berbew | a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519

Analysis

max time kernel
78s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519.exe
Size

64KB
MD5

6b3f12dec7324adc904a2a8988afadcf
SHA1

23e12700cace5f1b2cdf6249a4c73b1176b1bff8
SHA256

a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519
SHA512

775c4062f8ad62d2668368ee170cb64c4b45b1863ddd521042d778065c78843e83f727d6a910b335cdd0bcae59c05afdd952a32773ce3b3429a970cd793b196f
SSDEEP

1536:qHwc//xahZHoKXYPvh4sUXruCHcpzt/Idn:tc/o7oK6hzpFwn

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Johnamkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjohde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Innfnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neclenfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adndoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bheplb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpbpbecj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqpcjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inlihl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkjiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqpcjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onapdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmfnpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdepgkgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjadje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeaanjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cohkokgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djqblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chiigadc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfglfdkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgnqgqan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caageq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfkmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dimenegi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elbhjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdlffhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffclcgfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnoga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdmqmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdaociml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljobpiql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiildio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfmojenc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcgiefen.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaenbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejeiocj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlnjbedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohejo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njhgbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmbmkpie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipmbjgpi.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2864	Cfcjfk32.exe
4380	Ciafbg32.exe
1540	Coknoaic.exe
1120	Ccgjopal.exe
1928	Dfefkkqp.exe
2888	Djqblj32.exe
1164	Dmoohe32.exe
1812	Dpnkdq32.exe
4840	Dcigeooj.exe
1292	Dfgcakon.exe
3112	Difpmfna.exe
940	Dpphjp32.exe
684	Dckdjomg.exe
4296	Dbndfl32.exe
4644	Djelgied.exe
4480	Dmdhcddh.exe
4068	Dpbdopck.exe
1448	Dbqqkkbo.exe
4476	Dflmlj32.exe
3868	Dikihe32.exe
1600	Dlieda32.exe
532	Dpdaepai.exe
1508	Dbcmakpl.exe
2472	Djjebh32.exe
2224	Dimenegi.exe
1908	Dmhand32.exe
3852	Ecbjkngo.exe
4280	Efafgifc.exe
4508	Eiobceef.exe
2920	Emkndc32.exe
548	Epikpo32.exe
3348	Ecefqnel.exe
3172	Efccmidp.exe
4252	Eiaoid32.exe
2512	Elpkep32.exe
3760	Ecgcfm32.exe
1008	Efepbi32.exe
624	Ejalcgkg.exe
4852	Emphocjj.exe
4452	Elbhjp32.exe
5096	Eciplm32.exe
2400	Efhlhh32.exe
2896	Eifhdd32.exe
5076	Embddb32.exe
1012	Eleepoob.exe
1336	Eclmamod.exe
1784	Ebommi32.exe
3536	Efjimhnh.exe
3888	Ejfeng32.exe
1880	Emdajb32.exe
4340	Elgaeolp.exe
2360	Fcniglmb.exe
5064	Fbajbi32.exe
856	Fjhacf32.exe
844	Fmfnpa32.exe
436	Flinkojm.exe
1672	Fdqfll32.exe
1092	Fbcfhibj.exe
464	Ffobhg32.exe
3364	Fjjnifbl.exe
2272	Fimodc32.exe
4848	Fllkqn32.exe
1548	Fpggamqc.exe
1476	Fdccbl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Mfchlbfd.exe
File opened for modification	C:\Windows\SysWOW64\Jjoiil32.exe	Jklinohd.exe
File created	C:\Windows\SysWOW64\Kjjbjd32.exe	Kgkfnh32.exe
File opened for modification	C:\Windows\SysWOW64\Pnkbkk32.exe	Phajna32.exe
File opened for modification	C:\Windows\SysWOW64\Icdheded.exe	Ipflihfq.exe
File opened for modification	C:\Windows\SysWOW64\Ohkkhhmh.exe	Odoogi32.exe
File opened for modification	C:\Windows\SysWOW64\Ljqhkckn.exe	Lfeljd32.exe
File opened for modification	C:\Windows\SysWOW64\Fijkdmhn.exe	Fflohaij.exe
File created	C:\Windows\SysWOW64\Hmbphg32.exe	Hekgfj32.exe
File created	C:\Windows\SysWOW64\Fbhpch32.exe	Fdepgkgj.exe
File created	C:\Windows\SysWOW64\Pjdhbppo.dll	Jpcapp32.exe
File opened for modification	C:\Windows\SysWOW64\Mfqlfb32.exe	Mcbpjg32.exe
File opened for modification	C:\Windows\SysWOW64\Coknoaic.exe	Ciafbg32.exe
File created	C:\Windows\SysWOW64\Giinpa32.exe	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Gppcmeem.exe	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Ikgbdnie.dll	Igajal32.exe
File created	C:\Windows\SysWOW64\Mjaabq32.exe	Mcgiefen.exe
File created	C:\Windows\SysWOW64\Ipckmjqi.dll	Djelgied.exe
File created	C:\Windows\SysWOW64\Ioqgiibk.dll	Hcblpdgg.exe
File opened for modification	C:\Windows\SysWOW64\Kqfngd32.exe	Knhakh32.exe
File opened for modification	C:\Windows\SysWOW64\Hmnmgnoh.exe	Hkpqkcpd.exe
File created	C:\Windows\SysWOW64\Ibkgme32.dll	Ohkkhhmh.exe
File opened for modification	C:\Windows\SysWOW64\Ckclhn32.exe	Bheplb32.exe
File created	C:\Windows\SysWOW64\Cqmmqg32.dll	Eejeiocj.exe
File created	C:\Windows\SysWOW64\Jmbhoeid.exe	Jekqmhia.exe
File created	C:\Windows\SysWOW64\Nnhmnn32.exe	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Qbkofn32.dll	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Cfpffeaj.exe	Cnindhpg.exe
File created	C:\Windows\SysWOW64\Lfipab32.dll	Eiokinbk.exe
File created	C:\Windows\SysWOW64\Jenmcggo.exe	Jcoaglhk.exe
File created	C:\Windows\SysWOW64\Ipjedh32.exe	Inlihl32.exe
File created	C:\Windows\SysWOW64\Cmpmfmao.dll	Akqfkp32.exe
File opened for modification	C:\Windows\SysWOW64\Jjlmclqa.exe	Jkimho32.exe
File created	C:\Windows\SysWOW64\Hehkga32.dll	Ncofplba.exe
File created	C:\Windows\SysWOW64\Oplfkeob.exe	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Ahmjjoig.exe	Qpeahb32.exe
File created	C:\Windows\SysWOW64\Dpnkdq32.exe	Dmoohe32.exe
File created	C:\Windows\SysWOW64\Gmiclo32.exe	Gkkgpc32.exe
File opened for modification	C:\Windows\SysWOW64\Bnkbcj32.exe	Bklfgo32.exe
File created	C:\Windows\SysWOW64\Bllbaa32.exe	Bebjdgmj.exe
File created	C:\Windows\SysWOW64\Emoadlfo.exe	Eicedn32.exe
File opened for modification	C:\Windows\SysWOW64\Jiiicf32.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Dohjem32.dll	Kngkqbgl.exe
File opened for modification	C:\Windows\SysWOW64\Ojhpimhp.exe	Ogjdmbil.exe
File opened for modification	C:\Windows\SysWOW64\Djelgied.exe	Dbndfl32.exe
File created	C:\Windows\SysWOW64\Pnkbkk32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Gkbofaoj.dll	Eiaoid32.exe
File created	C:\Windows\SysWOW64\Ljeffhcd.dll	Hiiggoaf.exe
File opened for modification	C:\Windows\SysWOW64\Kngkqbgl.exe	Kgnbdh32.exe
File created	C:\Windows\SysWOW64\Ojnkocdc.dll	Mcbpjg32.exe
File created	C:\Windows\SysWOW64\Kmdlffhj.exe	Kjepjkhf.exe
File opened for modification	C:\Windows\SysWOW64\Dooaoj32.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Cboeai32.dll	Dngjff32.exe
File created	C:\Windows\SysWOW64\Kpkbnj32.dll	Mjjkaabc.exe
File opened for modification	C:\Windows\SysWOW64\Paiogf32.exe	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Efepbi32.exe	Ecgcfm32.exe
File opened for modification	C:\Windows\SysWOW64\Ljfhqh32.exe	Ldipha32.exe
File created	C:\Windows\SysWOW64\Pefabkej.exe	Plmmif32.exe
File opened for modification	C:\Windows\SysWOW64\Bllbaa32.exe	Bebjdgmj.exe
File opened for modification	C:\Windows\SysWOW64\Ibhkfm32.exe	Ipjoja32.exe
File created	C:\Windows\SysWOW64\Jbfadafe.dll	Gbofcghl.exe
File created	C:\Windows\SysWOW64\Mcelpggq.exe	Mqfpckhm.exe
File opened for modification	C:\Windows\SysWOW64\Dmoohe32.exe	Djqblj32.exe
File created	C:\Windows\SysWOW64\Ipflihfq.exe	Iljpij32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13960	13880	WerFault.exe	697

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiokinbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcigeooj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpqjglii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjhloj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qklmpalf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhdgpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhblllfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgepom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iinjhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjknfnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flqdlnde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhacf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlambk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdgged32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmdcfidg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnojho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmlpaoaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbabigfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmpkadnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oobfob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmdlmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lggejg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbfbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iipfmggc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igfclkdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgeghp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebdcld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbpchb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kofkbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbcfhibj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkbcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfgkffn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqkqhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akpoaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iciaqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imnocf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejalcgkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikpjbq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpmbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpqldc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogjdmbil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Difpmfna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdbjhbbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bomkcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fijkdmhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqpcjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcndbp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcelk32.dll"	Gfokoelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnjejjgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebnfbcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjhdagb.dll"	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knchpiom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckjbhmad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjola32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiebgmkm.dll"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Belqaa32.dll"	Fbhpch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glgjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdpiacg.dll"	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmjmhg32.dll"	Cfipef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igajal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jebfng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocjggbdl.dll"	Gbabigfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhfgeigk.dll"	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cohkokgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfiedd32.dll"	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfohgqlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondljl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaqdae32.dll"	Jgkdbacp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epgkpagl.dll"	Knchpiom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmieae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dooaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fflohaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlieda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohfami32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiiicf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgfl32.dll"	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icdheded.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fidhnlin.dll"	Phonha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glcaambb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikbfgppo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Malpia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjofoqdn.dll"	Hbohpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ombnni32.dll"	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmpga32.dll"	Onapdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkhkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmnala32.dll"	Pahilmoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdnnlj32.dll"	Cnindhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eiloco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bogkmgba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2864	2300	a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519.exe	87
PID 2300 wrote to memory of 2864	2300	a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519.exe	87
PID 2300 wrote to memory of 2864	2300	a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519.exe	87
PID 2864 wrote to memory of 4380	2864	Cfcjfk32.exe	88
PID 2864 wrote to memory of 4380	2864	Cfcjfk32.exe	88
PID 2864 wrote to memory of 4380	2864	Cfcjfk32.exe	88
PID 4380 wrote to memory of 1540	4380	Ciafbg32.exe	89
PID 4380 wrote to memory of 1540	4380	Ciafbg32.exe	89
PID 4380 wrote to memory of 1540	4380	Ciafbg32.exe	89
PID 1540 wrote to memory of 1120	1540	Coknoaic.exe	90
PID 1540 wrote to memory of 1120	1540	Coknoaic.exe	90
PID 1540 wrote to memory of 1120	1540	Coknoaic.exe	90
PID 1120 wrote to memory of 1928	1120	Ccgjopal.exe	91
PID 1120 wrote to memory of 1928	1120	Ccgjopal.exe	91
PID 1120 wrote to memory of 1928	1120	Ccgjopal.exe	91
PID 1928 wrote to memory of 2888	1928	Dfefkkqp.exe	92
PID 1928 wrote to memory of 2888	1928	Dfefkkqp.exe	92
PID 1928 wrote to memory of 2888	1928	Dfefkkqp.exe	92
PID 2888 wrote to memory of 1164	2888	Djqblj32.exe	93
PID 2888 wrote to memory of 1164	2888	Djqblj32.exe	93
PID 2888 wrote to memory of 1164	2888	Djqblj32.exe	93
PID 1164 wrote to memory of 1812	1164	Dmoohe32.exe	94
PID 1164 wrote to memory of 1812	1164	Dmoohe32.exe	94
PID 1164 wrote to memory of 1812	1164	Dmoohe32.exe	94
PID 1812 wrote to memory of 4840	1812	Dpnkdq32.exe	95
PID 1812 wrote to memory of 4840	1812	Dpnkdq32.exe	95
PID 1812 wrote to memory of 4840	1812	Dpnkdq32.exe	95
PID 4840 wrote to memory of 1292	4840	Dcigeooj.exe	97
PID 4840 wrote to memory of 1292	4840	Dcigeooj.exe	97
PID 4840 wrote to memory of 1292	4840	Dcigeooj.exe	97
PID 1292 wrote to memory of 3112	1292	Dfgcakon.exe	98
PID 1292 wrote to memory of 3112	1292	Dfgcakon.exe	98
PID 1292 wrote to memory of 3112	1292	Dfgcakon.exe	98
PID 3112 wrote to memory of 940	3112	Difpmfna.exe	99
PID 3112 wrote to memory of 940	3112	Difpmfna.exe	99
PID 3112 wrote to memory of 940	3112	Difpmfna.exe	99
PID 940 wrote to memory of 684	940	Dpphjp32.exe	101
PID 940 wrote to memory of 684	940	Dpphjp32.exe	101
PID 940 wrote to memory of 684	940	Dpphjp32.exe	101
PID 684 wrote to memory of 4296	684	Dckdjomg.exe	102
PID 684 wrote to memory of 4296	684	Dckdjomg.exe	102
PID 684 wrote to memory of 4296	684	Dckdjomg.exe	102
PID 4296 wrote to memory of 4644	4296	Dbndfl32.exe	103
PID 4296 wrote to memory of 4644	4296	Dbndfl32.exe	103
PID 4296 wrote to memory of 4644	4296	Dbndfl32.exe	103
PID 4644 wrote to memory of 4480	4644	Djelgied.exe	104
PID 4644 wrote to memory of 4480	4644	Djelgied.exe	104
PID 4644 wrote to memory of 4480	4644	Djelgied.exe	104
PID 4480 wrote to memory of 4068	4480	Dmdhcddh.exe	106
PID 4480 wrote to memory of 4068	4480	Dmdhcddh.exe	106
PID 4480 wrote to memory of 4068	4480	Dmdhcddh.exe	106
PID 4068 wrote to memory of 1448	4068	Dpbdopck.exe	107
PID 4068 wrote to memory of 1448	4068	Dpbdopck.exe	107
PID 4068 wrote to memory of 1448	4068	Dpbdopck.exe	107
PID 1448 wrote to memory of 4476	1448	Dbqqkkbo.exe	108
PID 1448 wrote to memory of 4476	1448	Dbqqkkbo.exe	108
PID 1448 wrote to memory of 4476	1448	Dbqqkkbo.exe	108
PID 4476 wrote to memory of 3868	4476	Dflmlj32.exe	109
PID 4476 wrote to memory of 3868	4476	Dflmlj32.exe	109
PID 4476 wrote to memory of 3868	4476	Dflmlj32.exe	109
PID 3868 wrote to memory of 1600	3868	Dikihe32.exe	110
PID 3868 wrote to memory of 1600	3868	Dikihe32.exe	110
PID 3868 wrote to memory of 1600	3868	Dikihe32.exe	110
PID 1600 wrote to memory of 532	1600	Dlieda32.exe	111

C:\Users\Admin\AppData\Local\Temp\a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519.exe
"C:\Users\Admin\AppData\Local\Temp\a1df4fd4169f02c60aba4403cc85074e7b5b70a238e2bc56b0b2670ee85c0519.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\Cfcjfk32.exe
  C:\Windows\system32\Cfcjfk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\Ciafbg32.exe
    C:\Windows\system32\Ciafbg32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\SysWOW64\Coknoaic.exe
      C:\Windows\system32\Coknoaic.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1120
      - C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        23⤵
        Executes dropped EXE
        
        PID:532
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        24⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        25⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        27⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        28⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        29⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        30⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        31⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        32⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        33⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        34⤵
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        36⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3760
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        38⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:624
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        40⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        42⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        43⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        44⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        45⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        46⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        47⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        48⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        49⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        50⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        51⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        52⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        53⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        57⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        58⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        60⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        61⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        62⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        63⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        64⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        65⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        66⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        67⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        68⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        69⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        70⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        71⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        73⤵
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2652
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:868
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        76⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        78⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        79⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        80⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        81⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5016
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        83⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        84⤵
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        85⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        86⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        87⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        88⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5248
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        90⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        92⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        93⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        94⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        95⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        96⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        97⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        98⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        99⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        102⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        103⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        104⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5984
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        106⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        108⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        109⤵
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        111⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        112⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        113⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        114⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        115⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        117⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        118⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        120⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        121⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        122⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        123⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        124⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        125⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        126⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        128⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        129⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        130⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        131⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        132⤵
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        133⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        134⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        136⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        137⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        138⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        139⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        140⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        141⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        142⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        143⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6204
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        145⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        150⤵
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        151⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        152⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        153⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        154⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        155⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        156⤵
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        157⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        158⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        159⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        160⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        162⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        163⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        164⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        165⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        167⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        168⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        169⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        170⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        171⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        172⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        173⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        174⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        175⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        176⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        177⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        178⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        180⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        181⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        182⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        183⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        184⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        185⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        188⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        190⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        192⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        194⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        195⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        196⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        197⤵
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        199⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        201⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        203⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        204⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        206⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        207⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        208⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        209⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        210⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        211⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        213⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        215⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        216⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        217⤵
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        218⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        219⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        220⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        221⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        222⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        223⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        224⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        225⤵
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        226⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        227⤵
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        228⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        229⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        230⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        231⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        233⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        234⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        235⤵
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        236⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        238⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        239⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        240⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        241⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        242⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        243⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        244⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        246⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        247⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        248⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        249⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        250⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        253⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        255⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        256⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        258⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        259⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        261⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        262⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        263⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        264⤵
        Drops file in System32 directory
        
        PID:2332
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        265⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        266⤵
        Drops file in System32 directory
        
        PID:2556
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        267⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        268⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        269⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        270⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:8320
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        273⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        274⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8456
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        276⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        277⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        278⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        279⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        280⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        281⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        284⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        285⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        286⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        287⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        288⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        289⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9072
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        290⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        291⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        292⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:8308
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        295⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        296⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        297⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        298⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        299⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        300⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        301⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        302⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        303⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        304⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8220
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8312
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        307⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        309⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        310⤵
        Drops file in System32 directory
        
        PID:8884
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        311⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        312⤵
        Modifies registry class
        
        PID:9192
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        313⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        314⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        316⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        317⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9156
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        318⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        319⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        320⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        321⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        322⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        323⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        324⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        326⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        327⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        328⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9376
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        330⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        331⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        332⤵
        Modifies registry class
        
        PID:9508
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        333⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        334⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        335⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        337⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        339⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        340⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        341⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        342⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        343⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        344⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10088
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        346⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        347⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        348⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        349⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        350⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        351⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        352⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        353⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        354⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        355⤵
        Drops file in System32 directory
        
        PID:9672
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        356⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        357⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        358⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:9944
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10016
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        361⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        362⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        363⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        364⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        365⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        366⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        367⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        368⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        369⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        370⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        372⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        373⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        374⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        375⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        376⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        377⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        378⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        379⤵
        Modifies registry class
        
        PID:9276
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        380⤵
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        381⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        382⤵
        System Location Discovery: System Language Discovery
        
        PID:10140
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        383⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        384⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:9408
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        386⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        387⤵
        System Location Discovery: System Language Discovery
        
        PID:10036
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        388⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10260
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10304
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        391⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:10396
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        393⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        394⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        395⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10528
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:10572
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        397⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        398⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        399⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:10748
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        401⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        403⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        404⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        405⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        406⤵
        Drops file in System32 directory
        
        PID:11012
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        407⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        408⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        409⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        410⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        411⤵
        Drops file in System32 directory
        
        PID:11224
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        412⤵
        Drops file in System32 directory
        
        PID:10256
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        413⤵
        Modifies registry class
        
        PID:10320
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        414⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        415⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        416⤵
        Modifies registry class
        
        PID:10448
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        417⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        418⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10656
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        420⤵
        Modifies registry class
        
        PID:10732
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        421⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        422⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        423⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        424⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        425⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        426⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        427⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        428⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        429⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        430⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        431⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        432⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        433⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        434⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        435⤵
        Drops file in System32 directory
        
        PID:10952
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        436⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        437⤵
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:10252
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        439⤵
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        440⤵
        Drops file in System32 directory
        
        PID:10480
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        441⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        442⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        443⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        444⤵
        Modifies registry class
        
        PID:11196
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        445⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        446⤵
        Drops file in System32 directory
        
        PID:10544
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        447⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10976
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        449⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        450⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        451⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        452⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:10312
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        454⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        455⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        456⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        457⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        458⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        459⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        460⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        461⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        462⤵
        Drops file in System32 directory
        
        PID:11544
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        463⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11632
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        465⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        466⤵
        System Location Discovery: System Language Discovery
        
        PID:11720
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        467⤵
        Drops file in System32 directory
        
        PID:11764
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        468⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        469⤵
        Drops file in System32 directory
        
        PID:11852
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        470⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        471⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11984
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        473⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12072
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        475⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        476⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12204
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12248
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        479⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11332
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        481⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11444
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:11540
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11616
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        485⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11748
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        487⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        488⤵
        Modifies registry class
        
        PID:11892
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        489⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        490⤵
        Modifies registry class
        
        PID:12036
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        491⤵
        Drops file in System32 directory
        
        PID:12108
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        492⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        493⤵
        Modifies registry class
        
        PID:12236
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        494⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        495⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        496⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11496
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        497⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        498⤵
        System Location Discovery: System Language Discovery
        
        PID:11696
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        499⤵
        System Location Discovery: System Language Discovery
        
        PID:11392
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        500⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        501⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        502⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        503⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        504⤵
        Modifies registry class
        
        PID:12220
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12280
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        506⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11536
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        508⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        509⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11840
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        510⤵
        System Location Discovery: System Language Discovery
        
        PID:12000
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        511⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12148
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        512⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        513⤵
        System Location Discovery: System Language Discovery
        
        PID:11528
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        514⤵
        System Location Discovery: System Language Discovery
        
        PID:11772
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        515⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        516⤵
        System Location Discovery: System Language Discovery
        
        PID:12216
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        517⤵
        Modifies registry class
        
        PID:11776
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        518⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        519⤵
        Modifies registry class
        
        PID:12276
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        520⤵
        Drops file in System32 directory
        
        PID:11936
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        521⤵
        Drops file in System32 directory
        
        PID:12312
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        522⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        523⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        524⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        525⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        526⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        527⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        528⤵
        Modifies registry class
        
        PID:12568
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        529⤵
        System Location Discovery: System Language Discovery
        
        PID:12604
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        530⤵
        Modifies registry class
        
        PID:12640
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        531⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        532⤵
        Drops file in System32 directory
        
        PID:12716
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        533⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        534⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        535⤵
        Modifies registry class
        
        PID:12824
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        536⤵
        Modifies registry class
        
        PID:12860
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        537⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        538⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12932
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        539⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        540⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        541⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13076
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        543⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        544⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        545⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        546⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13256
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        548⤵
        System Location Discovery: System Language Discovery
        
        PID:13292
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        549⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12372
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        551⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        552⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        553⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        554⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        555⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        556⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        557⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12904
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        559⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        560⤵
        Modifies registry class
        
        PID:13028
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        561⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        562⤵
        System Location Discovery: System Language Discovery
        
        PID:13156
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13216
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        564⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        565⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        566⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12500
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        567⤵
        Modifies registry class
        
        PID:12588
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        568⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        569⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        570⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        571⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13036
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        572⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        573⤵
        System Location Discovery: System Language Discovery
        
        PID:13264
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        574⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        575⤵
        System Location Discovery: System Language Discovery
        
        PID:12672
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        576⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        577⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        578⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        579⤵
        Modifies registry class
        
        PID:12344
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        580⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        581⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        582⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        583⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        584⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        585⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        586⤵
        
        PID:13372
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13408
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        588⤵
        System Location Discovery: System Language Discovery
        
        PID:13444
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        589⤵
        System Location Discovery: System Language Discovery
        
        PID:13484
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        590⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        591⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        592⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        593⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        594⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        595⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        596⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        597⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13808
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        599⤵
        Modifies registry class
        
        PID:13844
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        600⤵
        
        PID:13880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13880 -s 224
        601⤵
        Program crash
        
        PID:13960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 13880 -ip 13880
1⤵
PID:13936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akdilipp.exe

Filesize
64KB

MD5
3399eebb96e5e0d26cb5e512e3d6ae81

SHA1
9220c6761c1403f2e9ff6e63aa97d973e89cf225

SHA256
826a76cfb6e4c2f1160279fcea5e64caabf8a7095d7bc5c8e85c4fed27a36c03

SHA512
d8dbdab1aeb57b485a0046f4e0fe65a7b215562a1125f530466ec44411f3bc13674fb11cca8705d3ac5638f559802255e18d32084e894ccdc71421f96b4f3a59

Download Submit
C:\Windows\SysWOW64\Akqfkp32.exe

Filesize
64KB

MD5
68e11964d49799514af14bdf72ad3313

SHA1
f0b72c3df485bd6180af58e3a92a4b87731f5fe7

SHA256
0880b211c1735eb5ed8068a7757e85aae4aa1ef1ef233a1c770041bdb56fb789

SHA512
6dc8577ec5bf046b24e1ac7216b57781f2e46402dceb4c808059346f0b94216eafb0dbd0aa2c13b1fc154ebf4a21b13d2ed96fa1b4500c25401adb3f1adfd8c9

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
64KB

MD5
f7f9e10a6c250ae354533dbfea730209

SHA1
f3c596a19b96f56a4cddb5e948a3fd4323f2b963

SHA256
ae60faf8275463643b34ce066038f6be60238ef52d73c6b1444b5bd875372449

SHA512
04798efdf610f446c135503cadfd175309536338ca2659ca236076d4fb9cfc3c57b28673296f2018cc5028589ce506ccfadab6a41ace644b56c4ccca83332011

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
64KB

MD5
fd5b6f2484a62bfe74455d9bffb0f47d

SHA1
05834830f1773465138bad3239854e35a519944e

SHA256
7d5dc1d5d521e03f8a59fd7056a7d4434030fc6750f8f0d4ed7fda1148d8eb35

SHA512
22a2253d214bd90256e0ef067105e37ea4847c34bebe9976c4476a3dc56bdecb3c0c9b32d228397ec2377d60a0b48e8de5a1c9b8cd902a74b627615066fca9a8

Download Submit
C:\Windows\SysWOW64\Bffcpg32.exe

Filesize
64KB

MD5
56a920a9f992768c9facabe445f093a9

SHA1
bf6473aaa769ab2cc0bac8f18d5b3d8558bed8ff

SHA256
00bf693997b4e5c33075676a195d8154b748968e7807baceb6665d1947c5c6e4

SHA512
6b72a3640328251fb13017a93d5176f83263e48366a3cf21dc9ad255e9b6ca992dd480e9913f730bf6d1967da9df34f115bfe2b180b4bf9514bf5fe16f89daff

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
64KB

MD5
4480cb5c517b8be1f022103f40be0ab0

SHA1
6e9f3431164cf5edb2397bbe7af316f37819d0e8

SHA256
496bc45013d609176fe64dd878183a7420229fc7ffc1aab19b9a1c775913fd6a

SHA512
62a5785754aece182194b3cb404dcd4dc20d0f92174878d6f2ff8acdf2f9dd5e3b198fb2d46d0d0cdc2938a325533d182caa365db14edd6c6fc13335697efbf5

Download Submit
C:\Windows\SysWOW64\Bkphhgfc.exe

Filesize
64KB

MD5
eb6d6fbc2e16ca2224f1de2a98ff3c33

SHA1
57515617a8d951f34ccd63af7ec655aacf3b13c4

SHA256
0b1cd53a2759b63cc09d205a97b92e49e07b2014fd8ae563305d1d43786114e5

SHA512
177c04acce5c6c07296ba283ed9d5ab2d65704b053b9209f347bee49967aeef7765d8023a124d96980f39bdd9c84ae1670c7e068ea98e44e6cc8ec4e99318295

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
64KB

MD5
76788c252394aa148ebe66cef059b94f

SHA1
dbe3b68b1d08533d5ff7127867c30b0b31f58021

SHA256
47bff6867e43e8d54a5b0de23a7978cb091fb4cc5daadcbfdc82858efd084847

SHA512
6606c2a6858235f7013959b889679b66e97d99d334785eca9ac3d34d1e2c45dd1dcf5c94ad7e04674ca7a2e1f20f2aef8ae868c29f5afde86772af7dd5b5e86b

Download Submit
C:\Windows\SysWOW64\Bojomm32.exe

Filesize
64KB

MD5
0f3e7fd04def81922ed7ea31df93b74b

SHA1
38ff81ec75b0c24226d3c390cf46e3e4e04bdf12

SHA256
69dcc1188b33bc01e9ecfa27f8c1620dc88d36b324101b8af92d5800d72bce4f

SHA512
cc5fc5f2c83c783d060cd5b3ccdba57a4b63c4cb0c933812ffbb22e1d38c2cb20428bef201696b5e4f808fd6cde0525df9085682d7acb872792c4e46243505c3

Download Submit
C:\Windows\SysWOW64\Bphgeo32.exe

Filesize
64KB

MD5
84e87396a03959f9eccc9a8b116b1d80

SHA1
155b80461e613bff76d8c17549e3278a5bf6dbd8

SHA256
7e9dcf899df1709ac9ed24693d15e1e65c86f0c05433ba2166b538dbe470bb37

SHA512
9f4abb0cf65b2f2b364e3774543c3bbd731d12fae67c21f00a6e07206500b682c55135d0ecd7386731120c11827c378d23fcd982a0d25f48e554f66e0444db89

Download Submit
C:\Windows\SysWOW64\Cbfgkffn.exe

Filesize
64KB

MD5
2a4e0fb8ad644912174d59a049130d2d

SHA1
e91c18e131b7feeb769aaf7f0e157e3b0a5b810c

SHA256
7392cdbc6c7da8393d03d0da5ebbc9b5511c64d88b76604c40ce26cfc0fbe0b4

SHA512
ae16ebaaad6e745b8bcbfe50118886caa863f43e34ba2b0b37fc1e49ff12245b6ea673daf28d6e71b36f50fc31e587e7f39a44888336959bf4a563e8983e14ea

Download Submit
C:\Windows\SysWOW64\Ccgjopal.exe

Filesize
64KB

MD5
64a6d6877a2784e26e174e534c22569f

SHA1
a4ff267fb04ff2e41a52a029bfaac44c69446366

SHA256
ce49b8d4e90833dbf41d259e540d199121d176747ab445cd7bd0e47d0d1d21aa

SHA512
bb966eddcfe2222f7f6d2f8a9dc45de1bfaab3fe70fa11ee7364e38cd7155117fe4ff627da82576022683dfe218b43e94b4b479a6b0e4c287c4e2f3dc27491df

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
64KB

MD5
913893407cb208681d95144c0c189e34

SHA1
00cebb55ef09aa42f5f4a573f336f0e0833163e7

SHA256
077ea839c046c12844cd05775fabb04bedebf0301c2d1017732cd136a7ec45ae

SHA512
b01fd6f00c68f5a5921ae689d605711141f7f2ef50256fc653c34aa6ace392e93f53f454b7929b30cc64531da8439dea478db5b51181721ad8c0d94f6859cef6

Download Submit
C:\Windows\SysWOW64\Cfnjpfcl.exe

Filesize
64KB

MD5
0172f5d88cacd9bb3fdca1b2ca5c3fa0

SHA1
4ff91c9d661cb30b1b909b77e4b9678a7ced1a67

SHA256
56ee417877c6bebb5b16ddbeba79fdd86785773d6181b0093ea14283f5f398c4

SHA512
ef9d12c0b2e9812d9e99afd1150bcc9276c23030e0e559b6efd096df11d1c569c0b6b247dd3d92b67b8a9f505517c676bb0b3d6718b07b27f93933bf153ad36c

Download Submit
C:\Windows\SysWOW64\Chqogq32.exe

Filesize
64KB

MD5
75a243ccb5c35181095f7090d5037ef2

SHA1
d7f032762b9b0cdfd025f2637a579dc4b3ba8207

SHA256
f69130a73d75fbd47a9963658e451de4eef93d79a603177e819786ee3513c8cb

SHA512
404d6848040c39bab6ae01a9637861ce42562c4c6f8e7b58eae8712805e0b5f0984024b86275a3ad18661bf91de28f71c714e49fc3739415fc4071b5fe6e21c6

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
64KB

MD5
414fd52227e3a57d342ec9d7e189de92

SHA1
a6d6d22ba94f26eb813f30625548de3b6d6a42b4

SHA256
52a6b6967866e3f7db812918cb463b106b78ce223394af5da0892a09fe00660f

SHA512
d8d40aeb4010ded474c7226e78939b8659bd1c42801723182b1a19639c1bd52754e1ca537ec8e76f693caf4504f6354664f4c0f00523ad0e5f9a63bb98febaa2

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
64KB

MD5
7c54f4b6a93b5193b6e6554ca34bd506

SHA1
8f2d2d63b412b44cdd15da1e93740e361b34f4d3

SHA256
bc1d69e139a6fb8a8f0aa0dbce961fc53a7488ec7988741f12df66e5265cf2f5

SHA512
b93ab5181149ff6157d98ed46a757e51268a9eaf40f81e01538d8dd4577d2eca3892a1f95c55aa1e844ba4d02cb52134d9196d1768db3cfbd36647a4b1da29fa

Download Submit
C:\Windows\SysWOW64\Cndeii32.exe

Filesize
64KB

MD5
0e71548fa5412cac41b6ed38da79f7a5

SHA1
0fc3ce4ea1a8a5f9035f59d2ad3ead1747f8bb7f

SHA256
4c5336d2c84b049114730e86d7b554d34191ddc3ffabd68c876bde70995a8a23

SHA512
68582bfb8e8164957b35d57a2999628584315f9d80e47f7a930794c1d0f151e4456066ed4b6b7e3078791d4cfa0f8d11b418e55ab8b864f7121a3e3af797556a

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
64KB

MD5
c982fcf9af005a5ed98c6a4e7de41bf8

SHA1
ba2b45bd32ae343d43affc7e3d6def780c00f2bd

SHA256
4f0836f91d16af007f4978a946329c75c8e216d459d080ab76d029153a96ccac

SHA512
5c1e49fe86fef7ec4a80f4499bdb23446c12b66861f9428c7b9c28137d119edce1d8642ce6f6b80faa5b92bacf7694772ea7e31ec4367a38892b9e7a16ffb3e7

Download Submit
C:\Windows\SysWOW64\Cpmapodj.exe

Filesize
64KB

MD5
97bcc2f092a39e6394d621780d5725b6

SHA1
938aa6314926c355519c0ca182978c78723d51d4

SHA256
1a867a90045565a05101636920d69d4eb41730f4ce8a2ccb607367a795f7d671

SHA512
f218ea860e9ebafda554dab6215b297ac102d8a091acb14fb55f9001e419f94014fd87a69278dbf6a3dd1a4a2c3641ed32a83f087ba123aad8fc42d06704babf

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
64KB

MD5
e1943a14954c902842a21522fad07644

SHA1
2ddeff837606154b81af2d11fec71f1396ba78ba

SHA256
b4e19b949e5ddbad34a702f8e534ed41349e0bd500c0de9beb1cc9feab5c263f

SHA512
9c294e793959b613434ad1207261c4d05d62da68bdd56dba170c0bd68917487b3b92a107abf7db458dc04a67c87a12ed4b46473deb8c225c964907879c6ee2b1

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
64KB

MD5
c33ba1df16c407a6b488295d8830927b

SHA1
2fcdb23c7bbbb9a91bf5da3f1068cb5cdd378e1a

SHA256
5fbf5afc17dd411cdbdee5fca99e9d5a75458e059d8b0faeb0e6b6e105b29ddf

SHA512
3677e2407aa817ecd40f1b3d77350930e91c94ccd0333b051e9e0ce4f4cc360db470a4e074780647bcf969d644869195698ade74882d3700181573425fd61e35

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
64KB

MD5
a34bc850f5f205fe739f22edc1464a10

SHA1
ffb58051a7d6c1b4bd92f89ab6e7183b2751d814

SHA256
3716114ea5c3c3cf70c04ae70969a6ceda936b71cf2322fc0e48cb4916a10c74

SHA512
a324a704a69a10e6244010e141f80adb8fcc3d4ad24ab51c21a28bf97e61455d3a730e5992337810c66c3a7cf10e883f1ba103a4ab5f3b08218cbc296b456465

Download Submit
C:\Windows\SysWOW64\Dcigeooj.exe

Filesize
64KB

MD5
3ba624548b38470f87f12f989be9b1a2

SHA1
00aad9e0eccc2c3bb56cc7b4e56e2a2ea851aabe

SHA256
4ffa41fd84fa2738131d075cca88c158924c6f02bf88787f90d5b41d2eea6bcc

SHA512
de5fdad600027c380fdf58a0fd2d7454d9be60a23cd85710389d08a35dfe4d5797a6e69065a2dc0e7cac3cbf20a4b349de3ca6083e9ffba2692c3a549c63ada8

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
64KB

MD5
4bdbc760ca405c5b93367adef41e9308

SHA1
a7b392dd715e90116405752916078546073e7a0b

SHA256
a1edf93fd1d4160f91b741d9cbc1f3f74945bf818f2c3bdd2dba8c7bd85d7229

SHA512
aa8bb50988939d399571c909424d1d3598b9373a41ab0650eb86397e2ec354aa730b088733212e3a245d42215ce4503cd42402af8299fc55784cb5193d328091

Download Submit
C:\Windows\SysWOW64\Ddgibkpc.exe

Filesize
64KB

MD5
40f70711fda42e45f1ee98b95d2c2b74

SHA1
1d1abfa2f5605b14a338ed2af5a458a0ce96b562

SHA256
095ce5c7836caacb4a6ca61bd349d8f50351f2a2d1662d84e75dc740c68ab3d4

SHA512
356d9d2d685aad8d6dc3cae3aee0ecd36f8db850c8cc605f766e110c59c064d27a1bb871d25217c17918c5b12acb1c5c64e14d5d5d18aa8d5b07c6dc6e4c54af

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
64KB

MD5
c4381b44a72733901db711fe59f53587

SHA1
bbf8f6e5e30f25245c739e137d2c2af3a807fdfb

SHA256
aae560e31840ec339541f0cbbb406b6657874d7147048022029e4e7a1d31df66

SHA512
922cd060c85d73335bb227ff85e9073b181c866aaf0b2e5b458366191da47e2c7908b683a4d1624711c57d7a14024ff12ccc1c0ab1b326bfe0b4a16df2423c52

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
64KB

MD5
bd9982e04b89ddfc7b623db151b7d89b

SHA1
31e5ec18ef7482f313d2d511aab0ac8980a54ce2

SHA256
8d6f7a6ed3e4ae8508a51f10904929b920a32502ee8fdbf695f04100ad858c2a

SHA512
0a43cb7b88af6f7cf5ba5891b4d05732645674b60f0f1dd5556a5afa279e2a375efb98f494dfe2fae09ef669f1b0bcb8ec6d833bc4c9d246c9c53df68b09b18f

Download Submit
C:\Windows\SysWOW64\Dflmlj32.exe

Filesize
64KB

MD5
08ccab1870cd3d035af1015de85d803c

SHA1
8c31e94ac6b93f5db6d1823b09fc79e0b7439c10

SHA256
3a47bc6afb7296368233ae4f38d7b69f04416e2136ac20c8c5d56545a56d9a1c

SHA512
7f77c943136b6c533993687abaaf5763f9f1b85fbb926dfaa69f80ab02e6584c33e79d7e26e91991a05a0183c6f1d0fd1e661c84a4705cc39f25ee7cb4eda378

Download Submit
C:\Windows\SysWOW64\Difpmfna.exe

Filesize
64KB

MD5
ca13a6153dc402d4b553cacf3194d8bf

SHA1
eefa09573cca684c851572d584811d5810ad3bd3

SHA256
b4b4b4b80a4f240fb891f84a09dd3c905fe362496b4252c5b7f6a7275afe0b2a

SHA512
142c73218b4f46341e77ced791a336be94e71284f4aaa53f5b2dbb5871e7c5c5378bdf980d1a280b066b26abeeb28c27288cd23c33a8683a9db7e2c07e6d3482

Download Submit
C:\Windows\SysWOW64\Dikihe32.exe

Filesize
64KB

MD5
cf3a92ee98a066ef5d5564f5b716f3b5

SHA1
7c70c18c157dcc81fe73b74febfa77f72c8756ac

SHA256
78da4275768fb55f1a9babb00d0e6506f2d95bcf99df82ae17ee7a5729b324a9

SHA512
561548490bc12308d801fc04a0f7ce18d7dd21e13c235f36145e104f6bb0bcfd7fabde0e9c3a3b26d4d7df7a834c0bb449cfe4703941581eccbf49938b183f09

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
64KB

MD5
f227fedaef11be6da4c5441062a969ac

SHA1
fbcad9f0d3e4a476ea1c0f7df205c9c20c6bd4aa

SHA256
ae24112544e5dccf499b90040e3ad84b3bb49a02fe38b1e17e626ed6b33620dd

SHA512
895f0a4ea838d4a4a6681761c8a34755b3be67180883fd9a0d4704f790246f53fcae7a9039c888faf273ede35ddd06b660cc9233a707089ac6b62f15c2292f03

Download Submit
C:\Windows\SysWOW64\Djelgied.exe

Filesize
64KB

MD5
2d8cc37dcc2430dbedd751846355f77e

SHA1
0a36a3f32d458dc65ccc95f88b7b4b5e43b3caa5

SHA256
39153f7213010aaa20412681ec627338a03392da00142dffd9e9f76b25696a79

SHA512
9b167482aa3c6fb81c09db094a400cd3f701a3ec71441477898cf91b7f92e5ff92b4d6545d77fec1a070d43a3da71147fec4bec1d3236224c8fc677aaed9e07b

Download Submit
C:\Windows\SysWOW64\Djjebh32.exe

Filesize
64KB

MD5
31c30979020e2b7eaabf4184714df32d

SHA1
42b67883427d7356b1906cdb10ceaea62742e461

SHA256
4dc7c32dc21204ae02e0404ed7d1cd197d3d371bcf771c4f46721ba3ec95369b

SHA512
308cee1f83e8a629528f0e5f3d6acac113471a8770323047c696a0b72b48355184a67b27ed1ed75649da7bc9c60226ac9ca6e337d711a04bbf42c10ad1533185

Download Submit
C:\Windows\SysWOW64\Djqblj32.exe

Filesize
64KB

MD5
602d3e150c55acb28f5c5f50f9fa1780

SHA1
85b4f9be501ade2bc2717cdd153145a42006b6ad

SHA256
f025f8c084cf8bd8b7993058be4b6a97a19e9a6aaba40d7963544628a15a87b5

SHA512
441191afc226cec5c0dee957b1f79b7d8f0445c90228b92c7128e59549baaabca8e0f069d52db9362016f4a73ff93efacdd90c83d0945c1358757f4ce6af0008

Download Submit
C:\Windows\SysWOW64\Dkahilkl.exe

Filesize
64KB

MD5
43808c18c1dba947318a5cefe6fc928b

SHA1
1a1e5f13f0cc8017984120d0d08353f8d6aefe9c

SHA256
5bdbaf5315250d47e614ad37057090ea71baced653690ad7b95576617c2654a7

SHA512
9494535b508799017177e422d983ac0062564452e0754cdc47f5ea6dbbdcdec5382f37858e36a333d609a09739eb25ef533ef3bc75c143b3b0181f484d887005

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
64KB

MD5
7df15b158156ac92477ea09d644415fb

SHA1
43d763b3665a1e479edd3dd0169a824fba556a7c

SHA256
0425d3690919417820596f015e1bd452f07bcd84b2bd73f73e7bec6bc99c904d

SHA512
2e482cac67e189efded419bc1767888b430a92acdda7ef51a1f697ec1e77377812bb7ad80062ce127222b74de1098ffd9a600df09b58284e72b06c1cbac38701

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
64KB

MD5
1879cd2daba6da1a36c60d2fbd78f4a4

SHA1
ff3141893b235cb1e5cb9a1c98ed79723b09eaa3

SHA256
c1110672bb7a1aaf7fc8ea74353ac183c19f99ebb721bf11b4a2d75ab50a171e

SHA512
a83a3044e7754c545801d4fdbaaddfd41b44a277feecaee50126c9c4bef6af269651ebfa09b050d772e8932becccd7b7c829e917c1a21bb63127854c6c2dba05

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
64KB

MD5
71393dcb175c23f934e619d7d827bc15

SHA1
2c70f72b790ba92036088454b34e5465e559f8ac

SHA256
c935b488788cb30a07fd2d82a2b4e6fee9c5347ee95b7528eed1344c42466dba

SHA512
30e29a4e039df4064050c08761e4fca2d0e8c06d4a00c1b77abd0072e8cee6771102fcb9230576e8991f1c3aff2ca03703dd6f7b08bd070e8009929755963e85

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
64KB

MD5
f061b3e47558a408c8cfdc6987f9a1c6

SHA1
e32b6790e4a2bdeaeb4d099b5c067398cbbeecb9

SHA256
157a12779c93024b5e1ee967041c7cb7c5ff06afadb3d174ee51edac68970395

SHA512
b9cad4e0391dd54f1d31b3dbf1891c5bcf139856cf59e4a06e10c3ebbbfa0ec22c5cef64f742319852760122c230fd2f70335b089701614bf5ebddebb63f4b1c

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
64KB

MD5
e5053d71fbc7c1808909f235a151fbd5

SHA1
3c314801c59475e8fc842dc63f64851e4d40acab

SHA256
516cf1c46590ff00cdbab3806d9b5ffd504e426a89fe3ca7cba351cc26575865

SHA512
abd6aee7d27c9aa6baed757ce930f35d76d81ed645ac735b3acc2ba39235297d051f18097089bbc4215093fd6e38d82939b1226ff4ac2f71ae24c88c0c2a37d6

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
64KB

MD5
a315f429ac4d55b72e8aafda762d5e01

SHA1
7fa73af8bbc16b164ca1b8609366ab2f17adc422

SHA256
ef84a5fe39e5895b637ef12620fb1f5644e6c62739dd2607bad0b269e5f7304a

SHA512
1f5a34f6a6bf481243b16146a33322e6980b092f33f7fe3b6d4ebbbc50b141b729ec272a1fb6ed90c616f39b38e172157939f79db0282f8785220a17df8bcbfd

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
64KB

MD5
adf297e44847c371ff84cf5b177b8ba5

SHA1
03edb6acb645ddcb3b210acc028cc998ecbaddcd

SHA256
70e0c04709209945da22c5b5841b0d9d31be7d882e989cb4a481bd7ac3f30cb3

SHA512
a577e3a9acfeaba811cd23e29da9e37cc4c0d68ab1cca441ef0d6fc91271e0e4e7f643c3d7b3d2dcf825247ec7c74a35bc62dbf072c502c2c62f92a8e430bd42

Download Submit
C:\Windows\SysWOW64\Dpdaepai.exe

Filesize
64KB

MD5
642b0bff19c2c47054ef9f6cd3444c02

SHA1
233ef4024399595b7b92924768f24375d822f223

SHA256
bcfb1a7971bd9bd80dc7d6828df08199b71eb912aa485a62618d34e404956f2e

SHA512
2d79e3f72abf917823f0b0e940d3c15526d7a5a3b9f3aeb16ea68b3bd3e855f3ef4c33c810bf03eaf41bc461322c35a2028ffa437509ff91b939fb15a1c0961b

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
64KB

MD5
368e781bc0bbe6bdaa9e1a29c36a5e29

SHA1
bb682f845cf408a150b2460231644d7e83179a5e

SHA256
b52cf4523137c237c332938d5c90ea547704eba1a4c1d08975cdc0b069c95885

SHA512
44432b4810f8b04500b1f8d1abe0b9c0f80bcf412ba748809ef62d0ba2cc1480216139a23c858d79df4e4b6b08b8afa3c091fdc6aa46a322b60de416e5e40fdf

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
64KB

MD5
816ade513afcd8578375e6eb6880b9e0

SHA1
bb22f7c30ec0c395d269cfcc2d0cc6d12321ed21

SHA256
86acdcb0732fb795cdb78e31d44ae4d066de21df38de4285b1c6aeb2feb8bb76

SHA512
5a16aad5328e8cb14376e8fe8daa74c6ca50d115ce0ec18b7f3ddc9f56cd85cf694dbd44992aed39fcbe792e8b44884c80d0418463f728d76f8d213e9529a034

Download Submit
C:\Windows\SysWOW64\Ebdcld32.exe

Filesize
64KB

MD5
61198d7bab056c221b9482625671fb2e

SHA1
efe5203490e2ef6b845d7af7d78aacf564162a3c

SHA256
57e3b2c472b9a6ee7ad7a5a099b6bb8ea0085bff304f1d0f1df8459a0f6cdc32

SHA512
0b082f179a57caaea04a68fb5670f678efe4b0b6445f8055a4822ac5a907fa702c7007fe58da5af7f50c5ad8798d607a97fda2a6cad752c18803403769711194

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
64KB

MD5
dbf767a1e484c694778fe7ca50dbc2ae

SHA1
ac317a233f9d1b1480b58a0ef049dec04c580d4f

SHA256
5043e33ad5c36cecd9033fc87cf819fe6080fc11822047426ff4b6bd3938644a

SHA512
6a0ba3a3ca58704c2c9e00cc9bfc7f51e5ad2f74c8cf3b91df697f36522fd308a20d3c4453ca3f91150843c4edb35dd561522555a9a7e9ed44f736ed88ff36d6

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
64KB

MD5
9fdd41a748ab52c98afb09ba9fefc4ea

SHA1
8d46d03e28a5e26befacfe38354d768a45ccd05d

SHA256
f30dafc6164329fbee314ee1b52bc3fe09a3adbe13929a0d6d3eb30bf1beff35

SHA512
64854ab07b1e3677eeb90a93bd7790ca9d43c14bda64be0fa81edbc3738f155cceff33851d56d7dbee7dcaf634a5523f1f386ddb45ac076e35ef33f2b97397c9

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
64KB

MD5
fa79273ba477010adca5289e57f5a859

SHA1
a003c097ea4d87418fd3801d52931f640cfbd8d7

SHA256
28967e28485b38b181437da2e5003c4c6392e5a87ea8e69285c8576305a5ee61

SHA512
f768dd136e49533c9e77524052475770e2cf3c7cc03dfebee990f95a8736bcfe2be92f8fede493a300ea4669c8aee4f73bb9cc424d315d9305801fcbf5283df8

Download Submit
C:\Windows\SysWOW64\Efccmidp.exe

Filesize
64KB

MD5
9ef87552c6a7c939dd7e363d739e81df

SHA1
66dfce781f5a0850fdd246a0f0b4e4cb538ca376

SHA256
2459254d9f2fba2258843717c6213f747245d734961bb01a37492dd470fe4f47

SHA512
163a85c631a81a96adcac500b87d801c2b75e88139425ece3a5777494a8731000ae785492555e5edc0e69448dcd49dec1465b95aaf20df33993245db4dec4cda

Download Submit
C:\Windows\SysWOW64\Efepbi32.exe

Filesize
64KB

MD5
d2c9e8c842b851ff19051818b7c8885b

SHA1
b9ca3de49c011460e19ba14c2dc6b92a31aac975

SHA256
3a03e5032fbb24df62932c4755cb2ec807cb902015839343c946c619e01909b2

SHA512
d6ef562d348fad62bc95365cffdf77e6da60dec6c24ab6aaa694d91c47f6b4981010288159fb2e1eb513d7745a73a4f1176515ba9870bb9a5e38cffb843405e3

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
64KB

MD5
41cb2f93172258673fa08cef99af564f

SHA1
a4b801b2f3eb3ed39848113f6e170f16d244d949

SHA256
05c6ae9ed9c814bf26a05f7baf85a0151dd9ceb494abffb6ba48f069438dffb3

SHA512
1af22cbbe1ad9702b44dfc7cd2a7d4c6a11e551a07a47647f22de686380b2e0ec207d8c87b917ad6a741bd7aca850d291e1311569ecbbf7145355cf83ea14e6e

Download Submit
C:\Windows\SysWOW64\Ekmhejao.exe

Filesize
64KB

MD5
2d6d2805c6296eac35bceb23be966694

SHA1
9c77b97d87adb2b3876e398cf9493c5ae673a681

SHA256
dcd83cca45b8da5af652f8d43d4f6fa596bab39bafd42f6aefa1ca73fc91346e

SHA512
e77d66524bddc3055d0d47b40f97e404241191985a726dff1fcbdcbab61dd5b83efb41728af9e9b51d23f95528d2fb39aefa020ff3f1a1d0ad6a74875f08026a

Download Submit
C:\Windows\SysWOW64\Emdajb32.exe

Filesize
64KB

MD5
8924125522f390cc78f979492c66dfb0

SHA1
72439477233dd50f231f9e0c838d452a77e909f8

SHA256
fc1f48810f9116bdef0bd2f7527e30ff34aff8788ef005f90f543d9cce7be2f4

SHA512
f070c6e59d6089e14db017bb6e0ad66afa1fd6c4694567d60263b06a5b27df7a0f68cc900df97764df009cfe36282158ee5dd24cf7a04bc3937c94af7bf8c068

Download Submit
C:\Windows\SysWOW64\Emkndc32.exe

Filesize
64KB

MD5
b672f9e696ccf1ab71017d04f7b6e999

SHA1
c9d00701a007f804205e9343e05fae3d22422a55

SHA256
440788524567303e7cb6bbce7d6562a9054952c7809a8446a1a9823a6b323425

SHA512
8d924b10460eaea646e5b47e2e674afc7fc939dd2f7506b79bc739b111325f835f3078da04e46bbd6398bf8d8d0196e7e1b02428bda4d3fe4bf06c614a29f74a

Download Submit
C:\Windows\SysWOW64\Emphocjj.exe

Filesize
64KB

MD5
48638bb86ec2b1a099722077676db974

SHA1
d4b69ecf0513af72d18333267df155cb6c9b5768

SHA256
e6ca7c4ca112cadc3552c4f1dc015c88f5ac49cc702b5c6cbc21a82094992543

SHA512
aa1baaeb924d4d7cfeb60715b7c166e0de67902db63eaafccac453c68509d7f6ed4750db24a694029f9d5750a6c5f846540a5300a04a40e0a7882cfecfd857b3

Download Submit
C:\Windows\SysWOW64\Epikpo32.exe

Filesize
64KB

MD5
2139cf28d6c14a31c6523829fff91fb1

SHA1
0e8afce22f5700f9fd9232f9b7a1f1813816a9e3

SHA256
a8e70e66ab9e5e5d12876d2b22cf9dbbc0d82d2797e01dabf994dc56381beb44

SHA512
c14219fe87e145a0a2b9f140524e389b36f003f6744710c71b4b8963c1f01548c310bd1a9eb31794eb208e8ba09235a730b99b9de5d56c53bc8bf4b9d85c9b43

Download Submit
C:\Windows\SysWOW64\Fdepgkgj.exe

Filesize
64KB

MD5
75b3d069e911e66a9e65578bcafbca05

SHA1
9126b765e783241402597b1e9a6137188f51afd8

SHA256
ee166763216981d6f6b538b9b1159650744015fa7259e1a1d08f3d245d31f596

SHA512
8e6620ceabadd40bb5c4daaa9c0e8cc1e1622e3e2ba02db9c4766d7f957f91fdd3e4fa40285e776f2c92931d39eeff84a0e6ddb284697faf890f726afdb7ca37

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
64KB

MD5
79183bbbe2831a20050ec486cd78189d

SHA1
b16924beb31d2fcff95fb5c30c3fd52bd51c1d23

SHA256
ad2a9a164ce333a3a368d3064262dba371e99503ac8fd5a2af938eddf9e4e470

SHA512
0d8047c2419d60c73e01c504268443b4d43f04c196ce941d4d1da92083b96a6d91c1dd74ebb979559ab54e2f45f7fab0ec7d89b25eb8fd4bc5d3109e2c537bd2

Download Submit
C:\Windows\SysWOW64\Fechomko.exe

Filesize
64KB

MD5
c85e332479c5d33dfa794f80a9fb483e

SHA1
bcf8aa5a2dcf3099247aacbc159b90c48e49d00c

SHA256
a6a10e9ada29c5a0fe1a34324e896c7ef77dca33307a560890081289cee5b8d8

SHA512
e2c99808c062b0c7203db2d31778597238d51d496ec5608caa06eb67b490555caab69e03da410fef85d4ef10c22237c53a4ea42058ae6df0d55359395486375a

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
64KB

MD5
0508d6aaa3bb8519f7919d96bb5bce35

SHA1
0fb014f47c76000a374de65e622a8968e7f8ee51

SHA256
875b72b5617602aa6db4ace040909e994e55be579546495d6f8bbe65539fce23

SHA512
cc2bcc5697532346d3b20c0812221bc3447a4cdbc4b5fd5c9f8062aa98730939e187d4545dd73cbb2c2e0deba612be32ee392a5f7755d76de025d017eec3bc7c

Download Submit
C:\Windows\SysWOW64\Ffobhg32.exe

Filesize
64KB

MD5
c982d562843caea2973140565263a21d

SHA1
2c54f66552fb5d069db385c849c6e18a7657d0e9

SHA256
3d01457f90e088bb0d4605da05ac576ae6f401cb5508a17171e5b626a731a045

SHA512
cec135a463c20f0856c53e7d759ef425202ae0562e5cba0f53c02fdcd5ff54e73c90a3380bad88e41b91261838302a3d8cacd2fa389c28a3a0363a56aea75e8f

Download Submit
C:\Windows\SysWOW64\Fimodc32.exe

Filesize
64KB

MD5
490ff67b12a91e11698348a86239c54a

SHA1
7006751cd93803345fa0e0a7c3b4fa574882099a

SHA256
76ebb71f1a95c44c75bcd15e811d6a577832d75e230713b71e0882270c06288c

SHA512
9d0b4fc5ca90193c970aa2f6c08c5f1155c16c6e2bfcc95c78fb9181780ce6dc04348f25fe2ac908b74ca7e12cccefe25f2eb7bec3609eb474ff3a4a37f62f13

Download Submit
C:\Windows\SysWOW64\Fmfnpa32.exe

Filesize
64KB

MD5
2156703964ee296a20767dbe9b2e9931

SHA1
8207f0d700dcb9163b337ab1ad98aa09656884ea

SHA256
dabee8460ccac5b90a4c39fc07376a18aa6c88cc3cf0e3cc8aec06cdaf13367d

SHA512
ada4e80c7db5e46cc9d6a51e0378c5b9a6f55303c721084ea67c123207a34769cae327372509c4c1111dd6f16a146142019bf9e7b2555afd71a93293162b37b4

Download Submit
C:\Windows\SysWOW64\Fmkgkapm.exe

Filesize
64KB

MD5
e138617946ad8ce2c3ad413ae7d20772

SHA1
af1045b422e875bc8faf54d83384eae45994a7d2

SHA256
8bc2100e9c1adbb6df5cb6a742f7a00f61931090c44150fa376c117afadaff47

SHA512
a6d4b5ef3f7c4cfe1dae943add3681144fc45f16fd1ad6aa99ab088e7f9d9479016c426735bc7f18d9f55cfd4e92833254ae114ef0c7b90178860cf1a727f2b0

Download Submit
C:\Windows\SysWOW64\Gbofcghl.exe

Filesize
64KB

MD5
5c34f32d4fff21664e172d085c60765b

SHA1
a81d8b6e511e22aa6865c0bb4a8aa3d06dcbf815

SHA256
5fd64fd7d480f52f5ceb5f4da8dde80ee4cd6c5fff267771b5e2ed1c2ed0f1b3

SHA512
83f6306fc129efedcd7d5470e6f925cf6e1d696995dec7b403e48b0b65e4a010a0aa3aa368a8b5ee62ec76152326a2d2930d5de7eb277327fff788c0c510b3fe

Download Submit
C:\Windows\SysWOW64\Geaepk32.exe

Filesize
64KB

MD5
9ab2ef86b971c9c729eb4967853a2316

SHA1
ea8929113195846381829c13697e5c834093f384

SHA256
36abadd974ed978505d331e22e588cb651dd9d2cc56f2c211c5f69864cf10016

SHA512
cd66c2ec120e245dd99898e11c5a302cca283b0df83e3337f8cbffd8805e8b6e5ec0871374389127ad282eadc7df3205d319ff07daccdd4029d1439a0cbc06bc

Download Submit
C:\Windows\SysWOW64\Gfheof32.exe

Filesize
64KB

MD5
e80f25cae6c1a849eaae3f41b48db731

SHA1
e8e789efa105cf6a2e1a126d86256f8d80870c12

SHA256
35387b8ec05f99c3f6601a99df301dfdbf3a99ac43670d4ffd83d7a6067440c9

SHA512
d6dfd75a591d445ff89cf056eda09a8f37c265e41c02b0ed9b36ebba988bb6869b23a688c03be58c88efaf59cd795b84adde72ed52312b457d52ad88c9e0c1ec

Download Submit
C:\Windows\SysWOW64\Gfmojenc.exe

Filesize
64KB

MD5
e108e3992523accdb81fb13d5da1ae07

SHA1
45ec7d5c021f36c7c71354435a916e8d85df26de

SHA256
0a78d9fdb199905655b3db0736a62ffa7b23d66d20340ffa46e9c1167f10cd18

SHA512
30c6ff5c8b9f57990371f422941facb0f5783ff9ba30045537c23773df5435eaed91728d59c142089120b0d33ad72de8e70365970bf7198e413c9bbbdd3ba2ad

Download Submit
C:\Windows\SysWOW64\Gidnkkpc.exe

Filesize
64KB

MD5
b81fc6677c60764ba630d74f264ca751

SHA1
74230c2a9298a34a824726c5bf0193eaccc908b5

SHA256
17dd7da3501f9f1e8a10eb0cbc80114d1f510824a8e4d6aa2f579a34af099cce

SHA512
5d574a1345a7cecf78e4c443b34a254de944f1bef9685548736579c46329ea0d9b5aa8e03a5cdb5ef1113fef1bfea19d1808caafc73d7c15b8c9b7de8e996702

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
64KB

MD5
8e61b9d32ce0b5ab4faecb872f10bb1f

SHA1
816f010d7d5482a5bfa4340bdf003c530ac96024

SHA256
21d62ced520fe5d6f3dddfd007e167394290cf566ee11cd4fcdd90d76689d308

SHA512
5370c3ba622b701e053a2e636bb31bc66a4917e80da0410a90c943dcfecd2f11fd18937bf7b8a54eaefd5bb4ac94cad392ee9f64d99692f9edb6c7397ccdd098

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
64KB

MD5
01919b718b4f4d90aa7a41863ee4c4b0

SHA1
bcce3e86080da303c5a318965a2919d4d74234ae

SHA256
406e208ffded68a46e8edecef36ac86d5474ca85e4b378e28bbafada59ae62cd

SHA512
4b00ce452969e36edd9b8c7bb3b45ed06be85b583e06310e3e1ac9c72acfaf02ad0a785da8775c0521ce3740d338d4aed18f5e60df9974c49b388725da9e3ca4

Download Submit
C:\Windows\SysWOW64\Hekgfj32.exe

Filesize
64KB

MD5
fd0b64aacae36a64689489cd36ac15df

SHA1
f93db43339b7f6da6350047c97566f6dc1358951

SHA256
eec8fedae0bf6bd9a5e58c4acda2d437752d6adb136609e064854372d23a98ce

SHA512
e9351d3ffb3834c5b426316f88c8eea688a6b6a40f6105ea7709c1b70e57f5d3d62bebdbc21f2f3a463ebee1b5603d14aabdf80fa4ee17eab63f4b6f0ebae07d

Download Submit
C:\Windows\SysWOW64\Hemdlj32.exe

Filesize
64KB

MD5
3ec28760071dfa7afaaa7844c83af3d8

SHA1
bfe778ee61ff4687cafd8224a88a0dd5bc404e00

SHA256
7998c0b675ad8738255a001c9d11768125d99ddb3ef4fef9f387551dd831ca6b

SHA512
ffc9a98cb0f4b95fc56b8aca54cee38885b38c45e302ae4378ab4170413f81f057dfacd6d90b2cfb5f962e27ad915d7e6d4301e50b2bec3b6fc9f581e6b29fdc

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
64KB

MD5
f5deafdb53b292931b5d5a14c627d1ff

SHA1
8430da645be8e63b85a6e59f2e085efd839d01e6

SHA256
cf427796dedfcbc020e3f3553be6f922519ad75d9e017f2a07befec7cc7759fa

SHA512
b8aefcb604dd1d668148d9b7ca3ee30f661154f5b9cda86eb6acfc05dd415c6e7f9eb62a2955c060acec73c1a70ce71e4a5b736fa43557fbca5744e0b6b3a19d

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
64KB

MD5
8164c273959048ba5e512ec447425d51

SHA1
26b47f055057ab327fcbfbf5530368899ec43b4e

SHA256
fd2d68de1a077ec72e339fa791ec6bd9be81363ded7cf19865609af10d97e463

SHA512
ef6a2cc0310c2ab8b2099363d9679cbb6a6cd046996e9c35dd29dbfe86baf2643b1943cced39c66fa54143995a4b0b927be963775fcf7454987e22c2e0135028

Download Submit
C:\Windows\SysWOW64\Icfekc32.exe

Filesize
64KB

MD5
468dc91f71e13e3d0f461e1f01f647e9

SHA1
a3d0dfb8b05ec9952633ec0ac7e3840164a458d2

SHA256
7bb42dbfd83efe8e348dc8105a59a998c7cf2f07369654d5f2a6c5b404f7e766

SHA512
313a6e4e85114fe9b682d9efb556872c3656ff1f4f9c0dcfbcd5831076ed28afcd6bc2e38e06a46b99de8455f54fb06f71f6f3dee2f6d5b5edf6164f5da14834

Download Submit
C:\Windows\SysWOW64\Ikpjbq32.exe

Filesize
64KB

MD5
77a2e0dea7a80a2c8b5a960cdc741d7f

SHA1
76bd365bcb67c07bfcffd1ee23bd2ce8bc7cee6d

SHA256
ceeeda76f21491640801979bd2f064f01f4fd18fb71e0017a81c9b2c419a94de

SHA512
a19b2ea8901dd0a09b9d1ccb287ade465bcf6c3864cd6b247138d16953b46aeb3c54ff3dc4a3be042cb7763a9540f255aa9e4cbc9b4ccf68f874e23170a5f70b

Download Submit
C:\Windows\SysWOW64\Ipjoja32.exe

Filesize
64KB

MD5
1696921ccc2277e940be72c78df4187a

SHA1
38a274c8f7518d5ded9d1f57de35db2ca6a3f1d2

SHA256
b0bc906131d05f9f34757433f3b399751dd7d99d685c784f6c4eb2e6fb4bccc6

SHA512
0ef84bb9ff4547aaafe787f3a00264d7a9fdd43c688d9d007889e88a0202c2ad5f6cb39cd281f00d8e729099c99eccd6539760cdad8c028606a1fcb1239a7654

Download Submit
C:\Windows\SysWOW64\Ipmbjgpi.exe

Filesize
64KB

MD5
64ffaf6e142722e8ccc218452229ab35

SHA1
2eda7a03d5a51700e1035cccb3da49fc20c7cb63

SHA256
e109ce1405afc39b468fd4997e994df5abeff1903209039fae3ac6a671fa1ed1

SHA512
e5f0f4b32ce7164383d5462b205cf35a40d9fd45bd71f5213825ee0f6badb4484c46a68e8cef37b4a6f5a8caf884260d30bc632ac8b838c3ffa82c1a0584473f

Download Submit
C:\Windows\SysWOW64\Jjpode32.exe

Filesize
64KB

MD5
07907a25dd54e2ef087a648a6e148b18

SHA1
d5958322fea35c7995f6e8becda20da649095c6e

SHA256
98671732825f52014c41ab24b371b8546a05b9c08d4e9d45c0f5ea13845e87a1

SHA512
0307c52fc976cf3d3263f057452db36221baa65a6f0669d0117d9112515b721a18c422735a41956d14bcbd60aa24f390dc6fa0128da5812facbd431a1565af72

Download Submit
C:\Windows\SysWOW64\Jlhljhbg.exe

Filesize
64KB

MD5
124f81573ff4124ce9407e1da0480df5

SHA1
824e381d49c9bd2303e6f7ae03bd51eb59dfcfbc

SHA256
3c14b97f4862dc4160cbb7f3ed5db1d8d2c59fcfa7080d2787eaf947ca8a67a7

SHA512
a8e8279349b0b2dd93a5414289357db962d06ce925912ec9f1ad30a9cd46377227e9ef7ac09c0a2b9165373f800d82c00aba50e0af83f88f685161856909f7d8

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
64KB

MD5
23cd218374c469880e67bc071fb12401

SHA1
eb4847c0b6c9cd4dba16f68cd556c4cf7fc69216

SHA256
40c239add733eb92853fd6f3e420e6c07fce9b3aad0ea01d99af1811459173c1

SHA512
8fe2414cf0e1da851991f83e87959036faa3f24009e02826756d56979dd435bb75069cb8d59092cc33696ccadadc9438a490231207e930bd9d32a494e24c24b1

Download Submit
C:\Windows\SysWOW64\Kclgmq32.exe

Filesize
64KB

MD5
e07275134d5220b1e58d97c4e1c70cf7

SHA1
7ab481976cc76527532f3f458c7fba2d6357988d

SHA256
2c69e95c899e934b3c487113f8d5810e8753b37fc0ab0c4bccd797983b1acd92

SHA512
e7e3b7d6584cdc120791ccd27e94504e004ef9c74f00036b0f3ce2877bd52718edeb5d2f4bde64a937b32a5697f1c48d281cec17b303c852a45906dbe5133c4d

Download Submit
C:\Windows\SysWOW64\Kjblje32.exe

Filesize
64KB

MD5
33226f9e07570d39ecff15045d45e085

SHA1
0e008f6f91202827960a47733b023f42651f43cf

SHA256
1c5ffa27cf1c081b9c46150a852acf2de02078bedceaccbaddc441eb56cc115d

SHA512
d8d2fff9c1371dad46a0b8eca628a5bce6edf756e91f4264a991f3ea9461863892249d995edd25eb955becc72c399b37e11e3a33a853c87c76ad312fb40703da

Download Submit
C:\Windows\SysWOW64\Klcekpdo.exe

Filesize
64KB

MD5
eb693e00c547bb7931ac52ad7c0ce325

SHA1
437633112e73f7d4e42ae775e77c7b49f1e21a58

SHA256
2d0f789de7a8ca00c1d53306679ba7687e1cbf7a7b6c595c230ea119dd29d352

SHA512
1b29811e9e9dc41b24d7c3c291a5ab4693920f891f3ef48b714252b445f3fe74de2d209138967591984a03b132991a463e33f1eea4b8978a6cad3fd74ccc47c9

Download Submit
C:\Windows\SysWOW64\Kncaec32.exe

Filesize
64KB

MD5
cce5593e166d4054b72e95c9d2083eb5

SHA1
3e3efe028949271669243e809c229e653e6d5b93

SHA256
3625e36da661d3f282d1c2089fede7572a84324b6ddbce76883ba2bc0eb55b0e

SHA512
c306ab53d0c5960a4a9162de20e17deafef23b24b7b7cfda633057e677aa9d9d013f8293f6b0876cfa17bd63a4c5284970a0c49a9cf2e4af83e334bd8fd3fce4

Download Submit
C:\Windows\SysWOW64\Kngkqbgl.exe

Filesize
64KB

MD5
4057c8ef31b23d5a67d3f651733b9aa8

SHA1
e268ac88f957f7dc13574213e9c2bd1bf085cd53

SHA256
2d258a3b3e7ab7f83211d5be579cdc1179201811d662d3166af6b6a7bfa158b7

SHA512
5901822537274e067ec2df261e0d8481b65adc8c3fe61d22f51c298f7a3fd3eb073f7b7afac49fa736000ef468c3b6533322b9d4acc7fd582a31917d5c9d1790

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
64KB

MD5
24405b7ad7ed0cd8fa560a7b21e5d171

SHA1
384abccb610919c085b8a8fd62d9bbaf7f9cb70f

SHA256
7d48a73431e0e8904e2edbbc96d28a91634cec63c216859b19779360e094f124

SHA512
06be3c77f6ebe9753aa71d3bd9d34fe3dc7a027cce0c82ebea54612f77f11ae8be80ef41051f64b48592141f3722f6a9019934d58ce8e8554116f81e4b78f2b4

Download Submit
C:\Windows\SysWOW64\Lcnfohmi.exe

Filesize
64KB

MD5
013998d36c7b105c8be4b5fe7fe849b3

SHA1
f84a25c2a3cfbd04484bae39e1a8298c0e173ae5

SHA256
5faeb8318a46199c4698f2642100c606ce10352696a68e0f5771a24eb4afacec

SHA512
4a3febc701b7cadb7d9118fb2d7acd0c43e4edc5e1dce4b1cef2ba262d429a232b24e714c2054211f1d450925b8ba4027aba50428d44592602a69fd772fd80ca

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
64KB

MD5
ab44d8ef339de8cb493f372c811438e5

SHA1
319ececb791cb506ab7ebe9c8df119e3716b5a4f

SHA256
515aa0453665d3a87a398f10858a689e20a2673ccc1a9370462e761254b5ec99

SHA512
297f9374d53f8ca3dd870206517b50cbe3fe48cd4d22d47f4a22865c00c7a30c2cc252d1f712f1ed9139276ecbd785a8c07ced4b22aa5e88e3faa4079bfde3e3

Download Submit
C:\Windows\SysWOW64\Lenicahg.exe

Filesize
64KB

MD5
70271274aef4b905385db3cbb7697046

SHA1
5aa86f1641493681d6095b91ba673b4a0792b525

SHA256
fac0f1f867668f55bb33e18f78df6454804c7d5d3e5ecebf1a3d6a6bcc297dee

SHA512
459e66a0d0c9bac016ae49fb4260eef237c283ee04c91d3bcf3c69740679890fd00bb34da595f43165de20a3f352b02dce00cfa451c76062b954fc0574b0f9f6

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
64KB

MD5
12e84bd024a8a4bc32fa589413ae805a

SHA1
53942dc5b826df52d4868f5d09b3f53440b5c25a

SHA256
216e23d46ef31bf84f1db539087856fe28c85c994186159e6f5ff20b0b02ca86

SHA512
42891f064d82b6bc87e22a993150e8544949905f9a4dd17faf9506bfa99a85001b8cfac0cd6967af4b4e4ee4c07d225d0ab1c5ec5809dff7125b672c7af500b8

Download Submit
C:\Windows\SysWOW64\Lokdnjkg.exe

Filesize
64KB

MD5
7c23b45a363c97543184275b6669abb6

SHA1
15eaa0b81a841abd3a32dad79ab9e7ae022cf40d

SHA256
31da24890ff4745276fd8473408edd6e911beb116f7fad337bb0e408d29660f6

SHA512
09670ff6fbf4170540b4eb80c5345f234252dc2aa55efa5ae868b140423b09afc924a6ae8bec5590f649e95eb93f9fc5b9a3a3cb6d807584ec7293abb46fa34f

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
64KB

MD5
02b2a335522da7b8e6e0785475550b41

SHA1
81ed1d7ac84cc2869d037a4f790cd8d9c2936f02

SHA256
edee67ec5b4aa1fd5155ce8bce3eda7500746b63c71afd4dfcd2fd5e6896bc9a

SHA512
d08a4acf78c2ebdbcafacea8d5fb6bdd301396a734eb73fdc48046a96d4e880ad5c87f38babbf162d9e27afe27967905ae737a9a1181fe5cd018bcf720903673

Download Submit
C:\Windows\SysWOW64\Mjaabq32.exe

Filesize
64KB

MD5
2ddbe9a390b1d571f9c0254e58dfdaf1

SHA1
372aafec3dd552902a22a1a603b890e524daf868

SHA256
c4773a0e60cd467fb42ffa2fca6b84a9b8acb3919a4c9c678afb0fd0d42b776b

SHA512
57fef17bcd7433c7ef559d51dc509d46e2fbb9a21d7379840c8f1b12ae58bb5e7227770a9cbfe8f85e69723843eb1d559efb3f0a1f3a8b1340fc95773b6b511d

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
64KB

MD5
0e870af33cd777f2eaa781d8d90d9ba6

SHA1
58eb8c28deec73626e194b9c28fcb97ff4cf1093

SHA256
9ba50d8e835cdf4c611b1ecaf83e0fb2c12bb477f854a0329bf974f92cfcb75e

SHA512
4ccc4fe1ca2edea32e8f370f4f51360f3023655cab9bff53d241b90771a5a2ec37779f53c96806655a5be9c5f11602b2566fc05b6cc1aa852bc1b3c640cae38d

Download Submit
C:\Windows\SysWOW64\Ncofplba.exe

Filesize
64KB

MD5
cd9b93d18fa46593b517888cff9527d4

SHA1
44adb8a69bd98b60a55131199f1bfb3412ebde6a

SHA256
95d89f545d86b95009f27e206be0b7bfed8e07904f7656f08ab9b75d2a8dbe8a

SHA512
ddc36947f10df6b21406e36b1867dad8b8cee921e755e0c4815df6fa7a1bc16e3898cafd24786a6e901732e2e71537918b465d0defcdb0196672e16612d389b4

Download Submit
C:\Windows\SysWOW64\Neclenfo.exe

Filesize
64KB

MD5
304e9b5cdb7cd504dc8520b766c80698

SHA1
e1fe40c849099de3d3a845548a50e70b7f820431

SHA256
c9390b6bf2cebb69b1a5ca41670f0c761928338a77d0d790a220a8a76015f778

SHA512
579920349409152b8de42a153a71216203bb71e08e01f066996afd504a78306f4b261ce657aa4ec70ee008c309a832a27b8555ea515f8ce0cbf949b0c20bc53e

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
64KB

MD5
e499c96f1917c03ca7eb4f407ddc5367

SHA1
daf03557aa75cf1e6d4b2bde27c0f3b95e3d9294

SHA256
b8a5a57e7a0b111c784ee7a08d6f15d667b4d2d796494bed0a04d28fe21f272c

SHA512
5ef9028c5740bbad72665ad6ff505e4debc8778577f983b02a0a918b03b8382e373b5e5828be1b31de671fea710d1eb054c95325c81f88f8fe9e7c12d472f9b3

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
64KB

MD5
256b5c424f9fefa692c502454d704710

SHA1
6c492106fc6ef256b7463e32066e1a183ded20d2

SHA256
f92a85342b526f00c08298b686b3be8e7c5b42dd1cbcc98246a37221a06f356e

SHA512
ec6c7ce25552f3a8f3901bedd3541132514331fc95149e541774f923c649e4ad0a9fa808987e355a94d9390e8285de5d99c1e2676f84b9f74579e8669810b009

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
64KB

MD5
39672e5104497ffb6d97705c89978333

SHA1
1f4299b1779ee84dce1334092d2b0d2e9c51671a

SHA256
baf5f734aa0662fc4db9c96c6405c3fe289a52732666d73341961664cc0a94fe

SHA512
05148ab5e88d00a677bcca899668578369e643e43ee353ccd099dee47e8b3099d3c0bf425a2af5eac0af3f6976ecfa620500876d7418c5548df2708330e10851

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
64KB

MD5
6107786015b8847e5fc714bfdecd52c5

SHA1
851be9501b74ac9e1948e71a77c52e453e3cff11

SHA256
7b82067736e5e94eb00d907a38baed4ba49b0fc045de381a5c9fb5c3266f38e6

SHA512
b7818aa92e8438a760b4aa7b982026a73fe82da4eb81ba357de599865f595633a0c1f8c624290c460ebce96d92b26f276db99aaa4c22b246276f76327fc95506

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
64KB

MD5
18b4140fc8dbb798e1e2dec861fde156

SHA1
d1228e06194f738c4427a01463966ac943c1caef

SHA256
70b11b2f754146cd6feca69a5d55f0e145d1de255a63b8789f48a54c1d8e6f2d

SHA512
fa83869792193b2bdcb31b426ac279acf648fd0a9104310e4732313b76886c519648d239d0a10cd2687c38655b3d3bd8a7bc64cfc89afa1503b3fb377fb186a1

Download Submit
C:\Windows\SysWOW64\Oclkgccf.exe

Filesize
64KB

MD5
0b230d27518fd165ff841f8fa8f5d89b

SHA1
f2659028845e13482ccb031ca31e7b92c8479677

SHA256
ac926ac27fd49f7f092860bd13a86fca67ef6c601a29bb78608333f9f2953259

SHA512
c4e23d5a6f7f5ff6d4cd661190f8d227497b33a027ebb12fd9f108bef86bfd1cdd7009bad0133a96d4ed484cfcd6166721745f4a06e9c06fcf59568f6ecee47f

Download Submit
C:\Windows\SysWOW64\Odalmibl.exe

Filesize
64KB

MD5
8a4c75765efca02d2cd2a216d48f8943

SHA1
6831c3fbdd5bce2fb221e66c35e7066f41eb149b

SHA256
e4e6a2aa164befdece7445cef41bd0026cbfbdbeb39648b10660598e73c00e84

SHA512
d644ac86f27a2214dcce80d69966d7edd5267b6687335546fca57f239521de4cf4801a0ff9c7ee5c5914658a557463da293c18bc80e2619bc7bffc38dd515844

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
64KB

MD5
4c4a46349b01a1a3d2122177e2d518ea

SHA1
225ef5b6eab811beae0b469f9e8debb25fa3be62

SHA256
f981682361ba03795bbb447cdc631ee1b1c0404d9323fbde3588d9f42cd51734

SHA512
832490dbc39ad24819a4e9ddbd93029c4632f14a75bb7f6ea83d536f79c069dea165a49aa34467b38c9854edfa45f0f9bc733951cda6876c0e2aedd31d0caaf8

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
64KB

MD5
9c855b07c287c5ca44891f746696c83d

SHA1
638e985db39755249f56d2c9dbfc132daad3c551

SHA256
475335df89e3dcc2293301e94ace8143a878c22e06cb1ee3d6b30e1ce14e131d

SHA512
2d62fa1e44f57775456ee500f57762a608c3dbbd499fef550b7a0cfff3f30faf8a9aa2cba041b9bd94f6f9248498f4f247d867c2585946788a8ee29c4290786b

Download Submit
C:\Windows\SysWOW64\Oobfob32.exe

Filesize
64KB

MD5
2c33800594e750d3a750864b9610bb92

SHA1
f8206796fd0265a462afec26b995e6cd83125094

SHA256
5b43d5116a592713ba3bc8773e8b6281b6cc147751a54295b30c52f163d10e8a

SHA512
02f6925a2ad38f8090f997db33bc199c60482aa044859b34dcec9c6b8efd56334f7bf26a1a398ecb3f741e7827a6231ced98a0a3a36ac71f0b1b326063fc8ba2

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
64KB

MD5
975394871ebb3250af350673c4b75b32

SHA1
65fead58a1ee8ca69998f64dff1810fe8d8dfed3

SHA256
5b61c4360750143043d4f692ddf32426f78c97180f22bf7ac6bb4b9190486c8b

SHA512
627fabc16bdb798179edc88054f5290d1ebd846bd58be887514672e712a1e02ede7908fc1e554a2d540d5678117cbf2e328b21db04cbe451ec3f90081c9da9e7

Download Submit
C:\Windows\SysWOW64\Palklf32.exe

Filesize
64KB

MD5
a5a8643fe41a48f7a2deb4bc9b1523e5

SHA1
71937608be65deef4e254351a9feec9a21adfb75

SHA256
43e103c9443d1ab6a8c0abe386801ed6f9835a06fd033e898793da98a1c5f5e4

SHA512
fae2bfa41e3892e33fc6107be507f8dae9962f29ba4b09d3f77db08ac48674d56d7a872c6719e4cacf962c704fa82ec496f32cc275387323084f6ce39c7bc5c9

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
64KB

MD5
8c794984cc2ee515425383e8d80d395c

SHA1
cb142fe650f61f6a0c55f153a7d1138f021e76af

SHA256
69a11851eefd2bd65c18d55baf923bfb2b1fbbcc2e8923d5ea0c3bdf9bd98140

SHA512
efcaa23be76d84116e84e88fac86b26b52e067684205c316ad043de2546fed3493d40ab7c9f7c7e03bbd6e89f5143b5f39c95022fccac92f81481066cf726d24

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
64KB

MD5
1ed3962a83989d9f97b0d7d61ce2bc73

SHA1
8211bf473dc3b9015a3e6d88b6296c2be89a7ccc

SHA256
c09398018dad720585cb1401aa1ba59bfcddd4293177e53d67212b770e6889cc

SHA512
1c97bc9882f47117ffffd1f59deaceaffc59b0e8f224f17b5b3a7d11879e913dc222e54394bbe0ccfeb169b3d639e646db4e235551318666bd4ae5a4d1bd2ca5

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
64KB

MD5
af90f446edbc1dc342f5bf3e0b04c2d6

SHA1
5f2afe6d7b3e7fcdee3bb5c133cec1227f1d6e1d

SHA256
3131020c69eb333861725956375b98e356f1c2f3cbf6fde3b6347d72c3126bfa

SHA512
79540ca0325362f4f52c3f6dc9af3cdfcad747c2ce560386869242226c93851cc1851b3570c1ad48de25c1229afbd2b606b6fdefc40b949c536347a431b6bac8

Download Submit
C:\Windows\SysWOW64\Ponfka32.exe

Filesize
64KB

MD5
f7651dc77af0e5b5c5fe77e6737ee430

SHA1
9869e3be7e1bf0a4790b8bea211976fa341f4033

SHA256
64dd5b5f5f9e13bd3b5995570476c583abc244647588bc698193c8241a7af9e2

SHA512
8a2c057ed8de1ee50f699fa5fb7c3fe1c1c74be0878429af1bc2b247ae0c499775caf8f5d54b6b9f12f000a5068fffe09c80c0ff2a7fad9463949c9b3cc4aeda

Download Submit
C:\Windows\SysWOW64\Ppahmb32.exe

Filesize
64KB

MD5
42cf868d50145931577853dcf2ae0ff7

SHA1
6ea76e1d8c87aa436ce1742a536a161cbace4f1d

SHA256
a50c9ae63fb755211b9fa3e8317450450edc2396ce5d7f81f5e2ee60768e5a93

SHA512
f480d30ad2f9f47d838308862888bcbe7a3a5dc6c5ca4b13190d7d87564d53036f336f1f90dea14b9df9b22b69c91298b6f0ed22bd64f09ba8f30670b878f1ed

Download Submit
C:\Windows\SysWOW64\Qklmpalf.exe

Filesize
64KB

MD5
0ee117fd5ec79aede6e056d3e8d98c61

SHA1
08e8f96d23c50b564c4ca5964d5088a8b28468d2

SHA256
120cf4d1e765283b938d329a5362dd0ea866e099a0a3e646741cb36d9d01e245

SHA512
a59c3651cdcd56aedd2ca13fa703e715a644ea9f81e261fd9e100180c54ad0fbaae3e334f0be3a3a5af3d0d4b88e5da3f598038cd57acb25ed0f8db340a94ce9

Download Submit
memory/532-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/532-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/548-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/548-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/624-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/624-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/684-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/684-107-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/940-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/940-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1008-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1012-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1120-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1120-115-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1164-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1164-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1292-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-381-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-197-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1540-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1540-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1600-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1600-179-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1784-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1880-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1908-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1928-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1928-125-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2300-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2300-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2400-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2400-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2472-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2472-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2512-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2512-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2888-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2888-134-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2896-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2920-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2920-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3112-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3112-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3172-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3172-355-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3348-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3348-279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3536-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-307-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3852-313-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3852-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3868-259-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3868-170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3888-398-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-243-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-320-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-206-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4340-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4380-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4452-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4452-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-162-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-250-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4480-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4508-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4508-251-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-126-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4840-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4852-397-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4852-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-367-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads