berbew | b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b

Analysis

max time kernel
108s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b.exe
Size

470KB
MD5

a7155273bae2344f4ee0fb4ea73d6694
SHA1

1f050c72f2294f9645470d9585aacd243a0f7d9b
SHA256

b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b
SHA512

8806c8cc712d9afdd1d6fd0ba9b2c96dcc057a64c442374366ee09b70c4077d77890fc4008ccb66dabfd1ed0777e4f4ade2d7189370f5c99da1716342b7a85ec
SSDEEP

12288:WTNb/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8QVji:MJ4u

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hgdejd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inqbclob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnmdme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Emjgim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gppcmeem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjafok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oogpjbbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgifbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpmnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nncccnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcblpdgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjjnifbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbofcghl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlcjhkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanfen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fplpll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknmla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgepom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhkbfme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pajeam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmennnni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fmikeaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jocefm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojajin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kkgiimng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Caojpaij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deqcbpld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkbocbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkdliame.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elnoopdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbdcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dflfac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jleijb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fdepgkgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhkjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpdhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Blqllqqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppolhcnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbabigfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oanfen32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1744	Bjbfklei.exe
772	Cjecpkcg.exe
4944	Cijpahho.exe
5016	Ckilmcgb.exe
1372	Cbbdjm32.exe
1656	Cjjlkk32.exe
3600	Cmhigf32.exe
3396	Ccbadp32.exe
2240	Cfqmpl32.exe
4836	Cioilg32.exe
4436	Coiaiakf.exe
1584	Cbgnemjj.exe
1904	Ciafbg32.exe
2352	Coknoaic.exe
3596	Dfefkkqp.exe
3128	Diccgfpd.exe
712	Dkbocbog.exe
464	Dcigeooj.exe
2332	Dblgpl32.exe
3028	Djcoai32.exe
4812	Difpmfna.exe
3684	Dkdliame.exe
1960	Dckdjomg.exe
1848	Dbndfl32.exe
3952	Djelgied.exe
3968	Dmdhcddh.exe
3948	Dlghoa32.exe
32	Dbqqkkbo.exe
436	Djhimica.exe
680	Dikihe32.exe
2992	Dpdaepai.exe
4600	Dbcmakpl.exe
3820	Djjebh32.exe
4004	Dmhand32.exe
4368	Dpgnjo32.exe
3616	Efafgifc.exe
1332	Eiobceef.exe
1452	Elnoopdj.exe
1164	Ecefqnel.exe
3540	Ejoomhmi.exe
4588	Eiaoid32.exe
4972	Elpkep32.exe
1012	Ecgcfm32.exe
1160	Efepbi32.exe
1728	Eidlnd32.exe
2292	Elbhjp32.exe
1228	Eciplm32.exe
2864	Efhlhh32.exe
4800	Eifhdd32.exe
4064	Eleepoob.exe
4584	Eclmamod.exe
1356	Ejfeng32.exe
2296	Emdajb32.exe
4516	Fpbmfn32.exe
1132	Ffmfchle.exe
3808	Fikbocki.exe
572	Flinkojm.exe
4520	Fbcfhibj.exe
1996	Fjjnifbl.exe
4428	Fmikeaap.exe
1548	Fdccbl32.exe
4872	Ffaong32.exe
5140	Fipkjb32.exe
5180	Flngfn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Diccgfpd.exe	Dfefkkqp.exe
File created	C:\Windows\SysWOW64\Jnelok32.exe	Jkgpbp32.exe
File opened for modification	C:\Windows\SysWOW64\Jnlkedai.exe	Jphkkpbp.exe
File opened for modification	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File opened for modification	C:\Windows\SysWOW64\Ddgplado.exe	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Bkncfepb.dll	Mqafhl32.exe
File created	C:\Windows\SysWOW64\Efepbi32.exe	Ecgcfm32.exe
File opened for modification	C:\Windows\SysWOW64\Lgepom32.exe	Lcjcnoej.exe
File opened for modification	C:\Windows\SysWOW64\Pldcjeia.exe	Pdmkhgho.exe
File created	C:\Windows\SysWOW64\Kigcfhbi.dll	Hoeieolb.exe
File opened for modification	C:\Windows\SysWOW64\Qpeahb32.exe	Qodeajbg.exe
File opened for modification	C:\Windows\SysWOW64\Hmbphg32.exe	Hekgfj32.exe
File created	C:\Windows\SysWOW64\Chnbbqpn.exe	Cdbfab32.exe
File opened for modification	C:\Windows\SysWOW64\Cklhcfle.exe	Cpfcfmlp.exe
File created	C:\Windows\SysWOW64\Gkhkjd32.exe	Gbabigfj.exe
File opened for modification	C:\Windows\SysWOW64\Cbfgkffn.exe	Cohkokgj.exe
File created	C:\Windows\SysWOW64\Angdnk32.dll	Dmohno32.exe
File created	C:\Windows\SysWOW64\Dmcain32.exe	Ddligq32.exe
File opened for modification	C:\Windows\SysWOW64\Hpqldc32.exe	Hlepcdoa.exe
File created	C:\Windows\SysWOW64\Koodbl32.exe	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Ciipkkdj.dll	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Eifaim32.exe	Efgemb32.exe
File created	C:\Windows\SysWOW64\Cjafgpmo.dll	Fmcjpl32.exe
File opened for modification	C:\Windows\SysWOW64\Hdehni32.exe	Hloqml32.exe
File created	C:\Windows\SysWOW64\Pffgom32.exe	Phcgcqab.exe
File opened for modification	C:\Windows\SysWOW64\Anobgl32.exe	Akqfkp32.exe
File created	C:\Windows\SysWOW64\Ifomll32.exe	Ibcaknbi.exe
File created	C:\Windows\SysWOW64\Lqkqhm32.exe	Lnldla32.exe
File created	C:\Windows\SysWOW64\Gepgfb32.dll	Fimhjl32.exe
File created	C:\Windows\SysWOW64\Gmophg32.dll	Imgicgca.exe
File created	C:\Windows\SysWOW64\Jepjhg32.exe	Jcanll32.exe
File created	C:\Windows\SysWOW64\Ehcplf32.dll	Dnpdegjp.exe
File created	C:\Windows\SysWOW64\Dohjem32.dll	Kngkqbgl.exe
File created	C:\Windows\SysWOW64\Pnfiplog.exe	Pfoann32.exe
File created	C:\Windows\SysWOW64\Gphphj32.exe	Gmiclo32.exe
File opened for modification	C:\Windows\SysWOW64\Dmennnni.exe	Ddnfmqng.exe
File opened for modification	C:\Windows\SysWOW64\Pplobcpp.exe	Pmnbfhal.exe
File opened for modification	C:\Windows\SysWOW64\Kdpmbc32.exe	Knfeeimj.exe
File created	C:\Windows\SysWOW64\Qemhbj32.exe	Pldcjeia.exe
File opened for modification	C:\Windows\SysWOW64\Clgbmp32.exe	Cdpjlb32.exe
File created	C:\Windows\SysWOW64\Gemkelcd.exe	Gbnoiqdq.exe
File created	C:\Windows\SysWOW64\Gihgfk32.exe	Gemkelcd.exe
File opened for modification	C:\Windows\SysWOW64\Ojfcdnjc.exe	Onocomdo.exe
File created	C:\Windows\SysWOW64\Fihnomjp.exe	Efjbcakl.exe
File opened for modification	C:\Windows\SysWOW64\Pccahbmn.exe	Paeelgnj.exe
File opened for modification	C:\Windows\SysWOW64\Ahgcjddh.exe	Aehgnied.exe
File opened for modification	C:\Windows\SysWOW64\Lfeljd32.exe	Lcgpni32.exe
File created	C:\Windows\SysWOW64\Qfglbe32.dll	Ldipha32.exe
File opened for modification	C:\Windows\SysWOW64\Qhkdof32.exe	Qemhbj32.exe
File opened for modification	C:\Windows\SysWOW64\Ifmqfm32.exe	Hoeieolb.exe
File opened for modification	C:\Windows\SysWOW64\Nmbjcljl.exe	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Jkoepmnk.dll	Cioilg32.exe
File opened for modification	C:\Windows\SysWOW64\Ecgcfm32.exe	Elpkep32.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Nflkbanj.exe
File created	C:\Windows\SysWOW64\Gkmdecbg.exe	Gbfldf32.exe
File created	C:\Windows\SysWOW64\Aehgnied.exe	Anaomkdb.exe
File created	C:\Windows\SysWOW64\Hahqkaaa.dll	Badanigc.exe
File created	C:\Windows\SysWOW64\Faimhjhp.dll	Eclmamod.exe
File opened for modification	C:\Windows\SysWOW64\Mepfiq32.exe	Mminhceb.exe
File created	C:\Windows\SysWOW64\Hffken32.exe	Hoobdp32.exe
File created	C:\Windows\SysWOW64\Nmpgal32.dll	Hdhedh32.exe
File created	C:\Windows\SysWOW64\Kmeddp32.dll	Akglloai.exe
File opened for modification	C:\Windows\SysWOW64\Bkaobnio.exe	Bhbcfbjk.exe
File opened for modification	C:\Windows\SysWOW64\Fpdcag32.exe	Fligqhga.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14028	8324	WerFault.exe	702

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjjlkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pecellgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmadco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkfglb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cijpahho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlcjhkdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neclenfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dooaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiokinbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djjebh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giinpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inqbclob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgjndno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbnmke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hekgfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcanll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmhlgmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgifbil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjbhmad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enigke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baadiiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgkfnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iggjga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgiimng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oogpjbbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deqcbpld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgbefe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omgmeigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppjbmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplobcpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpcodihc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdoof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hloqml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lggldm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Poimpapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlepcdoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmkdcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ompfej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dblgpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqbncb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloahhki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodjjimm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbfldf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgplado.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljobpiql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oanfen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emhkdmlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmmmfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnhidk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqpcjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbdgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fneggdhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpdcag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhgkmpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmhgmmbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpaleglc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobhb32.dll"	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ecefqnel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Icfekc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gemkelcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpbpbecj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ennioe32.dll"	Hpabni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjpbba32.dll"	Emoadlfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iinjhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpfoag32.dll"	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjajmpkj.dll"	Iggjga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfbdfl32.dll"	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcecjmkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgdgna32.dll"	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jefjbddd.dll"	Jiiicf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jlobkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdplc32.dll"	Ljaoeini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klbbcjfp.dll"	Ohmhmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jocefm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggqecq32.dll"	Eofgpikj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjdaodja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgeofeib.dll"	Oeheqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pehngkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddligq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgngnj32.dll"	Jlobkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dflfac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ifomll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iibccgep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Phajna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmdml32.dll"	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bdfpkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dikihe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pkpmdbfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckilmcgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dbqqkkbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Elpkep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lekmnajj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmcpd32.dll"	Poimpapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfglfdkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dheibpje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hfhgkmpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jiiicf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfmioc32.dll"	Elbhjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lqikmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkakadbk.dll"	Coknoaic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dlghoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkjdipap.dll"	Lgdidgjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmdpecjm.dll"	Iknmla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jcphab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcmgob32.dll"	Eoideh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qemhbj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 1744	3860	b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b.exe	84
PID 3860 wrote to memory of 1744	3860	b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b.exe	84
PID 3860 wrote to memory of 1744	3860	b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b.exe	84
PID 1744 wrote to memory of 772	1744	Bjbfklei.exe	86
PID 1744 wrote to memory of 772	1744	Bjbfklei.exe	86
PID 1744 wrote to memory of 772	1744	Bjbfklei.exe	86
PID 772 wrote to memory of 4944	772	Cjecpkcg.exe	87
PID 772 wrote to memory of 4944	772	Cjecpkcg.exe	87
PID 772 wrote to memory of 4944	772	Cjecpkcg.exe	87
PID 4944 wrote to memory of 5016	4944	Cijpahho.exe	89
PID 4944 wrote to memory of 5016	4944	Cijpahho.exe	89
PID 4944 wrote to memory of 5016	4944	Cijpahho.exe	89
PID 5016 wrote to memory of 1372	5016	Ckilmcgb.exe	90
PID 5016 wrote to memory of 1372	5016	Ckilmcgb.exe	90
PID 5016 wrote to memory of 1372	5016	Ckilmcgb.exe	90
PID 1372 wrote to memory of 1656	1372	Cbbdjm32.exe	91
PID 1372 wrote to memory of 1656	1372	Cbbdjm32.exe	91
PID 1372 wrote to memory of 1656	1372	Cbbdjm32.exe	91
PID 1656 wrote to memory of 3600	1656	Cjjlkk32.exe	92
PID 1656 wrote to memory of 3600	1656	Cjjlkk32.exe	92
PID 1656 wrote to memory of 3600	1656	Cjjlkk32.exe	92
PID 3600 wrote to memory of 3396	3600	Cmhigf32.exe	93
PID 3600 wrote to memory of 3396	3600	Cmhigf32.exe	93
PID 3600 wrote to memory of 3396	3600	Cmhigf32.exe	93
PID 3396 wrote to memory of 2240	3396	Ccbadp32.exe	94
PID 3396 wrote to memory of 2240	3396	Ccbadp32.exe	94
PID 3396 wrote to memory of 2240	3396	Ccbadp32.exe	94
PID 2240 wrote to memory of 4836	2240	Cfqmpl32.exe	95
PID 2240 wrote to memory of 4836	2240	Cfqmpl32.exe	95
PID 2240 wrote to memory of 4836	2240	Cfqmpl32.exe	95
PID 4836 wrote to memory of 4436	4836	Cioilg32.exe	96
PID 4836 wrote to memory of 4436	4836	Cioilg32.exe	96
PID 4836 wrote to memory of 4436	4836	Cioilg32.exe	96
PID 4436 wrote to memory of 1584	4436	Coiaiakf.exe	97
PID 4436 wrote to memory of 1584	4436	Coiaiakf.exe	97
PID 4436 wrote to memory of 1584	4436	Coiaiakf.exe	97
PID 1584 wrote to memory of 1904	1584	Cbgnemjj.exe	98
PID 1584 wrote to memory of 1904	1584	Cbgnemjj.exe	98
PID 1584 wrote to memory of 1904	1584	Cbgnemjj.exe	98
PID 1904 wrote to memory of 2352	1904	Ciafbg32.exe	99
PID 1904 wrote to memory of 2352	1904	Ciafbg32.exe	99
PID 1904 wrote to memory of 2352	1904	Ciafbg32.exe	99
PID 2352 wrote to memory of 3596	2352	Coknoaic.exe	100
PID 2352 wrote to memory of 3596	2352	Coknoaic.exe	100
PID 2352 wrote to memory of 3596	2352	Coknoaic.exe	100
PID 3596 wrote to memory of 3128	3596	Dfefkkqp.exe	101
PID 3596 wrote to memory of 3128	3596	Dfefkkqp.exe	101
PID 3596 wrote to memory of 3128	3596	Dfefkkqp.exe	101
PID 3128 wrote to memory of 712	3128	Diccgfpd.exe	102
PID 3128 wrote to memory of 712	3128	Diccgfpd.exe	102
PID 3128 wrote to memory of 712	3128	Diccgfpd.exe	102
PID 712 wrote to memory of 464	712	Dkbocbog.exe	103
PID 712 wrote to memory of 464	712	Dkbocbog.exe	103
PID 712 wrote to memory of 464	712	Dkbocbog.exe	103
PID 464 wrote to memory of 2332	464	Dcigeooj.exe	104
PID 464 wrote to memory of 2332	464	Dcigeooj.exe	104
PID 464 wrote to memory of 2332	464	Dcigeooj.exe	104
PID 2332 wrote to memory of 3028	2332	Dblgpl32.exe	105
PID 2332 wrote to memory of 3028	2332	Dblgpl32.exe	105
PID 2332 wrote to memory of 3028	2332	Dblgpl32.exe	105
PID 3028 wrote to memory of 4812	3028	Djcoai32.exe	106
PID 3028 wrote to memory of 4812	3028	Djcoai32.exe	106
PID 3028 wrote to memory of 4812	3028	Djcoai32.exe	106
PID 4812 wrote to memory of 3684	4812	Difpmfna.exe	107

C:\Users\Admin\AppData\Local\Temp\b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b.exe
"C:\Users\Admin\AppData\Local\Temp\b0a6bc6c566b07b9ffb26e027a583ab90ba657842294bda0ac9045e6b9929a4b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\Bjbfklei.exe
  C:\Windows\system32\Bjbfklei.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\Cjecpkcg.exe
    C:\Windows\system32\Cjecpkcg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\Cijpahho.exe
      C:\Windows\system32\Cijpahho.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        24⤵
        Executes dropped EXE
        
        PID:1960
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        25⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        26⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        27⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:32
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        30⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:680
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        32⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        33⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        35⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        36⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        37⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1332
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1164
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        41⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        42⤵
        Executes dropped EXE
        
        PID:4588
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1012
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        45⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        46⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2292
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        48⤵
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        49⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        50⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        51⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4584
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        53⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        54⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        55⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        56⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        57⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        58⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        59⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1996
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        62⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        63⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        64⤵
        Executes dropped EXE
        
        PID:5140
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        65⤵
        Executes dropped EXE
        
        PID:5180
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5220
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        67⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        68⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        70⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        71⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        72⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        73⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        74⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        75⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        76⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        79⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5812
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        82⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        83⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        85⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        86⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        87⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        89⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        91⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1004
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        93⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        94⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        95⤵
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        96⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        97⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        99⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        100⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        101⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        102⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        103⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        105⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        108⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        109⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        110⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        111⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        112⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        113⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        114⤵
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1648
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        116⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        118⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        119⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        120⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        121⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        122⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        123⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6388
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        125⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        126⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        127⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        128⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        130⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        131⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        132⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        135⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        137⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        138⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        139⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        140⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        142⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        143⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        144⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        145⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        146⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        147⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        148⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        149⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        150⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        151⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        152⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        153⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        154⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        155⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        156⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        158⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        159⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        160⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        161⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        162⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        163⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        164⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        166⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        167⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        168⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        169⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        170⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        171⤵
        Modifies registry class
        
        PID:4740
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        172⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        173⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        174⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3804
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        176⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        177⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        178⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        179⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        180⤵
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        181⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4216
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        182⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        183⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        184⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        185⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        187⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        188⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        189⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        191⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        192⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        193⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        194⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        195⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        196⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        197⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        198⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        199⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        201⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        202⤵
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        203⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        204⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        205⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        206⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        207⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        208⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        209⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        210⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7824
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        212⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        213⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        214⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        215⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        216⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        218⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        219⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        220⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        221⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        222⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        223⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        224⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        225⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        226⤵
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        227⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        228⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        229⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        230⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        232⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        233⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        235⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        236⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        237⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        238⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        239⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        240⤵
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7736
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        242⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        243⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        244⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        245⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        246⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        248⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        249⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        251⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        252⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        253⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        254⤵
        Modifies registry class
        
        PID:632
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        255⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        256⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        257⤵
        Drops file in System32 directory
        
        PID:7352
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        258⤵
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        259⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        260⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        261⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:8036
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        264⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        265⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        266⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        267⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        268⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        269⤵
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        270⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        271⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        272⤵
        Drops file in System32 directory
        
        PID:7492
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        273⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        274⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        275⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        276⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        277⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        278⤵
        Drops file in System32 directory
        
        PID:3656
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        280⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8184
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        282⤵
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        283⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        284⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        285⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        286⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        287⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        288⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        289⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        290⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        291⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        292⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        293⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        294⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8728
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        296⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        297⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        298⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8888
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        300⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        301⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        302⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        303⤵
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        304⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        307⤵
        Drops file in System32 directory
        
        PID:9188
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        308⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        309⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        310⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        311⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        312⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        313⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        314⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        315⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        316⤵
        Drops file in System32 directory
        
        PID:7172
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9020
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        320⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        321⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8296
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        322⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        323⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:8872
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        327⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        328⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        329⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        330⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8528
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9240
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        334⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        335⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9352
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        337⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:9424
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:9500
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        341⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:9580
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9624
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        344⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        345⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        346⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        347⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        348⤵
        Modifies registry class
        
        PID:9820
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        349⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        350⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        351⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        352⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        353⤵
        Modifies registry class
        
        PID:10008
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        354⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        355⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        356⤵
        Drops file in System32 directory
        
        PID:10128
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10184
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        358⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        359⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        360⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        361⤵
        Drops file in System32 directory
        
        PID:9432
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        362⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        363⤵
        Drops file in System32 directory
        
        PID:9576
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        364⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        365⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        366⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        367⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        368⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        369⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        370⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        371⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        372⤵
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        373⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        374⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        375⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        376⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        377⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        378⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        379⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        380⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:10168
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        382⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        383⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        384⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        385⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        386⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        387⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9420
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        389⤵
        Drops file in System32 directory
        
        PID:10076
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        390⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8984
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10164
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        392⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        393⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        394⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        395⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        396⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        397⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        398⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        399⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        400⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        401⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        402⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        403⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        404⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        405⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        406⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        407⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        408⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        409⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        410⤵
        Drops file in System32 directory
        
        PID:10888
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        411⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        412⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        413⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        414⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        415⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        416⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11124
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        417⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11164
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        418⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        419⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11240
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        420⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        421⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        422⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10460
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        424⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        425⤵
        Drops file in System32 directory
        
        PID:10592
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10656
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        427⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        428⤵
        Drops file in System32 directory
        
        PID:10772
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        429⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        430⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        431⤵
        Drops file in System32 directory
        
        PID:10988
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        432⤵
        Modifies registry class
        
        PID:11052
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        433⤵
        Modifies registry class
        
        PID:11108
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11212
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        435⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10412
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        437⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        438⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        439⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        440⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        441⤵
        Modifies registry class
        
        PID:10912
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        442⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        443⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        444⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        445⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        446⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        447⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9028
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        450⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        451⤵
        Modifies registry class
        
        PID:10572
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10760
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        453⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10996
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        454⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        455⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        456⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        457⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        458⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        459⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        460⤵
        Drops file in System32 directory
        
        PID:11376
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        461⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        462⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        463⤵
        Drops file in System32 directory
        
        PID:11484
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        464⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        465⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        466⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        467⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        468⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        469⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:11736
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        471⤵
        Modifies registry class
        
        PID:11772
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        472⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        473⤵
        Drops file in System32 directory
        
        PID:11844
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        474⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        475⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        476⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        477⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        478⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        479⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        480⤵
        Drops file in System32 directory
        
        PID:12096
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        481⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        482⤵
        Drops file in System32 directory
        
        PID:12168
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        483⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        484⤵
        Modifies registry class
        
        PID:12240
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        485⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        486⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        487⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        488⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        489⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        490⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        491⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        492⤵
        Drops file in System32 directory
        
        PID:11692
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        493⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        494⤵
        System Location Discovery: System Language Discovery
        
        PID:11832
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        495⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        496⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        497⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        498⤵
        System Location Discovery: System Language Discovery
        
        PID:12084
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        499⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        500⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        501⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        502⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        503⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        504⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:11728
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        507⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        508⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        509⤵
        Drops file in System32 directory
        
        PID:12192
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        510⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        511⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        512⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        513⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        514⤵
        System Location Discovery: System Language Discovery
        
        PID:12212
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        515⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        516⤵
        Drops file in System32 directory
        
        PID:11444
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12312
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12376
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        519⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        520⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        521⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        522⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        523⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        524⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        525⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        526⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        527⤵
        Drops file in System32 directory
        
        PID:12728
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        528⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        529⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        530⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        531⤵
        
        PID:12872
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12908
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        533⤵
        System Location Discovery: System Language Discovery
        
        PID:12944
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        534⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        535⤵
        Drops file in System32 directory
        
        PID:13020
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        536⤵
        Modifies registry class
        
        PID:13056
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        537⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        538⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13220
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        540⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        541⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        542⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12340
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        543⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        544⤵
        Drops file in System32 directory
        
        PID:12488
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        545⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        546⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        547⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        548⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        549⤵
        System Location Discovery: System Language Discovery
        
        PID:12828
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        550⤵
        System Location Discovery: System Language Discovery
        
        PID:12904
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        551⤵
        Modifies registry class
        
        PID:12964
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        552⤵
        Modifies registry class
        
        PID:13052
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        553⤵
        Drops file in System32 directory
        
        PID:13148
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        554⤵
        System Location Discovery: System Language Discovery
        
        PID:13200
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        555⤵
        Drops file in System32 directory
        
        PID:13300
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        556⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        557⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12648
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        559⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        560⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:13008
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        562⤵
        Modifies registry class
        
        PID:13172
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12356
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        564⤵
        Modifies registry class
        
        PID:12480
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        565⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        566⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:13284
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        568⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        569⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        570⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        571⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        572⤵
        Modifies registry class
        
        PID:13244
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        573⤵
        
        PID:13348
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        574⤵
        
        PID:13384
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        575⤵
        System Location Discovery: System Language Discovery
        
        PID:13420
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        576⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        577⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13512
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        578⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        579⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        580⤵
        System Location Discovery: System Language Discovery
        
        PID:13620
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        581⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        582⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        583⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13736
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        584⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        585⤵
        System Location Discovery: System Language Discovery
        
        PID:13816
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        586⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13888
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        588⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13960
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        590⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        591⤵
        
        PID:14032
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        592⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        593⤵
        Modifies registry class
        
        PID:14104
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        594⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        595⤵
        
        PID:14176
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        596⤵
        
        PID:14212
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        597⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        598⤵
        Drops file in System32 directory
        
        PID:14284
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        599⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        600⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        601⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        602⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        603⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        604⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        605⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13680
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        606⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        607⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8324 -s 420
        608⤵
        Program crash
        
        PID:14028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 8324 -ip 8324
1⤵
PID:13988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aahbbkaq.exe

Filesize
470KB

MD5
3a08492240ebfd9f51ecc8c94c809701

SHA1
63b94661ed148ecaa03bd0e92597eaa188fe2dd4

SHA256
8a80f2912c7169ce7ef66c666c0655bde9a17ced694a9786a3a333887d99aeb3

SHA512
661d4ef84eb59585294c9a0c977b6871059ea93b6fbecc76167409345144dc447520d161efbf92c578acce32f923b8010d82a56af6d061c2c297581ec08609d6

Download Submit
C:\Windows\SysWOW64\Ahgcjddh.exe

Filesize
470KB

MD5
08ff1e223a99ff71636ea29242b8e6dc

SHA1
5e025ffca5850a4023d543977654dfde1b579f26

SHA256
75aee8f55d5cb4cc3f27dd4df6cf64f711339b2588e278f89e3c77faa3906c06

SHA512
8a3279d0b08499af661d31dc25604087e939a9b0f7b9449dc25609a34171c7810534704a5383a00bf5aba9675755bf05ec7c4570540120d049814ed6f9c3f9ae

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
470KB

MD5
85b9a2c52e62430bc7de206ea1e8cd93

SHA1
e08eee7b235287bbad3f5d110292ec101a44583c

SHA256
4ce60148e6ff23e4cc6d2b1e136005fac009005e6cf4268eb5c1f5b32ae00602

SHA512
d6a77c7a16934ad2e4f2b4878e9536dfbd7beefd628bbe2b4bf4a1b2df5c5a67a58ffce51161ae991338af911694a09826d7481faf4c9c7646c9d1f2f47201a3

Download Submit
C:\Windows\SysWOW64\Amjillkj.exe

Filesize
64KB

MD5
5fc63eea1045ead6fc7fba6100df5c0b

SHA1
8c737d5ab27484518e89ab9b5cf083bdf1ee7af1

SHA256
62271fbe74ab93a5d83cc25bb0715ab70434f4eb9a2cb8f072c86fb88cc1e9ff

SHA512
0a1f768938db7ef83d355065fdc7c1da00fe0d8299e29ea32cc7509547f8e1fb6910d67c265e023abd5e442d95291fc62368f34516a18988d8ef23d3271fc987

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
470KB

MD5
6007148ebb299b863fceb4733e383f8c

SHA1
c343739c0aae400405389cb199a573395de8c6b5

SHA256
ef0eeaa46a5ea0fcb790921e1ce2ffee1c8f53c9387a91401dd7fbaddcae4f25

SHA512
7e82b7fd3757a60957f3c851f6fc3db855d77cebef090a0c0abb748f63f2bbf05fb638332eaefe828cdfad7d978df71666d6556c5d26a2c12664db23190ce7dd

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
470KB

MD5
fca7a4a2adaf1057b22a2ced0f9c6d15

SHA1
39ce585e0c6e376e39e267b41b1458d5844e9c18

SHA256
069a0b904f86331bf1282d00bd3e17b135ed0b24bd2812e3b908080507acfd56

SHA512
681a7c92b0b5397c7d876b1e6fed80516c87e0eaa4a455ad6a7893cf2006263d00a6aee5388556c119164b9a4a70c235e940b7f023318e0279ab19c383d825ad

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
470KB

MD5
28c3e8ea025087ccf296d6d717938e40

SHA1
f23963e9124790ae11277431d16a6feb8bcf5fcc

SHA256
d1ad3105a1c0c2d1e1c9f14e78f41aa937eb1022331acddb954969ab08e381dc

SHA512
d8f06bdc8257b7c6a4a9909e48c6afa7425b6a00e02e517a8ad31d80ee4828a28c9db84351db8060d69220372508c52178eedeee400e5333391621d029d3c856

Download Submit
C:\Windows\SysWOW64\Bjbfklei.exe

Filesize
470KB

MD5
54ce384b1c0d87ec7327272580e917b9

SHA1
43b7360d56fe68cbd04a058268160c1bd2d8dd43

SHA256
0531c84f9c72ae9b228f711a3f27946ce9b5a3bd839750f7b8e2aba5f62633a7

SHA512
96532b3cc700d36f19fc35a8a2d2bd2dd64d6919b46af1dd3bfb5f1022900759d7f3788b67cfce5f6f34e6422d29763c4218dfee0402030d9efa56de8ce40878

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
470KB

MD5
86d919e2d2649595ac354c327f22fd57

SHA1
f2e864dae294b56adcbfb07fec0152bc8e21ebed

SHA256
dac3177064eb21cd689a51b81c18138185978f759f55de66c39ca59698a46229

SHA512
9fac91998fe755c4750666cfb83f5fdc6543da77937cbe9560021ed42845befe23ef9ba2a3444c9483eb3393dd8ded9cf0f0196a856887deef7b2ad12fd3e6e1

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
470KB

MD5
0c8d22df81dc8bfdf1d8dfb97796721c

SHA1
60c1e15eaf0bed380cd34d83f279f02b0aec977e

SHA256
1b89979075d37d49c39357dcad744c678cba3ee2efe90d13cdc20fbe425d5044

SHA512
f227fbb45309a7eb58c003d3b70315b95a13226997f0c485851c96acba360c1d03b6fa388b98974895dbf200726ec1eb7deb501c9dc894d20780cf52e840fbaf

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
470KB

MD5
5764e1632e63d9a60477684e3ba6a0f3

SHA1
b0379b2de0bd48f9a82810c0d621fb02dab07401

SHA256
6ecb0e706c9970cb9af36810a958934d6e312180b95308979db06d09bbbf3845

SHA512
969b9b6f3aebdd5224ff9929fbfa148faecbd65155224bafc588108fc29706f6b97d2fb4600de0ee03871403d127523773419e60bc4fda9a2b7937cd4165a067

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
470KB

MD5
058a2a990c1137d0385541bb433a353c

SHA1
f14cf0245346558be80aa7fbfeee2ac2fa173454

SHA256
c82e92695488138ff356a188bdff35189e4094c661f3d31dd54ea6df4d38ad0f

SHA512
f6405fba650867b7900b011fa46e2fc7a94ad0a1bbc767cd35d722f5774d7584daad0ca8fbdbf57b8a1d6bc5f69f64475e76ff039a1ee19852d6c7bde2dee49b

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
470KB

MD5
b5ef6371041e8c1d48c92b41b03b17fa

SHA1
5c3db79ac302a82866bc230082190ccb47e316e0

SHA256
bddfe4a0b9e05d205a2198ee55d897d050b14829ce58a2ded91dfefd9ad6b13b

SHA512
5e3a8a0ec845024dc818e4d08375c03c1a2e9c51814ea239b4955c421e9ce5b209d61c22a98932c6085b596106df1a4d1e90bbe89ee1d7623757a050442b5959

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
470KB

MD5
20ec78eac8348fd998cdb921f2b0fddf

SHA1
992cc97956ab46989262fef077854842f1392358

SHA256
0f54738cd14dc20a3f2777824d2717ac8cb850c269fa6914c5a2667ee70dbefa

SHA512
e9745431f35f6b7e3aa65fb700b83537fa5176c7be1ad50877a07f1d0fd6513e55bb63f187973c9597dd0f60910eeaeb3b08ee5fa624ee4a378b7a8b43e7b498

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
470KB

MD5
bc561bfaa072b519e20d3b6a9b9c2360

SHA1
15bac1d1d5291bc93e5f70b622b1be20a1dc8309

SHA256
256c6dbab2b525308d07ef13f86ad1edd4d4db2f418e92dcb69f75c72adc2541

SHA512
00d57d9b7c5b378897607d4a604ef333f2968fda366b6f09678ec01161780fcd2f05c7f0afb67db86a6d651051ad286dc598390906a4fddb8d45519edb7166fc

Download Submit
C:\Windows\SysWOW64\Cijpahho.exe

Filesize
470KB

MD5
f769ac785e2e98627651c3b36927c6a7

SHA1
8d5093c18aecfdbc6e73c3337f3228f648ebacb8

SHA256
2fa1fcd19a5c641f226422c93909f84fec8164acf2e30b4621efd322cb33e600

SHA512
f29f4f0705901d2f03a7c20403a2d12cb93aabf70cdd3aff5208d92c887067a092adbf0bdf5b312302fae666a02d73edea557eba9e7b9d95dc8e0428791d7fda

Download Submit
C:\Windows\SysWOW64\Cioilg32.exe

Filesize
470KB

MD5
49dc2ca9bf1103d33739436ac6ca2af0

SHA1
7709e88c77de494d3aff598a39f81745f7f0dc52

SHA256
a9bf93752ec0476215dd97f2a4cbadcd083c663719d6d7bbbae939d0db70ba1a

SHA512
ccd015ee7b44226a17fe8d53e5eecd8c9f2c7bd91430210618ff8d26b5bc8ae5ff7f0f32cefa16f3d2fff5618bacc2f12224119b00622a3a6912fcba1ab120c7

Download Submit
C:\Windows\SysWOW64\Cjecpkcg.exe

Filesize
470KB

MD5
ab18ab70a0fa11852ca4ba4383f736ff

SHA1
1336437007dfacca3ac577433fb548ebd60386f5

SHA256
0143ab92bf9f3e918b3a3f2bb9d644aff04a48f3216a3731309e9d7f689d99f9

SHA512
60c99bc72eadecf47690c3e4e3c7aa7932990591e560d017996b1225395317488d571bc8f1bbac7a6994db700f0bfab360e4cd504d438acc41e1471da9919478

Download Submit
C:\Windows\SysWOW64\Cjjlkk32.exe

Filesize
470KB

MD5
cfde9d550f0039bf61d75aea3e8199ea

SHA1
f367879ba8b7f11028f07076d62c5095391f311c

SHA256
2eff7f6a034db5f2907eafe6603fb1fe2ce6f4eae560659990e150dc05b88c73

SHA512
42e193a1d8b05fc38e7e11d9d22eb348ebf32fa425c2c650038dcecac02dc44250c5c896b8c0c1ddfd8060e96c152709204c3a3a710d1d60752259374374d9fc

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
470KB

MD5
4347f4980d6f80cdd028bb5289f53a1e

SHA1
8a6de108e7fa96a4bbe486c1e8dc51ff1c86f4ac

SHA256
4eb307cebe5a30a32aaad652e6c5e9d641e1711b006888abdab9f3e34060b77f

SHA512
d5a90e62ae665637165008647e9627535f4932644ef45a97978a50fa8a06faf482851f462911a05ae652ae244b2d92dddc76563452b4b50cd3196ea00604e016

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
470KB

MD5
e998a017ec1cf636d21c19423c8a0dde

SHA1
b5422be9df5bfe91b9404bc8c5c7322f4a1e7a8f

SHA256
1b8cc995f81a1fa226501c9c28832fa855c4c0392accb8f8a5f5804382cbf9bd

SHA512
1f34ddede15497b3153c1db982a5d3b9fa79fbcbeee7b9b740914e21e5f7c3d25f9168e9c97f55dcb96f8c7c3f923181a260a3cc4e6bd3de564cb8ca3ed8c871

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
470KB

MD5
9183ad9433cde1b9aada0e2f10647f76

SHA1
c913299187a7c26c3d142d76d40ef69032c40f0b

SHA256
a80d6fe389767bf18d69f17878c4a6b6b74d7914d30ee62a2a0ec1c3750eb779

SHA512
29a64d6df78c799aea15881c3365d3d06187f8f3a8364679e958eabe5796ff24586336401e65384b8373bbb4fd294e152abb1324aca3aeaf6f0934f2dff62548

Download Submit
C:\Windows\SysWOW64\Coknoaic.exe

Filesize
470KB

MD5
e0925ce5fe7e3a7d7838dafc225af93e

SHA1
6018ba683360464e2757bc4a555c83a2c8ef6244

SHA256
aabe95afcee817e35b23d0307d940136c11616017f56af9a572855f76aa8a8f8

SHA512
9478bf34b592c87c3041ad3dce900b08f8706d8b010927a87be4112b7593af0b54c04196a4d4a9ff1dbf7abbe049598f2bf98677f3bd0944706243987d4ce82c

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
470KB

MD5
a3aeedee21ef4f5a333e8005160c542e

SHA1
aaf53c23aba6fa3d10c616f99232c31b99c2ce10

SHA256
1b451f422276d2a27637d51df13d8635e4bb6376007b0642eceb42be98c285f2

SHA512
012b30dd580f17bbe282824079cc4a0051bf53f644f00db683f4268018bbafe8b8ea121134203eff4da56d0d2f00f08b3bcd884e40ca795024ea65f210ed5e9b

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
470KB

MD5
a233f28a54f5af87059e1dbf5867a336

SHA1
a2b112483817b9d47b4fd12fa7cd419a530c952c

SHA256
415b586ba4c193cd23066729edd6b54b4bdf3cccf40f48068f8afc3770fca8af

SHA512
1f95e5a6c07bce7cbf36653a99695c252d2de1610101f6deff5c4273e1fde77b6f682cfecc1677e902f53225fe915b524d042592081a57e82588d8acae2f6a01

Download Submit
C:\Windows\SysWOW64\Dblgpl32.exe

Filesize
470KB

MD5
9333b8746e3ba3bb3ed5243d33728f67

SHA1
48c9f6606eb61216b42328b1d85c5879fa74024c

SHA256
537fc2b8e234ce439465527794bfee72c30c0bb27f5d43685dbeb3af95e32181

SHA512
ed2969737d600e67bdcc56875afd6ec93cf4824078c85e612f35f4c8b730d4f5b7da86e37c955574f915a3239daaf34ca51f0ed74ee64c5dc763d5bfa0a2fcd6

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
470KB

MD5
36d99e523b088f46218caed5d2c7bb31

SHA1
caba00426b9a73cc457de24d71128f2ce66fee77

SHA256
aa4e472e19f51c9745263b44d2a11ccb6558dfc5b46c57039bce744347207e42

SHA512
1864f60273bdb3fe9fe538c80eca810bd1df856fba9d35f1472aa0c19dd2e66a4197ca424f160909579dab9d435c498f45c70b7b6a243c57abe891bf3db58e06

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
470KB

MD5
d943de0b7387820cce49221e20ea4ce3

SHA1
7a457250eb162cabf4456fa73400e1696e322a46

SHA256
d2db2b36b511c1ff1edf4078015f6a6ba4ec154a024deb652f99025cae2ffe68

SHA512
28d9c087a3811bcce08d1e79fcf495ab943868d7153c78259a45e8e063f90de3fee4c0c4d15cbca8644e7c83b04a4f9f0783cca7c04daed559b44c61383b34f3

Download Submit
C:\Windows\SysWOW64\Dcigeooj.exe

Filesize
470KB

MD5
07145d1a2627a67327ecfc8d3f8c87f5

SHA1
66d5f8f4c05cef702c1572cf9931095aa10de785

SHA256
0dd0d627038435910819aab83a0645e4fcfc4fd3080e3f51cbe158a31c19d297

SHA512
d3effa1e86f505d50daab03befd262d4c73066912c997dd463e2f5dc3eb53fc22974a6b4a70e4f0494eae73c5fe397fd20955aaf38eaa5032b20799de5722af9

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
470KB

MD5
5975317a1c7b2a1fbd90e794a6c0a6e4

SHA1
4caf3f7d5f6701808019dd011dc0425f4c79dcd1

SHA256
5123fccb2ca7371671cbbd378f73c92f91ebf04d61e841ced85e56fc128100a1

SHA512
eea76431bb26687c9e41e6a99ebcf71da1a29bcc160ff43cdc1ac329d055f0ac5c76c597a95871792754ed500d46b3c9b2da03ee8ae9bb496931e2c42fdc325e

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
470KB

MD5
2b87182e560e7f11ed69c98bb738814e

SHA1
9ad40ed4ab038b5ae6406dde2f0021deb7794e7e

SHA256
901c8e069e44468be4016a1d19f026d0bfa192ee74a75aa1aaae77c414845d08

SHA512
1d16c4acaf335ee36f41115955bde399062e2d570822fc75f24830a87e903c0405bef4f012ddfa52e5c404be11cfb4e90a0b1da365aa6b0fbe23c0d1349ed9b2

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
470KB

MD5
6b988c7f6b8fa24d11472020145f101a

SHA1
efc9947cd59baf60b8e8ddd2a6afec3ec1939cb6

SHA256
7c269aeee4511873e59220d2aa682c59980dac81fd4ff743e188796839638143

SHA512
c910e750ccd8694606298ed4c7fd378bae7671643ebd84a12308044d5cbca9c9bf975356a5129d3dec76ac292bb06371d65397ecbca4142594998b3ee25ca78f

Download Submit
C:\Windows\SysWOW64\Difpmfna.exe

Filesize
470KB

MD5
d726cb8abe3638a896c0785bef43803b

SHA1
ae766b666d7347f703f3a3d275d6bc74f28fa6c5

SHA256
a02a7bcacdf9144fd195921ef24880e0f1cf129aa9dd5d2f45adc0c74b4d2504

SHA512
f954b8b646202b74b90c26e4da001cd7f81ad615ad4bd35b3d6b0bddf736dd51a6d2b6b4fd6a4b7c8437c5ddc2296b6129d7cd0bd7aa4902a1c7ee4fdaae8752

Download Submit
C:\Windows\SysWOW64\Dikihe32.exe

Filesize
470KB

MD5
d0b160da35cd10ce5e151769a11bb45d

SHA1
c95f17350c6f41d90bba2809895c84406d3ff2a1

SHA256
f980f2722d83f3f62804d5475f3edf9f4e028dd1307ca1acc17f756bb3e6c893

SHA512
d5afc02d6cfc7de67f498cd4bf7bcec9a522a1538cd240b9cddca96cc530cc6b5b4e09e7bebada7124650f317d2bd3eb0ced40bfcc64c12222f7bc374ccccaf6

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
470KB

MD5
12dd293f1eaffba57abca1f8036a5e92

SHA1
16f6189ba83b518033ea684898e65cc303397915

SHA256
448ca3285f62afa4fab458d7f9cd18078d1f7d4915b7f915074bec2e2e976d4d

SHA512
77c529d9eddc7fea48160b3c3b0c309ddcb8cb287619b36e49016ca16529b34a6b98cecfce38bac7002d4dd7fc527bc052ea9fc066a8e7628fafffa323aaaa2c

Download Submit
C:\Windows\SysWOW64\Djelgied.exe

Filesize
470KB

MD5
5b1fe6241ef3621c074fce87ca6823da

SHA1
fba3c96d3872c87617ead38b693e9b902fd53f7a

SHA256
391e96a4f4a022a877fbd720076d2dd7fbd31d12b8875a6cdabb090ae768d455

SHA512
ff6378f8ea66f2d600b50d2278e5f0f6113e864f0b33c789a6317443d6748a75da011d81ec286a1ef00141e13147d198a06ca3bbbc4a6ce9bae48bf14a396622

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
470KB

MD5
fb238d92a7adbd6d67e926a5178a2ef9

SHA1
a5bfc177eb231ec86d96159982e652c5cecbfdd8

SHA256
602da8913c46ac9eae63bdb6107b36533c1c4d594fb9ef49c61d54a6f4d922bd

SHA512
e3d94ce8e8b4a61954679c73334bac4fa05c8e6eaa8b6414e54fa8446f3c5dee6c1bd76080f6c3b030f3f22bd780eda706901b3bb97c48390817e0c4c6f9c36c

Download Submit
C:\Windows\SysWOW64\Dkbocbog.exe

Filesize
470KB

MD5
74c1ddea5edbb5a4da6f2aa65816611b

SHA1
806e710a28dd32aeda8a7034f726dacd98ef1545

SHA256
3b3c157d9950a0c9c9536c2383fc737ef01ce20b7f2bcbef627553e6a5c05015

SHA512
4a70d17b4bc453695fb61e0882fba1bed9d95d35a0723cc1ee6a57c2ce2824874f6418108c13ae7a5aeafa6a71681a5d724e0e845a670394b543cb6d5d06aa38

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
470KB

MD5
fa030413f4ee5377a47f98ff047ba305

SHA1
bd87f345c6347b96edf69f02246246c6c65e97ea

SHA256
daa53674c69c6a1e90a668b1256e87e43308acdf422a6073c465a07ab0550f03

SHA512
d39b60e0011d0e47859075037bf40ecf59d0ef8ebd41c9a8ab6d7de34b0aa1870fcc67675f5f9abf3e83c2522e2f6ea6aaec7aad2d39e265d673854ef589acd1

Download Submit
C:\Windows\SysWOW64\Dlghoa32.exe

Filesize
470KB

MD5
27207c91f02444b7b6f87edc5138fa58

SHA1
d46969c4dd7f0bf5b9f198f912009dcee05cb0a0

SHA256
56a30d52055321eee8a0af876334e1941705b0050f7dea1fb7231230bb89f2ff

SHA512
0de6f57012bbc431ebf683ad812ca9580bf8d86b2874d26109f385e0b74d5bbe24dea7d71f31d07b97ca3bdf151344812ae6da13297f3699e0ac2ec233e1906c

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
470KB

MD5
9fafbff12e050f0873e602b15da536e1

SHA1
ca773e5b5cac94eb6d65588129b299f9c8bb313b

SHA256
7339ec213f93d86a827642fc5628ea972b2edabdf94ad3b43fe077fa1c2973d5

SHA512
9c6ee2e3fe4c88820f8485155481ae955d2ea731ab7c1f36f2ff7fe564c8dc8d03e26ace5c042206bef9bed09f2d8f64eff143680d9bf0a53cf1ebd513eefb41

Download Submit
C:\Windows\SysWOW64\Dpdaepai.exe

Filesize
470KB

MD5
dac6340b31db3b49779ec5305397c480

SHA1
c7a067b21373950dd2a18ca732f6fdf37e425118

SHA256
27ead49c60bf761c89acdb9364ba7685a0eced5db571d78b34fec37518433df6

SHA512
579733df89b200e5774015f08690c1da23b5ed3605565bd81370a6bd77013b6d14cab79e64adaab7a2492f9039e800e618c46a42685d4702de27d4dbc7b0d9fb

Download Submit
C:\Windows\SysWOW64\Fmcjpl32.exe

Filesize
470KB

MD5
ee1117d2dc551d14818931d612636765

SHA1
790502eb58be8714b0eb1537fa1eb77f6e3980ea

SHA256
5c02e042700ff17937fe9073286040257cc420000c617054e381bc2488979b6f

SHA512
3658eccca63cbd2cb623e85a1bd75f4d717583071f22ba18c2e5eac8cf3cea0cba1abe3569f8aa047d564a39d2277e1cbd4dbb82e4a03e833795c0b67f18eb00

Download Submit
C:\Windows\SysWOW64\Fppcajgd.dll

Filesize
7KB

MD5
96dae4d12432d1d0fd5334289875935a

SHA1
ed8724cc429f83ebb133eed8cc937f6d75b51ac4

SHA256
9c1426b41951a28ccadc2bdd7e5cd41229f735cd10eee5fabf69b11d7a00b5b8

SHA512
de7637eba396c619170405ecb1f138e3362ddbdf6697fe8afd25f6ed52c8d29f933e78345a879ef9aef0a46591c8dae2cf9bc1aeb14ac12e54e0c7f52d5374e0

Download Submit
C:\Windows\SysWOW64\Gfhndpol.exe

Filesize
470KB

MD5
5edb71a8884496fe4b4c7a16b80cb7a3

SHA1
f93d5ded0dc562d21c57f8ff717c725dede1878e

SHA256
c5db526c4712a09e3ad1844ea6debfe84d92b6214425b365b7bd17ff65934612

SHA512
c51ef329ca082b5b526a72d4c8ef4231550907ec8150837cc19d817879b0f4e80342d78f3ecb053f13f09c0fd1dd6cc39071b8a8690efe9f0117e7bd4dfed780

Download Submit
C:\Windows\SysWOW64\Gfodeohd.exe

Filesize
470KB

MD5
01892cafb697cd2949325a28b0e4338f

SHA1
04e9626ca48071ecb6aadceebe40d3de845ece71

SHA256
470296afdbfa017f97dae390c6aafb2aec9ccadc5a0a607265bec3dd640cc5f0

SHA512
9c856a5909db32cf126f2a4f0cc9b2f3484ba952a4d4468f4b287c30ee555275a45d5be5ec4a78dd2616df3a6494e6f10923034d74a576a1f744abe4057c097f

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
470KB

MD5
ac10369fad823378abe41ab0f975da6a

SHA1
155fca06b6aed65638351acf02dab36cefc22dd2

SHA256
eafa1c98a7ffbd04754e4f0ef9a29866f6edd007c6b623e168d6f69dff397e85

SHA512
5439bc7c3028358321b019383faa6c84e790147c3ec96a90ce74e3588b17ce6f982f88f58bce034fbab63e3a8f1dde1df11b95cb111821cf4a8520b9df5307b5

Download Submit
C:\Windows\SysWOW64\Hibjli32.exe

Filesize
470KB

MD5
f6a09860cdf3b83e7a9af692e7941cc9

SHA1
e55a72427ab6a8e1bfdd78e2e333228576b0fcb4

SHA256
88ba96f167a6d6f5b58c0cec53a5cd8c3c6efd71beb95d486ac0eebad5bd59ca

SHA512
0383da33942bdc3a70cde10d4241aca46f4e4cdd6c4d7363b8d50a4ca69a3a8e2ebd4cb1a5b832a6f76ee6d599b4e596c06641f76fc17ba3fb1e956bd845f2db

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
470KB

MD5
88aae176ac9d66ed403286d2f380f528

SHA1
1804a4931d91f72f1c85412ae509df4b8c8d1eee

SHA256
905ce78d8ae271be39ac4c736c0c9fb5007880a9b169a0edbbeaf61727dc5743

SHA512
00fc1c9892574c4a75d2d9526937b653b0dbff20f17b7132c68e9f0a330e337e0e54705457e76c72a8ca5ab874f3d553827b52b4903bba70b5b65329d84970bc

Download Submit
C:\Windows\SysWOW64\Ipoheakj.exe

Filesize
470KB

MD5
6f4709581c392cbb2d9d9538ed65ecad

SHA1
a1fabe938fd1445384bd57c1ec1d3f8f8a8cc12f

SHA256
c058ba52770c4ca9bb5012d4de4fe8a5810365b0ecfb809e3af981a181922302

SHA512
6f60afbb9bb261da5d08196ce8267dac0f02738467211bfc6a81ae1bfa76d3f83473cbd0b3e67ce60b996159be72bf6205356cb18708c4d02061fc42c9faba5b

Download Submit
C:\Windows\SysWOW64\Jlgepanl.exe

Filesize
470KB

MD5
3f39893efd304d8bad39e8acbc7177af

SHA1
fdb2bf70769bd36f2135924d89af965328c37c7b

SHA256
d6fde5a96eeecaecf62d10d38d7c896e0a0db06b73f4d4992727cc8a2860dd62

SHA512
6feb4fa30d08e220c2c4a2d8f28f871a202cfb66fad5d2973df9345ded98cec258a44f215a798e95123e2310fe8f61cad5bf20db1d7749963109bb83527f0955

Download Submit
C:\Windows\SysWOW64\Joahqn32.exe

Filesize
470KB

MD5
cbacd9a7f1070550d50a84ca0576d98c

SHA1
53c627748c87e80f47f3fc725f9ebac4f57fb85f

SHA256
92602f01eb5d48e0acaae6b4c9e53cae76e5c6478161fa11687149b8425ed403

SHA512
b66aea6812696c0156f99811352340ce436a6d3f5c0522218f3cfcc39097bd900d7dbd034db8e2229534f92703f315a768c90901572f9beb1488f545971d1a02

Download Submit
C:\Windows\SysWOW64\Jphkkpbp.exe

Filesize
384KB

MD5
e610e9c385b2a76c13f716f88ad9521f

SHA1
f14f0d1a96607bfd2246f8e576031389957da848

SHA256
ac69e47b33d1d435241a39f98b2cd8af30e96f7204977397eb8037ea6d44f82e

SHA512
45f3e28983bb43c4fd3671a82ba204c65dbb93cc833857fb4d9b8a187d8b2609c05f73737a195d97a0b2a0d4c82b260274abf650e5e32f64eb7ee79a32ebc1c7

Download Submit
C:\Windows\SysWOW64\Kjeiodek.exe

Filesize
470KB

MD5
cda875add09bae8a3ba257bd35edf6c0

SHA1
c3c85973300e99ac0d6650930677cd58dc7a7f59

SHA256
0ef66b3061bc21751bc80795976dc1da1eed511d4697efbc215f322f003728ec

SHA512
d85ba08328fff03d12b618da117496fef63d07ccd5c6e19590642e13f1ecc05749efc0450a003ceeda719d113c1a61f6e6956bafae55903209226197396e1567

Download Submit
C:\Windows\SysWOW64\Kncaec32.exe

Filesize
470KB

MD5
94c2ff2f4bef81598cb64d6e0c3093df

SHA1
a9b146117a24ba6c7251905af5c6cad2e21d6c17

SHA256
6cb17c6d2abb6cf2d71c3a98e7dd64e495139d282a0957236ac75795f73874d0

SHA512
8168e223cdcf753e9bbec460d5a40cc98fad3274ebb023ad567a3a79f1dbabf259061688671d7a27aeee1579acd69992cb640043bb07c98a46574c1320f8c7c4

Download Submit
C:\Windows\SysWOW64\Knenkbio.exe

Filesize
470KB

MD5
cbd8d64314987c4bab564952414ef580

SHA1
89c44d8aeb447fd698c6196662ef5dc2ba08af10

SHA256
30f476317e08125d96fa9d1890ecf8a4a83f50298aea7d20508d2a009a077ab3

SHA512
3b898384f6cc3578ea1bbdf85420c4188c66f770c19721bd9a5375448bfc8db4163ff9fa8285fc09d15bc611bf1ade320ba130ec0e9b5ece10c6853d97583424

Download Submit
C:\Windows\SysWOW64\Lgibpf32.exe

Filesize
470KB

MD5
125cc3e7f81d648c9b6b8958e945829b

SHA1
074e4ef699712c48a3810794d8bda089286f9e58

SHA256
70ba962f16a3f8750be7fed62f1da1cfe54e9f2e2ae3cd62538e7a7dbb40f607

SHA512
88dbd0e1c0330f758f94b292820f7444b24942c5a5ac2f6ab4df4a8737e0d206ebd8a7c2572b6613e4d8b8afd62d15c9f6d7ae69e1e63c57cc76dabdc9eebed2

Download Submit
C:\Windows\SysWOW64\Lnangaoa.exe

Filesize
470KB

MD5
9b4f308f0d7a22a5991c4d204566f34a

SHA1
4f27c66d92832925655fef212dbbae066d9c919f

SHA256
9f32860bd412affc8fb5e1ca83371260907480d535af859153ff37748b1618f2

SHA512
b025db81ca09cfe43aa4c28ea3ac6045fd03ff0fb8ec42f864fb0a0e008975e67a6873204ab71e330c313490a7f6f0e70f75441417a37df449ad669f5feeb29e

Download Submit
C:\Windows\SysWOW64\Lqkqhm32.exe

Filesize
470KB

MD5
d06b086893e27a3d5e28dfae6ba034aa

SHA1
0fa9b0b160ea4156644bc85c85d87fd9792654a8

SHA256
dc4bbb6142708cc72e6a610b00790b275d33c47aa476b7b35d53dfa49c2f93a0

SHA512
91071ce2caa41984aa3ac557ad6c91db40a2471c622647a416eaa84d90c7dd1f49b192d4e255863d0c81730192089660b0c0331fa4212b874dd0562f5083dcd6

Download Submit
C:\Windows\SysWOW64\Lqmmmmph.exe

Filesize
256KB

MD5
12834f266015e7814ffbbfaeb5c5ab3e

SHA1
06852496335077a379184de0a3df749baa5abe9e

SHA256
d0dc1e28225707d1394e611f8bb6caa506e6cc0f527a068607dc03d78e4da92c

SHA512
083c5bdcaa2e11c1546aefe4102a257974798ac72644953967c4ebc0f0185fb417e272e8814f2f08de2b2cd5bb340a9a276405f8977b0dd18e08ee881c8882c7

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
470KB

MD5
662cdfb1a27f8441ddc3d873fbdf8057

SHA1
ce4b8d5cffb004d341dfe6cf47bb50dea1ac1263

SHA256
ad017acc127d45d8bf346c513d183471834cb65e0fa2c02d5f9535fc5bf58a13

SHA512
4d4b867e17c323e238f96550a62597e6ca267c05f746246c77fc0cf458cad40fa5bbf732f2d4a7eb7898270058fbb1ef0e81408727aea0683a9b738644bb5243

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
470KB

MD5
df15ef0c6c12d2770fabdd531cb3622e

SHA1
6aa97ad0e6babce8a2b72d7497e64a31b53c4716

SHA256
35bf2801fcfcd5831daef46712ffb8360d17ba176b3c6746db629d97d144b340

SHA512
c72c8c6032c4a68ee14ffbbd3c04d2b3a2deb767a3ee08ada933c351ff3c0aff87e7fc3fedb35215d5f1b5841816cdc9ae3e8b49580a802abe1da7fb3c6c295f

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
470KB

MD5
8ca1660374c42e05d99b133055d00d2c

SHA1
f0abbeb7a859acdd829b52bac73fbe7b7a853382

SHA256
46d2325d0867de9d8c889917242a2706f71b3e49c7173b0d53bac05d45b8b64e

SHA512
9ff8904d79b3e3fc4dfbc16229e8430f77ea2acf01e1a09378aeade53117dd25b94b28292523a0591db8266f48a0be56b630674fc79e3d3cf32f4b5041e378dc

Download Submit
C:\Windows\SysWOW64\Ohmhmh32.exe

Filesize
470KB

MD5
7ca12358b85a80b3c86c687d2d7674ed

SHA1
97ef9b6a055292740e852ca2c4bc01fba03d02a5

SHA256
1157d805c0e13718b96f3366facdc73b6e1a0343abed5f7925cd64f50ad9e7e8

SHA512
2b5edf1a75ada89d50440460cfca77e99eaf2a3823f08e97573aa67f4a581dcabf4c7a92be6f7ac6e6d973368f5e8bca297a508a45d0ada58190724ad4b8e246

Download Submit
C:\Windows\SysWOW64\Oodcdb32.exe

Filesize
470KB

MD5
e95f95f674158c861b0c184f393b9755

SHA1
ddd2c6392b20129fdd1e9ad0905988b28125359e

SHA256
dfea47bf29dc051d0b8590831377990873eea7fdcaa72c943e5205af5cb5ca43

SHA512
7e9e692befeaea29875937714205e6a350f124944f355e40188fb7cbcaab899e41230432b4c4e58796c1783966a7863c5e0f3a379824b54fffa4993a7490fcd0

Download Submit
C:\Windows\SysWOW64\Pdhbmh32.exe

Filesize
470KB

MD5
a789ec2c53776ae9b54bb91b3fb217e3

SHA1
3a68d01142c4bb44091559d5aa350370c784d725

SHA256
6aee28d268f928a1d19360721acf1cbd057776cfc33ca7995d2c7f27985202ba

SHA512
3303350d6355670d7c09fd85ad7dd86f7072ed7c5a16602b2171f5ce5cdd6bbb03404399c5fd69087d5ff40646c923a085d51ff3a182ac1c59250449711c8cb9

Download Submit
C:\Windows\SysWOW64\Pffgom32.exe

Filesize
470KB

MD5
916b29d9e9c2908862478a60b2a56494

SHA1
73c9645da0af3061e6dbd4fc6e67758359788564

SHA256
7ec0aeaeac48a86b0964393e6a644f5b5d17640b1d35da55b122e8923cd37219

SHA512
65ba0a5939f1968023dc89e62f8ea5b7703ec2a270715820fba0db6caa3aa360bece7d4094da33040c1605f6a177744de9b2ecd4a0d2ffb10f330eb2c7876b2b

Download Submit
C:\Windows\SysWOW64\Pjdpelnc.exe

Filesize
470KB

MD5
87eecb2f2a8483da9c00ec2fe1037003

SHA1
8b5a28d17ef681b853a4648cc229902cf72020b1

SHA256
0aea5c74aaf9926a514931f75a7859bf6f13f5d028822126eab3d1b9ade1aefc

SHA512
c7abe4e993a007d8a27c06731cb7318850c249e5c1ef6fb1fe0c03f71c1afd260a1009b2b616d9659d98d9523ab6b8e4b2483989ac39198443d7800de9dd27b6

Download Submit
C:\Windows\SysWOW64\Pldcjeia.exe

Filesize
470KB

MD5
8d4be87d23d2ed922432da35f6f92d0c

SHA1
1ecaa6a4b58afbf501b9624ca1a09f935d734433

SHA256
efc0752db2ea5b0e124ad0cf5b80c0ab8e1f0e6b2baa254420ce4542a2088f53

SHA512
4ecb12ab106d66102de57723d4156e9f2d02add92f11525a04df5a9ecf8217acc426b132120ad42a5f4e4407bf20c27027d1f26f3e06089033e9a44fde643438

Download Submit
C:\Windows\SysWOW64\Qdbdcg32.exe

Filesize
470KB

MD5
3669cc78209d30f20268f813aead9d0a

SHA1
b603dae7964f2527b5833a781b58a67c4a437f44

SHA256
d967f870c3ea40e580dfda9f549fc1fac60b9c3a97f28563e4fa375e5481e459

SHA512
adc1e685833c79d91f117316fa729e7a1074f6f47462ed86849bc6839336ee26dfcdba2069b0d4f36ab014df1b892021a4945099b40ff635721a09669d2dd1b8

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
470KB

MD5
d0fbef23bf7e96fd31a9d63182e4e49a

SHA1
3cc0714ca2f90adea32e8ce6c87ec7128ed1d146

SHA256
e3bc891a0c4980ce55eba00f0b658b8f384651969e64e49ceed1006a4dabcc7f

SHA512
c36b5d22224862633e1beb76dad5018b009c2b2088053e8584ac7b316d196df168e57db77296729da5ed3710099998462227a2f59c4703dcaf79a3afc42aa585

Download Submit
memory/32-228-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/436-236-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/464-650-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/464-148-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/572-407-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/680-244-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/712-644-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/712-140-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/772-554-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/772-15-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1132-395-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1160-330-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1164-301-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1228-348-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1332-289-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1356-377-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1372-572-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1372-40-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1452-295-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1584-100-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1584-614-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1656-52-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1656-578-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1728-336-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1744-8-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1744-548-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1848-196-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1848-4034-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1904-109-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1904-620-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1960-188-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1996-419-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2240-76-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2240-596-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2292-342-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2296-383-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2332-156-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2332-656-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2352-116-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2352-626-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2864-354-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2992-252-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3028-164-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3028-662-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3128-132-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3128-638-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3272-3858-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3396-68-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3396-590-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3540-307-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3596-632-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3596-124-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3600-60-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3600-584-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3616-283-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3684-180-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3808-401-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3860-542-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3860-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3948-220-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3952-204-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/3968-212-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4004-271-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4368-277-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4428-425-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4436-92-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4436-608-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4516-389-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4520-413-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4560-3785-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4584-371-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4588-313-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4600-260-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4800-360-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4812-668-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4812-173-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4836-602-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4836-84-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4872-436-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4944-23-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4944-560-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4972-319-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5016-566-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5016-37-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5140-442-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5180-3954-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5180-448-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5220-454-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5300-465-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5336-471-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5376-477-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5416-483-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5456-489-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5484-3752-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5536-500-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5572-506-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5612-512-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5652-518-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5660-3687-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5692-524-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5732-530-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/5772-536-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/6896-3689-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/7188-3666-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/7464-3747-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/7500-3746-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/8496-3632-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/9744-3553-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/9888-3552-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/9956-3543-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/10128-3565-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/10280-3528-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/10544-3520-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/10592-3496-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/11340-3462-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/11412-3460-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/11728-3416-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/11840-3415-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/12496-3400-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/12964-3370-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/13148-3368-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/13420-3347-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/13608-3317-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/13620-3341-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads