berbew | 461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe
Size

69KB
MD5

59a36f40363820fa28d8825909e11b70
SHA1

c39e5983cd735b53250d8dde729b3c4a43812610
SHA256

461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec
SHA512

512ff8cbbea0a16c49081012c3279e85b81c590681296d488334022440aa41b34853cdf4c415362eea8d0d0f899d7f5910655a1aed58418e32d38e7ca2319dd0
SSDEEP

768:qY7y1nHNDPnCi74a27SOr+qie5tnqHG8rGqq3WFCMjwEH2/1H5xXdnhg+HQJ414y:qJXDF4a+QMtqHG8rq3Wpwis5YXa7

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pajeam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pehngkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paoollik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aplaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnjqmpgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cibain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfnjpfcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cljobphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfnfjehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llodgnja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmoijje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eghkjdoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geldkfpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmgabcge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpffeaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hipmfjee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Panhbfep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pajeam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmmmfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcnmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebifmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqbliicp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmadco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkfadkgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pecellgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahbjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ommceclc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcjmel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adikdfna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbojlfdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqhfoebo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geldkfpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilphdlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amikgpcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmhlgmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pagbaglh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgjoif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fijdjfdb.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4808	Lmpkadnm.exe
960	Lkalplel.exe
4308	Lnohlgep.exe
4836	Lmbhgd32.exe
1604	Lkchelci.exe
5012	Lqpamb32.exe
396	Lgjijmin.exe
2012	Lmgabcge.exe
4968	Lenicahg.exe
1372	Mnfnlf32.exe
3104	Mepfiq32.exe
2016	Mkjnfkma.exe
1148	Maggnali.exe
216	Mcecjmkl.exe
704	Meepdp32.exe
936	Mkohaj32.exe
3388	Mcjmel32.exe
2464	Mjdebfnd.exe
3052	Meiioonj.exe
4780	Nlcalieg.exe
3940	Nelfeo32.exe
2688	Nlfnaicd.exe
2148	Nhmofj32.exe
5024	Nmigoagp.exe
4588	Nhokljge.exe
1608	Nmlddqem.exe
5096	Ndflak32.exe
3876	Njpdnedf.exe
1548	Odhifjkg.exe
3624	Ohcegi32.exe
4644	Onnmdcjm.exe
3320	Omqmop32.exe
1920	Ohfami32.exe
4452	Oejbfmpg.exe
8	Oldjcg32.exe
2444	Oelolmnd.exe
2320	Olfghg32.exe
2864	Oeokal32.exe
1764	Olicnfco.exe
4584	Paelfmaf.exe
3316	Pddhbipj.exe
1412	Pknqoc32.exe
1804	Pahilmoc.exe
4896	Pecellgl.exe
4540	Plmmif32.exe
4508	Pajeam32.exe
4356	Pkbjjbda.exe
4760	Pehngkcg.exe
4180	Pmcclm32.exe
976	Paoollik.exe
1440	Pocpfphe.exe
4708	Qemhbj32.exe
4716	Qlgpod32.exe
4828	Qmhlgmmm.exe
2296	Qeodhjmo.exe
1424	Qlimed32.exe
3820	Aafemk32.exe
3848	Anmfbl32.exe
1388	Aednci32.exe
3280	Ahbjoe32.exe
1644	Alnfpcag.exe
2704	Aolblopj.exe
4100	Aajohjon.exe
212	Adikdfna.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fligqhga.exe	Feoodn32.exe
File created	C:\Windows\SysWOW64\Npdopj32.dll	Iibccgep.exe
File created	C:\Windows\SysWOW64\Kfcfimfi.dll	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Mqnbqh32.dll	Bklomh32.exe
File created	C:\Windows\SysWOW64\Doagjc32.exe	Dgjoif32.exe
File created	C:\Windows\SysWOW64\Nimmifgo.exe	Ncpeaoih.exe
File created	C:\Windows\SysWOW64\Ocdnln32.exe	Nmjfodne.exe
File created	C:\Windows\SysWOW64\Kgffoo32.dll	Ickglm32.exe
File opened for modification	C:\Windows\SysWOW64\Ocohmc32.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Jnfpnk32.dll	Phajna32.exe
File created	C:\Windows\SysWOW64\Pjdpelnc.exe	Phfcipoo.exe
File opened for modification	C:\Windows\SysWOW64\Pcbkml32.exe	Padnaq32.exe
File opened for modification	C:\Windows\SysWOW64\Aabkbono.exe	Qikbaaml.exe
File opened for modification	C:\Windows\SysWOW64\Lmpkadnm.exe	461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe
File opened for modification	C:\Windows\SysWOW64\Bhpfqcln.exe	Bebjdgmj.exe
File created	C:\Windows\SysWOW64\Pqindg32.dll	Bheplb32.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Pnmopk32.exe	Pjbcplpe.exe
File opened for modification	C:\Windows\SysWOW64\Edeeci32.exe	Eohmkb32.exe
File created	C:\Windows\SysWOW64\Mgccelpk.dll	Mfbaalbi.exe
File created	C:\Windows\SysWOW64\Jdockf32.dll	Nmjfodne.exe
File created	C:\Windows\SysWOW64\Ekfcklij.dll	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Pneall32.dll	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Mnpofk32.dll	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Clmmco32.dll	Ihmfco32.exe
File opened for modification	C:\Windows\SysWOW64\Mfpell32.exe	Mpclce32.exe
File created	C:\Windows\SysWOW64\Pafpga32.dll	Qpbnhl32.exe
File opened for modification	C:\Windows\SysWOW64\Bpedeiff.exe	Biklho32.exe
File created	C:\Windows\SysWOW64\Lhffmd32.dll	Nhmofj32.exe
File opened for modification	C:\Windows\SysWOW64\Cmbgdl32.exe	Cgiohbfi.exe
File created	C:\Windows\SysWOW64\Qobhkjdi.exe	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Ilphdlqh.exe	Iefphb32.exe
File opened for modification	C:\Windows\SysWOW64\Oihmedma.exe	Obnehj32.exe
File created	C:\Windows\SysWOW64\Ampaho32.exe	Ajaelc32.exe
File created	C:\Windows\SysWOW64\Khokadah.dll	Bphqji32.exe
File opened for modification	C:\Windows\SysWOW64\Nhokljge.exe	Nmigoagp.exe
File created	C:\Windows\SysWOW64\Mokmqben.dll	Aolblopj.exe
File created	C:\Windows\SysWOW64\Jgbchj32.exe	Jgpfbjlo.exe
File created	C:\Windows\SysWOW64\Oabhfg32.exe	Ocohmc32.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Qacameaj.exe
File opened for modification	C:\Windows\SysWOW64\Gicgpelg.exe	Gnnccl32.exe
File opened for modification	C:\Windows\SysWOW64\Ibegfglj.exe	Ipgkjlmg.exe
File created	C:\Windows\SysWOW64\Qlimed32.exe	Qeodhjmo.exe
File created	C:\Windows\SysWOW64\Dbbffdlq.exe	Dodjjimm.exe
File opened for modification	C:\Windows\SysWOW64\Mcelpggq.exe	Mjlhgaqp.exe
File opened for modification	C:\Windows\SysWOW64\Nmlddqem.exe	Nhokljge.exe
File opened for modification	C:\Windows\SysWOW64\Hfjdqmng.exe	Hekgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jpcapp32.exe
File opened for modification	C:\Windows\SysWOW64\Pcpnhl32.exe	Omfekbdh.exe
File created	C:\Windows\SysWOW64\Nppbddqg.dll	Cmedjl32.exe
File created	C:\Windows\SysWOW64\Cncijina.dll	Omqmop32.exe
File created	C:\Windows\SysWOW64\Cghane32.dll	Cleegp32.exe
File opened for modification	C:\Windows\SysWOW64\Pjdpelnc.exe	Phfcipoo.exe
File opened for modification	C:\Windows\SysWOW64\Bknlbhhe.exe	Bklomh32.exe
File opened for modification	C:\Windows\SysWOW64\Likhem32.exe	Kcapicdj.exe
File created	C:\Windows\SysWOW64\Ckjfdocc.dll	Aabkbono.exe
File created	C:\Windows\SysWOW64\Gmdcfidg.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Ibdlakbf.dll	Hplbickp.exe
File created	C:\Windows\SysWOW64\Ibegfglj.exe	Ipgkjlmg.exe
File created	C:\Windows\SysWOW64\Oelolmnd.exe	Oldjcg32.exe
File created	C:\Windows\SysWOW64\Ifolcq32.dll	Mcpcdg32.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pakdbp32.exe
File opened for modification	C:\Windows\SysWOW64\Pahilmoc.exe	Pknqoc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12156	12032	WerFault.exe	587

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnmopk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckbemgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glfmgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnmmboed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhbcfbjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpcdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geldkfpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kakmna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplfcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqhfoebo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgpeha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnjqmpgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piocecgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paelfmaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iojbpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llmhaold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekajec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjfdfbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakdbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbfgkffn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbejloe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkmeha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dooaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olicnfco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clchbqoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagdnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Goglcahb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bakgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfkmkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eofgpikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpgmhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnegbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfogbjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnfnlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiloco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfiokmkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcgjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmcclm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ickglm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kodnmkap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmcpoedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehgnied.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eppjfgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hipmfjee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqkqhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngqagcag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkofga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkohaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpccmhdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amikgpcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqafhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmohno32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlllhigk.dll"	Lqojclne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bepjbf32.dll"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afcmfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpljehpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkjiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongbqjjf.dll"	Dooaoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phfcipoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpdbcaok.dll"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqkplq32.dll"	Pcpnhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfipab32.dll"	Eiokinbk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emmdom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Focanl32.dll"	Eghkjdoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pddhbipj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dokgdkeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkjfaikb.dll"	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Almoijfo.dll"	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfeljd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlimed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchcpi32.dll"	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dejncidp.dll"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlglnp32.dll"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epgldbkn.dll"	Qppaclio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkalplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leilnmkp.dll"	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbonoghb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjldplpd.dll"	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpgpgfmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfmmaj32.dll"	Goglcahb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilgonc32.dll"	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jihbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlhkf32.dll"	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlikkkhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkppnab.dll"	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edommp32.dll"	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klbjgbff.dll"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlikkkhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncbafoge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogmeemdg.dll"	Ocdnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmnajl32.dll"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhihhecc.dll"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deqcbpld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figfoijn.dll"	Mgbefe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqgmmk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Camddhoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmocfo32.dll"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckjfdocc.dll"	Aabkbono.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 4808	1144	461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe	85
PID 1144 wrote to memory of 4808	1144	461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe	85
PID 1144 wrote to memory of 4808	1144	461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe	85
PID 4808 wrote to memory of 960	4808	Lmpkadnm.exe	86
PID 4808 wrote to memory of 960	4808	Lmpkadnm.exe	86
PID 4808 wrote to memory of 960	4808	Lmpkadnm.exe	86
PID 960 wrote to memory of 4308	960	Lkalplel.exe	87
PID 960 wrote to memory of 4308	960	Lkalplel.exe	87
PID 960 wrote to memory of 4308	960	Lkalplel.exe	87
PID 4308 wrote to memory of 4836	4308	Lnohlgep.exe	88
PID 4308 wrote to memory of 4836	4308	Lnohlgep.exe	88
PID 4308 wrote to memory of 4836	4308	Lnohlgep.exe	88
PID 4836 wrote to memory of 1604	4836	Lmbhgd32.exe	89
PID 4836 wrote to memory of 1604	4836	Lmbhgd32.exe	89
PID 4836 wrote to memory of 1604	4836	Lmbhgd32.exe	89
PID 1604 wrote to memory of 5012	1604	Lkchelci.exe	90
PID 1604 wrote to memory of 5012	1604	Lkchelci.exe	90
PID 1604 wrote to memory of 5012	1604	Lkchelci.exe	90
PID 5012 wrote to memory of 396	5012	Lqpamb32.exe	91
PID 5012 wrote to memory of 396	5012	Lqpamb32.exe	91
PID 5012 wrote to memory of 396	5012	Lqpamb32.exe	91
PID 396 wrote to memory of 2012	396	Lgjijmin.exe	93
PID 396 wrote to memory of 2012	396	Lgjijmin.exe	93
PID 396 wrote to memory of 2012	396	Lgjijmin.exe	93
PID 2012 wrote to memory of 4968	2012	Lmgabcge.exe	94
PID 2012 wrote to memory of 4968	2012	Lmgabcge.exe	94
PID 2012 wrote to memory of 4968	2012	Lmgabcge.exe	94
PID 4968 wrote to memory of 1372	4968	Lenicahg.exe	95
PID 4968 wrote to memory of 1372	4968	Lenicahg.exe	95
PID 4968 wrote to memory of 1372	4968	Lenicahg.exe	95
PID 1372 wrote to memory of 3104	1372	Mnfnlf32.exe	96
PID 1372 wrote to memory of 3104	1372	Mnfnlf32.exe	96
PID 1372 wrote to memory of 3104	1372	Mnfnlf32.exe	96
PID 3104 wrote to memory of 2016	3104	Mepfiq32.exe	97
PID 3104 wrote to memory of 2016	3104	Mepfiq32.exe	97
PID 3104 wrote to memory of 2016	3104	Mepfiq32.exe	97
PID 2016 wrote to memory of 1148	2016	Mkjnfkma.exe	98
PID 2016 wrote to memory of 1148	2016	Mkjnfkma.exe	98
PID 2016 wrote to memory of 1148	2016	Mkjnfkma.exe	98
PID 1148 wrote to memory of 216	1148	Maggnali.exe	99
PID 1148 wrote to memory of 216	1148	Maggnali.exe	99
PID 1148 wrote to memory of 216	1148	Maggnali.exe	99
PID 216 wrote to memory of 704	216	Mcecjmkl.exe	100
PID 216 wrote to memory of 704	216	Mcecjmkl.exe	100
PID 216 wrote to memory of 704	216	Mcecjmkl.exe	100
PID 704 wrote to memory of 936	704	Meepdp32.exe	101
PID 704 wrote to memory of 936	704	Meepdp32.exe	101
PID 704 wrote to memory of 936	704	Meepdp32.exe	101
PID 936 wrote to memory of 3388	936	Mkohaj32.exe	103
PID 936 wrote to memory of 3388	936	Mkohaj32.exe	103
PID 936 wrote to memory of 3388	936	Mkohaj32.exe	103
PID 3388 wrote to memory of 2464	3388	Mcjmel32.exe	104
PID 3388 wrote to memory of 2464	3388	Mcjmel32.exe	104
PID 3388 wrote to memory of 2464	3388	Mcjmel32.exe	104
PID 2464 wrote to memory of 3052	2464	Mjdebfnd.exe	105
PID 2464 wrote to memory of 3052	2464	Mjdebfnd.exe	105
PID 2464 wrote to memory of 3052	2464	Mjdebfnd.exe	105
PID 3052 wrote to memory of 4780	3052	Meiioonj.exe	106
PID 3052 wrote to memory of 4780	3052	Meiioonj.exe	106
PID 3052 wrote to memory of 4780	3052	Meiioonj.exe	106
PID 4780 wrote to memory of 3940	4780	Nlcalieg.exe	107
PID 4780 wrote to memory of 3940	4780	Nlcalieg.exe	107
PID 4780 wrote to memory of 3940	4780	Nlcalieg.exe	107
PID 3940 wrote to memory of 2688	3940	Nelfeo32.exe	108

C:\Users\Admin\AppData\Local\Temp\461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe
"C:\Users\Admin\AppData\Local\Temp\461a512503c2b847aeeab033173edfd253d85ebd509fd2ff77fbd2ad830120ec.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\Lmpkadnm.exe
  C:\Windows\system32\Lmpkadnm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\Lkalplel.exe
    C:\Windows\system32\Lkalplel.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Windows\SysWOW64\Lnohlgep.exe
      C:\Windows\system32\Lnohlgep.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        23⤵
        Executes dropped EXE
        
        PID:2688
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2148
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5024
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        27⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        28⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        29⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        30⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        31⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        32⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3320
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        34⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        35⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        37⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        38⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        39⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1764
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3316
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1412
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        44⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        46⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        48⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        52⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        53⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        54⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1424
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        58⤵
        Executes dropped EXE
        
        PID:3820
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        59⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        60⤵
        Executes dropped EXE
        
        PID:1388
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        62⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        66⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2028
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        69⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        70⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        71⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        73⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        74⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        75⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        76⤵
        Modifies registry class
        
        PID:60
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        77⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        78⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        79⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        80⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        81⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        82⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        83⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        84⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        86⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        88⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        89⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        91⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        93⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        94⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        95⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        97⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        101⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        102⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5496
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        105⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        107⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        109⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        110⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        112⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        113⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        114⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        116⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        117⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        119⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        120⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        121⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        124⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        125⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        126⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        128⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        129⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        130⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        132⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        134⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        135⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        136⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        137⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        138⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        139⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        140⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        143⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        144⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        145⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        146⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        147⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        148⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        149⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        150⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        151⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        152⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        154⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        155⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        156⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        157⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        158⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        159⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        160⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        161⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        162⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        163⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        164⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        165⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        167⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        168⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        169⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        171⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        172⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        173⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        174⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        176⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        178⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        179⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        180⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        181⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        183⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        184⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        185⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        186⤵
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        187⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        188⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        189⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        192⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        193⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        194⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        195⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        196⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        198⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        199⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        200⤵
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        201⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7476
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        204⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        205⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        206⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        207⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:7704
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        209⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        211⤵
        Drops file in System32 directory
        
        PID:7836
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        212⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7920
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        214⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        215⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        216⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        217⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        218⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        219⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        220⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        221⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        222⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        223⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        224⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        227⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        228⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        229⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        230⤵
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        231⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8020
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        233⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        234⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        235⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7484
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        238⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        239⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        240⤵
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        241⤵
        Drops file in System32 directory
        
        PID:8016
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        242⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        243⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        244⤵
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        246⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        247⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        248⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        250⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        251⤵
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        252⤵
        Drops file in System32 directory
        
        PID:8088
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        254⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        255⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        256⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        258⤵
        Drops file in System32 directory
        
        PID:7612
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:8208
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:8252
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8300
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        262⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        263⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        265⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        266⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:8560
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        268⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        269⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        270⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        271⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        272⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        273⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:8872
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        275⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        277⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        278⤵
        System Location Discovery: System Language Discovery
        
        PID:9048
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        279⤵
        Modifies registry class
        
        PID:9100
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9144
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        281⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        282⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        283⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        284⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        285⤵
        Drops file in System32 directory
        
        PID:8444
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        286⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        287⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        288⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        289⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        291⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        292⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        293⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        294⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        295⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        296⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        297⤵
        Drops file in System32 directory
        
        PID:9180
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        298⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        299⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        301⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        303⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        305⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        306⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        307⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        310⤵
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        311⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        312⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        313⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        314⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        315⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        316⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        318⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        319⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        320⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        321⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        322⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        323⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9200
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:9016
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        326⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        327⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        328⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        329⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        330⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        331⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        332⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        333⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        334⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        335⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        336⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        337⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        338⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        339⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        340⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        341⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        342⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        343⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        344⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        345⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        346⤵
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        347⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        348⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        349⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        350⤵
        Drops file in System32 directory
        
        PID:10236
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        351⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        352⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        353⤵
        Drops file in System32 directory
        
        PID:9420
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9488
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        355⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        356⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:9688
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        359⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        360⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        362⤵
        Modifies registry class
        
        PID:10024
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        363⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        364⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        365⤵
        Modifies registry class
        
        PID:10232
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        366⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        367⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        368⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        369⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        370⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        371⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        372⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9956
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        373⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        374⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        375⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        376⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        377⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        378⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        379⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        380⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        382⤵
        Drops file in System32 directory
        
        PID:9536
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        383⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        384⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:9712
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        387⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        388⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        389⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        390⤵
        System Location Discovery: System Language Discovery
        
        PID:8712
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        392⤵
        System Location Discovery: System Language Discovery
        
        PID:10272
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        393⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        394⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        395⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        396⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        397⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        398⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10584
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        400⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        401⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        402⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        403⤵
        Drops file in System32 directory
        
        PID:10764
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10808
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        405⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        406⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        407⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        408⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        409⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        410⤵
        Modifies registry class
        
        PID:11072
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        411⤵
        System Location Discovery: System Language Discovery
        
        PID:11116
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        412⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        413⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11248
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        415⤵
        Drops file in System32 directory
        
        PID:10280
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        416⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        417⤵
        Modifies registry class
        
        PID:10416
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        418⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        419⤵
        Drops file in System32 directory
        
        PID:10548
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        420⤵
        Modifies registry class
        
        PID:10568
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10664
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10728
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        423⤵
        Modifies registry class
        
        PID:10748
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        424⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        425⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        426⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        427⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        428⤵
        Drops file in System32 directory
        
        PID:11064
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        429⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        430⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        431⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        432⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        433⤵
        Modifies registry class
        
        PID:10344
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        434⤵
        System Location Discovery: System Language Discovery
        
        PID:10460
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        435⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        436⤵
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        437⤵
        System Location Discovery: System Language Discovery
        
        PID:10780
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        438⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11000
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        440⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        441⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        442⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        443⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10444
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        444⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10844
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        446⤵
        Modifies registry class
        
        PID:11020
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        447⤵
        Modifies registry class
        
        PID:11152
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        448⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        449⤵
        Drops file in System32 directory
        
        PID:10756
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        450⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        451⤵
        Drops file in System32 directory
        
        PID:10524
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        452⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:10992
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10324
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        455⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        456⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:11368
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        458⤵
        Modifies registry class
        
        PID:11404
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        459⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11476
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        461⤵
        Drops file in System32 directory
        
        PID:11516
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        462⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        463⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        464⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        465⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        466⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:11732
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        468⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        469⤵
        Drops file in System32 directory
        
        PID:11804
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        470⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        471⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        472⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        473⤵
        Drops file in System32 directory
        
        PID:11948
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        474⤵
        System Location Discovery: System Language Discovery
        
        PID:11988
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        475⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        476⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12096
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        478⤵
        Modifies registry class
        
        PID:12132
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        479⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        480⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        481⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        482⤵
        Drops file in System32 directory
        
        PID:12284
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        483⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        484⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        485⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        486⤵
        Drops file in System32 directory
        
        PID:11508
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        487⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        488⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        489⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        490⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        491⤵
        System Location Discovery: System Language Discovery
        
        PID:11828
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        492⤵
        Modifies registry class
        
        PID:11896
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        493⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        494⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12032 -s 400
        495⤵
        Program crash
        
        PID:12156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 12032 -ip 12032
1⤵
PID:12120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abmjqe32.exe

Filesize
69KB

MD5
1fc36f906087c3c2c5cac28762e504bc

SHA1
7a75e8fe20a97a2398c925e6dfdb3bdfae958b1d

SHA256
5e7959ebdce2b90f3a3c9dbe6cd24e04b403ac01498e2a55b1100ad1a4f5ad53

SHA512
5fe76816da8521fc2b079cc36cbb73d5dc69f1a83bb263d9f4a800a1bfb9f423bc289e26639bf0b1d101f1d31bb5da3be6fae7e3d1c62af295e1490235ced06f

Download Submit
C:\Windows\SysWOW64\Adikdfna.exe

Filesize
69KB

MD5
73487610d482f1afbd21f53709694eed

SHA1
013250da23bfa5a50676886c9d6ee9e5068378c8

SHA256
85263fe5cc4a7f06d125c7f0ca1835b03f5e3bef5535b0116de67041894d697a

SHA512
206ec4759c8b008a97acff419beb431de83245a60f505cff86a9ae6c83616b32175ea2ab29583716911364cfde4c5993fa6786a39b036aa6a2ac672f969c363f

Download Submit
C:\Windows\SysWOW64\Alelqb32.exe

Filesize
69KB

MD5
17cca28622fd3c235ed20d0d77a4e0bc

SHA1
8ed43d11713cdf18b162606767767e91ffea47f2

SHA256
44e2e4e6b5617211f5f779eca3fd8531328a996716dfd142aef1d82e68d78e9b

SHA512
ce1439f0123d547750dd0d7daf69d423033cbc340b1b29e79758e1fac56aa60f7a72463b18943ef0e50e764d52459306358173ad2e894ab277bb4d614094e194

Download Submit
C:\Windows\SysWOW64\Alpbecod.exe

Filesize
69KB

MD5
da11067a72576a15cbb67b0d7ba592c8

SHA1
9ec82610a219535128797a9e7005ba32de3b4d2f

SHA256
04785e8b680a953febacd62ebe10880360d86c2e851041925151a22179eb2618

SHA512
3dbe5c47dcb95e694192ba6cb2bb7bb2c3edad20e19fb6cb160e17d2756c8bdb02503d26c01d711ed207081229caa6cb991a7e3f27eaca925b1f6d6f9e35e378

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
69KB

MD5
ae3bd59921486dd216cd3780d3b9e399

SHA1
430a433e8de402210a5402a321f29150343576c7

SHA256
469110b05f965e17247706ec5a1db5ce0f246aa330d8a28f711f4d2ad90e909d

SHA512
cf3a90f5eaa6bdd6c1909a7b1ed6073f177232953382e8e3858a330a9e73d9f10b71f8814b908102b874535638b27684c2d1a2744d883c374cd7daa74bc2a930

Download Submit
C:\Windows\SysWOW64\Amikgpcc.exe

Filesize
69KB

MD5
1f52f6a0fb7630d53646ec897292d6f0

SHA1
b1808923a0297b9ffba54e5b633e3f9efc3e1c76

SHA256
2b52e3547509d89414c118cf428dbaddec7b4c5715eba1f483aab4fe19652eda

SHA512
08fb13ae36d9c1d022d41e4c517e30596bcfc14b7f6852cd0866e01795e756b6280a12b668a2d83315aac76419a5359497334188f6f1ab8441124e2094c1ba42

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
69KB

MD5
14875ff9c8353f35bf623d7f9a2595bf

SHA1
1d5c775d854dc480a9720b42a9ba7e1008a6b2be

SHA256
d7587450cfa6a67c98409e5f004f642fbbed7504140af30b5db93f88d93d67ca

SHA512
a9806c9f176376067a12b95f9d7808b7ffbd6bfe4a0c9bc09bfda306cea16a205da8dbc315599bf081bbd7596fafcb1bbc231d077ce34c1c60b34a0eab9c7482

Download Submit
C:\Windows\SysWOW64\Banjnm32.exe

Filesize
69KB

MD5
ea4821185d0ed9f44c6e7c323db9df4b

SHA1
055e1e788a2d1d8b85caa4a069f117df4240618d

SHA256
5a8699919cfdb8604794d852a6f4e4d88847738ed807daf041f0f1f723e9f7fd

SHA512
858f9bee175c1e616b9c4b45cdf7cf6a317df3ebcf3a505174d13ba7abd4c07da0d20b38814f4f7bf079365e59eaa0f3e1eae17d36ed72adc8d72e4552e74e98

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
69KB

MD5
56806a73b6fb44eec52bd1996e7834d7

SHA1
40114fab0c81c28ad5d566123651c13df3dc4182

SHA256
bbbdfb2cf94ed9f602093e08ddd7fe4f6ca4fe397e5515d863c48403079925ce

SHA512
6ed38e903d6535e29c61dd4d46ea050d24239332337bc3818c48bbcb7d096dbc4ef3576dfb467d9621b9818eb38bf7b5828de9ce070974357f8a7fa3e608e9b5

Download Submit
C:\Windows\SysWOW64\Bkmeha32.exe

Filesize
69KB

MD5
0b37fd6e123e41515c5f27a044b29c4a

SHA1
aff968ace723c7c6f04ad58074458bcf950d4c33

SHA256
c138d252c54094f18614b8733df38b71163802d7e36cb82934a7f270922a0794

SHA512
740f2fe8535dfe9fe324ca10787596d3c4003f8e529058b2681de61218ba12ecbc903045c72bb597551461fcaeea440a855bc788b365da2958924b357bb0db9c

Download Submit
C:\Windows\SysWOW64\Cibain32.exe

Filesize
69KB

MD5
7116950a38889d607e0a66452ca53aaf

SHA1
8b326d6e70babdbc4ab79aa2e101aa4c0a41a8e2

SHA256
04ad025fd4f702bc2d4e3c5394af12c0ad94f61316d3fd36f0e82ba8e6ec7520

SHA512
097be250a15978337e05d8893dc75ef91d99ede6d4ca95682746d986abf3f7608ce8b1489e1dba4c18bf8887d86c49ebf32e8b516ab1b0c514c27acd21f3785d

Download Submit
C:\Windows\SysWOW64\Clchbqoo.exe

Filesize
69KB

MD5
5b2ead3be78542126eeac58b60c71455

SHA1
0f664c8cb30d900a4b714692aff36cb365090721

SHA256
b7073956d24d77697f65cb854619458891187e0483870fbdb1ccca39a31a5188

SHA512
e5eeb1064d9dba78032166d4cab00e2100db22af1827a91ecd6f9cdd03089427c596642360820e5c8618d7da7e91d8bbaa7a65fd202b33fd3dbc4f7f89e97d2b

Download Submit
C:\Windows\SysWOW64\Cmedjl32.exe

Filesize
69KB

MD5
faaf76454d2348470230d0648f61dff0

SHA1
2d90869bb697f69b20f8d7a63aae0834b092ced7

SHA256
6d5f5cfe895c4455dacd63726fe2c10bf5581e89bdb9d3e1b905905f79cb4fa8

SHA512
c080bbdfc3f84531b79133665a4c4991e664b46b427c04cadbbde47591b8bfb4a70caf7e5585492cfff749d179140d50ee872f969dc9683526cd14cc557f03ec

Download Submit
C:\Windows\SysWOW64\Cnhgjaml.exe

Filesize
69KB

MD5
35daf6f06d4131ab9598baf2930ad9cc

SHA1
d621d5da60185e654f7a02bde7261d6742cd5011

SHA256
f03b28809baf74b53b3bb71ce223109d0b933f53f3ec46c161929bf66ab0e077

SHA512
45ba5815647f677224b648558c3a836f682e80fdb19c59be0c38fbe71707b7a290066f4b0992d42c1e0e4a149184870ed10a9429db51e2b39e248e8a44bf4821

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
69KB

MD5
e66ca3b56ce16135a43c83d97208eff5

SHA1
3067a62cf5e6c3a4fcd090ed2e10ae847c3a500e

SHA256
796569ba4d669defb62f0a1fabff6f887a8b08c910f15a89bb69a5893df24549

SHA512
2b5ca7798cf18cf964a4dc36d6d33673ce7167795cbd6e3521d050d86ddbec6f0befb48e0ab6a646dca6f804296a76f239b3c5aa51774bfea29b9a642d9656de

Download Submit
C:\Windows\SysWOW64\Dgbanq32.exe

Filesize
69KB

MD5
92a52c7eb3b137fa540b2b669b26a863

SHA1
b32ce55c40f467d055bf719506d7aeab52e7081f

SHA256
3a9f6481f443e0777191c60640743f24a46cf938ba65085b6200ed6cf8863bda

SHA512
7dd5db4525b624ec8da73489afbd0be74b564144b0b490e30a945ae584a2a55e32fd58964b145bcd9dc3c457ea8580815c5a0815cb31815ac00bb38e7fc719c3

Download Submit
C:\Windows\SysWOW64\Dgeenfog.exe

Filesize
69KB

MD5
e2868944a4309198f183bbec0d9d7087

SHA1
f3297dccafb1bf597e744d9d5f5e55ffd3c10dc0

SHA256
5168d7cde4e913882999e6c7e04294484ca4437e7afb3e24c9df09220f04c65e

SHA512
b21af1dbc1e5c9ccdef8bb9f6ec240d5a67255b45f80037d62d2042803f3bb537416820c1cf63e5e2081ff9dd6e4e8f062e9b59312814f756a2b4218d9cfbf26

Download Submit
C:\Windows\SysWOW64\Dhikci32.exe

Filesize
69KB

MD5
d9512420ae7d4c1bd960edf1c323cc06

SHA1
1161ab56c7bdd70123a7ef19f72f1d4280fd248e

SHA256
85eec2402a7b04a84e78fb3376afc4abe8e9fa351008a0670267685b9594ec03

SHA512
08a5e918c7767aca6d7a2cd21349425fa46e3ec71763c37c12e8ad556cccbe253884c3bc6788358459b0e13b6d34cba42626ffedf21c7cc239f2c5467a920fb2

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
69KB

MD5
e0ba0b94057775d891f67bf8d11c4dff

SHA1
40634790948b9450d8a017762c01cf95a5974a2d

SHA256
4c65a20c67414b45bc49d65cb7c7ce0c2f4c66d1897ea67ebd93aebcf1c0e2d6

SHA512
9aa811cf1ab61d5035b84bf7fe9ab9c901d23aa9937bc02713ca3ebfc71be822453cbab531da4eaa94ee9b6f759416307b88257057749b943083c679eaa9f511

Download Submit
C:\Windows\SysWOW64\Dnajppda.exe

Filesize
69KB

MD5
98ae89ab13dff9e51425bf9c7a8e26cc

SHA1
b6d7ebee5a7c454edbc977b5734e00ff1d963703

SHA256
e15d9be09be8a68e7aee049a84b25a2b0b8021dc1a41ccb6010f38af47ab1223

SHA512
4f596bb02bb02981ce3bcff20c4a319cf39be5d79745d1194facc9553b3c236979c6de059c1c819c38eb76ee04f6e8b72c3bc9aa71c0b00268942e007cdb50de

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
69KB

MD5
e475915bdf070b09ca76bcf67a5a0a7e

SHA1
a21a5f66e36c1997e0123c0adcb0a7b4960a9828

SHA256
a0c2cd6cf6a47964112da3e32f452d199458dc349312af285a14c4a32977ab03

SHA512
77b649a06b4b8194db2e6cd10c316a23b635bd6bd4179531f1c9e508f52a03652d25dd698d35cc10036dcabfdb93d349e78ae54755a7a3eeae599bc56c515952

Download Submit
C:\Windows\SysWOW64\Ebgpad32.exe

Filesize
69KB

MD5
28b5b497953e7eeefd9ca4825d143fa3

SHA1
169b07cfb254a5c84ca97f2743f7d5cd475b26f4

SHA256
0d671ced499234e5f7a0ec5c62ef36452378376263e8ad5afcbd7297a5666cbb

SHA512
88f8cfb489e71f061a52a57ee026e5c0c5f8398487dd8bf860e7bdc454de85038084312a87cf851afe965dfb4268b529314d5adde219cfc665b05083cec53e0d

Download Submit
C:\Windows\SysWOW64\Eghkjdoa.exe

Filesize
69KB

MD5
ba57d9de5228211ad5cc52915b4fbd6e

SHA1
a7f63da616ddac77e39d11617dc29e207c034cc2

SHA256
71713ae118f98d661f43b92e26c6aa582eab9a50550da20c85db7f1c8f1d4728

SHA512
ed91414fbcb76e7a00080b6b6607a9cea9520e13deabd0773d73cf4ecce1c163ec48c1034e510651f7d5f4c293a18f509adeeea13b3e029abaeea8df1c8ea59f

Download Submit
C:\Windows\SysWOW64\Fajbjh32.exe

Filesize
69KB

MD5
4c88d947689f284351e74009873f0228

SHA1
5cbcf2ec6cf2770f89701876e1ba5281ba19647f

SHA256
a2eeebbb94fb12e6f007f7f5b3564599192ec79545a7dc7e55ada36447e3cd64

SHA512
f3a772a4dbc251680519d9ba1a236a207d9830efcf98899690ff5a7304fb11ac8fe1ebc5e05312e0d8e920dac320dd4b1699e5ccd73116f8913ab1920597cc4d

Download Submit
C:\Windows\SysWOW64\Felbnn32.exe

Filesize
69KB

MD5
194f833be95317dd43d16c427586ca7d

SHA1
a193baaf098e2f1e7defc1809ff11be203664fb1

SHA256
f7510135c635e5738f9a9b9bc7696a378f6d5a143c5d149f221aa51eb624b17d

SHA512
bbc07fff140225999349322f2905674efb6d6a5f4076599a37b3c62ed098b63e7e07caef02fa6a0e3aa836a05f963a7cbfe23f7b45c7b01705abd6a3d4d39c3c

Download Submit
C:\Windows\SysWOW64\Fiodpl32.exe

Filesize
69KB

MD5
89131a77e940cb7cc2f3f6ece8662305

SHA1
2e892de4342e92a9b968b36c5dfa554806656e57

SHA256
2f0ff553fe9b84761bf9a7e2b3a2beaec5de997a5b98a7c96304e7d8618b2a82

SHA512
d9d3f190eb160a5971952b66e01941c5f2a555c4375ecb93361850f2a1acc06d4d80716f18a89b4918dbb76fa39c8f61dfedb542bf9dee2431351edb5ec4e5fe

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
69KB

MD5
1a16210249882e90e1e0645fc284bd6d

SHA1
1a3ed0e2d097ca59932a8b68c00fab8f85e9ed63

SHA256
d8e1e2daabd81d0e8d6cd3ba0df85c176a260c93e6ba10fba4850f08ba4d1d54

SHA512
193bc623b49fc29a1241a3feabe16743024da065c091551636fadb8f94b3743cc44a882929d6b3cccb6a99bd3341f7098d87ca5f958c583ee59c534703af0dda

Download Submit
C:\Windows\SysWOW64\Fqbliicp.exe

Filesize
69KB

MD5
8b9a3035de890a99a84933607c676c57

SHA1
420ecdd50b9864115d29d6ff9a4119d8ef3bab7a

SHA256
32a57d3d3a62cbaf9310a1b0c666a351038ee99b0a15ffffaa60d901922777b9

SHA512
27539eb9ff3d7a33d0118748c3773863003e94fe6fce2a76ae374dcc76e9da1a18bae7a3f77162fe7416927832cad0d098fd8a5aaa323bd0d7ca67aca62cabdc

Download Submit
C:\Windows\SysWOW64\Gijmad32.exe

Filesize
69KB

MD5
91a37223a42c856f1f8ff62a6c6c5bfd

SHA1
d26c7303fc6a1d4cd0c7eef159e114ef4b948b31

SHA256
f7ec17e90346d75eb5b922de44b8f8cda426c399ee092eea9cca2efc94cb055d

SHA512
705b798c6e67a3e29614d921148e8ef5aa7daa519ff10a730478b62f57d86bd2b1ab4b9340569e16b7d9c5207aded5fee23dce96e7a1dfb326486e2548f318fb

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
69KB

MD5
24ca4dbd9e7163012a0658b06b8ef580

SHA1
16fcf74d9a19af6816cac0629734bedc4e6642ea

SHA256
fb06bd6b2fbe75f11cdb70a4f97377c9dbfd79f4d2266b013a284b066cac1eb1

SHA512
a70824217bad400655483b960e6f1e54dc47144afe9c228f5efd8241238d719a470957126618cfb7229c172e8f1ea6913cf024128c734109025d0e34ab321fac

Download Submit
C:\Windows\SysWOW64\Gpmomo32.exe

Filesize
69KB

MD5
dd1a2b4fced31456fa08a59fbc6c4952

SHA1
ce3cc09f8788ab9b0a7615472ec6ccf70f303148

SHA256
aef32a26b7844eb7893f42245d554d574148c5060ace3633f29855a13ef3274d

SHA512
d45bb983060417631f63c40b1d16389533d278aac92fc4610317f2815a4d6143e67eb9d4596405dc3a799cd2ecd746107d961bd55c14a6dacc571856732a4809

Download Submit
C:\Windows\SysWOW64\Hbenoi32.exe

Filesize
69KB

MD5
7ca1a554685ea0a8ad964179f01068bb

SHA1
a45c89314a925e043bbda05328f478d622798179

SHA256
959c0bb4a166275e2f0416914f8ae47045fad22fd56ea1c0d0c184be0241c3f9

SHA512
405b08251be0214ecf7953563c876055002e4ce6071c9e19ac1ea0647cddb617117f1ae646d19c2d6bc4d7f10f3f8c53d3e84a0f46f8b05610fb127cc59392da

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
69KB

MD5
c512ec9473085c8eb20e27f5c42c9c91

SHA1
a6bc57be951d1d9052baeb7114316df360bdd5fe

SHA256
3bd7f670eb4f7ad756bc6a4f142471c8951023f5389235ff3fd036b0f953465a

SHA512
c4ab05b123fe7961d49cb386481467616fbbc6ee2164df7b5b0f2b278bd213e95f0f558b8c88446cae4c837adf0cdc9047e6a2d47e5f3d71340b7cf9b7987279

Download Submit
C:\Windows\SysWOW64\Hlglidlo.exe

Filesize
69KB

MD5
21647ce787bd149e7769c81f6b6e1385

SHA1
e1987661c957d938e271069040576522fbef6caf

SHA256
44fc8e294e79823c491329454ceafd3693daa41d5807f1c65bc30297a68898e7

SHA512
32a6f67f904321945bd46270af10f428526675f8223f28cf47c5b1aad2d19d395ed23db77f09aec38812500dfce803b8c30f682c40fc4b45aaf3f2c624299f34

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
69KB

MD5
c6bf207f8f7644b58eb4b9ba3e185b37

SHA1
38338f0e99dfe8a8ce5d865a1c1c5bcd829f6b93

SHA256
d56d6a08a7e491c0f7e5e8f301a01396aa2a2d9b77705383e649a7bc34b03855

SHA512
9a170d99b2be0cd785e956742f46d26ab13104e4a3f4f451d968b28aa5787417cc4fc867c4d0bd9b2511a07714ae42e47ae7b15179a1f67591c6001899ff8d24

Download Submit
C:\Windows\SysWOW64\Hnnljj32.exe

Filesize
69KB

MD5
3c6370d0976427222ad50e04daf7822b

SHA1
29ef0df5dedfa5dd703f8dc30c992df2f920a02a

SHA256
24cd69e51f953a898affe786f235ba168fc01a27b916f07958ff7ddc02f932bf

SHA512
a6ddc387ce42047ef61d17d84c3dd66cd03542dcca9cef6b207242d006ac043063b7b47dbb55b57e43f30784463d94bbff18d9771dc8c5138f6458916a83de8f

Download Submit
C:\Windows\SysWOW64\Iefphb32.exe

Filesize
69KB

MD5
7b4c490c0e384e5d3a6fd32d9a82b62a

SHA1
5275d1c1124dba60e17f6b77e8ba4c3e5ab14b4c

SHA256
b35ad8d040faf89095dee408de7f3cfb9f0d9d32f9bf5daf0e706049545dba0f

SHA512
4165f7d47fd72649ae266ccd7398337ba18591af5a84dd8b520e7fe5448cdc6a756716dbf78f632720324243c59d9aeb437b463c0635451c2f4e9e60e78cc217

Download Submit
C:\Windows\SysWOW64\Iehmmb32.exe

Filesize
69KB

MD5
b1a2910ec0d6f7b514ba84b354996f7c

SHA1
015a3ea96e30511e78437b283da968782303bcb6

SHA256
cbc2f5b49a5fa3ad5c601238e607546a9fcea5663c89b49596f6f870b5d35473

SHA512
672476ddc05b2d6c2cf3b8d6651352df568ea0a53d082563e7bbabad65afd879491b1bbfd535095701c999744c0f9df399e056132a64ba14f3f9342da1fc764e

Download Submit
C:\Windows\SysWOW64\Iimcma32.exe

Filesize
69KB

MD5
c031acea0842757a99c2ceb5fd865494

SHA1
8ae0596cdd871e1658fea536d7bcb63db54ca2df

SHA256
a92321f10692e5b1e0a01477322abcee37ef3e56313fae8f8e00ee9e2b5536b4

SHA512
3587d96608b6c71fcdb6a7806d1124fe9a733c9b310a39aad89cd3dd59b6d39a54ec8bf7c2dabb28b6e32d0e7baff62b42a7d0086b823736a654e9115654b36d

Download Submit
C:\Windows\SysWOW64\Iojbpo32.exe

Filesize
69KB

MD5
8d743ae7858036b33c4385bf7fe27e2a

SHA1
8bb47c1c4ac331e033e6205ed8c06f1dbeab3b8f

SHA256
fb6511403e9f367cccca4cd7d5cdb2f7578ccf933ce637cb7ef890a358824ae0

SHA512
2b3f6a40dff5d75e4f6d6ac99d95ca4363b2397a7d9e5cba6358847fff14c2ca7464000f534c8742374550f308d397347d4bfee4dd72f702c404b7fe9084b15b

Download Submit
C:\Windows\SysWOW64\Jeocna32.exe

Filesize
64KB

MD5
b3ea41005fae1fc48b81c4aac4a37483

SHA1
9874b2597b6f28c0cf37b2fdd0eaccd80843a0b1

SHA256
87d279b6e7bec9d898917e942ce1ebb139ec82c01dedca5111fcc0ac84950a9a

SHA512
3d3fd531aa1b18329ffc3cbc458c71bbc625a6502cc2c7187d52ff45fe151640863e7333be689ba2e476a31686b16cfc95a8bc68e970e9ceedc4bc140054ec38

Download Submit
C:\Windows\SysWOW64\Jldbpl32.exe

Filesize
69KB

MD5
57dcbc78558d5fa45095a3e8f5eaba59

SHA1
bc1bad28ca01bdc864066536499f52bd204272a6

SHA256
8254bfd708f4f987af42f50cbb5b8c98e805c3dcaa979d1af07f5f1bfc4d11ca

SHA512
39ea6a35ae204af716987b40da05b0ec30b094550bc3810975b7899703c091cd751cf73dab1581f95aa863f862dbd44496098081da29ca7dc53b06e6c599dd80

Download Submit
C:\Windows\SysWOW64\Jocefm32.exe

Filesize
69KB

MD5
b505fbf936f795ffa26ce063b35a5218

SHA1
c0b42fd60aa7b8032ecd40bb71955705654d6052

SHA256
ae2f4880f484eb6e1923b11163da604a523486f77fdbf2d8e9bf0f02495495b5

SHA512
308d5259f677bd46053abaf7263393508738c2f1165ba282fb1ae71c90cf4ccc37ef9d84d9d77441bacf7e01c7f71e12810ad6dded02e74a0de2597aeb044c99

Download Submit
C:\Windows\SysWOW64\Jojdlfeo.exe

Filesize
69KB

MD5
8251cd56762cdfdf1c0af7b0371ef45f

SHA1
bc07be2508d25409a8dcdab4717643c16b225d0e

SHA256
de732a56468beab38d8871f82ce4872e71e4d0f3a74c1f4d4260065346daac13

SHA512
d88e03886b2470b592d52caf000f9cb46ac857a2bc90b1da3d444b5e6ac5fcb43d587d14d371f2b7a42f2e370976e9a01af3648ddbad6af603203a00e42fa906

Download Submit
C:\Windows\SysWOW64\Jpenfp32.exe

Filesize
69KB

MD5
52822e60f04dd943d91601900062c449

SHA1
7ae3339f129e69daf0dec6239a0d949ab9cdfae4

SHA256
4ce4e9c2028655b502511f9feea46c919cc1616263ea19a2b54a416850572352

SHA512
e8d6d84980b9a342be6542229c8d7b54f921e43354aee79e15f0d6887d3efe7e184bdce84c4358a6f0f4b053c32ecfd7a31e5ddca9e31fbce52401b1bbdeff55

Download Submit
C:\Windows\SysWOW64\Kakmna32.exe

Filesize
69KB

MD5
c634373c56e5e4ad5e4a366f80196030

SHA1
b5e16692d82769513abd8527cc3cdb320870c63b

SHA256
d28614f713d65d2797b98030b75a901d96cb84855d325f44648d15e9afd552f6

SHA512
8ddc59db8ecfa26ad6fa374652dd84abe670c0e5fe62fd85507481f50f76c759c7e68e8190d0b885c9cea754cd3c3a35e6ca6add3821658c35e0bd28afceb2d5

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
69KB

MD5
ae0a9c69324346da83cb3fcaea650b9f

SHA1
3961f615aed7ecd2745b23b8f988c0d66d3fbece

SHA256
f81fc1969ca6d975fa513e28703a4f23f7d1b2c4df36127e558bb1153d81266e

SHA512
12684f2dc5c227aed8cae9c6127d1ceb958a3c753ccbb2737d2c7b47d3800650a088ec7de25aa88c2407a5b249471125bb4f051f310fd7491942b98af8330200

Download Submit
C:\Windows\SysWOW64\Kngkqbgl.exe

Filesize
69KB

MD5
3decdde097ff27906c41aab97530a86a

SHA1
e838b99240002c9d347fda07d86653a7a68466e2

SHA256
f10c13b6551f9cd96dc28bf10a8c45843ac7e74a453b6cbdaae0652a690b5096

SHA512
11ee922764d690321db8f36fe126165d5ba986053683dcc1638c6f2c5c09424df86597c0064a3d190a1e19011a809c1a4f721e85919909bb359a342c8fb8f413

Download Submit
C:\Windows\SysWOW64\Kocgbend.exe

Filesize
69KB

MD5
4bfc13f5f05184506c3ad908701e01fd

SHA1
12f0462e19eabf93bf2961d9a87035a588b9ced6

SHA256
805125884ca4988ad871905dc1c49eaa395f57adc072b3bfd4405264a69d7b6e

SHA512
d5ff26ec72aa2312b4d67ef73b948b66560bdfba34e8d3e37a744ffa91ab9ffa1bfce5572e983870650e4b6c92e641f7e9c4a918d38fe4f77a52f287dbf9407b

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
69KB

MD5
bbfc52dc7b96ce2c543e7b4bfe37a320

SHA1
fa3a247e10ea8210c663d0a2219403e761b2d684

SHA256
c9f142dabb36c65ca419cc2c7b418eb466cedc04b9210e6c0bc7aa95ab306776

SHA512
888ceed1dcd339fc357521c2e10d87e6c09387974fcce683fdca51366c89c670c6949c46b57f7a5f22796dad2c34e23623dde4be0c2919dbdae8e36080f6e741

Download Submit
C:\Windows\SysWOW64\Kpnjah32.exe

Filesize
69KB

MD5
8691c38a605a863f5a619dc6e69e1de9

SHA1
b628169958c4ce64ed6a7722d450596cfa8f26b8

SHA256
c2fdbf4d34dee91e8de11258d081b33c540f3fb93650c8f7c7c5b76445d42a48

SHA512
b9b803d22962c6e0fdbd8496e48e1edd1c892995b0a5c1ab324afe6cf2acf2ebdc6f40b5bd91e6e16b3cadc8fbf9d7bcb421ae5c9aceb2e661904e367f278e5e

Download Submit
C:\Windows\SysWOW64\Laiipofp.exe

Filesize
69KB

MD5
42b6ad6063bba8bfc7921c178b587b51

SHA1
095fefc0d4f6c080324d60d600fd3f0ed70aaadd

SHA256
e08355993a25c21620ebd18be56db55ca1382053b3240b2b23800ab4365af1f8

SHA512
26bda260be379abb25ee9966f7ea9afaf9f449e9b24613511e7b8ebd770c7b2a7aed58b634c692d96947b7192f530d7ac7395ad033784f4a7e65dd909b4161b4

Download Submit
C:\Windows\SysWOW64\Lchfib32.exe

Filesize
69KB

MD5
93f0345864159971063e1a458c07f58e

SHA1
59212ed97f415a3476f73655c6b1920df87c539c

SHA256
f568e61f0e30acbfc6ecc47240fe533630bf7b42c77cdafaa4358b0c7f52c7ea

SHA512
d5ce2347e4cc7f3b2870cd8ef8eac3695a033d3f0fffc01fac7f5dfb28937279a3f174c2bbf6475199da1f4323756f665f04d0f540017b295670f6356c1815fd

Download Submit
C:\Windows\SysWOW64\Lenicahg.exe

Filesize
69KB

MD5
a1b79740964ee1d771aaeadc85cdc302

SHA1
e27a3790ccdf3268fae4aa8b9870b617ff607aaa

SHA256
8955b55ec16dc7f6026961cd3a4ca748ced23850d9116a1e85fe2775dc51e866

SHA512
5385aab89dfc171be1957875aacbececaa805712e426cb36becfc3988564c9a1e036f3e7a12cf8ae7c6062e86373295b893be3ce1caf7758c6d8cb0849776bab

Download Submit
C:\Windows\SysWOW64\Lgdidgjg.exe

Filesize
69KB

MD5
151c6e09948cc039d5bf3df03a02d61c

SHA1
40540cd5cfd3e49cf61a425a329b8903eb666259

SHA256
65d37afa87fee6814d5b59eb8a5f6c0fd884768902fd33ce6d337c3ca432702b

SHA512
a40ba9629dc8e04dc54a96a899c58ece8282e314b16ce97390cd77b0194a072f500572824b887f64441b0a5904383d4369fe7cd238a3bcbfded35bd641856765

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
69KB

MD5
ec7f063b74241e2e7518119348db8786

SHA1
42bdbbcc8d6aab9a1779aab40ccda00c32a3e1b2

SHA256
e8d5c15a348df055347cfddcd2086fcf6dc315d77121efd37ff0c6971b7b8fb8

SHA512
39217b3403b40bcb332ae8b02e5382d982337b362cee2fc7e0c16257db255ebfb3e7456d9d7c43d421802740aac4c9999fd83ad35e52469392d2e62d198e61bc

Download Submit
C:\Windows\SysWOW64\Lindkm32.exe

Filesize
69KB

MD5
b696975fc8f7ff64d8d2372b43e3a517

SHA1
74fe192c7885d2f80e05b525383421f5cbc1a37a

SHA256
adb04a74916dc4939e27eed78cd9c4d954b3a85d6babc98bbbeba854771b5e1a

SHA512
7bd32de9c6a05ca454ed7f0004428a34ad2bbf13282530538fc11405ef6ac5cb7b3ec82d498cd1ff3451d0981d738f74ce77c97816a9d5308270e4d706295d46

Download Submit
C:\Windows\SysWOW64\Lkalplel.exe

Filesize
69KB

MD5
bab5828033209fcb12cf0628aef8e9dc

SHA1
c15bd11076d8d055233b5cdd56b7775d052dc905

SHA256
1e1ec4e103b6125384372b4323b2e2adfe6d8925f9ba601e1aef145653956ca5

SHA512
0010f75b164f52799caeaaa582a53ed4e30c267aec6f1672cd5c7cb8832d00a63f83ba7a2edb766d8445ebaa0e81b3c8f50c2305a05dd41ffeeeaf1ba4173c36

Download Submit
C:\Windows\SysWOW64\Lkchelci.exe

Filesize
69KB

MD5
86e623d87ad5376fef345eb97fdbb6f2

SHA1
22d5740580805fb66115edcffdc30ab8291afa1d

SHA256
9884af2eee5b71d349d194448f92e784eb9c090882fc08d473591a8b07a89ee1

SHA512
9121888f2a73d16fc776a06f5961180f0c4c19d07ebad9869ac61478611c613f4bfc2d0509ced598d89da7e25b5aec3f5a45a75a5292ee3e0ce3e895a4d96252

Download Submit
C:\Windows\SysWOW64\Lmbhgd32.exe

Filesize
69KB

MD5
b1e405eca0f1c656f86701fb4ad880df

SHA1
116c5998195c82df32f15b1d95353630d9725b0c

SHA256
1feb210c69246c2e400a177de0eb2b9fe82eb5666312f93d8eb7e55699824835

SHA512
a94d6863b3ed1fa058a3e4adc06e5ba2c9a157ce94415b6bcee0901dd3738537030efff4ed47a98b280f703305ad457bda9923d21e417f709493398f35f2e43f

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
69KB

MD5
f13766d73e4d5cf0d99436149f2d1aea

SHA1
268723f3cfd73148afbfab4381b4fc4899703e16

SHA256
16cd5578922d3b18d75f59d1cf2c7587ad061634fd0cb26833b638a23af258b4

SHA512
c594b06b950d96391d43dcba199c841baa919b0fbe12b465b920381930a1c050a1c51631a41725b6cac7130ed1a90160837224d553aaa60067154fcadfcfff97

Download Submit
C:\Windows\SysWOW64\Lmpkadnm.exe

Filesize
69KB

MD5
c76afa2f16333dd20feb7367ea67295c

SHA1
98ab38719942523f2bf22aac7d835761d24f4ace

SHA256
fc47da29a429bb370bb0849f2b8b1764cd2b208f091f52af47c99fa900de0cbc

SHA512
9045afed9640acd80f20a8da4bb45bbc06f046b45301e782971f275cdfce26a52537a1b05c2ad296be6ffcee371cde1c4bcab915a3822df75ca4759725c7012a

Download Submit
C:\Windows\SysWOW64\Lnohlgep.exe

Filesize
69KB

MD5
e927cdcd317aac2fbebbfb3818890c16

SHA1
c4c93b65624a5893e0ca901059e611e1a00dc609

SHA256
1f938d65088afe6bdb790fe5470ed0fa9f3bf36c7d699635fee7039bfe2e1416

SHA512
f5afcef1e878b3c330ceb7816e9ac396476b889261619b2905d4e908ac5435f44cd3754f107031ce0bf03e371fcf1ece9f07d3d25e3b951cc7fe2ea66ff07d91

Download Submit
C:\Windows\SysWOW64\Lplfcf32.exe

Filesize
69KB

MD5
c7fb085d2f68704fa04f786b4935eba0

SHA1
ab6aef1d99739533f58d23d4993929b99ee84c5a

SHA256
f4aebceb75c18ee14f7ba80b8b7a7740e1126d535df5fb3730d37c7a9d40075a

SHA512
f57d3cadbe63f9ca30ffbffcfc27ce811666fddfb550ad4979ce15fd8bef41e087e71cf94bcd5824630a2b0188100112cf2d441d568f2f4ae662152c44d3a7e4

Download Submit
C:\Windows\SysWOW64\Lqpamb32.exe

Filesize
69KB

MD5
52aff2f5ba5cb823b968975637c8bf76

SHA1
461635a3471264eec0c4dceae2b936f9a91dc169

SHA256
4b89ac3de285aeed292c17cedac003854388e3df58c86987b41fa8c0998a207b

SHA512
881dc808db2d3b95d0c83a3a3b73d630b736ad39dfa2c762b7bc879ad77a61d00bfc62862cfc38da00944416f182de4ebf164d8286574d78721bff38593a2e89

Download Submit
C:\Windows\SysWOW64\Maggnali.exe

Filesize
69KB

MD5
e9116d37a882dc67f90af5ff032cde5f

SHA1
27a80d00b161e9518e02b6c285eed7007391a530

SHA256
87d86f241bc80d53453dc12fe241a4fb3db38e784bb486ea3dde4225ba7a5b8e

SHA512
709ff4fa02524c758256ec40a2d4a9d23be17392c3b326eb21b290ecf326b12b0a231c442522922ecd845301404ea6b4273d3b1e2db93a1734726da4ee396049

Download Submit
C:\Windows\SysWOW64\Mcecjmkl.exe

Filesize
69KB

MD5
b708c02021633106ea90019c6709276f

SHA1
081e5efa32a60a69af8b8c89301a580c44f16f26

SHA256
65e3fc92196730e734ef5616cf9d4f347be10602e8163ec430bcba418207d2fa

SHA512
5e51f1ae291fa40e50a4893b3f4e9683f79f2681543d1a7a3a290b34da16041ace97a02802e92aa9c324376c3e007944cf3f4523dbe1ccd7ddabffd2e86c9292

Download Submit
C:\Windows\SysWOW64\Mcjmel32.exe

Filesize
69KB

MD5
8322771a6844a75e8c894620acee7f4b

SHA1
a3952f788f794dca8f061a03656d46e80a5980f9

SHA256
7c5ea9a8fa45302dd7d774752cb0141000a3841b67093cd6f90bb9768278ba4b

SHA512
ac00ccc395145b8a244fcf380f55ddcf714e9ab3006afed36b56bf6d9606146e8ed59bfdede936886d6e20aa55e7ac0b4fc253449d0958970f88d263ee644fc0

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
69KB

MD5
f8249e0977d063dc5bb9ce46c7b44361

SHA1
0ab1f7d2feb136d88fb9500ef983efe0c40b832c

SHA256
b4c91a3b32ce143e9828369ee99d96f25dc45a2cc908b5cf1416bdf928012b1a

SHA512
9fae807e04de8307a06e3fcd10cc2e3241037d1967add1a041dcf6d66ce54d235a3336b630fa9616b403ff0a4abdeed75809c8c9f3ec125fdb9a220ee768246c

Download Submit
C:\Windows\SysWOW64\Meiioonj.exe

Filesize
69KB

MD5
23b9bbb1722c1159f034b8315d4b566f

SHA1
9cd5ec8fb03b85c4ebf40f54d3f06231171b6bfe

SHA256
3fd0aa9c293068e747887c0fef3bf87d59b8212960339fdf655343f4f574f621

SHA512
76890bbd5df6139ea5f56b1490f0ae7d796b8dc9a1e3c841e268f8da9ca591b57a46fd53e3f15530c0a220819b5929a5bc2cbd1507ec928c52e099740c86ad3c

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
69KB

MD5
6bddddc43b58e22f1d4299988620f481

SHA1
774cefc556cafaf73e6a9de091bb61109806a317

SHA256
d8129d7023e56fa3177e452fff86595eea7bc0ffcc4b6a3a2f635dd42c375534

SHA512
25e3887dbe5bedb3ee9fc52c698acf7ecc980feeecbe91172b5f87e91b9906d09189a9e6f86d0b711a28f83774483b8cd19951a92d23e91aedc1e4ea33565ff4

Download Submit
C:\Windows\SysWOW64\Mfbaalbi.exe

Filesize
69KB

MD5
b83c7d028e7132e4be8e75ecfe2eda36

SHA1
858085d7c5e305a304cd6ae8ccfc14dd931f0f55

SHA256
5514a3149ea94733c38e211d785f0fc0aa508e030564b90a2ea7ca38fbdb5c49

SHA512
596a013e62cf8b8f973b78c59697924733af1a65ba48c96ee5f77770d5a5be7347f40706641f830b15f5c0747af103cf05de28f659a98a68292e3fa0e35563c8

Download Submit
C:\Windows\SysWOW64\Mjdebfnd.exe

Filesize
69KB

MD5
188638d6bff6a30ea203dd710694c918

SHA1
164f2f981cf171fcbcd5c3a876afe2135418dc53

SHA256
b1394fb707315d6534bdb44be223da19515b7c86ed68cd6c7f76b4f3b72328b7

SHA512
ba1e99ad8a59db837a4b71ca4587051a50f0daa221609ff0476fad3c479dd96309d9ea9be65be44eafc24f0e524185463dd877c6786efc996c3515d4a12d3afb

Download Submit
C:\Windows\SysWOW64\Mjlhgaqp.exe

Filesize
69KB

MD5
d19c155e5161e97a1c50f139af7e0fa4

SHA1
859abfc183dccd1f9e3a48c99f35a606de77ce61

SHA256
117ee00e4c23c33c9f884c15d0303b3c01f1cb8ef1f009a1f32c103967ebdba6

SHA512
fdd672bffcdeb709a13ca9a769488850ffb19a7de64ba7de20e51a5da1f326c341a1f4eb0acdd9c7a79f41d1b4c4a42f1913146548e52dfba56ea1568b661180

Download Submit
C:\Windows\SysWOW64\Mkjnfkma.exe

Filesize
69KB

MD5
c2c3360723149329462c1cba252f91e8

SHA1
4380c1a1349d527ac9ace83c7c5999ac6dd80b0c

SHA256
bff800007f5477dda54163628dd228a0550c7ebc24ce1f0217f74c67eca51b42

SHA512
ac76e5743b64ed03c7b29efab636aeb8cc729bf2cd43b3c0cb9083dfc5b9b91a7a78c8da0cebc962453fea2cfd7e27e160edde3764881e9059685ff0cf2993ff

Download Submit
C:\Windows\SysWOW64\Mkohaj32.exe

Filesize
69KB

MD5
4b2f104342b8705d94e922171a7069b2

SHA1
53ae4a60ad3ec1d2e6452ef70178342b969858d9

SHA256
8a9e48b10de2a491a9279784f0c6b42915f96c1623cea879ddeec436a20e3eaf

SHA512
1dfd9c91df2196f73c0321b65f0bf87168bcb30d463cdbad87a44d1290eb912a60bc08a20495308202898fc052f8fed32d69a89c6a7ec5de3b11a11c30fbf1c7

Download Submit
C:\Windows\SysWOW64\Mledmg32.exe

Filesize
69KB

MD5
19a2c3c488600423253ed82042c4621a

SHA1
8662df22f62bd5ab43fa78c300246e134b935542

SHA256
bc17ca3b7e58a553c7089dfd3a404f170793ca8d8130486770faa41f65d5ac7a

SHA512
31682327a046bf0a3752e5de14d6d5721527ab7ec1f75dac16a160c7cc96a628873c467cf98649a4a3724b049b77a9da9b8da5d5e7c940953baf950bb83edeb5

Download Submit
C:\Windows\SysWOW64\Mnfnlf32.exe

Filesize
69KB

MD5
af31800f6ef1018add5bba815479d074

SHA1
51b56ff46b3b7916f5942e9883bb6611359614f9

SHA256
1ca54b81c225217358b854808e460873097cb66100f6ca83adcdcac495b3337c

SHA512
99923d22d0265f16d4c953c4dc2faeaedf291755d40a226eef8d4da3e1191464d17e68dd538928dfa4dada80e97db06f949b26734aef3dc3be5d1b0dd3db24df

Download Submit
C:\Windows\SysWOW64\Mpclce32.exe

Filesize
69KB

MD5
3e18e13bd9c0ca88fe278c721f584ad4

SHA1
4b5819d2370a94679b4d3dfe1f6b98063f9d14a6

SHA256
a56bb0c60f07a591af727c84ce4cbde0f9865d07230d846d94deb3ac2e55f5c8

SHA512
40fb77621b994c48391e2d10ce68c83fcf8e0d20bbb1b1d9803e3325663732ce72a810dd41fa83599f0e26cdca211e9c4083da0663afcdadd2fea6753bcc06c8

Download Submit
C:\Windows\SysWOW64\Mqafhl32.exe

Filesize
69KB

MD5
0bc13eab265663f21a64f020985f7e1c

SHA1
148748e043b517aff9928fa278515e876ee33998

SHA256
2d8e488c7a84ec6c9501b0ea43615e0193fe7021b89f6a025dddfa0097551799

SHA512
08b0781a737f50e853ec9226fd25e5118ea17fcf5a63a8fcd6b210667c74d59cb9ed36bc473fac31c147502a598c6000a91e22919e363b47b6707ad05f9aa0d1

Download Submit
C:\Windows\SysWOW64\Nblolm32.exe

Filesize
69KB

MD5
3a1ea2ccd4c422aa50725dad2a026d05

SHA1
9c6ca13987ab2364eb9d5f5f567de1dacb1d3257

SHA256
4a1097edda4eb2eccec701b0bcdf3cb8164fd803be1d917f76833d5736b68805

SHA512
111eb18ed42228c5dda0a0b4d6d2c39a1abcc62e1564e5f11d8a73447e92700c9961dd94427efde010edc3af9e13b5f00635064adf3f908f3fd3e7d91c8444ce

Download Submit
C:\Windows\SysWOW64\Ndflak32.exe

Filesize
69KB

MD5
4effd28da35c68885c1fa57d6021c7bd

SHA1
6da828af32fa1795bd769e71a87498b1a3ddb88a

SHA256
48c0ab404ba4dabeabf0d5e873fe7df7d38c0b3b3a52f400e91ce999a402bc94

SHA512
dd73f0218cf4b213c919b45091213cf8ae81ee8a5d9a989ae6d46bb714017e7c5c6729f37e89402365dfc25f6abcdd36cd3cbb6886602c23448694d07e2a1cd0

Download Submit
C:\Windows\SysWOW64\Nelfeo32.exe

Filesize
69KB

MD5
e2d87fb34dfb3761250f0d7255dba452

SHA1
142c6b76752c05b6265decd68e82c2300f73e748

SHA256
d1efbc7377354ae0a5ae3e9ffae77216e70c0d2e475f8caf8828432e909a57ea

SHA512
80c4c72b0d67175ab1205fc8990872e7e56c7c604a28a7cb7a759165584192fb94e0b1182b7e868e48c8ea9b2835f7180452e54d7b00dfa9ec4012eba00ef243

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
69KB

MD5
40e866807b02a85fe0f842d31fbf849e

SHA1
55352775ad2b1fec3ed767ffb0cfb578caa9cfcd

SHA256
92cb815291c746ffef44c71979f8de1b529d3af6865853bb87c0395a93d8fc96

SHA512
204b55adb864655b4b7720918338c4ee958a46740453fd4b147f7cdafc0632bbc28ee131fd29676ad960744b77e32c9391a51cc3e312414620d7cb3b0be877c4

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
69KB

MD5
169bd698720dc5a4610cdce216a8c68f

SHA1
9a73eca8d374113491efd14a50ee78ebcd16e433

SHA256
e6a55e3cccd434b702ce311c1eefee5a41e96f3133e29a5f1bd7772c8dea5820

SHA512
a236f50069194e46dd3e7335fc3eddf96d808471cea40026ffea54175c81ca5f4788780613093306f214e7c3eb249b7e6a68d7dada78d253bb41513252ce940f

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
69KB

MD5
b4f90aa450bd444ebed26ddd34f33e54

SHA1
42c8d258bba9329d4b261e3a8f0bbbad87f389db

SHA256
df8ee2364ef1f62a05a0cb8efbb1cedfefd1b364b1e728faaab33b079fdaba23

SHA512
1a5b62c19c0dd3632505bbe2d26551d3607dacac1b34013ad4ce63a32d5434b65de1246865431a36d466e89a39d40ade2f9165cda2b26c1f6697bce714d8d569

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
69KB

MD5
4909c735284218a9908d5c84d003b9f9

SHA1
e4c29dfcc291c4380cadb57cd6d45d1ad3e2e025

SHA256
f0d16271dfa05664459abe2b748c834a4ffefbd66d2947625c8c030191e581b9

SHA512
e5478a58bc76a6b386dba9c04ca6eeb7c9d33fac1e2947b453fb633008b6c60f21d04d1afb6df9acdf10410311662a70d7600bc706e4e04a4d6595718a840b98

Download Submit
C:\Windows\SysWOW64\Nlcalieg.exe

Filesize
69KB

MD5
5c8b433cae4f1ed24b6a8c90fc8bd31c

SHA1
4ba81073fecbee583a72d4706ef02220887c0060

SHA256
d83d1dc82f6359402bff1885c70454f7ec4c2f9ef6b7ef1e1383449ee521a00a

SHA512
f4c5653bef63ecb2bb8596a21c43e3b4dcdcba8fa008ed04b64d861a40d61c8a3f9c6f7059151de14d99c07c8769cf3e5881662e9b4c18b890c86d922f4631be

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
69KB

MD5
7773bf1970fa0068cb1481b0a2c942db

SHA1
9d7901e50c2552af584cc85012b27a1b8d8df588

SHA256
d59741601f84e4f939576a27608c6219f15b81ec00021c33b88a3f7a307e4108

SHA512
cdc88c8222fb4d97b435b9e98ba5188f258cc58f1adb8d918c67e2846fa3a3b07f1a4e99a913571f45c21c30cc86dee5d201604c3922341845426a4f966692a9

Download Submit
C:\Windows\SysWOW64\Nmbjcljl.exe

Filesize
64KB

MD5
c3b77e842e99c58d6ec15b6bbb6d6d34

SHA1
0d7875eb5f3122285fc8b0ce1e4fe9323ee1f7cb

SHA256
26db3887666a10ebfdd12f66ef462fe1e87b66ff694888cebf31eaf6b806c9ee

SHA512
9a36ecccbc507bdf73e5194daef43b5e0638b0fde1a419746e2f86edf19bbbd15119e99c62d0735fd8e318e4da1b61c4d2863feec25c813dbb82a076dca3c594

Download Submit
C:\Windows\SysWOW64\Nmcpoedn.exe

Filesize
69KB

MD5
aa0eb23ae83ac7b94a5149b0f5aa527c

SHA1
0618d52dc4b287beb66f44da9f482a6aa9e5be5c

SHA256
520c5265403f42f4386aec26068e7f51758a27979871c0286e4abe163899821a

SHA512
620beda397f05a1f17d36044adfe0df3916e162f6f5c8203bbfe0101ff2fccc6510657599a0f136ca94de711e4ebbf48ae51c8902d502cc1c660da4d21663274

Download Submit
C:\Windows\SysWOW64\Nmfmde32.exe

Filesize
69KB

MD5
69ccb263c2e3e27a8857398d418550d8

SHA1
892f1ec5ef70ea8ccd54956f8710d3360390f8cd

SHA256
282e062dba165e20d423b8f64ca945c6920f8993d7859b780a9f0413e06226a8

SHA512
c8ba54fb429b69d992c00bac82df14a1faa74cf7d1f6671e29c719f5ded90e62e77f8aa92a810d9de3e64465ebb6a27e8a145d04ab91a0879c0429a2102c0eab

Download Submit
C:\Windows\SysWOW64\Nmigoagp.exe

Filesize
69KB

MD5
42a71b31dd4a0fe96b904cdbdf6ad205

SHA1
c40c4cb11596f32cd9478899ad4f89bf8b2dddac

SHA256
4ea6b339709e08e9905df879b38ba1c4f5a1c7fe7b86a8e26df1e4f795fc92ea

SHA512
01d1b0124990adf655bb73fb528d31df8a77cd0277b0976a7fef4f4ba4a072d9a5f9cc3c5dd0b650c91a78394e593a9bcf2c890c9a3d4a2a7116b9bcc291376d

Download Submit
C:\Windows\SysWOW64\Nmlddqem.exe

Filesize
69KB

MD5
6fbe2281c866f451e134a16a1c3fa9bd

SHA1
75b496c5c6841be400b88fc98ccb8fd99bcbbfa3

SHA256
1021d8c8a8bd2b14cbf3efdc48d3cdf79ef08b7e0646a5eb2c2519d4006c9823

SHA512
e6103f6ac8ea35dac8a2100523a3c3fc5f0e62137ea03032aab0252a6fc905aa13e7eaf48e1ffbe34a015097fc6f154fce4c5ccf24cd860ef3c0d83c3beb5175

Download Submit
C:\Windows\SysWOW64\Odhifjkg.exe

Filesize
69KB

MD5
936a26d91d39209d5808a8b9c1a194d2

SHA1
648ca6c03e8187cefdce9a95d8cb022588620ab1

SHA256
7371debe6c6c66e76abb7d44cc59c421c77bab48c7e760daab384537ebd3fcae

SHA512
b73514b082d3f2622a5b135aeeb488e7c1644d2095e802fbb09fc93990dc900cd71273faefde7f5abce6fb3e75b4c23792928a32ab4f56b20da79c01cf6576e4

Download Submit
C:\Windows\SysWOW64\Ohcegi32.exe

Filesize
69KB

MD5
e6a44237a29557d61bd9f0005649b7d3

SHA1
686de5a5e0b6b99c07e21a01530222f27b6ed76f

SHA256
ff7fe1e180dcbbe192a621c6308452f4c2ed1bd5d0c40c238fd584713906468c

SHA512
47fd06d5ac5bf3a1871ca79872939c3b4e7f0dfacf53d3a1fb0804e7d612cea115e82c78cfe73ec0ee852fd49d7eac402f3fcff3a3f479dbcd25ea2d943c8cef

Download Submit
C:\Windows\SysWOW64\Ommceclc.exe

Filesize
69KB

MD5
8a208e1adc16e3f8f8e74c2ce4be6a33

SHA1
b2ee28a804a05300c92160fb598863c1347ebde8

SHA256
90fc42119eacdef95b7525be684b83cee42d078040c9acdceea9a92af406bcfc

SHA512
07034d911acb7515a1149749743d4f060a445948b014bd17dcbe442eb569ac88602df11b0412acd06077c9c04c7d45c1f06d406cfc7549115f2237ba42def5f4

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
69KB

MD5
bdc7cdd6d51819c636024e05e0b97121

SHA1
0aa9ee081042075d54a0ee0641f6cfffd19d1e33

SHA256
29254df0a849e42d41d69d0c2301e831a81f8e395d47afe83acb93c67e87432f

SHA512
ba059d96c075085fbb8d7f6455b62ad7f08e49fb539e64179680f73d6e43cfb0858b5b18ab42e2888e08a8e3cb2d1558ba430a8e58c5bbd7deaeaf9ced243665

Download Submit
C:\Windows\SysWOW64\Onnmdcjm.exe

Filesize
69KB

MD5
fd81ca8d51faf09bfc416c40c6922720

SHA1
0fc66642ba67072b006e77e18e9951f11ec83297

SHA256
ae5252f6ba94a3b18fd5799510a1b6d7b1271d77fa297fa98a8884c9df15db47

SHA512
899f9d856098cbdea1c6e47d78fa62b786ae617b31f3693e8d96a0722173068f76a8c07283cc83f989b7eb9a2427d001e413473dd5669de5dc9488ff7ac5b7ed

Download Submit
C:\Windows\SysWOW64\Opbean32.exe

Filesize
69KB

MD5
87821721d3493c721e6244f8fc1bfea6

SHA1
730a84dcd2980c29c8f18e9431583e9a58a5ed77

SHA256
e0aa9ff9c04bdbcdb2207758b121060ab081a56fa7b9031e7d73fb19002aac13

SHA512
a3d9ad7cf814f1588467b775725fa8ee524669e642b69383feb7bf2f3a12f789ab74f189d56474f8c4970c8e0d40ca75eda953fe930d77fbd316715e0be8d61d

Download Submit
C:\Windows\SysWOW64\Opnbae32.exe

Filesize
69KB

MD5
b241cbcb871017dba45499c341b9a684

SHA1
17fcddf9ac97467f49542f868f5538b1f96e523d

SHA256
651e13e13500ac46c97bd292b125b2a11668e27fb8ba22dd279f65b123aaf3c1

SHA512
1c53176c522229963a2dd4afee3c84be2926910364cc0111c329cd26917ac1fb9cfcb06b509f33556c1c31a8da55e2c170f65cafa8116b122f83a03f3c3edf87

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
69KB

MD5
52f4528363c7b3daec0de9730cfaf43f

SHA1
a0a5a8d803ff6483d2e4f18378bf8b44a4dea943

SHA256
ca852656385a8ee4fe20ed07d28a312ae1a8f603e61e6aa41c3866aba5e3d0c2

SHA512
72ebe7be30d552096099a2532378c664fcd2ff58c0274ab14f6d000d25c48b13c9683ccab1b1f6902b08084f0ef96344cbe95c10b701f9a1976cd17d04f23869

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
69KB

MD5
7cc07996c00ca27d3c31e74293ffcfe6

SHA1
c1fa6bc7e438af36d8c1b8848e00a5e27673a89e

SHA256
db38d02332f3b3bcd97fe407fa4459489235a20ce84a14c13349285c6b2c9bd6

SHA512
450381565ad22872a5d4d44423ede671e51b79e1269fb84c4af95bac2cb5c0e2de4dae0fd06471682a999e2014f25e9221df0a65cb822bc396de2a2d2eb294a0

Download Submit
C:\Windows\SysWOW64\Pcgdhkem.exe

Filesize
69KB

MD5
768a789a25acc03c342c43a9f048a94f

SHA1
d1e6c41eeb691d1a162be46f050c8e6d92bcfec4

SHA256
b310c6a56b36bd6e4c8e43130a473a8d106f86d5c3b055620357e887e2b975c7

SHA512
4ec152b5a4d3ab4d3d3d3d761f3ee26ca317714406bda5906ccf6240aa793c19f5ee87c1b6507318bc2b87fe5df6b412238a9ac010b08beceab6f4452aa9fe1a

Download Submit
C:\Windows\SysWOW64\Pfandnla.exe

Filesize
69KB

MD5
127725444b4e2ee0c46cf7c04cd50245

SHA1
3d8819d767adb6fd0766113ffb25271a355a2667

SHA256
723912ff3d0739d346ebec1777be73be79e80455d9851dc6939d74385d1b1d41

SHA512
4fcff9f06e6887a95572bd387d67691d846d37e823319f25a45b77d4a7cd6450c50a79d3fc46585b98077c988609ef4575622f8a4ab4d3d324900ded65f296cd

Download Submit
C:\Windows\SysWOW64\Pjkmomfn.exe

Filesize
69KB

MD5
b94f7af111657a6501915c66c9108dea

SHA1
75c9eb9f2eb94e3951242d659d46677e9ef7a341

SHA256
9473bf257f03144e7d1826f6fab513925e69b6f53bc896b3d7dc0aa6f7d63bd2

SHA512
48a95e5d5c23e39e4433e6e466a4eeff34c7305299d75f83996d7a414bd1fa8c1db88a9348dbc9ba99a12c072ec51f42ee8d598a7056e2ea919a83a386ac2380

Download Submit
C:\Windows\SysWOW64\Ppolhcnm.exe

Filesize
69KB

MD5
c7691f350bab30c381be5a839e8aacd3

SHA1
0f8538ed5921b834e85b651fcaa7bdfb34260622

SHA256
e8fd683aa5d12246d4f662f58ba1fc9fde2572bf1cefa0f77dafa6f91818a887

SHA512
4661b1b795e1da29412e888d9b8380cafe39e41b559ce99e43264f2aa2ee4749043d2e1784914b46230fd4e456855981ae5cabc51b8ec513d49330b0ff769825

Download Submit
C:\Windows\SysWOW64\Qeodhjmo.exe

Filesize
69KB

MD5
a2a2d2c011684b0b34ed11bb798b6a68

SHA1
1f4f7414610f7a77a3e357fb0555b9bd8fbbe272

SHA256
94f07d8dc6be5fcef6accd32584de3f098216198913bc32d8ee8fa985dcd4080

SHA512
1f1023775316479e89413282eeea974d42fbb3def8eb13224fe7c9ca7e4a0c75a021d03f254a4a1679e608e6b10d76319d0fad132950b8a8ba189203568003da

Download Submit
memory/8-301-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/8-368-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-206-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/216-118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/704-215-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/704-126-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/936-136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/936-224-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/960-21-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/960-98-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/976-404-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1144-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1144-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1144-72-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1148-108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1148-197-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1372-171-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1372-81-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1412-417-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1412-348-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1440-411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1604-125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1604-40-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1608-226-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1608-307-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1764-329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1764-396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1804-424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1804-355-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-354-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2012-152-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2012-65-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2016-188-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2148-286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2148-198-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2320-382-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2320-315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-308-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-375-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2464-242-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2464-153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-190-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-322-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-163-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3052-252-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-180-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3104-90-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3316-341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3316-410-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3320-347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3320-280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3388-233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3388-144-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3624-266-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3876-321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3876-243-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3940-274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3940-181-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4180-397-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4308-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4308-107-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4356-383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4452-361-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4508-376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4540-369-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-403-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-335-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4588-300-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4588-217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4644-276-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4708-418-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4760-390-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4780-172-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4780-261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4808-89-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4808-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4836-117-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4836-33-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4896-362-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4968-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4968-162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5012-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5012-135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-293-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-207-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-234-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-314-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads