3f352600870be5b72d6

SHA1
c02cd00349064fff8a0f713c02758ccefa4624b3

SHA256
3ad33bda43c1f7acc7b847e58b4992aafe0908e550a286f1158eb68218d52451

SHA512
445427cfa554922e6d92a3a31ee2333305f932b14feb80c8f13e75ce62fbf96a19b4d66ce43377d7efbcc93c403a57b01bd57c242a04e78b624f0f9b393945e4

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
302KB

MD5
beb0e64ecdc8625e269d3f7b055806a2

SHA1
76559981acd49529f45b4e58f68c23f62abec89e

SHA256
9f7b47699c961ae1cfd6d82a48282a3923b3b4af6a1b1a074b9263ad90b90579

SHA512
bff0eb108388acfbdcd719d5cb6c90532d3ca0e9c2e8d5dbdf8079937891e51408f429ff1e1602c43a432053d300958926c139903b26623d62c1382aedbead91

Download Submit
C:\Windows\SysWOW64\Fniihmpf.exe

Filesize
302KB

MD5
836b9b0edec52e279e9caca1b5758b27

SHA1
5d238fa3cd3250fbeb2b8fdabfe3b3b9c2f64d64

SHA256
15b95c61012054156847346f3b2261d07f89fc553a400e4d412ca840e00767f4

SHA512
ebd44941b73518a52103e4c7ec4134867d327f477113bdf2e22997b4292c27f5820a3a33714f5e5e41ad8dffbc95fe6ac8da1ad8b5f7f41631130500a0276f64

Download Submit
C:\Windows\SysWOW64\Gbbajjlp.exe

Filesize
302KB

MD5
457efd028940e262977a749f6987a076

SHA1
b282572a15ebf8ff1c2a576f34d08b295c97148f

SHA256
c9f01ade0f2783ec4a6452f81c3fb656d52d3c99c044f213858e07ef3b8e14dd

SHA512
7b49c30b26c851c1d6e1af5cd9393cc6b59644cfec9dc262e78aace7e32a596a624a7f024ff6a8b8cb4772a17254ecee138dbf8b15bf5bb8615b2a6cf9f9ebcb

Download Submit
C:\Windows\SysWOW64\Gemkelcd.exe

Filesize
302KB

MD5
907add3ab1828b83d37e0d3992694589

SHA1
f28d437e680d50657f626fc2f1ddb9bde0eea391

SHA256
7bcf6feb087f35aba859f7327f4770d4fbfc12c329b26486e656529f74ae4d8b

SHA512
39d3d567d4877052a96822c224e1027bb522d39542f9a72445527171277fd44ed6c3d74f9db7536ca08a577ed7178e12de55157d21972cd230fceecf7ac0f0a7

Download Submit
C:\Windows\SysWOW64\Gfhndpol.exe

Filesize
302KB

MD5
b885db01a1f602a541faedeec762fadc

SHA1
87a2a61d36a3d73a6a89b44f525b8566709b8494

SHA256
ddb0f9573add0139fcbf967b332afd7bc7acf1ff4e443d12de81229fdf3216f2

SHA512
25713936c6cff985ce1aeaf8a6e5a1cf3ad6a0d8e9471624414167d77f14186069ec81a06944616de631d1b1ee42c79ea0fb7162e2b8d8f044ed8541fdca48c3

Download Submit
C:\Windows\SysWOW64\Giecfejd.exe

Filesize
256KB

MD5
499707b6eed2517e25e11842fddb0705

SHA1
15f87a5609c542e0f57b845ae4507ee96975db5b

SHA256
1f168841b608c993a2a04021d03358aeb42b96b00028f15bfecd5a90a5a89655

SHA512
8d83593c001a52f2928e1fef2faa326fb8c816f323dd2b9d771b47746d6eccd34dc92a8807b9160f301fef3e3fd3080429f7bc5ef7b789be85ade807f94a34b3

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
302KB

MD5
e858a8b06861becd293f0a9cf24e03c6

SHA1
d8ce40d2300fd1015a35fadbbd7f5440a4357e6f

SHA256
771a040024d638c4ba24a4715d22c04c0215e4bd342033537e75eb7244752b8d

SHA512
5233b703e7c943b019ca2f425af97f0293e77c08e94595d9d622fe91b5a256581f7c6c815ccc7e8e3376ac636edfa2c3fa3316a0663f8054d3113dfb9746e50f

Download Submit
C:\Windows\SysWOW64\Gokbgpeg.exe

Filesize
302KB

MD5
6ffa86bccf7f4d467acca8754ab927eb

SHA1
233bc3e4a9946f6ef6af0e7fe579f2a194ba5db6

SHA256
1f5ea5907a1052390408772a425ec7ccaec7429bcfa5c37257915d6e9959f642

SHA512
fe841998385a5e09eae0cbc90377ce088c9ad517ae202696c73fde1f622a90dfe7099ad0299665c1dd80a61ed10c74546cf15abefaddcb2e6b027d6641ddaf27

Download Submit
C:\Windows\SysWOW64\Haodle32.exe

Filesize
302KB

MD5
2f67a5fe14d9d9a3b08a01775b8f2f88

SHA1
29c081ab07c1423397cb338fc59973fbaf075e60

SHA256
1abe85fe8c3da99bd5aa78615eda26f32a29add3cee9ead2709fe7c4bc8a60ac

SHA512
523073cfb50dd7d54cddab8dc6eef2f0670cf786db0b028b966ff59824898cef3581c2e9035d02e5322aab963df63c7679e87695123fb6a20d43517b835102ac

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
302KB

MD5
63bfba3031096efade8833708febf416

SHA1
4adba0b3ac23b5b9cd84e5cd3f8cedc4950d0dde

SHA256
5e59229e0a9fb091ee63cd569efb72061e4e060c296013bafcd8e770db0add04

SHA512
23a7ef816482882f9b6e5facb531a0d3dbcbd97000ba6ec2bdb185ee8e89269b6f3f6134a9e5066926847246a14f0a0765708d65561efede12ea8f16d0efbd1e

Download Submit
C:\Windows\SysWOW64\Hlepcdoa.exe

Filesize
302KB

MD5
852ccb23ba74882fdb87242ac9b0c3c5

SHA1
d8abcef28f8839edb92544e3e48edd018d914af3

SHA256
8cbdbdfe1c3c8c58379778dfa9a0d2fff3a2c9332fa0e019d2ff24ef1b1001ea

SHA512
feca99041a3e49de32c83a30018ffaa53d8a99fae3d7fa0169e03afa49c6ed222bb955ec0fddb4c7b09c2e9fcc3b36f9bcf7dbb07b82f800df566f81c3ea38cf

Download Submit
C:\Windows\SysWOW64\Hnlodjpa.exe

Filesize
302KB

MD5
c603f43fb203630faec29bbe02726e38

SHA1
ec4db1ec49ce714fee1e7686f5df8356337dbad1

SHA256
d5c5e1a63e68bbbb878a19eb0d0f83077e610a6cc22e1f3d4f91b416f3ad089e

SHA512
3f0cbe651385155a6598acce0b0d99a72e7cbf0efb46a3a83ec1b78d56e038626435e0be36ca20dae822059bfa27b09754b3f2c75f74228ae07804c9b688932a

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
302KB

MD5
74b4597c6ab61ddef07039c620f9d22f

SHA1
66af630877a281d5416bbbf2e26578997bed107f

SHA256
8b49df158a8894946ce00760bf633099fd665a47f80eacea7c7f7606a37922bb

SHA512
8733a2131421906e23bc51ffb5bd9f0299769497cd8ebabf0550d7cd23a1a361144acfe2ae79c3023d8b3f8cfa9ca8ea9f204a90ecc16f9bfb501d7c848b8eff

Download Submit
C:\Windows\SysWOW64\Idhnkf32.exe

Filesize
302KB

MD5
6837c3936aabc83525182e07ed112422

SHA1
522f9c613eb2997c15a877b7230beaa385fa70c7

SHA256
17cf3d2f28e9bbe57f26f7cb310a56cebdf164e2b76be3e795964bef67c08843

SHA512
9ae20aa7916280799fbe1e0423302eff4b49b8e58387ba27ad07ea5b4840306dcdb300acc0f77cc0ed5c516325cc63f7111bcebcf7f99cc13b1e453d8fe09bcb

Download Submit
C:\Windows\SysWOW64\Ihkjno32.exe

Filesize
302KB

MD5
605dbcbe960f09d372f5ef5a62399284

SHA1
d56bc8f1e1e9b7cedbd6312ae42c61bcaffbdf19

SHA256
81512380563ac0f38168c91e48df6fb0f52c94a1e29e7a716d52a990a153fbc2

SHA512
ace3c85483415fb04eed23b74482c5f45b814fbd8bff62e11e4321327691a720a6819b6b908401d13b3f481367da27007237531fe752740709878f3b839a8c09

Download Submit
C:\Windows\SysWOW64\Ikpjbq32.exe

Filesize
302KB

MD5
217c992b26a51d4aeafd57fbf335bcb1

SHA1
a1415a93de2ad0ad37b52013810008641307b598

SHA256
731eb7b3e6d90c8772f7e45efb2c4dec4b21a95b2ea92052cba2ec56ba4a363c

SHA512
1da6808840d82c563ecfd7050b2c6dddf833bf148d507b10d482be7effba365186cf267ffdc22a1273c667a5db38effdf13f008fd5441b547ac7b804709f549a

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
302KB

MD5
f9f9d743636948d4e0bce2d359f4b975

SHA1
dd70501bf02a9376dd97110c4d3537faf2f84509

SHA256
0434d58ea9d28d52ff84037a0563a34096a15ecc0a7e075bede3872f66b0ff8c

SHA512
a1ae869ead71aaebc497b52e242e9a4bfb9e914ab5bf4519cbcc0fb63792ee9dc6e75216bc46b3b52808d9b0366d2c9d0635a6ee151da83e97012c468cf37c8f

Download Submit
C:\Windows\SysWOW64\Ipkdek32.exe

Filesize
302KB

MD5
73c9b90588e915a31fd5831d8b555234

SHA1
1ed635a9c2e76cb34f874528676e8b7ad3e49038

SHA256
e834151707d68616b747ce6dfc5892abde10942f55d14b8021b353bba7e20b6e

SHA512
f0cfa4a0ac9f1753862e83032520198fe79c9915966674be0647e650dbe0e1f028b441842e32ae25e55aa58e57c7637ab5fb49832d86ffc70735a8d626be43d3

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
302KB

MD5
f8c30c996d2ea09ec10f18a23a0625e2

SHA1
21479873a26a608de112d5e99e16921fb62a3392

SHA256
8b9404e251d4b53d06c44729d26be2957f639a2fb2f795a57acce5678f014e43

SHA512
a681479ab6517381230cc958c4fed7b12922a1fa6f5f5cc2d28097400405c807355455b4e3db674d536b6f88f72a754e4f3758dbe3d5e223055d049a4ee9f0b9

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
302KB

MD5
bccbfa384ac7348d3e86b3a3b7de98c8

SHA1
74717c6f6ea510b39475aa2f55eac5972d376350

SHA256
e72243e7160f8bd1600d6a955a5cf02d434d75d80094185bb3fa8e40d13a75df

SHA512
9552013b9fba6d5493d4c9fa29b49a39742c5849adf6834a9da434adc4bb4f91460b3ea890b9a81729ff32e19840746741032898da9e5eeeb7e4f40c1f7ff508

Download Submit
C:\Windows\SysWOW64\Jikoopij.exe

Filesize
302KB

MD5
99c0fceb974d9a070af5abfbffb4adf1

SHA1
95f1fddd1b26ba0fe97cf097d56cc7199f52d32a

SHA256
e29e0d3128e8e13c2c4d90d83b46e35780e0819de973be313555856f9ef1fd28

SHA512
c283bcaf0c00ced7529970711d056aac8bed68b8cacf9f5037f44f2e3813861ce728b98370488f34406742df1701a2496517074ce6116523f33f9cb308ed9ca8

Download Submit
C:\Windows\SysWOW64\Jinboekc.exe

Filesize
302KB

MD5
984fcad590d369030830e6ab071dc5ab

SHA1
d229fe38bb79f931c67476e55d8b4bf8c3bc0aeb

SHA256
74d7010b07b064c9c85d448272ddf6a1d6dbc8f97f36f14d1c3aef0d66d1d5e2

SHA512
b4cbfc099f4fbca1a8aa8a5a256241f7d97617532233f663bc45b9d37e856d7df35d32edcec320fa13d070941da7779053d65472c35e9900fe5fb44711fe40c5

Download Submit
C:\Windows\SysWOW64\Jojdlfeo.exe

Filesize
302KB

MD5
3dfda281a3a4751720144079becd89ef

SHA1
180b9a617449de50994911e452e5156171ad7100

SHA256
30f01872b2ce0d4203ed3117d9740351c850a730fe1b875d45964d1bc88c5329

SHA512
802f04898f10c6499c0e610a65a1d5051b8ae30e11b3cef4d1a5ebfc44c598728213503a3dd691eaea0ac537befe991ca68d4929670025129daecf1d4b78a290

Download Submit
C:\Windows\SysWOW64\Jpaleglc.exe

Filesize
302KB

MD5
798eb8c906ccc4c8b7e81bf7154616c4

SHA1
94cd57c514560fc4260fda9f2d8b46eb186cfa9e

SHA256
d8db3331c18aa03481a18757e33be60089e4ad07d94279b329e2ecb0092f559c

SHA512
0782f2ff623fd27afc2d40780d43123620d78a088713c45dcb97ff340f0099f7216f1f144612d959ccb31ea5dd91f0b74f039589d4b84c0fd9bd8e0b3e853f04

Download Submit
C:\Windows\SysWOW64\Klfaapbl.exe

Filesize
302KB

MD5
caf27840cad241136a5f594e76bcfa49

SHA1
a989aed1bcc5e2f449ff63ec78d2d513b130dfdb

SHA256
4bd74eab7aa253c62edb53bbcc4b44aa731953352028d7b49e6b2fbfd2aac01e

SHA512
aceec0f545a34b78019662d9d13dbbe9bf0ed1f2127d7d44a12ad3280b5c9fc102f8e7cf8212248d0a147498028741f0f21dce864e1928f44222bc1927d9bfb8

Download Submit
C:\Windows\SysWOW64\Kmdlffhj.exe

Filesize
302KB

MD5
5076e8311b10778c32c7f7adf1d954ea

SHA1
7a6b73ed1624f1eb32f8c2e1f9adb8722816c996

SHA256
51e25e270bfbe973bd27b28c536ce802cd6e4ac0626b0f3db902f548308a18a3

SHA512
82f6204e350f118bfc4b511802f607d3144ffd8c2828aad46594f03b35035d8057b1f3244755e84fa1781c7debbe69bfee80363b203b6a429cc2521eb68268c4

Download Submit
C:\Windows\SysWOW64\Koaagkcb.exe

Filesize
302KB

MD5
81e75fd83aead3eb1ee9c461aa4aeef2

SHA1
cde225cad133919fa7764c5020a1e6b985d31097

SHA256
04647f9fc1c19f19904e674009b74d1b4194b274f73aaf92b7a11023c6a9cf9b

SHA512
b7b6a2a8f69c55d1f3c7eb0386e80907cab21646b69c07a7a9928531a18b45f07288eff0208ec79839dbccd0b9cfa2fb2c374a3506d27cb768b28ce3a7022946

Download Submit
C:\Windows\SysWOW64\Lckboblp.exe

Filesize
302KB

MD5
1c1074882a30ad94c804598abb2ad172

SHA1
ef6e3e21a02b5201caf787d4bb8e5f991263ff46

SHA256
cdddcb562dcc0e29aea9c4db1c7607c11b1ae36df2c08cd7a18142307e387fd6

SHA512
0cfa1f736cacf26fe021bcd134e74dda59c5e6fe22f63b76c899a3be6ac899addc4cd319a5a30cfd00e04136f93b68d231093dc8ea5a30966ebf5595888f2f56

Download Submit
C:\Windows\SysWOW64\Lgpoihnl.exe

Filesize
302KB

MD5
2d894d6fc4d32c3fba216debbf9af526

SHA1
a7acf1680d41c3d06a7c30b431cf2ce749d3944f

SHA256
e5ad9ae494be4be395c76388dc1ebf7700d6a28abdbd84ff7b9f0eb75464cfbe

SHA512
8570903ae581a23ed6b7e03691d0ba294dabe08472ce98ef87de9a22166a74922e0c0700861625091bf969bf72c88b179ebe868ba5bdd4b06c026c242961a7aa

Download Submit
C:\Windows\SysWOW64\Lllagh32.exe

Filesize
302KB

MD5
dbf0b7fc734c9b74ddbc85e8e9fdf087

SHA1
9136156cef43d8f1946d4135b25b24185927dc4a

SHA256
cd55cb9c3ebaeaaaaacebd55b1baaee64838a2283cad8f7d88265fb023addc28

SHA512
977eb053ada7eafe688ff2da36eaadf4740b84b2ed79d319ce9ba2622c13d7fcbbb0f6ba9d4decc5f9c636ff4745fd93d9fd6dbf9f818700ea48a45b15f4c221

Download Submit
C:\Windows\SysWOW64\Lohqnd32.exe

Filesize
302KB

MD5
9d82fc45961df713eed70a2fd4f3bec4

SHA1
daeea886d5318551fb8eb801c282e18c04cfd550

SHA256
0a27b20f75ef8ee8567461c1e46b1ba1df9335ba156f8d81fcd7ca113c24115f

SHA512
c466d5a060aab27cb6dad8e6e3317190620dc48231a9dd195758a84b6645e4d57f5a4024e78f0a590f80ca87fdf9213865be08599e33b8092a24ae18990dd77d

Download Submit
C:\Windows\SysWOW64\Lqojclne.exe

Filesize
302KB

MD5
cf827a9e588d429d077b8c792d231066

SHA1
1fa6a477f3374c2c695eb17030d76531b9b9a923

SHA256
a8727f3e5bebaea1ea4d051b8eba0a96ae0969dbc84aa814b72ee1fa6f98a01e

SHA512
3bf764fc56b4cb13095fd638babcc5ac3e88b4ddb48bfb869595a77607a71e1e7c5448bbf5ff0152e19b5e9c7b2b956ae9e20856f8379be1b90927fe5729672a

Download Submit
C:\Windows\SysWOW64\Mfplpfib.dll

Filesize
7KB

MD5
27efb6000e7ab32fb3a91d329345eb17

SHA1
9724148d49b2aa2bb24662344050d01456ca4641

SHA256
a4e295ffbc37d2cc3cabe1bf5066e7dc59c31587da523b155d371f70608de4ce

SHA512
22c373567ef26e7a1021ed1b8ccb1910e2323e29c4968d9a2897c59816f762fd12d4409b07f23600d85c01dee6759430ad90250d2f3b09b7353f9a64d07879d4

Download Submit
C:\Windows\SysWOW64\Mgloefco.exe

Filesize
302KB

MD5
41f92fe52441602453006582df996195

SHA1
912b16e969a8cf62453c3167e3d4b6f0ee787558

SHA256
b5d1f9af26810fa9409d5822f77eeee2a08c6e7ddb1d1a915f770198cd08ad4a

SHA512
237ab365351ec4f4d23ee2e050a1885e58fb0d72e8c65937bdc5b3457d711bc9e3cbee742953351c3abb37eb75e152e2ce5659051531e6693fcb21f5da96b739

Download Submit
C:\Windows\SysWOW64\Mmkkmc32.exe

Filesize
302KB

MD5
b00ffab17fc45ccfdec43db40f8e0a43

SHA1
9fd34e7a85875a7078fc2abca27ce44293b56223

SHA256
5ffa8901a2b927f90b63a1a93a65537b7b86de9d132b33c212307841ac0f6132

SHA512
556e12d581285d445674f05f85366d2cc13ef337844b131beed05f96465c8bf9fb0d535e9ec1e9517ce9b21db82627b5dd8fa0fd71f47cf66e7e29a1331a1679

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
302KB

MD5
c49218cfb94e0d7ff7c9e7280713a6aa

SHA1
df9578a6545bfb46859e2e1389dfd796a00e5513

SHA256
8bc119482b0eb377d85d3cc6693de994cd2e4c7532f6125513f820ffd58f2284

SHA512
fba7f92a2bc092f86598a73f4084f45ec06ead504dc5b407e2534b85ad08b31b497f02e8966ccb2658eecd126d3f865b283b2a125f222e5762daa1dacf545eaa

Download Submit
C:\Windows\SysWOW64\Mokfja32.exe

Filesize
302KB

MD5
0482edeacbd62b53f0c79ce8ddd39e50

SHA1
fd6f8b361b9fb65ed70fbdd316db75fce6eb0777

SHA256
b4ab4684d2b19dc57a09f1c2ce128f173eba538fbcaa3cd22fbfa74640e831bd

SHA512
96acccf0d6eceb9bb51679d1e0f8daa62dda076b209375629ddf0489b5eec0be825126a8724e8d45eda7b1abf7223f391eb2dbaa1c278172bb99b0d182861d2b

Download Submit
C:\Windows\SysWOW64\Mpclce32.exe

Filesize
302KB

MD5
2f12acedc603097fa7ed151b9974fdea

SHA1
29f788fce1384d6827861f1961431e13964b6468

SHA256
a25abb9f1ca9f59913277eb0127e1246339070b9e8c1c40682da6187e4c3acaf

SHA512
4449c76520b9c5487ee12ab543794002b78535c644993c2b6a3da6a63d595ed89f97baa2472120b51ecf3d2d17cf33ff9265da1210b8048753f1710dbd54fa64

Download Submit
C:\Windows\SysWOW64\Mqimikfj.exe

Filesize
302KB

MD5
d7a13139bb1109e9a500f1717a379ce0

SHA1
d3aa6bb607c16c6988728cecfdd7bb7cf1375438

SHA256
1effb06da171280aa860fd5ab86b36c7977970be70b008932d1b1ec3197a9623

SHA512
71591311288bf36ef81992a37029b1b08bbe199b10bcc55a4b790c6771fd510bf7fc5577ca2a29269a6075b7bcee31f1295355268699be8a37fbdc468cc9fcdd

Download Submit
C:\Windows\SysWOW64\Nagiji32.exe

Filesize
302KB

MD5
33c4a0f2492bf6ac341eb388b52168be

SHA1
e0dc08ccba63f9be31dc6e00487c9405e3e91d5f

SHA256
ab3544ebb8cb30a2ffd70285699372b7f9510f975c3fe95f4c54959b458d95d7

SHA512
ef94fa31ffd9c4bdfdfff3dfa7d730c6e24146adcf2d84e7b39864bc0a22220ce3091e316909994007594eb467a2dccd583a813eb2b0a95b88cfdea0c5ad7952

Download Submit
C:\Windows\SysWOW64\Nbnlaldg.exe

Filesize
128KB

MD5
bf26f205fcf556a4f3a82e3cc32b4943

SHA1
faaa71c7aef48909bc537ded3e0b904ad5d7e03a

SHA256
d11d5ad544905876ef0840d01c8cc3d7e28059408abdb9b29cedf19efe494946

SHA512
b5dd910d309c8e38b371e9449a5e58938a4f57d3fa06bd2a01dbf024e81ca2a4cebc88c50fe28247201cb640ce3988af1010bacc6328be74ad29e22f5bed211a

Download Submit
C:\Windows\SysWOW64\Ncmhko32.exe

Filesize
302KB

MD5
3e3367717e8dc7a75c585ed12c8cfe45

SHA1
f461d2e0ccca34a1a311440b4d467864a31be864

SHA256
be33d8b3c563f335e735fc6d7db6410f838102bd36e0570a4228d6ff65ad0c17

SHA512
2903fb46c41f5f3173ffe2cd1f8713c97692931298349fb563935c2563daa444d4552797ad3a394b83e03e19e446efcc361ab04d9ebc3b6d6c054eeb83681337

Download Submit
C:\Windows\SysWOW64\Neclenfo.exe

Filesize
302KB

MD5
7cb0013639940a222b515b8dd8d63fdd

SHA1
e41abd21d556a9e3118c2fc80ec35c28fb3a7aad

SHA256
d9def19afb21a8b38d6c02019ba24b6aa6d155ca7ad4a950bffdd95eb3eb7788

SHA512
8a73ddb643c0ca5ba2665d5f0d6a6effc253b01f58155ee2eca8493dd28f41e8653889ca55b8c2a8c7270cf0695ee12092c0d1f7222d56d0712de35b06088558

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
302KB

MD5
26894e31c0f40d41aef6c69ebacd441b

SHA1
feaf6ec23b80690def8e7b6675a1219115536f14

SHA256
17e75b2b8891b04751ecb272f495017b7ac286ffd676037c40e81ba7ada884df

SHA512
344ad0a28b1d548b8aacfeca4b0a5a720edd6c89aa800e057176ddd33ec5800da91ce59042be5dccdc65fc8122a1877b25e4957927dadcbd8a56ae9874ed51ac

Download Submit
C:\Windows\SysWOW64\Nlhkgi32.exe

Filesize
302KB

MD5
b8bdb9eaf9775cb7f7ea43a3a72c0a9d

SHA1
d623761db99cb3656a5a9113e1a8bc89a0c65c9d

SHA256
89fb034820e92c53a49a8b183a4ed6cced8c3a34538b8510a95a7482088295c1

SHA512
818fdc3c7fc4df3b69c9ba492604eed698fea26aecccda09e388d9a003762f052f2e245c343d64581bbf337da3c4ea65dd3d87e8d9b9b0af1e70734e27bc7455

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
302KB

MD5
8a9d43308bc2ddaa418d96cb4476388c

SHA1
70a94db304437f38f2fa26fd9e5215c94fa6643c

SHA256
307552b984b2b6067c323d58483c179044495b2687c6e0d356cde7c9a2860446

SHA512
cd2e986db8c9649b02816da46f43c1e3a805b0dd4904481076500f74794599e01d11f9b563161bf933a0b03665c389c078afe60d4783a6c4c730c8d2af2fe1e8

Download Submit
C:\Windows\SysWOW64\Objkmkjj.exe

Filesize
302KB

MD5
ff1384cc07d8f191ac05f9be8ea0b0ca

SHA1
3e7f12d8bb2185a7cf4405072a7909c73eb01ee4

SHA256
8d46369f7060cec935c697699639859137e8ed5c47d936f6c861f21fa09e8070

SHA512
85c792c8e6b2b429be58fa29e5c226767435dda555c09aaadddc33182ae2017178a03d3ee99c85d31018441870d75ae02758f62a70811c7758937e41efc95e2c

Download Submit
C:\Windows\SysWOW64\Obqanjdb.exe

Filesize
302KB

MD5
e5ff75ee3cd6c8a36e0f706eea6fc919

SHA1
e7a5af7e9295fe209e4e4dcc4e5fdb4ef718025f

SHA256
ceed88d842c2d9cb3964dd6b939535fcb9716b84ff93bf0d7cc3a1831d02ef16

SHA512
28627c61f40a0e51ddd4d2e36e9ffb2d275118327890128c83c2815b7df6d87bea9430bebc066d7f0a5fea06cb20106f936979bc2a98620f911ebdbd959b526b

Download Submit
C:\Windows\SysWOW64\Ojemig32.exe

Filesize
302KB

MD5
017dea3ecb54a589f881e37e07137a76

SHA1
11fbc83735009252de7184827cc8dfa68404cd0f

SHA256
8887ee7606486eda3bdb67d8f230db8fa23b36c1475ebdb1ad611db2802a87b7

SHA512
d664c44cca174b87f34515ca8eec21e27231aa70e208f08ef01910a694a3ed2e039602c8f1b6b5ea523f491b904f88dfb1aeb2547084d0214bcc70d68358b6c9

Download Submit
C:\Windows\SysWOW64\Ojigdcll.exe

Filesize
302KB

MD5
5ad422691fdc165d6d4c26ab2d27287a

SHA1
9c65c845bad830df04fd5892b1f947b644d83aed

SHA256
fc1bd88e34710e7f5df396822e65aa177c105f18c4338369d1115f07ab00206b

SHA512
5b2dbdb62c9c71bd922531c7a8537a2eb049e26efdd5c2de887931b8793ad046e843c5df86dfd48993f3d1abed8f05d7fad7f0888c6989951efbd2f268c0f15d

Download Submit
C:\Windows\SysWOW64\Omgmeigd.exe

Filesize
302KB

MD5
8e2645c94bc86db086f350b9ef7db4e6

SHA1
c28c65ca74650214859c4eee10c230b5043ae321

SHA256
aa0d4d056b273ae7a0ff114917d8e2ed3c410dc5d06befd29e119e9e7890a747

SHA512
ad104a85d514904fb70074b256595d48022ba25674a4c0159f1938f152d57447fc095fd7db0793ab5f1d0845600d26c59cf1cd3a573f42a9532e7c5c71088f7c

Download Submit
C:\Windows\SysWOW64\Ooibkpmi.exe

Filesize
302KB

MD5
2a46c3ec9319546e9e2292db0a2d4762

SHA1
0b98e79cdc4ff02516372e17f48ed9ad89792c5f

SHA256
3e8db36e9eb464e5c690621ab5498404da6a5c81d9d2608b5638cf1c8644b848

SHA512
6fea5dcd152048119f0dcfe0af25cef958275b7cc9c054fe132783cdb514dcdca5be7da0f8768c4a6a7edd5d18de83318785738e10fbae990d6ffeea9d6937ca

Download Submit
C:\Windows\SysWOW64\Paeelgnj.exe

Filesize
302KB

MD5
569a9f58229e42b27d50a6ee81cd2d6c

SHA1
c3762b230718e8452987c6abacec6112b19da1ea

SHA256
2c79317471a48a061662a28817bad48dc67c3ed275f2db14c4b49f2b8d2387c8

SHA512
ee1c992f42a15a966cc9fc17be9246a1108e5f2b8553fdb270381a450868a2ba5360046c7086df5803264e87e8c62e8b73a26ee2be34fccde6608605a5496946

Download Submit
C:\Windows\SysWOW64\Pblajhje.exe

Filesize
302KB

MD5
b5d34f5cbeb610e49175f69ad82ce74c

SHA1
76687eb7aa7843a166c78cedba5242022a326728

SHA256
9c97f38a527d25b90f83af4789ea24a1777b882f7e2d4b1c69883fd74e12341e

SHA512
a072d13cb00ad521943860fe6796ce0b006082f9ad8c8718b87b78a13b9a8b3932199a39a53ca861f8031522946b641343f2100240ea029ce61f0ca56169d74a

Download Submit
C:\Windows\SysWOW64\Pcgdhkem.exe

Filesize
302KB

MD5
0a4e2b52e9d17df0a04513108049e07f

SHA1
f67c0888c42cc7db075f8f1f12f4922f44af3d68

SHA256
890178d6d1d05d8f9a99539c1d92cb4ec6c0f7d191955f5a4f12ff8221fce78f

SHA512
dba69882599f641b667c3dbf25003ce06a958cbe62d17b7f0f0ebdf20f051461aa9d7dbc9d562e908a0f77721adb32fc969dd189f3d7e3c85a70a27f6ce95977

Download Submit
C:\Windows\SysWOW64\Pehngkcg.exe

Filesize
302KB

MD5
075cae0a9e9f88a9fa92f204dccf0d82

SHA1
2781afc1a369177f2c99d0553cfef160efe56bde

SHA256
3655ec9ad07c1f8c5b032b39bdbd113b24428a9706d7c3f9868f2652ab1f4c44

SHA512
5179b7f806f6cb98a17857f7779c143ee10ede3331d2215188753c89bfefadf088a5819319ffe8052539c4c224282c2b1b55433a754bed72b2862b37eea42ef9

Download Submit
C:\Windows\SysWOW64\Pfagighf.exe

Filesize
302KB

MD5
d09138baf228846988f32008bbb913fc

SHA1
161ff38e19e286af79beef8cb55cb9f08e7522b0

SHA256
10f35c993ff309b82518ca5e183002c0c65f9a4b8af7ecfa8626ea4217197734

SHA512
be454288aa84717680b5a1d14597914b247cdbbe361b28f150c6f11ffe11f22669511cc93f6d4dfd087ba081dcad55ea5bd3fde989beaa13cbb7f4f78a7a6bc5

Download Submit
C:\Windows\SysWOW64\Pfccogfc.exe

Filesize
302KB

MD5
cc3988be5c67c1ed36ea8e1bd984c00b

SHA1
2b0ec369110e3333bad1889223c3f907f3e3aca5

SHA256
166a9f15e7cd9ed1b2be9c719e6fe84989a2dcfb2d392d802ad6dc5904264ba7

SHA512
5d539a273a41032d2ca7f0c381cce0cf082b2cdfd78eb8563e594809c790f003d5e0a046be2dfa631499e04495dbb973ad63d6dbd79fa26e29a4e1126f5f4463

Download Submit
C:\Windows\SysWOW64\Phfcipoo.exe

Filesize
302KB

MD5
6118750f79f02b68f189d31e7917d0eb

SHA1
dc854757accab187415de74d35b8e0cc0ae2b05d

SHA256
d643d6e646309440e45f93bf8b2652a8ce1dcf89f22d42fb9af3d9ce292f04cd

SHA512
f80794c38c8229252a7a43e81880553fc9c584176345af3a75803f84abf5a01201fe524143e18508cb9be5e45aad4cd7b56e0dc57236aa144894f2e6ad8f83d9

Download Submit
C:\Windows\SysWOW64\Pjmjdm32.exe

Filesize
302KB

MD5
ba33f42bb225befd4dcebc1190568ab5

SHA1
82e132f6dc8c56762829a38fc91cb18a08179383

SHA256
e1e3efa64b00ca325369daede30a81cfde713b47733f29b7dc06b2aa565bd032

SHA512
7b0e34856a7f94b8db48cf8bd802d4e9730afc90380866b4e58f86d4e79ca3bad3eb90c90c7a262fff71fddc473b309e1e7423e4906051b06834fe1f5cf33dfd

Download Submit
C:\Windows\SysWOW64\Pkgcea32.exe

Filesize
302KB

MD5
a41ba620a20295b78a0148b40c3a8a8f

SHA1
61213a0ddedc69ea65027abd31ef8f30ec87206d

SHA256
8b5e9e3c3ea52331868b66075d368c1f04b60c160b037da0ec1b7cf6de4af444

SHA512
396d57c4aa1063b3dd13a16d3025378c17d2f83746dd6f49115bb98a8381eb59507f1fbe320f2bdb1a3a6671624f1dd15605a6fbd9e650df1d5d775e0abed37e

Download Submit
C:\Windows\SysWOW64\Ppdbgncl.exe

Filesize
302KB

MD5
23b920e8856eb62c0fadbab001b18a7d

SHA1
a014d2470cffda7181b9a0f3f10ae2cad03e2206

SHA256
7a44542f5861c6631e42ed7c119cbeceb2d56b6cb5a7f5125d6c8fca9617d33c

SHA512
02382c7590f30f881b357e0791e9ca3ed88ebe4aa31d5b7f6f14339474fee0e4ab54f8a68a35c0c6e053e41a4e05b2508acb79efd94cef378e7ef3a8cdfc6985

Download Submit
C:\Windows\SysWOW64\Qobhkjdi.exe

Filesize
302KB

MD5
25ff4055a329abe938538c6f9a4e30a7

SHA1
36241fb4c58df0fd1a3639307eedc68c5ede0d2e

SHA256
086cb267041639b986d3f059849b7897b7a599958ea51d5728da7ad659a83952

SHA512
9332187807e023abd724a140d781e45cadb3ecd4d293fb0ba6f1623435d10c93156391d0f53eab28f6f244ce442d3bb4e23806d624c29ea38e66cfe1bb8d8e11

Download Submit
memory/180-651-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/208-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/368-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/444-585-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/616-632-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/632-643-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/804-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/836-451-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/864-652-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1044-567-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1312-634-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1324-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1412-434-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1440-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1536-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1596-440-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1628-578-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1720-439-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1736-631-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-583-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1848-575-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1932-608-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2248-581-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-571-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2576-635-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2592-445-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2612-453-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2620-584-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2640-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2648-444-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2700-640-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2704-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-456-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2896-592-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2960-638-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3048-447-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3052-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3092-604-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3096-641-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3136-450-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3144-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3180-649-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3192-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3232-668-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3320-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3324-609-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3496-590-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3504-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3592-647-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3628-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3636-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3696-449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3840-455-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3852-644-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3916-669-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3928-646-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3996-639-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4052-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4124-582-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-463-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4204-650-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4216-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4232-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4272-642-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4276-589-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-438-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4324-606-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4328-457-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-605-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4404-576-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-564-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4464-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4484-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4488-591-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4564-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4568-636-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4700-648-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4732-637-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4736-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-607-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4792-574-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4828-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4844-645-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-441-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-462-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4952-577-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4988-633-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-603-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5056-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5112-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads