berbew | 0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560.exe
Size

89KB
MD5

8e3d8b9d85c892f67c3e12399ef5850e
SHA1

9a20b5460e798d90cf8213b8387795c3d00ca127
SHA256

0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560
SHA512

c12e0832ee9f0e6e3b23b95adc339ac7119847caa5ce3059061177983089721f49abf967165f6d68e022cd7c71916b277afb61eaee4e72fcfe1c126698b1f6e5
SSDEEP

1536:p3lBv+PyXhENgOqPMQ7T00I0WspG1WcS9Hn8lSlmbIczdlExkg8Fk:5v+PAcQhv00I9JS9H8lSl+Icxlakgwk

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdpjlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eecphp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gndick32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcmeke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plbfdekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhkdof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phbhcmjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aojlaeei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afgacokc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iloidijb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnlbojee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgccb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhnhajba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdaociml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hplicjok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmkbfeab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcggio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkokcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cimmggfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjbaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bllbaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfodeohd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoobdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpdennml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfihbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcddcbab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcfahbpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljclki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbicpfdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kifojnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcepkfld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlcjhkdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iciaqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bahkih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nafjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkicaahi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phincl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhlkilba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpaleglc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeokal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofgpikj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjmoag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pajeam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aojefobm.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4124	Maodigil.exe
3956	Mifljdjo.exe
1960	Mldhfpib.exe
1956	Naaqofgj.exe
1108	Nhkikq32.exe
1316	Noeahkfc.exe
3388	Neoieenp.exe
4000	Nliaao32.exe
2864	Nafjjf32.exe
4580	Nlkngo32.exe
2744	Neccpd32.exe
2052	Nlnkmnah.exe
4680	Najceeoo.exe
3884	Nlphbnoe.exe
3916	Oampjeml.exe
880	Ohghgodi.exe
1420	Oblmdhdo.exe
1552	Oldamm32.exe
1544	Oocmii32.exe
3648	Oihagaji.exe
3700	Ooejohhq.exe
1364	Ohnohn32.exe
4916	Obcceg32.exe
4236	Ohpkmn32.exe
3644	Pcepkfld.exe
812	Phbhcmjl.exe
920	Pchlpfjb.exe
1888	Phedhmhi.exe
4476	Poomegpf.exe
2852	Pamiaboj.exe
848	Plbmokop.exe
392	Pcmeke32.exe
32	Phincl32.exe
1600	Pabblb32.exe
4288	Pemomqcn.exe
3112	Qhlkilba.exe
5060	Qcaofebg.exe
764	Qikgco32.exe
4088	Qkmdkgob.exe
3488	Ajndioga.exe
3128	Aojlaeei.exe
4700	Aeddnp32.exe
1948	Ahcajk32.exe
1336	Aomifecf.exe
4164	Afgacokc.exe
4020	Alqjpi32.exe
4036	Aoofle32.exe
2996	Ajdjin32.exe
1500	Aleckinj.exe
4504	Aodogdmn.exe
2260	Bfngdn32.exe
2064	Bkkple32.exe
4932	Bcahmb32.exe
5044	Bfpdin32.exe
3996	Bkmmaeap.exe
4532	Bcddcbab.exe
4044	Bfbaonae.exe
4352	Bhamkipi.exe
4616	Bcfahbpo.exe
3032	Bjpjel32.exe
1732	Bkafmd32.exe
2124	Bblnindg.exe
808	Bheffh32.exe
4572	Bopocbcq.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Caageq32.exe
File opened for modification	C:\Windows\SysWOW64\Mgehfkop.exe	Malpia32.exe
File created	C:\Windows\SysWOW64\Ioqgiibk.dll	Hdokdg32.exe
File created	C:\Windows\SysWOW64\Qlgpod32.exe	Qhkdof32.exe
File opened for modification	C:\Windows\SysWOW64\Eklajcmc.exe	Edbiniff.exe
File created	C:\Windows\SysWOW64\Phgibp32.dll	Ommceclc.exe
File opened for modification	C:\Windows\SysWOW64\Mminhceb.exe	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Lhcali32.exe	Lcfidb32.exe
File opened for modification	C:\Windows\SysWOW64\Pfhmjf32.exe	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Bfngdn32.exe	Aodogdmn.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Chfegk32.exe
File created	C:\Windows\SysWOW64\Mbdiknlb.exe	Mpclce32.exe
File opened for modification	C:\Windows\SysWOW64\Dmfeidbe.exe	Dbqqkkbo.exe
File opened for modification	C:\Windows\SysWOW64\Innfnl32.exe	Ikpjbq32.exe
File created	C:\Windows\SysWOW64\Jncoikmp.exe	Igigla32.exe
File created	C:\Windows\SysWOW64\Lgepom32.exe	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Fimgpahk.dll	Ddgplado.exe
File created	C:\Windows\SysWOW64\Ofckhj32.exe	Ocdnln32.exe
File opened for modification	C:\Windows\SysWOW64\Kkconn32.exe	Kclgmq32.exe
File opened for modification	C:\Windows\SysWOW64\Ipgbdbqb.exe	Imiehfao.exe
File created	C:\Windows\SysWOW64\Nmaciefp.exe	Nblolm32.exe
File created	C:\Windows\SysWOW64\Akmcfjdp.dll	Nhhdnf32.exe
File created	C:\Windows\SysWOW64\Ekhobd32.dll	Aoalgn32.exe
File created	C:\Windows\SysWOW64\Opclldhj.exe	Ogekbb32.exe
File created	C:\Windows\SysWOW64\Oeeape32.dll	Bdagpnbk.exe
File created	C:\Windows\SysWOW64\Cnaaib32.exe	Cggimh32.exe
File created	C:\Windows\SysWOW64\Cpiijfll.dll	Ibcjqgnm.exe
File created	C:\Windows\SysWOW64\Fnlmhc32.exe	Fechomko.exe
File opened for modification	C:\Windows\SysWOW64\Imiehfao.exe	Iebngial.exe
File opened for modification	C:\Windows\SysWOW64\Gokbgpeg.exe	Fiqjke32.exe
File created	C:\Windows\SysWOW64\Pmaffnce.exe	Pkbjjbda.exe
File created	C:\Windows\SysWOW64\Gokbgpeg.exe	Fiqjke32.exe
File opened for modification	C:\Windows\SysWOW64\Kjmfjj32.exe	Kgninn32.exe
File opened for modification	C:\Windows\SysWOW64\Cocacl32.exe	Cleegp32.exe
File created	C:\Windows\SysWOW64\Lflpengd.dll	Jlhljhbg.exe
File created	C:\Windows\SysWOW64\Ccgjopal.exe	Ckpbnb32.exe
File created	C:\Windows\SysWOW64\Gjimmmpe.dll	Fideeaco.exe
File created	C:\Windows\SysWOW64\Gpqjglii.exe	Gigaka32.exe
File created	C:\Windows\SysWOW64\Ilnpcnol.dll	Kmieae32.exe
File created	C:\Windows\SysWOW64\Mokmdh32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Gpojkp32.dll	Bpkdjofm.exe
File opened for modification	C:\Windows\SysWOW64\Foapaa32.exe	Fdlkdhnk.exe
File opened for modification	C:\Windows\SysWOW64\Qcaofebg.exe	Qhlkilba.exe
File opened for modification	C:\Windows\SysWOW64\Fpggamqc.exe	Fjjnifbl.exe
File created	C:\Windows\SysWOW64\Pmcckk32.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Kcpjnjii.exe	Kjgeedch.exe
File created	C:\Windows\SysWOW64\Gicbkkca.dll	Kqbdldnq.exe
File created	C:\Windows\SysWOW64\Fimhbfpl.dll	Fngcmcfe.exe
File opened for modification	C:\Windows\SysWOW64\Gncchb32.exe	Gppcmeem.exe
File opened for modification	C:\Windows\SysWOW64\Jhkbdmbg.exe	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Qcaofebg.exe	Qhlkilba.exe
File created	C:\Windows\SysWOW64\Hlcjhkdp.exe	Hkbmqb32.exe
File opened for modification	C:\Windows\SysWOW64\Jncoikmp.exe	Igigla32.exe
File opened for modification	C:\Windows\SysWOW64\Kmieae32.exe	Knfeeimj.exe
File created	C:\Windows\SysWOW64\Iebngial.exe	Ibcaknbi.exe
File opened for modification	C:\Windows\SysWOW64\Mokmdh32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Bcddcbab.exe	Bkmmaeap.exe
File created	C:\Windows\SysWOW64\Ccoecbmi.dll	Bobabg32.exe
File opened for modification	C:\Windows\SysWOW64\Hpioin32.exe	Hioflcbj.exe
File created	C:\Windows\SysWOW64\Hnekbm32.dll	Lomjicei.exe
File opened for modification	C:\Windows\SysWOW64\Ooejohhq.exe	Oihagaji.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Jeocna32.exe	Jbagbebm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	2864	WerFault.exe	756

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iedjmioj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neoieenp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pajeam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkoch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eofgpikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Damfao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcjjhdjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gigaka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilcldb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jleijb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cimmggfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkconn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkgiimng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lekmnajj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knooej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adikdfna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoclopne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgkkkcbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mccfdmmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbgeqmjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfihbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbebbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maodigil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpcfmkff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhenj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemooo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpnmbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maiccajf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaohcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdickcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njhgbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlnkmnah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjnqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkohaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plbfdekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnepna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaajhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpaleglc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aojefobm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eifaim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpelhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipeeobbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnbeeiji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpnjah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhacf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjohde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mifljdjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmoohe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coohhlpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieidhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaqhjggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afgacokc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dimenegi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlhljhbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adndoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbdiknlb.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibcjqgnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihjoke32.dll"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kcjjhdjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofgjophm.dll"	Gmggfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Doccpcja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofljo32.dll"	Nbnlaldg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Codhnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hemqgjog.dll"	Kcpahpmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iondqhpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocgkan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmbeqne.dll"	Mmkkmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnkoiaif.dll"	Ofckhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaoobkd.dll"	Cimmggfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ggahedjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgjhee32.dll"	Nclikl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Accimdgp.dll"	Jiglnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Melmcj32.dll"	Oampjeml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iplkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Naaqofgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fplpll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhfgeigk.dll"	Omcjep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnekbm32.dll"	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iciaqc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Knooej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmdlffhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mapppn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Neoieenp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjgpfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmechmip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Idahjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnlinml.dll"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cglblmfn.dll"	Amjillkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jghpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghgmioe.dll"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amjillkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnddp32.dll"	Coqncejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbakef.dll"	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Najceeoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhdnigno.dll"	Ipoopgnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hknkchkd.dll"	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmapoggk.dll"	Gkdpbpih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Haaaaeim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Neclenfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iokifhcf.dll"	Jppnpjel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcjjhdjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghghj32.dll"	Lklbdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obnbpa32.dll"	Mccfdmmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lopmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Noppeaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qeodhjmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnifpf32.dll"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfokn32.dll"	Gflhoo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4124	4312	0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560.exe	84
PID 4312 wrote to memory of 4124	4312	0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560.exe	84
PID 4312 wrote to memory of 4124	4312	0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560.exe	84
PID 4124 wrote to memory of 3956	4124	Maodigil.exe	85
PID 4124 wrote to memory of 3956	4124	Maodigil.exe	85
PID 4124 wrote to memory of 3956	4124	Maodigil.exe	85
PID 3956 wrote to memory of 1960	3956	Mifljdjo.exe	86
PID 3956 wrote to memory of 1960	3956	Mifljdjo.exe	86
PID 3956 wrote to memory of 1960	3956	Mifljdjo.exe	86
PID 1960 wrote to memory of 1956	1960	Mldhfpib.exe	87
PID 1960 wrote to memory of 1956	1960	Mldhfpib.exe	87
PID 1960 wrote to memory of 1956	1960	Mldhfpib.exe	87
PID 1956 wrote to memory of 1108	1956	Naaqofgj.exe	88
PID 1956 wrote to memory of 1108	1956	Naaqofgj.exe	88
PID 1956 wrote to memory of 1108	1956	Naaqofgj.exe	88
PID 1108 wrote to memory of 1316	1108	Nhkikq32.exe	89
PID 1108 wrote to memory of 1316	1108	Nhkikq32.exe	89
PID 1108 wrote to memory of 1316	1108	Nhkikq32.exe	89
PID 1316 wrote to memory of 3388	1316	Noeahkfc.exe	90
PID 1316 wrote to memory of 3388	1316	Noeahkfc.exe	90
PID 1316 wrote to memory of 3388	1316	Noeahkfc.exe	90
PID 3388 wrote to memory of 4000	3388	Neoieenp.exe	91
PID 3388 wrote to memory of 4000	3388	Neoieenp.exe	91
PID 3388 wrote to memory of 4000	3388	Neoieenp.exe	91
PID 4000 wrote to memory of 2864	4000	Nliaao32.exe	92
PID 4000 wrote to memory of 2864	4000	Nliaao32.exe	92
PID 4000 wrote to memory of 2864	4000	Nliaao32.exe	92
PID 2864 wrote to memory of 4580	2864	Nafjjf32.exe	93
PID 2864 wrote to memory of 4580	2864	Nafjjf32.exe	93
PID 2864 wrote to memory of 4580	2864	Nafjjf32.exe	93
PID 4580 wrote to memory of 2744	4580	Nlkngo32.exe	95
PID 4580 wrote to memory of 2744	4580	Nlkngo32.exe	95
PID 4580 wrote to memory of 2744	4580	Nlkngo32.exe	95
PID 2744 wrote to memory of 2052	2744	Neccpd32.exe	96
PID 2744 wrote to memory of 2052	2744	Neccpd32.exe	96
PID 2744 wrote to memory of 2052	2744	Neccpd32.exe	96
PID 2052 wrote to memory of 4680	2052	Nlnkmnah.exe	97
PID 2052 wrote to memory of 4680	2052	Nlnkmnah.exe	97
PID 2052 wrote to memory of 4680	2052	Nlnkmnah.exe	97
PID 4680 wrote to memory of 3884	4680	Najceeoo.exe	98
PID 4680 wrote to memory of 3884	4680	Najceeoo.exe	98
PID 4680 wrote to memory of 3884	4680	Najceeoo.exe	98
PID 3884 wrote to memory of 3916	3884	Nlphbnoe.exe	100
PID 3884 wrote to memory of 3916	3884	Nlphbnoe.exe	100
PID 3884 wrote to memory of 3916	3884	Nlphbnoe.exe	100
PID 3916 wrote to memory of 880	3916	Oampjeml.exe	101
PID 3916 wrote to memory of 880	3916	Oampjeml.exe	101
PID 3916 wrote to memory of 880	3916	Oampjeml.exe	101
PID 880 wrote to memory of 1420	880	Ohghgodi.exe	102
PID 880 wrote to memory of 1420	880	Ohghgodi.exe	102
PID 880 wrote to memory of 1420	880	Ohghgodi.exe	102
PID 1420 wrote to memory of 1552	1420	Oblmdhdo.exe	103
PID 1420 wrote to memory of 1552	1420	Oblmdhdo.exe	103
PID 1420 wrote to memory of 1552	1420	Oblmdhdo.exe	103
PID 1552 wrote to memory of 1544	1552	Oldamm32.exe	104
PID 1552 wrote to memory of 1544	1552	Oldamm32.exe	104
PID 1552 wrote to memory of 1544	1552	Oldamm32.exe	104
PID 1544 wrote to memory of 3648	1544	Oocmii32.exe	105
PID 1544 wrote to memory of 3648	1544	Oocmii32.exe	105
PID 1544 wrote to memory of 3648	1544	Oocmii32.exe	105
PID 3648 wrote to memory of 3700	3648	Oihagaji.exe	106
PID 3648 wrote to memory of 3700	3648	Oihagaji.exe	106
PID 3648 wrote to memory of 3700	3648	Oihagaji.exe	106
PID 3700 wrote to memory of 1364	3700	Ooejohhq.exe	107

C:\Users\Admin\AppData\Local\Temp\0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560.exe
"C:\Users\Admin\AppData\Local\Temp\0307dce7df6476f139754e852d6a3907d911c206d1adc0e245031b799710b560.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\Maodigil.exe
  C:\Windows\system32\Maodigil.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\Mifljdjo.exe
    C:\Windows\system32\Mifljdjo.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\Mldhfpib.exe
      C:\Windows\system32\Mldhfpib.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        23⤵
        Executes dropped EXE
        
        PID:1364
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        24⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        25⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        28⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        29⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        30⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        31⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        32⤵
        Executes dropped EXE
        
        PID:848
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:32
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        35⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        36⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        38⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        39⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        40⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        41⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        43⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        44⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        45⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        47⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        48⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        49⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        50⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4504
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        52⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        53⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        54⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        55⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        58⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        59⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        61⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        62⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        63⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        64⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        65⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        66⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        67⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        68⤵
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        69⤵
        Modifies registry class
        
        PID:3164
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        70⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        72⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        73⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        74⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        75⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        76⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        77⤵
        Drops file in System32 directory
        
        PID:3316
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        78⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        79⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        81⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        82⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        83⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        84⤵
        Drops file in System32 directory
        
        PID:3792
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        85⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        86⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        88⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        89⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        90⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3520
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        92⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        93⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        94⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        95⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        96⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        98⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        99⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        100⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        101⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        102⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        103⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        105⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        106⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        108⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        110⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        111⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        113⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        114⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        116⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        117⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        118⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        119⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        120⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        123⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        125⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        126⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        128⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        131⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        132⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        133⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        135⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        139⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        140⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        141⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        142⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        143⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        144⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        145⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        147⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        149⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        150⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        151⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        152⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6424
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        153⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        154⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        155⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        156⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        157⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        158⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        159⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        160⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        161⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        162⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        164⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        165⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        166⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        167⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        168⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        171⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        172⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        173⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        174⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        175⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        176⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        177⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        178⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        180⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        182⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        184⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        186⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        187⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        189⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        191⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        192⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        194⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        196⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        197⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        198⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        199⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        200⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        202⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        203⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7348
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        205⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        207⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        208⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        209⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7612
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        211⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        212⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        213⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        214⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        216⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        218⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        219⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        220⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        221⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        222⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        223⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        224⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        225⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        226⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        228⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        229⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        230⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        231⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        232⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        233⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        234⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        235⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        236⤵
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        237⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        238⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        239⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        240⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        241⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        242⤵
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        243⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        244⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        245⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        246⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        247⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        248⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        250⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        251⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        252⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        253⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        254⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        255⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        256⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        257⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        258⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        260⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        261⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        262⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8148
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        265⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        266⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        267⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        268⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        269⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        270⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8500
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        272⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        273⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        274⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        275⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        276⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        277⤵
        Modifies registry class
        
        PID:8780
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        278⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        279⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8908
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        281⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        282⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        283⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        284⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        285⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        288⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        289⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        290⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:8536
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        293⤵
        System Location Discovery: System Language Discovery
        
        PID:8604
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        294⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        295⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        296⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        298⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        299⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        300⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        301⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        303⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8428
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        305⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        306⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        307⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:8920
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        309⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:9112
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        311⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        312⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8696
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        314⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        315⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        316⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        318⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        319⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9028
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        321⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        322⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        323⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        324⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        325⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        326⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        327⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        328⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        331⤵
        Drops file in System32 directory
        
        PID:9748
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        332⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        333⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        334⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        335⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        336⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        337⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        338⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        339⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        340⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        341⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10236
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9280
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        344⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        345⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        346⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        347⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        348⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        349⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        350⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        351⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        352⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10044
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        354⤵
        Modifies registry class
        
        PID:10112
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        355⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        356⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        357⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        358⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        359⤵
        Drops file in System32 directory
        
        PID:9588
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        360⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        361⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        362⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        363⤵
        Drops file in System32 directory
        
        PID:10056
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        364⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        365⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        366⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        367⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        368⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        369⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        370⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        373⤵
        Modifies registry class
        
        PID:10188
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        374⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        375⤵
        System Location Discovery: System Language Discovery
        
        PID:9716
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:400
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        377⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        378⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        379⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        380⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        381⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10156
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        383⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        384⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        385⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        386⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        387⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        389⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        390⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        391⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        392⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:10296
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        394⤵
        Drops file in System32 directory
        
        PID:10340
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        395⤵
        Drops file in System32 directory
        
        PID:10384
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        396⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        397⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        398⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        399⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        400⤵
        System Location Discovery: System Language Discovery
        
        PID:10596
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        401⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        402⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        403⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        404⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        405⤵
        Modifies registry class
        
        PID:10816
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:10852
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        407⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        408⤵
        System Location Discovery: System Language Discovery
        
        PID:10920
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        409⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        410⤵
        Modifies registry class
        
        PID:11000
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        411⤵
        Modifies registry class
        
        PID:11036
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        412⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11072
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        413⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        414⤵
        System Location Discovery: System Language Discovery
        
        PID:11152
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        415⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        416⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        417⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        418⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        419⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        420⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        421⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        422⤵
        Drops file in System32 directory
        
        PID:10512
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        423⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        424⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        425⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        426⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        427⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10880
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        429⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        430⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        431⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        432⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        433⤵
        Modifies registry class
        
        PID:11224
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        434⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        435⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        436⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        437⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        438⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        439⤵
        Modifies registry class
        
        PID:10748
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10860
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        441⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11088
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        443⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        444⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        445⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        446⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        447⤵
        System Location Discovery: System Language Discovery
        
        PID:10808
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        448⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        449⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        450⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        451⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        452⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        454⤵
        Drops file in System32 directory
        
        PID:11184
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        455⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        456⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        457⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        458⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        459⤵
        System Location Discovery: System Language Discovery
        
        PID:11388
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        460⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11464
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        462⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        463⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        464⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        465⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        466⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        467⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        468⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        469⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        470⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        471⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        472⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11896
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        474⤵
        Drops file in System32 directory
        
        PID:11932
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        475⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        476⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        477⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        478⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12080
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        479⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        480⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        481⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        482⤵
        Drops file in System32 directory
        
        PID:12228
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12264
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        484⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        485⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        486⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        487⤵
        Drops file in System32 directory
        
        PID:11472
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        488⤵
        Modifies registry class
        
        PID:11524
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11604
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        490⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        491⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11744
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        492⤵
        Modifies registry class
        
        PID:11812
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        493⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        494⤵
        Modifies registry class
        
        PID:11928
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        495⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        496⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        497⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        498⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        499⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        500⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        501⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:11544
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        503⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        504⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        505⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        506⤵
        Modifies registry class
        
        PID:12016
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        507⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        508⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        509⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        510⤵
        Drops file in System32 directory
        
        PID:11632
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        511⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        512⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        513⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        514⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        515⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        516⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        517⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        518⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        519⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        520⤵
        Drops file in System32 directory
        
        PID:12312
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        521⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        522⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        523⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        524⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        525⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        526⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        527⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        528⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        529⤵
        Drops file in System32 directory
        
        PID:12648
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        530⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        531⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        532⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        533⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        534⤵
        Modifies registry class
        
        PID:12828
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        535⤵
        System Location Discovery: System Language Discovery
        
        PID:12864
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        536⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        537⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12936
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        538⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13008
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        540⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        541⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        542⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        543⤵
        Drops file in System32 directory
        
        PID:13152
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        544⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        545⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        546⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        547⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        548⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        549⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        550⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        551⤵
        System Location Discovery: System Language Discovery
        
        PID:12528
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        552⤵
        Modifies registry class
        
        PID:12596
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12656
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        554⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        555⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        556⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12852
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        557⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        558⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        559⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        560⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        561⤵
        Modifies registry class
        
        PID:13172
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        562⤵
        Modifies registry class
        
        PID:13224
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        563⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        564⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        565⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        566⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        567⤵
        Modifies registry class
        
        PID:12744
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        568⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12824
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        569⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        570⤵
        Drops file in System32 directory
        
        PID:13076
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        571⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        572⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        573⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        574⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        575⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        576⤵
        System Location Discovery: System Language Discovery
        
        PID:13104
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        577⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        578⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        579⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        580⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        581⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12968
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        582⤵
        Modifies registry class
        
        PID:12816
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        583⤵
        System Location Discovery: System Language Discovery
        
        PID:13220
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        584⤵
        
        PID:13344
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13384
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        586⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        587⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        588⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        589⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        590⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13600
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        592⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        593⤵
        
        PID:13672
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        594⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        595⤵
        Drops file in System32 directory
        
        PID:13744
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        596⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        597⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13820
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        598⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        599⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        600⤵
        
        PID:13928
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        601⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        602⤵
        Modifies registry class
        
        PID:14000
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        603⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        604⤵
        
        PID:14080
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        605⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        606⤵
        Drops file in System32 directory
        
        PID:14156
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        607⤵
        System Location Discovery: System Language Discovery
        
        PID:14204
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        608⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        609⤵
        System Location Discovery: System Language Discovery
        
        PID:14288
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        610⤵
        
        PID:14332
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        611⤵
        
        PID:13380
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        612⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        613⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        614⤵
        Drops file in System32 directory
        
        PID:13572
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        615⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        616⤵
        Modifies registry class
        
        PID:13700
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        617⤵
        Modifies registry class
        
        PID:13768
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        618⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13840
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        619⤵
        Drops file in System32 directory
        
        PID:13900
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        620⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        621⤵
        Modifies registry class
        
        PID:14036
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        622⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        623⤵
        
        PID:14192
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        624⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        625⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14320
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        626⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        627⤵
        
        PID:13488
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        628⤵
        System Location Discovery: System Language Discovery
        
        PID:13588
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        629⤵
        
        PID:13680
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        630⤵
        Drops file in System32 directory
        
        PID:2424
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        631⤵
        Modifies registry class
        
        PID:13936
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        632⤵
        
        PID:14032
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        633⤵
        Drops file in System32 directory
        
        PID:3092
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        634⤵
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        635⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        636⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        637⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        638⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        639⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        640⤵
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        641⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        642⤵
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        643⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3380
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        644⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        645⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        646⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        647⤵
        
        PID:13812
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        648⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14008
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        649⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        650⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        651⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        652⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        653⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        654⤵
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        655⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        656⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        657⤵
        Modifies registry class
        
        PID:2164
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        658⤵
        Drops file in System32 directory
        
        PID:1420
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        659⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        660⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 420
        661⤵
        Program crash
        
        PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2864 -ip 2864
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Alnfpcag.exe

Filesize
89KB

MD5
cfd9d72e4511fe4a6d87ac58862a9cf8

SHA1
3f379d630f7693aaa52b1250f7fcede86af77dde

SHA256
4079c75b4d1e54c8c45c10f8567af7f327aa291cab2e247f86debaab9cfc35db

SHA512
613cb7a6721bd6f04e8fe71e29651fc4035d7f6ba7d79c6d3b113aab5a7ee79857eb33cdcad8c4729db26fafe0e3edc463a1df6f5da8664611004eac11bb4d92

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
89KB

MD5
56c94fdbacb096b1a4738a33766c155f

SHA1
7692285806b11194461400df99daaacba3743b9e

SHA256
89cfa8c4fc1ed47910afec96f5d1d60ea7400c1ee3d7ea73145d273adbc76089

SHA512
f781b89a69b5349ec0cd6ad4007fbc3f7f5a0f3f3f17c7ffe98b34e930b7fa788370a8ad88ebd10c1b65eea2793255b0e614e2db152c508417fa32468f000275

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
89KB

MD5
ceaf0270fa6ebe1c031fb736da0dc079

SHA1
4d442c0fdfcc095f5c8ff9aa65eaae22e1c742c9

SHA256
1d3855ee12dcf465979726de6a653767325530e30ccd077553369880f0fbebb5

SHA512
82809886ee99e8889382425067e2e10adf95c5e4a6096c7fcf77344a548ef962f321dd0fa3e6ab154fb30f7b11304f18af764dc9e58a30c92533b2622550904c

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
64KB

MD5
fa7c6a62cce709d298f1a571adf9a5da

SHA1
53bd05a35f28d8c42b54e2b9cf03717d698a4e37

SHA256
aa767d8482d11b3ef1db7e68bceefe7a75fca79e6e5cd1c47f0d1f1760c93430

SHA512
6ab69a7abad250d00f8ecd6a9fc5fc40d0bac1c837b11fa128a2c7092dcd77ddeff6112e72d6951c707d65fe65ba147dc3998d42db1548dece28cd70102470c8

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
89KB

MD5
6f3548ce8ea7a350d0e11ad0881cd5b3

SHA1
8475e3348de0dffd54a42736e86a6d90d650dc20

SHA256
f4781769894f087af9b86b17fa2dfec2acbcbe9c26a51bf1f198aa9981ccbaa6

SHA512
581b6ab951e1ca574bd47003df2c76a9b254f1aae790a81f57796548f372f2aa3efe74a4c1863acda1b3e29b90a517dea698436d8e6d9f52454ecae7303dc629

Download Submit
C:\Windows\SysWOW64\Bnhenj32.exe

Filesize
89KB

MD5
842603ea9cddea87be03d70d139e81d1

SHA1
8c8347a0101e48f65f688f38527288075e17b243

SHA256
404865e3488d68401b2047b3b23a2333745b2737ba8f88671ff71708074de471

SHA512
5c4e11d2892fb0f0eb79a0dd2cb8238b56db8781ed97ecdf30cce74dc4f50b65797b401ff45a3e68fc904cef389f51d99fe3b6d37bd58cb09eee2b4f66cf3917

Download Submit
C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
89KB

MD5
53355ab51d3380c351b529db210c29d6

SHA1
df5fa35061c4cad70310bffc500e44c38e5c43ca

SHA256
b396b7ff1c2e47b1b6f841f76a8e6bd833f7968ebdb6fb6df9400327bb8eb0e1

SHA512
078c1916d54785e8b6172303c2202f29110daad87515727a0a8b37b18dfb0b68cc9daa5c17d83c3bc6d52924fc39ab20bfb8f528dc5ed4c4fe972e4092da64f6

Download Submit
C:\Windows\SysWOW64\Cdmfllhn.exe

Filesize
89KB

MD5
7f381bb118cbf882ad61b540eee70f32

SHA1
d905306ca0179c8503d6e0c9cc709b8b18d969db

SHA256
e1a52c65d48e7dbc5885317c84827bfb28dbb5c7285c1d70694eee247d8674c9

SHA512
c96ffa37f4393fd59bc493efb4691bc7de86f902d99327f29ef9a7d3ca02e9f3cb97bd0f916f56d09782f8c718d450386fa94700c6e08db31063afb19accfbfb

Download Submit
C:\Windows\SysWOW64\Cfipef32.exe

Filesize
89KB

MD5
934d9bddfbb936e7b771e82cfb973540

SHA1
9f7abce2b737d56b1dd76b5aea0659a367620a2a

SHA256
37074c3d95e6939900c6f33ecfa5e3fe84181832fd80b2930812ee97e11bc717

SHA512
ebd746abc5f26a6b1a8a78af1883c7376fa51f7127a75c8edd53cf651c7eeaa23b9fc47ce6dd3c698aec13241f00f71a89d9110b4c8b6fd278b19736d48b75b7

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
89KB

MD5
5d2ccbce12c303b1df54d3260c3d7411

SHA1
5b402cd0c6e4125c0d138baccacd8ebb98f4b200

SHA256
cf7c2bf3a30400638ba27bf1c48a0a5b63aebcc7895ce2e32c6b5df3e4430e60

SHA512
57d904c99aa4f54e88e861989b5d2c2aadc5178030d2806644a2a2680f774bcadcc8ebeccd3774bb0a8cd828bd9f1c46006fa8738ac0baeedae41abe2fe3d2ac

Download Submit
C:\Windows\SysWOW64\Damfao32.exe

Filesize
89KB

MD5
63e5a2fea203bc2c8805ef71e5bce6d4

SHA1
5f9082fc5bc3680d03689db045537a6e8616a9a2

SHA256
7f4c7dd3c28aea4d1ca9b355931af07db9ac6d8521ee955954f0fdaf95f0abd9

SHA512
c2cbe4d8844c994bc82cf37f8ac5617fce248cd48664c90e0e56fad9860d536a62fb4aeafad907bb8afa15489a3179183a142f586248dfa31f279e67820ff416

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
89KB

MD5
6f56687443c8fc9d474eea0e0d7a061d

SHA1
fd1e7c0a054f5ae17df8b3b11d680829aad6eac6

SHA256
f230584a79fbd4831b063b565cc5cea537a228b71f4ab053d11af7006a7e8958

SHA512
ff2c888249c4785df737a08b6cc485811725fa9cf437f18cafe99a61be15a7f6912f3a05a90ba1b49cf7e30c137dec293d79e36255cb1eb2ab6b495c56d70df7

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
89KB

MD5
994b5eb2a38978e48dadbe09f7384f77

SHA1
cc29433a26ebd0cd883d7841f55349da7142d52c

SHA256
cc340d3074e4e6f32e215dd33140b95200ab93c17a237127bf5f8fdc8b66afeb

SHA512
92377f897dba05d7f7de22426d1406d4f2d05d74c98919602e555c4d3c395315d8abe3a6816d2ca8fc75d8fd5e0e3e3bbb47473d804fc90a8be55a84df27f725

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
89KB

MD5
0d37a428bb93379c034e125ce5df6633

SHA1
fdd9f8761ef20315cf2da337c2df8c6889338b8e

SHA256
2155e3b896f60bdc95b7ef47825cd3443598f77fdfd9b0f992242e0fe8a63934

SHA512
53ff699c88ca8cd948f5be558ad4cb56ce5734344079c072fe49b579979d2969f361f63c25404aba0d28537927f8586faf2c11937bf6f952449482659a702082

Download Submit
C:\Windows\SysWOW64\Dnpdegjp.exe

Filesize
89KB

MD5
8974c3b6d4aa19d8d28a8750d82e1ffb

SHA1
b2b3660627c289665b333c29d08b5513e41b799c

SHA256
3e74af690bee9e4e82423f7794ed28ca1739376155331daadcc3ab36881c5404

SHA512
653bda3b3617053dbb241d78171f6ab1726db420e56f06dd196700f11aa784cfeeee13aa4e183146c395eb6bc478e8f60cf3d1531878dfd6fdf471ff5993bc09

Download Submit
C:\Windows\SysWOW64\Ebgpad32.exe

Filesize
89KB

MD5
e36c697c585835a452cfb2b200aaadca

SHA1
c26883e93eb0b9e47a19154033c299c97230747e

SHA256
4d8a11c2ef73ab8e00af839d5c5d6f3d5eb6b699c4891b884040e74aa02a95da

SHA512
1ca10dfc006c87d7b1cefbcaad547428b9bfd80cdb845f9e0deec8342017d2cd111f0c1bf797c8f45bc8ae6d9e4e95b1869a337f93901e8cd8dfefb49ad67962

Download Submit
C:\Windows\SysWOW64\Ejfeng32.exe

Filesize
89KB

MD5
b571b1228f11bcd3e4922f693c4bcc77

SHA1
d194fcbccfe904d87421b4dba62aba35ba30c031

SHA256
1fa447f74b58d4d5eaaa8080e8312a107b147dd305c05e48250c4c19263bcba1

SHA512
40f908e270f1fc68b8642ac44d24499742417ba871d2385aa09d575863cf5c05223b67d344f7e29b0e7d10c5701b9499ff959f8f84d8c84e00652336fda48a9d

Download Submit
C:\Windows\SysWOW64\Fganqbgg.exe

Filesize
89KB

MD5
a56c40e6bca96736d9a0de2aee84c778

SHA1
ee51ee32fa0c16a0a3882e11936a96e227b957bc

SHA256
7952d4f4c107bd43eb1491fe07ec0cf7d65dc6c4fe76cafaf69fb9adbb8ddd01

SHA512
371a5ed5c9a47ae3b0f06526f07fd93cbe7888f9e46b5e84ce7a0509916fce803f6a207d7b30da95d8b820b03b59eae12143a72d2081d19f8fc1b1feb0515909

Download Submit
C:\Windows\SysWOW64\Fijkdmhn.exe

Filesize
89KB

MD5
c2961d9297df909cccb367f535eea967

SHA1
65b5af900b45ec581f53b41566716f734506c080

SHA256
2d261d6eb009d66dfff0f37b01896ce774926201a15824dc64f189cfedff96ea

SHA512
457b914b7b7a9890b800ca7a8f1b913d0229cf087e726260d3c5c3bc3be0fb4758d3b559f68c530d690620ce46bc71990f93c0152af5b3113f215536acfd3109

Download Submit
C:\Windows\SysWOW64\Fnbcgn32.exe

Filesize
89KB

MD5
ccde6dd3ee9bea00ecb21aa2955b241b

SHA1
2b5294ef8f5c612c7ca6be9e412bc8ccd737fa6f

SHA256
7046d32cb2a0267c5a640fdb2fadefdcf0bc0cb022156c863839e0b4457a2289

SHA512
fa53374c3ec8e413a2b0915d8d61c49453826425ee41292dbdb9ec7b893da0835cd7c06ea9680f4fdf6711ed9dcfda8d83fa3e4570ce5495b9454846dfd680b4

Download Submit
C:\Windows\SysWOW64\Foapaa32.exe

Filesize
89KB

MD5
e6836c084638c5661d27f97d9b922753

SHA1
4e58be0e5efd830c00cdc9884b2833ce9153c091

SHA256
a7f161bd94311f110507a58434bf06fd053dc4dd2a211559def98d1febec720f

SHA512
66868988c93c3ff9fb7d7732c45ee32b38c7a8db5106d6dd60d4327a96c590cfdb56d3df3e97a85137c8eb9a2ccdf18d4e16743e87997992acc730ddbb79ac0d

Download Submit
C:\Windows\SysWOW64\Fpejlmcf.exe

Filesize
89KB

MD5
62e083b1c4993b7c113b33eac646f52d

SHA1
6c835f0d75e2a5a028fe1b930660a6b2d5111eb5

SHA256
e15a575cf29dd34eef75aa627c3ec63686516a29f264d15f8f2ed51a3f13205f

SHA512
f439e421fd20f3b87dfccbe9c678c8246031ae7a41f982fd274d32f62a9411007b6fc61f05435043204313ea7deaf2fe1d76dc1a5a3a494c4febe3d9dc5b3c23

Download Submit
C:\Windows\SysWOW64\Fpjcgm32.exe

Filesize
89KB

MD5
e6681f3fb35685a052b796ce60cca899

SHA1
8c0d1b755b6557bff3fca6162b0870e49326d99a

SHA256
506e02cdc6eebcd122f2de889e859bae8e5dece75b936428a809bb2a2a0f4eec

SHA512
2e2507d13bb91ff64ef7e15f814e44730b28e230c09c1c7d9134cc0cde481184d0d9efa035fe56ea9e26170b845b52790815e7853106ad7975c958e690b07da4

Download Submit
C:\Windows\SysWOW64\Fqeioiam.exe

Filesize
89KB

MD5
17f6069fb186d5d445e4abde2d35e789

SHA1
ce26e77ea3d689b34bee2e3c5ed4f72e8ebc284c

SHA256
86f590696d909e6bcf0a716539eaafb8498a6200ac414dfb138fc70dc6c34033

SHA512
36e5667e8089309f20d1e6965b0ebf3ffef072f9319fbfb6de56fcdee9155f61131a7979832ea70a2a43f5e7b6ded971f886c99042c26ee4e02fd1d48443cd39

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
89KB

MD5
859128b0a1f9fafc8ec8a7e440a8c92b

SHA1
786188edd6b873479e8d27dbdce6bd83fcb8ea47

SHA256
355a97e170ae9c4dddafe1986064b140cb2642c7228405c3f5127a40673a8883

SHA512
cbed6756bb2c7ad7c6326e19fe623e4dfff1a63deca97497ae76def04c9ac50a1a1e1030611fe8d95395ce8eb42afc15db7b1f4da8e002e8e2e6714ff0d3aa93

Download Submit
C:\Windows\SysWOW64\Gfkbde32.exe

Filesize
89KB

MD5
beaa4f8db7d30720ea9158f1df220696

SHA1
af41d553e9b76944d5875e77f1ff4f2c77690bff

SHA256
225ef5a2680f52e62ee1d25616f520422a8e8412ebc7893a67cc066a2fc88bc4

SHA512
bec3c653376dd11ba75d76b148411b279e83a03e04a0a7d48e48a94f8937041380f98f1a0a41c0cbf3dd5457afd716e3ac2470995b7e5b16166e3dcd1dcf9cc6

Download Submit
C:\Windows\SysWOW64\Gflhoo32.exe

Filesize
89KB

MD5
73e5ea4fe465cc5e09830e008bfb5301

SHA1
a0dd18260e03d75fe4c1558590e6c00d8d7e1a29

SHA256
875fede7e9c2df81c9b40483b4c33fdf6126d621baa28df2d636ace36a85b1a4

SHA512
38d3100196c945c7115293696827c04fe6e1f251a0e608b406bac6aa41c7f12de4cf43e35edb6cd77ed547bfea57bdf5165cb1925c9bd215422846b06465fa87

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
89KB

MD5
93fb1df367798eba82a51a16239e1aaf

SHA1
14ebcdd7990fe980ee32b772e37c3f836ae26ade

SHA256
634bcd774bb2193aff0010057c37c824fb1cec5b09b7aeb2fcc6c071515e16b1

SHA512
6704036310fcb30ffdcd402635314c7e02bf1e49bc23059b95f489ddc3403ba078fa82963caaed425dc14fc62deac0c8602202d6c3bed59452458de216870731

Download Submit
C:\Windows\SysWOW64\Gpmomo32.exe

Filesize
64KB

MD5
e06d18d0b986ba6c6c37249273926598

SHA1
42ce55bdeecbbb5a75bb91527fc5a9efea414334

SHA256
ae0fd146cbc0a22f6ac56c3c46acbd9c4a566fe0b5f5382d06ac9303793e8e09

SHA512
7c410294f17683e4ec44efec3ec672dbad8da652f6552e9a1853560d177def95e405ef6e9c360e4fe8196bd6caeb057150a3eaf3d3644cc62c4fb0b373453c55

Download Submit
C:\Windows\SysWOW64\Hefnkkkj.exe

Filesize
89KB

MD5
e909ff3219557104c639d0269c37212f

SHA1
900f7bda1b8a52dac1a3274a67bf02cf42a62088

SHA256
93429034e202d31c364858113b6e6d8baba63f8fef1ffc0645f3778904379e57

SHA512
1b2f21980f09deba705b984d97072b722764ef1ea51f3ba2980eb2bf5f6e625073b7e47167e02ab8897a3f885ce9980ac0d55caffe46d3e46bed4e38ed97f146

Download Submit
C:\Windows\SysWOW64\Hehkajig.exe

Filesize
89KB

MD5
0b00d9ffe463747a131d759e0a1b8841

SHA1
5518d599d21cf38047640f3d5a3dd6c0a5eca984

SHA256
b495aa11ad1e2abeef33c8b18a15a18ae5f6d7781f670f10cc9eff35cf8de6e4

SHA512
7fff162baa8de80ed12f3e72cbb09ef941022c372d4f89e993eaa60b0988e87d5dd3dfc4b2049e5b708e3501737bafd7e637b8120119a42dda4036223d06712c

Download Submit
C:\Windows\SysWOW64\Hhimhobl.exe

Filesize
89KB

MD5
f122e6ef528356de9246f68709ef3dd8

SHA1
469fa622faac070ac05b4477da09aeec5a6d1b54

SHA256
de1a03231c27c2284354c003a537a8068b399692256f2f3cc356a3decca3bb81

SHA512
e5ea5adb9cf4708cfc1f6e503a3a243e35dede13cb1651eb6d3906f4919167618e5f3ee77e87a68247b21d7aca3b3cdd44296458543118f04aab57f729fd0638

Download Submit
C:\Windows\SysWOW64\Hkicaahi.exe

Filesize
89KB

MD5
de9d5f4999c5e49fec9ebd70a8ece768

SHA1
26c2d9944acca43c7b105ab9e9a437169f97fd62

SHA256
b2190c11c91b6f106dea22720a9999682f725fad96e3cd7cbd3296859be686be

SHA512
6f62710dfa0027bc479a204b35492b7fdb2f7f1cfca2e9c9251b748c6a6d45399e02d4b0a530e7e27e73bad1a0a65e509e145ad7f61e5b4e7451d1a1d68ddc80

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
89KB

MD5
1d9edafa39329f3b5343d16199c77fbf

SHA1
4d20b09068d3c973e5f3e2c809b3d9e660f19293

SHA256
eea74434286526109f8efce7dca7f767d9d58917fb8640c00be022cbbe57c81b

SHA512
902b8e7be4a99831ab323de9300f5fd7c03e26892d803385ee5cf0c8e0e6d93a155a3aebd2a2bfcb6edd35613e2bfe99ff391e7fd0c135a66968a5c0178e806c

Download Submit
C:\Windows\SysWOW64\Hmechmip.exe

Filesize
64KB

MD5
8d4417dab6b6eba55bd41e2862089bf1

SHA1
35895c69642385ac6bf3d0a7a587a0876839c4c8

SHA256
ea89a705d1d7a3e596db8432a4b43e73fb0c36387d03a61b5f0b8a9eb7676407

SHA512
4b69511285bae66d979fd98e3420f9adb781c37ac4f75e09d49f96998640c9fd2cc913f4b5dc35c0024b407eb3f2fb229b78c7c477007ab1842e897f4798b130

Download Submit
C:\Windows\SysWOW64\Hnnljj32.exe

Filesize
89KB

MD5
68cd1305bbc9fe8c29fda0c0772a1827

SHA1
9309dc6bcacdfb6a55377b4dfb3ea06239d3959f

SHA256
210adea0edda4e47219df58bb05a0b803bad695d603947c566ec3a63fdb2fc41

SHA512
3aab8bcfa75cfb737e25896b6978b322a06ece454a3a854ab17c4d67e6d1ba4f0849294f03b0200ec15245a128bc6e98b93821e3280b20d4770ffb439922c750

Download Submit
C:\Windows\SysWOW64\Hpabni32.exe

Filesize
89KB

MD5
fddec231c05fbddc7c95773fe96fc1aa

SHA1
428f6604bd6c3133ca28c941603be1b3a9d10737

SHA256
545d09897a245c6efa3beaaa13004f0dc5068c8c5bc8dbc51ad9091d6844c574

SHA512
024b0882c6321bb920847a4a6aeb7d0e4ee112321bdf2e1934c966a2a7a55c08810a9465c67e75cca0fc4f8ecc8b34df3fcaee1fd46bbfb9beddf5d929616ffa

Download Submit
C:\Windows\SysWOW64\Hpioin32.exe

Filesize
89KB

MD5
7eb2ddc64d8b7815400e70255134c548

SHA1
556bf2cb4f3d24215e1c00f253e537d293f74fa2

SHA256
7c4dbd1c48cf6a05f594e3a21309882b7eb7de32b0789847cb4d5b59f6c1e2fb

SHA512
399d05844e1480c5b50701e4c4f71e2bf2b5941dd04a23ce22a3e1d928f5559e3d5e7f7deddd04c3c24261b84cf222ce6603cfca358ba65e327b6288afc7dda1

Download Submit
C:\Windows\SysWOW64\Hpmhdmea.exe

Filesize
89KB

MD5
d78599acf95272ccb05b149c54c5a0a0

SHA1
ae924b5358d8494e988b8f25c948811c64c93219

SHA256
c906ccab16aa969d1433ffbb1cdb8558be38b87a7fcd828b5f9cc76659daa54a

SHA512
a3e5c2f3edf795135b405cc6a6c1c12a895a559896f1c7c3fcb0d3f6979470b79f1fd0f56e0fb8b77dd357b4727ddce5506a097d430f0fc68e29bcaa28c28dc3

Download Submit
C:\Windows\SysWOW64\Ieojgc32.exe

Filesize
89KB

MD5
ecd2e63058e9fb4982de7bbf5f0e780e

SHA1
55449c11604ecd8c32969098c0542f4d00b32805

SHA256
94a1f4db132148b62b1afde8cc529e9d4892811b3aeb99d30413585cd858d11c

SHA512
4c99ae0beb6a0d19c0b6bffcb5a04946cb229289b23c528b3ff1a2bdbb79fb87fec8eeb9c66c56dc3acb84c9962de8c51b7362de692723f0fcd3809198116b0b

Download Submit
C:\Windows\SysWOW64\Ihpcinld.exe

Filesize
89KB

MD5
55d7337c464c66de9ae2fa10f4a8e37f

SHA1
4a4f12ef9476ef7a32e7e4ad4a51115ed6273bf6

SHA256
f3a17b799e181e1239f7b0a6e582e13e48d1c6632565e6fa9b3f7f4a61574a66

SHA512
d4f7887f85d5262ac67ecda2ee3d230a2ba1abff66c34486affcdb23bf4d8d1e46fc3cbc4818a6c41d38c26f35674478a569b211879c20910036fc535102a181

Download Submit
C:\Windows\SysWOW64\Iondqhpl.exe

Filesize
89KB

MD5
a4ac633974a372f7ecb980c8a213e1c3

SHA1
fbedbfaca6c9c0f808e5ab988bd37a0d3e9bee68

SHA256
1c23ab8fca7ac04d0f0299f90af0e83da3a227b8d43f83f6197b423d73c358d3

SHA512
7b26bc3b920aa366f207b8275b8ded459a639c22b3643dbd8b5381f712a52579f18c77737f6173fe14ce0e143c8d62a75679fe2f530f5201277d0609b108ed64

Download Submit
C:\Windows\SysWOW64\Iplkpa32.exe

Filesize
89KB

MD5
512669055cf995c5561fcb1e8c7a5072

SHA1
5a8f48421a48e3be14d48cb2148f38129873e453

SHA256
8ee9e604d2beecdf3eeabade9c2a49e8c5a907bb3946da705ab86ff8345a7681

SHA512
ebdb9ff894110a33818b081c91156594eb93dccb84875b3d6b513aa76eebda36ff8201a83b1defa2a26fee6c2cb36daccc56fb8f39b071ef4ea19854b6234911

Download Submit
C:\Windows\SysWOW64\Jcdjbk32.exe

Filesize
89KB

MD5
247b11c11b61893e595bc5518aafd828

SHA1
36d766424e06c89314d83668dc5dfa65ca4f952d

SHA256
3f36ececcc5feecc43cbe2d69389c74c861deb2324925118363e12fafde710db

SHA512
20faebd31643bb7b21ea4c9bddbad59ee4a29e500f27917b0699f5863fcfca2f9b5f46a2198e07db1b3eb2f07b4c618e05c0396864c0762e3c9bb8b672e08145

Download Submit
C:\Windows\SysWOW64\Jgbjbp32.exe

Filesize
89KB

MD5
b7c59a9826f69c277f436ebce2df0416

SHA1
f38917572ea03628d1d6cbc87088398fb66c4233

SHA256
5b397136c652ccde47c43794a1ad6d687c19fa4d91bfe991f36cefdb5ef217b6

SHA512
7469cdeec8511d559e78174bc489c1f15f8efb536eeca184e63f3ff55c4850ea9ed72b274af6bb30dc09ef45682fbb2f7b8b2d3eebfa8f72d570a3718d5c2eb2

Download Submit
C:\Windows\SysWOW64\Jghpbk32.exe

Filesize
89KB

MD5
a4738783aea3fbdba7a69c12722d8689

SHA1
d5a27f85a78c0150646968e0e60567f866a1446a

SHA256
a6876c4155436d536928f19f448b5f56d963a038d9b69a5874633a0a88afc728

SHA512
faa621331cdd0471dcf6a1bb32bfc8573929986162883f93d0ae9c9cbe2d1a81b5bb67bb3406ebffc845f83caf7da52ba2a39b5001dfe922cb79cfd390f32c30

Download Submit
C:\Windows\SysWOW64\Jpnakk32.exe

Filesize
89KB

MD5
e81d5f0a634f7865150767e63507196c

SHA1
f20f0fbb179602b86489d394d1df2977ceff2f69

SHA256
e41fd1d40c9a150ee7cbb29ce22c166ce8b876170d43dcf5e2f8f5da8a24d71e

SHA512
94e627c0f23ac091cdca441e10afd4e428b1b8462b571d6abb3a32518f31b8e4ed0d0e213ca6a865aef7871954416938f84bb6057922ee0968664582854b8295

Download Submit
C:\Windows\SysWOW64\Kbhmbdle.exe

Filesize
89KB

MD5
75ceb8b35734df16c364f54d3c80ab15

SHA1
0bda2b11ee197996bf72e8b2a7f22098087fdd3f

SHA256
01291f75adb2f22930b9af5792cfee3603b49e6b9b3dc015f9fb47490f2f7c57

SHA512
7b22ed5836e20e5e8a205e1bceffcf33c9ca246ffba9b89e6d6c9e3048b0ee37dd15c1a6b81563406ac21f656aabae49d33af8df91010215ce8de71c1754cbf8

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
89KB

MD5
ecb69fa3e6dbe7262e07fdb450f24099

SHA1
1b40fecd1a492b0242827128f249b409a8d60e15

SHA256
c4a2619247ac33c13859728994ab83104fda482d77ff851ad080107e52c9811c

SHA512
5043d8e2c9d98fd3be2a449abc2a8382e505c9157c4d3a7571baf26f197e09c98a671bdb8cc7b3a87f0dfd7fca0d4b7745cf337ce9aa97b3b23ba9c376fc8794

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
89KB

MD5
a67669316580868b62f4fd65e85706c6

SHA1
50f1948b9128f9d35a410225645d0f149ed9def2

SHA256
b96ef09a8d24c6c491239ea91ce80460dc45ff6130acf589311c1158a30368ce

SHA512
30774bdf1c83da97f05888e05f29ffb045ddbca210f63dbbcabce8451e3d5da5f8f6b05235c76c4499faeaab1d620a5e36105beb28e6aaeccab127a1378e7402

Download Submit
C:\Windows\SysWOW64\Lcfidb32.exe

Filesize
89KB

MD5
1fd64dc054b2fe1ea975e67e7b13988f

SHA1
3186e3be63ba10b20372cc22cc3a5a291a5e7699

SHA256
62b7545dbd1f46f304b38dd5a6d5ba9a0fea37299b6845f845a37b71ce8fe12c

SHA512
e969db2f7229451a697e8da09bbdf4a9febf94300e05bc18c6b89388cb2d44c332c7eed36e784fd11f493455d552fb7aa5d6d59db7cbed9a00532b6f491da643

Download Submit
C:\Windows\SysWOW64\Lckboblp.exe

Filesize
89KB

MD5
2f672ad8af9db0412604e8d652c6b9ae

SHA1
af967e8105d14d4ff76c6fa38bffe8abbf4fa70b

SHA256
d6fd47e0068b5b21b1a48680d475a6f60dc4e264c289cea1f52703572324b781

SHA512
f6a01fd58a9fe2d838e2d22f67be1845645f9ce44eb22d8c6b2dc035431ec0d28f839f0d30276226e93fd16a519ed179c211a0e37d4b674bd27100f2c50e6a31

Download Submit
C:\Windows\SysWOW64\Lnangaoa.exe

Filesize
89KB

MD5
1587329742e9ef4fc7b53b46e4f203f1

SHA1
e2cf3cc2958d36aa0a68a6c4ace59d0ba1605edb

SHA256
4a291650c464a15515d6b2ee12b5522d3727e06b627d96f9776c13cce936b903

SHA512
dd9b9ff0e10b27cec08e60780ac18eb081184754549fd220fb67abf4a8c3c228f2a9deec20bb3d212254836b2f16271999a06e62cb2411b7038134a9d1173618

Download Submit
C:\Windows\SysWOW64\Maodigil.exe

Filesize
89KB

MD5
bcdfed0e26923621b4536e90fdfe8e8c

SHA1
7dd29531d0b518cce7ab0d6b257fe8527a88326a

SHA256
b7ab85956853072615974979a86a0f62c6a25b836bc8222b4b4bc315ced2c223

SHA512
17f15d2e74a0d0e331e1b70b81212615e39adf12fbaafabee711e3fb4bdaf54e7cca1341434a67be121531b0b165d1d1a8be23f6ae6880d0aad23ac2701f18d4

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
89KB

MD5
376531f2caf1b0854d7218bc37e581e5

SHA1
36b8d3d5f34ccc4536f0e5cf3513fcb4550c036f

SHA256
d8590eb7d289ae08ffe07c83e3ce8502dc7fd0703f7e849cbde072189290d149

SHA512
aeb83bc1055f5f76b1846913ecca547cf997beec01ad39f84073f0bac4a081cbc5dd1e6388a9bc6f44c1544bfe3ae7039fcac9f439527547188391d15c5f6071

Download Submit
C:\Windows\SysWOW64\Mhbhmhpf.dll

Filesize
7KB

MD5
06e833e2a9e6f6713ac67403b074f971

SHA1
b9b3f3d6eec7622af5f44abdf221d86a5576d882

SHA256
613e74739a78e1a5842f989331a1a9de0313fb9c0c43a085fd5a0998b0dad743

SHA512
a6d34f30348c7a3233f59187e9ff4339595e47298a34d7c59aae58ede2cd7df979dcf68c6a4491c0071181525f682b646d8cc72a509c2af933d2a7bfc8ad6171

Download Submit
C:\Windows\SysWOW64\Mifljdjo.exe

Filesize
89KB

MD5
b09c0f1d447079cf838d6a46d955ef55

SHA1
e6ce84b45eefc64491c45c28641e2f66dc2323b4

SHA256
494defb7faee9234499e43a371e71c07abf27cee752942f55ac2066eb2575984

SHA512
016c141dbfeba07a3cf516ab0c73be654a10e804c32129397eb70f45e6b4841be969d574304a2dce49f6728966fab0ccfef4a4e26da796ee768dce162aed0510

Download Submit
C:\Windows\SysWOW64\Mldhfpib.exe

Filesize
89KB

MD5
049771b72c4a8c1953bddb297be57498

SHA1
6554c072d91a8fe59ae5bb076191c2e95921cfb4

SHA256
587cc042662ef04359cd743ce78905b4635914a6e00f7a3649b2488c40aa6347

SHA512
1f89d22e6aa5cf7e3e898ab5a7e12ae36ac7a11d0136cd5fb6e8206e5244407d1fb5892634d89aca9b5efb5b501e93e8210de12f9b97bd98193ea8ed5d5adab5

Download Submit
C:\Windows\SysWOW64\Mnhdgpii.exe

Filesize
89KB

MD5
7c7aa82d0cadf23dd6f2cf2e41c1f8fe

SHA1
2d76759781fd2a0f8bdaf0ec950a8a234211e793

SHA256
362c4997d49770589930cd0b761cac17d8a0cd2f1bc0e191adc414f25996c675

SHA512
7541a84814471e6a08363a2c5114f46963b4d3bef4bd0498991ffb9dbd414d459962ee678cc612dd7f542cd384b98699bc1ae1822654ee6ff8ba4c6924a1c817

Download Submit
C:\Windows\SysWOW64\Naaqofgj.exe

Filesize
89KB

MD5
ef40f2128f8a8870700db0cb370ca2c8

SHA1
7488916b58c9e348f817f836ff3f3bf1dc844451

SHA256
bac7b6a720f613eb424572b7f822660b5ce2189de107781fb25c281f6f64591a

SHA512
beaa3718f1d8f3d5ff6710c45c876490a8cfe96175e04c1f5ff90f44f9e1f75db103f289d3a754c7c14c0b921be72a463b3c21c6b3efe47e06a9fa6ff8774440

Download Submit
C:\Windows\SysWOW64\Nafjjf32.exe

Filesize
89KB

MD5
b07652ac8eb3230125bea6f3d614a6bc

SHA1
4a0d06529423f65c5896513b31bc11768f03daed

SHA256
fa4ba81487de79fc3a475d0e738d023e8dce6c44daead9f343cfd2c3c1ed5c14

SHA512
f78f35ee0ab6accea4f8e2d6897e5e7dc9d4ad57aa9fb4b00d14eac80719922baadb3d35f3696cf756c4210defe2d36b882b9ac6db4ed12bffad28188b087ec6

Download Submit
C:\Windows\SysWOW64\Najceeoo.exe

Filesize
89KB

MD5
e222b7e6e214ee25e348597a80415625

SHA1
e5658dd3612b3d66d145a69571c890876a5f0366

SHA256
8babb1dffb220f6ebbb9c5e4d4cab2d707302b3da68cb52d6adf7b4fa7fed699

SHA512
ff1ee990c0ea8e67c6f1ef691dac15f97f80bbeb3deb1be6508a27c07b6c8c52fe738c512d18a43ad8fb60b8b07a030bbcae883bb9175aeedeec895b141049ac

Download Submit
C:\Windows\SysWOW64\Neccpd32.exe

Filesize
89KB

MD5
27b8c15470f0126832f286fb67720d76

SHA1
a2e1f70b581fa9fc6ab7cae3f49b6d19c7558d1e

SHA256
a4632f3f5b809b283e49201b7b30e8e055084a3a80d68c51b4ffc1da5786b303

SHA512
a2095b5e85130a0aa27d9142fb2c467c215570fe4f01a9756dc60e09e7b5d1ed844ce1b1f4345e4b4f9f1860b21ca30e144410808b75a213ed54bcb30c2bbb72

Download Submit
C:\Windows\SysWOW64\Neoieenp.exe

Filesize
89KB

MD5
ee1a2b0fd23e617b2ac3197cf0a3f1d5

SHA1
e07bdda734583dbc7a4bb9893582a7f7c235bbd5

SHA256
947d19ddc43fcd5cd5790360de419a69b0eb7efb2d337fa5a3a47830f5b1e803

SHA512
2c83317de43b0ee3dc4a7d69a31ef1fbdb6dccfcf6c19aef818016e729257861142862a4e7e30f45e541859e7cc919e3f35f6970757ba02005d7e377edd97615

Download Submit
C:\Windows\SysWOW64\Nhkikq32.exe

Filesize
89KB

MD5
4130dbeda59a9649825d61813421cf06

SHA1
c1970fc618fe853d33735fadb9744b3f70be12aa

SHA256
6eba65b2cb4ac79bb14a65f5b966c2c68ccbd9a37eb996ed44727dfa7626d1ce

SHA512
52e70263f3069b31398355ace03bfbbc290ac46be24c9a4ece372108f041637859a008fd57b7c564fba4ee5e3e14a0fcfa26cba5d5253c73c85a73f5b3fc3258

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
89KB

MD5
36658cddda7d85d88656fa2b674244ff

SHA1
ff5042fc4fb52c9e1a00373d9b65828b1f467a6d

SHA256
97c1fafd2f723a9a8197c5f91cc5c770a2b5d5150b68d15b2970cb34e72b0993

SHA512
af9961ce7d899c1541021470ce1f6c5389a4b86bef88d4791f7e03991e8332aeeca59f8733f06fa8a08235a35d33f5e3809d7eb4e75ef3d4f0342174a06ee543

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
89KB

MD5
f67b763c3f9947a8ec41bd3b0cae088b

SHA1
511833d8a7925678de9d5ec0924aaa04fe59e4ff

SHA256
c11751f5dddbb7777afdf1df53615f87060fd7620ef73a90bae1627809834f1f

SHA512
51ab049c742a1fb3a07595eda68e1fd2085cb9f2db549eb6a19d21bd880d4be80bb9fc98580a9ba95d89aff37385fcee76dfb1e8640cffb2f64b8c63c9a3c181

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
89KB

MD5
a440fdf72f33ded6a9f59e61585172b7

SHA1
ef501dec6f46a8efc6890cee03437ae8ff0f499d

SHA256
3084e718bd21b236db46df00e3348ae2008bc015c293d345a30a1ac0e62bab68

SHA512
3a6d8efdbde3727c8857888f12bef47d2e522d17647f77a254cf14f7c1af0b7c0b5439632a261ac8adc977522e2b3c271e9f13b4e12cbe8ef50063c86f8fe715

Download Submit
C:\Windows\SysWOW64\Nliaao32.exe

Filesize
89KB

MD5
395012a9e1037f46e74c3aea0b4ef879

SHA1
0ff714e34feef63982d6081a97c5422ae5f7b232

SHA256
7df3393d4aaa18b3eb53d0541b48abace479a96e3cbb6d57e57fef4d85f23bc7

SHA512
7968da97308af82b123027bf278287d1f48dba6ac09a031df7f1fdc13f3520373d7c7bd3887e8d00666643695eb32566ae7c63b7ef1e57ff7e3941222528bb22

Download Submit
C:\Windows\SysWOW64\Nlkngo32.exe

Filesize
89KB

MD5
57a18e206a380170b597eac4a12f51cf

SHA1
9cfa20da07f8894f9f4f5930a544314863aeadcc

SHA256
6a3aa0620567d89341059dfe322430d158b3f296013f73f1fd23c1630a5214d7

SHA512
7b42a3696a2541ae2deae54ea0f27f3c27fa13fa12decc9b584000e9c4198ba5b63bcb1acd51138859c6d6160c878ca94155f660938fb428d3098370b582f0f1

Download Submit
C:\Windows\SysWOW64\Nlnkmnah.exe

Filesize
89KB

MD5
464d4808f0d1ade02f887ffa982736b5

SHA1
a7edba815e82fa65a98a95d8587eca3dbf05da84

SHA256
2a3354af11c4a371db21f88acd2ee788af37acbac0002f865b26e76548037a16

SHA512
e32b70dd3e4928bf15995425bcdfd2877a9bb29f5d83c4104fee767bcc55ef99f06b21f032a6918dcc9cdc431464cc4269430df050b2747898fa4866d16bf125

Download Submit
C:\Windows\SysWOW64\Nlphbnoe.exe

Filesize
89KB

MD5
2c9f1255423e3ffa16c64283873ec3cf

SHA1
f019c48c58f4d29eafd2c0ffadf991aa70e1b51d

SHA256
06b7471e56d2ee32e452eec964e21dd6a547f0ff5274a27e908fdfaefe10f7b2

SHA512
f0f856fa958da689604db5c6df0b3a44289f53e21b78eaa3f0d61ab4a50740dad3cf7b6f9180d1ee04091ff0c70bb5d8936dec53aebe815dd595da196fb770e6

Download Submit
C:\Windows\SysWOW64\Nnkpnclp.exe

Filesize
89KB

MD5
911f69a1c57c76bffc3771dabdc98253

SHA1
984bc06975a25ed8999716bc28596a99dc2e0a85

SHA256
4edfc53b3429f775a2f2d0f7c429a7a69f27215fd15849365b0cea66be0888bc

SHA512
21fcff7a90d69ef4c6484147ffb09a34b1cd757ebdd3a75b8569615f74ce7d5cdc951a486274d1bbbca4a6554bad5e58f91c6cd216915a4f781403b62eb7c0db

Download Submit
C:\Windows\SysWOW64\Noeahkfc.exe

Filesize
89KB

MD5
7cf14c330f5bb070e3dd89bc10b73879

SHA1
c96fa1833628f0f945b99b310e28fded8bf77128

SHA256
88e5c31baf2d2531de9184b0d0a9b9d9448508e53e0589be3bbdea0e70cad828

SHA512
6ffe12bf60662874b13328e3d3594a0498461788a8155a30237ebbe579b0ffd7a00727ecfcc81d91376f5ffe5e19268830314fde0f964afa074e97ea36583a3a

Download Submit
C:\Windows\SysWOW64\Oampjeml.exe

Filesize
89KB

MD5
f34521c29de275819534e3e88e002bd0

SHA1
b5f0e82da815f76f68019c70ebb83dd4608de0c6

SHA256
41054f1013a7f8b0c37fb8710c307cc985fe9f5f1760ef43382bf5c84ee18ee2

SHA512
ff66b7358fdae48ed8e3b5d75373260f78282e2a34e8ab52e415a6a8b7e69da5cb0ac9681515fe6cf86deef4c6a38a30ece484718846137707aebd73657b037a

Download Submit
C:\Windows\SysWOW64\Obcceg32.exe

Filesize
89KB

MD5
d3607820dfce2c2e16b1a471334f6bac

SHA1
6ed0b0a9b4b28013e8a71998f5ed64d6cca63670

SHA256
c5c180537e51e69b14241c005b8b34fa503d8dfa9798d242ca71c2eb0574aee6

SHA512
76c0ecd3d3a6cca27132cf07e271458dfa9c1826ad1ee053f2d2c5c3a11c0a3fca992c0ba6c2bccb6da55d1acf5b36db0d85088f39ef192c113f80f48e7b60e9

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
89KB

MD5
bd569ff8d1e8125dcd0f5007efc51e8f

SHA1
95dd94ddbd95bb5c0c52774bbeb85f71a6350e41

SHA256
e7f56ae6232357709c0bbd5fe5591c424e67810da401bf4dff7b2b8964e84cef

SHA512
e1231f485669979dbf3abf295c54df2c3cc0eed9fbe301f3c09335e184c3fb71d9346e679d0687f69b37a7ba93911c8737967faab385fc15358e66933dbd47a7

Download Submit
C:\Windows\SysWOW64\Odmbaj32.exe

Filesize
89KB

MD5
d990ec1914bb04094ded9546f5280b13

SHA1
e494a1f40ece17512a51397c9f477636e0b2a022

SHA256
3b9d2791eae3d4765322561a20e87f8206f8327b2d8116abb590589ffcbda30c

SHA512
ab33988daef9ac0d6c6ab76c1b019b8806aed3f62af7a42244385c6a74d4590caedfcb8d24faef7a63398c0a073361c4fb2dff7c6a8f1d4e84388f19fb99a5a3

Download Submit
C:\Windows\SysWOW64\Oelolmnd.exe

Filesize
89KB

MD5
d3f384d09bfff50b9df39da39df68d4d

SHA1
ab11a22de401e12f66b76a4806785ee336609575

SHA256
03c955aac01321f12be44c33df4d873e4cbc569fdec1fc1efeb202bdfdc80ca5

SHA512
434fbe50486b8ea5e4b772201af0f6cc451fabbeca47eb743c5ed0fad210af4eac35aea969c737b0517d77df386e7b6d5c576f82653b032c70c379d881c0a61e

Download Submit
C:\Windows\SysWOW64\Oeokal32.exe

Filesize
89KB

MD5
29e2a7b518567b4f836db00825bc562a

SHA1
dd68bfcd17bb4ea353e01aafbad5116ca508bb5e

SHA256
53905c420935f2ad5596e4325f2e08df9f34313c89b8060e8952d0e0a1141e13

SHA512
7fcb32c24b3bb19fcfb5f85c75b709291d06faea0dba731ca719a37249f9d34b2c4f743104d636aa6407dd529ae8c9b92e6a9bef5b32e08ceb0a032fca1bb85f

Download Submit
C:\Windows\SysWOW64\Ofjqihnn.exe

Filesize
89KB

MD5
2706a31ee195bbb83d0e9f951b160f92

SHA1
10a165b186f5307feb9ff5e08732aa7948aed5f9

SHA256
fb7c26d400d8096c79af7b8021632ec2490ad561d90bf6e4a2cfea6c9a354969

SHA512
9143f716e863c21acc9df174a3ce977584e0c3fd87ba09dc6f86800e41b879262be59ef6ae33e43af1a025b666a708d118ea45759a653d778a5a1ea5a902c0f2

Download Submit
C:\Windows\SysWOW64\Ogekbb32.exe

Filesize
89KB

MD5
7694c9e6a024a74b8f18a68a4f1b5b27

SHA1
56417fc17c0a4eac1a06284bce4509e773645438

SHA256
56c16b4493219a0017403061514ba40d9239c932be0d704d920f8323cd34ebea

SHA512
99f8843587d11b0c38898fd983f97e6ec862f2ddadfe2bea91944234da868128fbe061b8f2f9d82023891885404a32c6d3ee0af604efd75ceaffdc75899c02c1

Download Submit
C:\Windows\SysWOW64\Ohghgodi.exe

Filesize
89KB

MD5
65f34ae12ce7e8a2f3b35057d48d7e4a

SHA1
3148a9a8254fe8d5e7f23bb2a07e282eb9627a75

SHA256
83fcc489426905f64677cbb0f67e50cba4429a64897e1001e29a243685a7e390

SHA512
1b1a6d712a2fed0d5cde2536a8003d4f3f1871abaf8a58f0cff23f632fdcf574533b2869a4b45cb2d100e05d73f93ea40fe2a01aa00bc9b82317ebcbaa1b4f5b

Download Submit
C:\Windows\SysWOW64\Ohnohn32.exe

Filesize
89KB

MD5
c3fb45baf39ed2a97b295a02e91c96e1

SHA1
2211113ff424de973d5002d0595c3938a48de096

SHA256
ceff1ab53464c6fe6f6d0002b29bb9f35ad8d07f74ca855ce79ce51e24337733

SHA512
4ec591ad45999668f19409c3d90179fbac285b17518526726e90d45e0c1f2deee48b417cc5abced42b4ea4ad52f7bc890d12688353c346177d9e22b6999c2e98

Download Submit
C:\Windows\SysWOW64\Ohpkmn32.exe

Filesize
89KB

MD5
e0c6987669c731f1fc5abafeb36d271f

SHA1
5f484f7cbe612021c302bf564cf82160f578aa9c

SHA256
047d51c19b9bf378844bab85216713e906a6da7bbab31053f2aa204baae6ef76

SHA512
47c0ac44e70059e3cfe85ec3f91cae3624cd7839ce77c4dd70949adbfed33060700aee368af335b2ec01e3c18eede7ddc6b4b81b8e8cb3799df957a3200d1863

Download Submit
C:\Windows\SysWOW64\Oihagaji.exe

Filesize
89KB

MD5
6e2c3c80fcb73cab7f86ccfcf367650b

SHA1
509300acb3450130555233ad86c28c2ecff21647

SHA256
9bad573166a5fd81aeb5d8b7fff1bd039af176d96121d961a5bd7d311dd71055

SHA512
e154f40368724599a3057779fddc3927b3c87975cc8a672546b8b29a7d770a2d5f54fe76789102dd18d7369aeb798135fc642c9d20f220e1b3280b659d2008fa

Download Submit
C:\Windows\SysWOW64\Oldamm32.exe

Filesize
89KB

MD5
8b46192ed439612f4a6fc616999cf7c0

SHA1
31728ac4593814b5d50dbf6a86f2935a5097e168

SHA256
1e688c8241867b83279b0f34eedfa4a1b9751309a22d23abb18ed053df33fa2c

SHA512
316da62cef0bdeb8cc6e12df011fba106f9cf69369fd91aa73dd187e09d06ad43e0fac3acfef763e3928a61298c5e9987ffdd238ee995be865045ed21e09808f

Download Submit
C:\Windows\SysWOW64\Oldamm32.exe

Filesize
89KB

MD5
c366a2f198a8a0274dbd6faa791c5998

SHA1
1ced3a385f19b6468d75d62ff3aa273be4ede14f

SHA256
f0aa22f4d65b9f301c1e8a1557e200473259ca71a814ea71dbb1918c15e0f675

SHA512
efc3d9003caf01b2122ef1ebb70bca5b3d90bc201ff7ccc8aaebb8241658a363d05b7b2b64dbd905f5f40d02bc04493d3c5c97439095e9efb5ea51590584ae1f

Download Submit
C:\Windows\SysWOW64\Omfekbdh.exe

Filesize
89KB

MD5
3743683fe829af35f71b1883942e3aad

SHA1
b2f2b3c0bbf8dcf4466c224070d297362ae07237

SHA256
cbe1602fb2c164acc86d6f193926bd6ca152baf759a968af778d7ecc5d8d002a

SHA512
d2a84e6b69d0dba6cb1ff1c97ab617b2efceadf721e19374c98a2814f71d8b61810beca6ea92eca2a3da37bf94dcc72f50535d076d53629b1e4a67c16a8eef3e

Download Submit
C:\Windows\SysWOW64\Oocmii32.exe

Filesize
89KB

MD5
8bc2e97f17e5bc7f404ce72347d30e97

SHA1
86129792ad4f762e0708b3576d8428762b5215de

SHA256
e96a861108de19b1f5aba02aeb7f6274d5ae5c4b03a89092b58d530f209c8007

SHA512
b45b078c731031f7544f2e9046c00cc509cc436b0f525e73d2cfdeb0ddc8b63a8e6a5e53e9eaf2c931ac2d1b067a8a626c4ba6014e63d94abb5be5837cf3d044

Download Submit
C:\Windows\SysWOW64\Ooejohhq.exe

Filesize
89KB

MD5
201ebfe338c1069109337a974ed34e7f

SHA1
ad9f425769bc374a37f71ce55afb067111ae4c42

SHA256
ee33cf7722033ff3cc313ba139d85a1703395f1b912ad13fb954324d295a6715

SHA512
bc1d23393d74bdde6986e6575baf6bb1fa09214c2f1c6ee3205334a3822a52e840038ada78992604115e83197436abfc7adab44640f4cbf040ad1b65d7ac347a

Download Submit
C:\Windows\SysWOW64\Oqmhqapg.exe

Filesize
89KB

MD5
75149137f3641eb41b31d9796369cddc

SHA1
9c939a0cf1580aabd5e63d52029e9377469d00ec

SHA256
07e087c7ea7baa0fac9a33d83558df8b23d76957ae8e0682fefba342298a1d83

SHA512
5fd9c0270d83f9c11e5b96c0a95f4e968cdc02ee8213ef820125ed09bf68b22a351b91910bd45926f4de56dc8a68ab7a3cb6744a8cb4cec41269b9d522ddb431

Download Submit
C:\Windows\SysWOW64\Pamiaboj.exe

Filesize
89KB

MD5
e197139de72f09c5719b17603a40bc74

SHA1
7347f8da646b7b6b0ac39c85cf55a00673092be2

SHA256
19190ec65b767f605224a470dea4f9d0e88968478c53f6f07800afb04e4adbeb

SHA512
be5b4e583e271f428b810aaf7143da727c209df3562febbe70b965c76cbb2a06ec3f07094b81a54a469ac0c8a18ffc1755419e9a609390ac05404a34aa5a06a1

Download Submit
C:\Windows\SysWOW64\Pcepkfld.exe

Filesize
89KB

MD5
d02406242b7578e5c555623fbd4f0371

SHA1
4c160b6714acd4a931d4df00c1d6d5574e435933

SHA256
0083462d27ecb8eadd023ce1dc61e7271e2e5845770d99d414392dd912797216

SHA512
95206a91631c629fe3f575a47435b591fbeeefb6b0efb3c38e3cdd286ec7c3d9a67ed214ba8a6b32b6548a25d1a5c5c90cbdc50acefa92a5d440eb1aa4ad73d2

Download Submit
C:\Windows\SysWOW64\Pchlpfjb.exe

Filesize
89KB

MD5
d749e21bb4fdbc9b9ce1fb0ed08af516

SHA1
fdc895dc7bc8895c9fdf58060208464ad58ce9da

SHA256
4b8e7390c79cdb262abe18007b41382f6f6d1c32852f474b4f2f13d54fdc4cca

SHA512
b7b4e0df3cc2dcd3bf0ef562dc82fc71dd7c884704ba8e2f25b3de6292f08e94505386881f4a5d1cb8d90d5c87fcbbfd9a5afdcf23f2eb3797266615828f6ed2

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
89KB

MD5
7107ea04a254bcb4b2a6deddc7f206ba

SHA1
ac6c1600826a8c128ed7ba5028171334618dd7f1

SHA256
09141c7104e7b87360bd4174bf60a8606edacd6a7b2b9c6f9be7868802e4f9bd

SHA512
1cc227569000b22532ee281599448a19d13a5fe8f891754d5954937679b4770bdcf9a5b2ceb87722aa80c67e8aee35394acf154a39f7836a02ee34245c00a128

Download Submit
C:\Windows\SysWOW64\Phbhcmjl.exe

Filesize
89KB

MD5
abaa4468a2543bfc3c705f7b6c9b6f37

SHA1
32597684534ff1f9194db6bb9f1b32ed8b978838

SHA256
f5fef85b6489e5faf7e825c93e40efa3e3a32a73d3f5beb923dfccfb4984f1e4

SHA512
99264af4808387b483e63dbb66aa083b87b7659abe92c2bedb39f55117f3f37c49d1d1eaf3f065737c157eb90f650ca91f2627bb14246fec26b8a3ec046b71ca

Download Submit
C:\Windows\SysWOW64\Phedhmhi.exe

Filesize
89KB

MD5
4ef5722e0e4c2dc2660c162b9d571896

SHA1
1fb3ab3033fc397eafd67e3e8c68a46ff17a93b1

SHA256
09c47a97f2d3a7a6f9c9fc028f4929d08b87e5b2d9cd5086c17e0830e8564c20

SHA512
5791d05917f28e60c8ef6662a7fac90301f01267deddec4249220fe3d789cd416fa4a4e9a8e4f3a126119bf93ebbf5d1334ded4ace64a0d492a91b7d71f85e87

Download Submit
C:\Windows\SysWOW64\Pjpfjl32.exe

Filesize
89KB

MD5
302ba587b0c1df154b284e8d766452e5

SHA1
20e05a6baefc35032892bf36e11d9a150affe889

SHA256
bf7fff058b48193b96ea9be50b378080f37fafc312a72ae4711a917113324712

SHA512
d604f2c146b820061791e34d8d645ebb37bdf2b0e1f814fa2fb002a8d8128804d7afaafec729772106ec2231084820691fa35f23b3ce820f36e55347235645df

Download Submit
C:\Windows\SysWOW64\Plbmokop.exe

Filesize
89KB

MD5
95d85685aee799adc29446957f17bead

SHA1
bc081c12aa97e534faf0e8c4f340572d5eef8a90

SHA256
ac4ce4de8f1930dc930296596b2e0185c0ff009decd3bb0790c83aeda0b5b5ee

SHA512
2aed686d92addf6bc7cd2837bc3358c2f806c6a6022103bd3157f95482c90d7af248f5d471e7b342b3c0b3c07617252d7ef64237eefdb51bf78353e1e7902235

Download Submit
C:\Windows\SysWOW64\Poomegpf.exe

Filesize
89KB

MD5
23bfd4704e737be2cebe3434c08de342

SHA1
9ca585a6860d70868bba6d8c4f450073685dc3dd

SHA256
0de76cacf150f786eb2f2534f7620fb649656e2499d5289e2d01da0428943999

SHA512
582997a8836d3607365b2d7f6d255d9b1b8e8700ea7115f65a4ebafe9c29463fb435cdcaac8f03460693c9ed5a7d90f03f1d8a6c974403bfc38e45f5cbde76af

Download Submit
memory/32-262-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/112-514-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/392-255-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/764-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/808-442-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-207-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/848-247-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/880-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/920-215-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/940-508-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1108-579-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1108-39-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1284-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1316-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1316-586-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1336-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1364-175-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1420-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1432-478-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1500-362-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1516-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1544-151-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1552-143-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1600-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1732-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-223-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1920-526-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1948-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1956-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1956-572-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1960-565-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1960-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1964-545-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2052-95-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2064-380-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2124-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2220-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2260-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2744-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-244-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2864-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2944-454-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2996-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3032-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3056-538-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3084-466-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3112-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3128-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3152-505-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3156-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3164-472-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3316-524-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3388-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3388-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3452-536-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3488-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3620-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3644-199-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-159-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3680-490-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3700-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3792-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3880-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3884-111-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3916-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-460-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3956-558-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3956-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3996-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4000-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4020-344-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4036-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4088-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4124-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4124-551-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4164-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4236-191-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4288-278-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4312-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4312-544-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4352-412-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4408-496-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4476-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4504-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4532-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4572-448-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4580-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4616-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4680-103-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4700-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4756-484-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4916-183-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4932-386-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads