berbew | 852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe
Size

55KB
MD5

13000b7d1cfdc95eb5e48b1373bd4986
SHA1

c99b2db4cf9626074fa4bc77f98cc33c3175970e
SHA256

852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a
SHA512

f38d0e14edecd3e6e707b57c92aeb831fc3f105fa2e65af507e00e09985e20daa1da8547809a7fdab78d96b906ec5bef0550e08b855ea0765d6b762b43a68f20
SSDEEP

1536:1s30qaF6YO77qR8mxOwlhmNtXNSoNSd0A3shxD6:+31aFPKm8mHCXNXNW0A8hh

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Malpia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igdnabjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhmqdemc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfheof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpjcgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbofcghl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbdoof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnldla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jknfcofa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljobpiql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emhkdmlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilafiihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iggjga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hipmfjee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcpjnjii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdciiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dikihe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phfjcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcain32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gncchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hidgai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gingkqkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilccoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgifbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bohbhmfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkgpbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Feoodn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbcfhibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Najmjokc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiloco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjjkaabc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hplicjok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkmkkjko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcegi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phdnngdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcecjmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1248	Diccgfpd.exe
4756	Dkbocbog.exe
1896	Dcigeooj.exe
2352	Djcoai32.exe
2424	Dmalne32.exe
1984	Dpphjp32.exe
556	Dfjpfj32.exe
3588	Dihlbf32.exe
1204	Dpbdopck.exe
1776	Dbqqkkbo.exe
4432	Dikihe32.exe
3040	Dlieda32.exe
4248	Dcpmen32.exe
5076	Dfoiaj32.exe
3512	Dimenegi.exe
4684	Dlkbjqgm.exe
3500	Ecbjkngo.exe
4100	Efafgifc.exe
4952	Emkndc32.exe
2344	Ecefqnel.exe
884	Efccmidp.exe
4352	Emmkiclm.exe
4504	Eplgeokq.exe
3624	Ebjcajjd.exe
3996	Eidlnd32.exe
2808	Epndknin.exe
4792	Efhlhh32.exe
4744	Embddb32.exe
1596	Eppqqn32.exe
3016	Ebommi32.exe
4972	Eiieicml.exe
4928	Elgaeolp.exe
4844	Fbajbi32.exe
4676	Fjhacf32.exe
2924	Flinkojm.exe
4892	Fdqfll32.exe
3288	Fbcfhibj.exe
3916	Fjjnifbl.exe
3004	Fmikeaap.exe
2724	Fpggamqc.exe
2320	Fbfcmhpg.exe
2148	Ffaong32.exe
4584	Fipkjb32.exe
1612	Flngfn32.exe
116	Fpjcgm32.exe
4324	Fdepgkgj.exe
4640	Fjohde32.exe
4136	Fibhpbea.exe
3472	Fplpll32.exe
1848	Fbjmhh32.exe
5064	Fjadje32.exe
4000	Fmpqfq32.exe
4484	Gdjibj32.exe
4336	Gfheof32.exe
1184	Gmbmkpie.exe
740	Gpqjglii.exe
3080	Gbofcghl.exe
4872	Giinpa32.exe
3752	Gpcfmkff.exe
3216	Gdobnj32.exe
436	Gfmojenc.exe
2916	Gikkfqmf.exe
808	Gljgbllj.exe
4328	Gbdoof32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Giinpa32.exe	Gbofcghl.exe
File opened for modification	C:\Windows\SysWOW64\Jjoiil32.exe	Jgpmmp32.exe
File opened for modification	C:\Windows\SysWOW64\Kcejco32.exe	Kmkbfeab.exe
File created	C:\Windows\SysWOW64\Ljfhqh32.exe	Lkchelci.exe
File created	C:\Windows\SysWOW64\Jgjhee32.dll	Nghekkmn.exe
File created	C:\Windows\SysWOW64\Oldjcg32.exe	Ohhnbhok.exe
File created	C:\Windows\SysWOW64\Pddhbipj.exe	Omjpeo32.exe
File opened for modification	C:\Windows\SysWOW64\Dhclmp32.exe	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Jcgnbaeo.exe	Jqhafffk.exe
File created	C:\Windows\SysWOW64\Nlhkgi32.exe	Nhmofj32.exe
File created	C:\Windows\SysWOW64\Alpbecod.exe	Aajohjon.exe
File opened for modification	C:\Windows\SysWOW64\Dmadco32.exe	Ddjmba32.exe
File created	C:\Windows\SysWOW64\Egljbmnm.dll	Dooaoj32.exe
File created	C:\Windows\SysWOW64\Enbjad32.exe	Emanjldl.exe
File opened for modification	C:\Windows\SysWOW64\Enbjad32.exe	Emanjldl.exe
File created	C:\Windows\SysWOW64\Flpmagqi.exe	Fnlmhc32.exe
File created	C:\Windows\SysWOW64\Gddmgi32.dll	Hpjmnjqn.exe
File opened for modification	C:\Windows\SysWOW64\Mminhceb.exe	Mnfnlf32.exe
File created	C:\Windows\SysWOW64\Bebjdgmj.exe	Bohbhmfm.exe
File created	C:\Windows\SysWOW64\Gmdcfidg.exe	Gihgfk32.exe
File created	C:\Windows\SysWOW64\Hmdlmg32.exe	Hoclopne.exe
File created	C:\Windows\SysWOW64\Gddedlaq.dll	Lljklo32.exe
File created	C:\Windows\SysWOW64\Kofmfi32.dll	Oplfkeob.exe
File created	C:\Windows\SysWOW64\Ofkgcobj.exe	Oanokhdb.exe
File created	C:\Windows\SysWOW64\Ofcmimpk.dll	Elgaeolp.exe
File created	C:\Windows\SysWOW64\Hginecde.exe	Hcmbee32.exe
File created	C:\Windows\SysWOW64\Ncdmbe32.dll	Mcjmel32.exe
File opened for modification	C:\Windows\SysWOW64\Nnicid32.exe	Njmhhefi.exe
File created	C:\Windows\SysWOW64\Mmacdg32.dll	Kjblje32.exe
File created	C:\Windows\SysWOW64\Nnojho32.exe	Mqimikfj.exe
File opened for modification	C:\Windows\SysWOW64\Agdcpkll.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Gnbcohkd.dll	Eidlnd32.exe
File created	C:\Windows\SysWOW64\Innfnl32.exe	Ikpjbq32.exe
File created	C:\Windows\SysWOW64\Ajfmkfhq.dll	Jknfcofa.exe
File created	C:\Windows\SysWOW64\Qikoka32.dll	Gmimai32.exe
File created	C:\Windows\SysWOW64\Pnjbcghk.dll	Jiiicf32.exe
File created	C:\Windows\SysWOW64\Idhnkf32.exe	Ilafiihp.exe
File created	C:\Windows\SysWOW64\Kkpbin32.exe	Jcikgacl.exe
File opened for modification	C:\Windows\SysWOW64\Kdkdgchl.exe	Kmdlffhj.exe
File created	C:\Windows\SysWOW64\Lqndhcdc.exe	Lmbhgd32.exe
File opened for modification	C:\Windows\SysWOW64\Dnpdegjp.exe	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Mhegobpi.dll	Iefgbh32.exe
File created	C:\Windows\SysWOW64\Clddmhpl.dll	Lmmolepp.exe
File opened for modification	C:\Windows\SysWOW64\Ljceqb32.exe	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Bkncfepb.dll	Modgdicm.exe
File created	C:\Windows\SysWOW64\Embddb32.exe	Efhlhh32.exe
File created	C:\Windows\SysWOW64\Kmkbfeab.exe	Kjmfjj32.exe
File opened for modification	C:\Windows\SysWOW64\Popbpqjh.exe	Phfjcf32.exe
File created	C:\Windows\SysWOW64\Fpbflg32.exe	Flfkkhid.exe
File opened for modification	C:\Windows\SysWOW64\Mnhdgpii.exe	Mcbpjg32.exe
File opened for modification	C:\Windows\SysWOW64\Kjmfjj32.exe	Kgninn32.exe
File created	C:\Windows\SysWOW64\Phaahggp.exe	Pahilmoc.exe
File created	C:\Windows\SysWOW64\Hhihhecc.dll	Bohbhmfm.exe
File created	C:\Windows\SysWOW64\Jcoaglhk.exe	Jmbhoeid.exe
File created	C:\Windows\SysWOW64\Ifhahnbj.dll	Gpcfmkff.exe
File created	C:\Windows\SysWOW64\Lajlbmed.dll	Kdpmbc32.exe
File created	C:\Windows\SysWOW64\Omcjep32.exe	Onpjichj.exe
File opened for modification	C:\Windows\SysWOW64\Hmmfmhll.exe	Hefnkkkj.exe
File created	C:\Windows\SysWOW64\Amnlme32.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Kdebopdl.dll	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Npjfngdm.dll	Lnadagbm.exe
File created	C:\Windows\SysWOW64\Neqopnhb.exe	Nmigoagp.exe
File created	C:\Windows\SysWOW64\Eiokinbk.exe	Eofgpikj.exe
File opened for modification	C:\Windows\SysWOW64\Gmimai32.exe	Gbchdp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11776	11444	WerFault.exe	603

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojbacd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffcpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjmba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dooaoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klhnfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mminhceb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngjbaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njinmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbcke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiokinbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpcapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcbdgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiloco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igajal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eplgeokq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnkpnclp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmpjmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oanokhdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omgmeigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pddhbipj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baadiiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfjkjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojajin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljfhqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmaffnce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkijdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbphg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcndbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmmolepp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqpamb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnmfclj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lomqcjie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijegcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqknkedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djcoai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oldjcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdciiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbofcghl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idfaefkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmdlffhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnhcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofkgcobj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpmdfonj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpiplm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibafp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfnjpfcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmhhefi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onpjichj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgpgfmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flngfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmbmkpie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgnbaeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpbflg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlpfhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Diccgfpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjhacf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binnimfj.dll"	Dpphjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gggpfopn.dll"	Fjadje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Linhgilm.dll"	Fpgpgfmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljhnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckgohf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkndie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgninn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edmpgp32.dll"	Dlieda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hplicjok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfllfd32.dll"	Knfeeimj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baadiiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmdnbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfjpfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onnmdcjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcmmhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhpmfbl.dll"	Baadiiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jomnmjjb.dll"	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pickil32.dll"	Okkdic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clgbmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcmbee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqndhcdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phdnngdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmkhgho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enbjad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Moipoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobhb32.dll"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnaaib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efhlhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmnjnld.dll"	Odhifjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igdnabjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apmhinni.dll"	Jgpmmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmafqb32.dll"	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnnbme32.dll"	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmhjapnj.dll"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkfoel32.dll"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajmdgelp.dll"	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmcnoekk.dll"	Ieidhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fjjnifbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikpjbq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkddhpn.dll"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Meiioonj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 1248	4412	852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe	84
PID 4412 wrote to memory of 1248	4412	852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe	84
PID 4412 wrote to memory of 1248	4412	852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe	84
PID 1248 wrote to memory of 4756	1248	Diccgfpd.exe	85
PID 1248 wrote to memory of 4756	1248	Diccgfpd.exe	85
PID 1248 wrote to memory of 4756	1248	Diccgfpd.exe	85
PID 4756 wrote to memory of 1896	4756	Dkbocbog.exe	86
PID 4756 wrote to memory of 1896	4756	Dkbocbog.exe	86
PID 4756 wrote to memory of 1896	4756	Dkbocbog.exe	86
PID 1896 wrote to memory of 2352	1896	Dcigeooj.exe	87
PID 1896 wrote to memory of 2352	1896	Dcigeooj.exe	87
PID 1896 wrote to memory of 2352	1896	Dcigeooj.exe	87
PID 2352 wrote to memory of 2424	2352	Djcoai32.exe	89
PID 2352 wrote to memory of 2424	2352	Djcoai32.exe	89
PID 2352 wrote to memory of 2424	2352	Djcoai32.exe	89
PID 2424 wrote to memory of 1984	2424	Dmalne32.exe	90
PID 2424 wrote to memory of 1984	2424	Dmalne32.exe	90
PID 2424 wrote to memory of 1984	2424	Dmalne32.exe	90
PID 1984 wrote to memory of 556	1984	Dpphjp32.exe	91
PID 1984 wrote to memory of 556	1984	Dpphjp32.exe	91
PID 1984 wrote to memory of 556	1984	Dpphjp32.exe	91
PID 556 wrote to memory of 3588	556	Dfjpfj32.exe	92
PID 556 wrote to memory of 3588	556	Dfjpfj32.exe	92
PID 556 wrote to memory of 3588	556	Dfjpfj32.exe	92
PID 3588 wrote to memory of 1204	3588	Dihlbf32.exe	93
PID 3588 wrote to memory of 1204	3588	Dihlbf32.exe	93
PID 3588 wrote to memory of 1204	3588	Dihlbf32.exe	93
PID 1204 wrote to memory of 1776	1204	Dpbdopck.exe	94
PID 1204 wrote to memory of 1776	1204	Dpbdopck.exe	94
PID 1204 wrote to memory of 1776	1204	Dpbdopck.exe	94
PID 1776 wrote to memory of 4432	1776	Dbqqkkbo.exe	95
PID 1776 wrote to memory of 4432	1776	Dbqqkkbo.exe	95
PID 1776 wrote to memory of 4432	1776	Dbqqkkbo.exe	95
PID 4432 wrote to memory of 3040	4432	Dikihe32.exe	97
PID 4432 wrote to memory of 3040	4432	Dikihe32.exe	97
PID 4432 wrote to memory of 3040	4432	Dikihe32.exe	97
PID 3040 wrote to memory of 4248	3040	Dlieda32.exe	98
PID 3040 wrote to memory of 4248	3040	Dlieda32.exe	98
PID 3040 wrote to memory of 4248	3040	Dlieda32.exe	98
PID 4248 wrote to memory of 5076	4248	Dcpmen32.exe	99
PID 4248 wrote to memory of 5076	4248	Dcpmen32.exe	99
PID 4248 wrote to memory of 5076	4248	Dcpmen32.exe	99
PID 5076 wrote to memory of 3512	5076	Dfoiaj32.exe	100
PID 5076 wrote to memory of 3512	5076	Dfoiaj32.exe	100
PID 5076 wrote to memory of 3512	5076	Dfoiaj32.exe	100
PID 3512 wrote to memory of 4684	3512	Dimenegi.exe	101
PID 3512 wrote to memory of 4684	3512	Dimenegi.exe	101
PID 3512 wrote to memory of 4684	3512	Dimenegi.exe	101
PID 4684 wrote to memory of 3500	4684	Dlkbjqgm.exe	102
PID 4684 wrote to memory of 3500	4684	Dlkbjqgm.exe	102
PID 4684 wrote to memory of 3500	4684	Dlkbjqgm.exe	102
PID 3500 wrote to memory of 4100	3500	Ecbjkngo.exe	103
PID 3500 wrote to memory of 4100	3500	Ecbjkngo.exe	103
PID 3500 wrote to memory of 4100	3500	Ecbjkngo.exe	103
PID 4100 wrote to memory of 4952	4100	Efafgifc.exe	104
PID 4100 wrote to memory of 4952	4100	Efafgifc.exe	104
PID 4100 wrote to memory of 4952	4100	Efafgifc.exe	104
PID 4952 wrote to memory of 2344	4952	Emkndc32.exe	105
PID 4952 wrote to memory of 2344	4952	Emkndc32.exe	105
PID 4952 wrote to memory of 2344	4952	Emkndc32.exe	105
PID 2344 wrote to memory of 884	2344	Ecefqnel.exe	106
PID 2344 wrote to memory of 884	2344	Ecefqnel.exe	106
PID 2344 wrote to memory of 884	2344	Ecefqnel.exe	106
PID 884 wrote to memory of 4352	884	Efccmidp.exe	108

C:\Users\Admin\AppData\Local\Temp\852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe
"C:\Users\Admin\AppData\Local\Temp\852f3dd9b39deb0c99016f743192f0b94cea6bea88729c5254006588c67edf0a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\Diccgfpd.exe
  C:\Windows\system32\Diccgfpd.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\Dkbocbog.exe
    C:\Windows\system32\Dkbocbog.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\SysWOW64\Dcigeooj.exe
      C:\Windows\system32\Dcigeooj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1896
    - - C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3500
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        23⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4504
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        25⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3996
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        27⤵
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        29⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        30⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        31⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        32⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4928
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        34⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        36⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        37⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        40⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        41⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        43⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        44⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        47⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        48⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        49⤵
        Executes dropped EXE
        
        PID:4136
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        50⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        51⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5064
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        53⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        54⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1184
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        57⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        59⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3752
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        61⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        62⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        63⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        64⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2492
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        67⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        68⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        69⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        70⤵
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        71⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        72⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        74⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3952
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        76⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        79⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3404
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        81⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        82⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        83⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        84⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        85⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        86⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        87⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        88⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        89⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        90⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        91⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        92⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        93⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        94⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        95⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        96⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        97⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        98⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        102⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        104⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        108⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        109⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        110⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        111⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        112⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1388
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        114⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        115⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        116⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        118⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        119⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        120⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        121⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        123⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        124⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        125⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        128⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        130⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        131⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        132⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        133⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        134⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        135⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        136⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        138⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        140⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        141⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        142⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        143⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        144⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        145⤵
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        146⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        147⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        150⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        151⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        152⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        154⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        155⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        157⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        158⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        159⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        160⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        161⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        162⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        164⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        165⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        166⤵
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        170⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        171⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        172⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        173⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        174⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        175⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        176⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        179⤵
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        180⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        181⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        184⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6360
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        186⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        187⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        188⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        191⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        192⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        193⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        194⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        195⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        196⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        197⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        200⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        201⤵
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        202⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        203⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        204⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        205⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        206⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        207⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        208⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        209⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        210⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        213⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7548
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        216⤵
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        217⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        218⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        219⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        220⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        221⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7900
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        222⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        223⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        224⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        226⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        227⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        228⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        229⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        230⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        231⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        232⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7544
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7660
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        235⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        236⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        237⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:8068
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        242⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        243⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        244⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        245⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        246⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        247⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7936
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        249⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        250⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        251⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        253⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        254⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        255⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        256⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        257⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        258⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        259⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        260⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        261⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        262⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        263⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        264⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        266⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        269⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        270⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        271⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        272⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:8212
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        274⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        275⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        276⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        277⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        278⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:8536
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        280⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        281⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        282⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:8764
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        284⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        285⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        286⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        287⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        288⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        289⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:9080
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        291⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        292⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        293⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        294⤵
        Drops file in System32 directory
        
        PID:8264
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        295⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        296⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        297⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        298⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8652
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        299⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        301⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        302⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        304⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9200
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        306⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        309⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:8772
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        311⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        312⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        313⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        314⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        316⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        317⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        318⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        319⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        320⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        321⤵
        Drops file in System32 directory
        
        PID:8792
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9020
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8468
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        324⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        325⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        326⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        327⤵
        Drops file in System32 directory
        
        PID:8364
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        328⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        329⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9268
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        331⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        332⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        333⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        334⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9492
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        336⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        337⤵
        System Location Discovery: System Language Discovery
        
        PID:9576
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        338⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        339⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9660
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        340⤵
        Modifies registry class
        
        PID:9712
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        341⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        342⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        343⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9892
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        345⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        346⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        347⤵
        Drops file in System32 directory
        
        PID:10024
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        348⤵
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        349⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        350⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        351⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8844
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        353⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        355⤵
        Drops file in System32 directory
        
        PID:9436
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        356⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9568
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        358⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        359⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        360⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9856
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        362⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        363⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        364⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        366⤵
        Drops file in System32 directory
        
        PID:9228
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        367⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        368⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        369⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        371⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:9836
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        373⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        374⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        375⤵
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        376⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        377⤵
        Modifies registry class
        
        PID:10228
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        378⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        380⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        381⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        382⤵
        Drops file in System32 directory
        
        PID:10044
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        383⤵
        System Location Discovery: System Language Discovery
        
        PID:10068
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        384⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        385⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        386⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        387⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        388⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        389⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        390⤵
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        392⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        393⤵
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        394⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9620
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:9224
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        397⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        398⤵
        Drops file in System32 directory
        
        PID:10316
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10360
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10404
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        401⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10492
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        403⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10536
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        404⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        405⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        406⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        407⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        408⤵
        Modifies registry class
        
        PID:10748
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        409⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        410⤵
        Modifies registry class
        
        PID:10840
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        411⤵
        Modifies registry class
        
        PID:10876
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        412⤵
        Drops file in System32 directory
        
        PID:10928
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10972
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        414⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        415⤵
        Drops file in System32 directory
        
        PID:11064
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        416⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        417⤵
        Modifies registry class
        
        PID:11144
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11196
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        419⤵
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        420⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        421⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10400
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        423⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        424⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        425⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        426⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        427⤵
        Drops file in System32 directory
        
        PID:10736
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        428⤵
        System Location Discovery: System Language Discovery
        
        PID:10804
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        429⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        430⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10948
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:11012
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        432⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        433⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        434⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        435⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        436⤵
        System Location Discovery: System Language Discovery
        
        PID:10344
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10456
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        438⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        439⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        440⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        441⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        442⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11072
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        444⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        445⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        446⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        447⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        448⤵
        Modifies registry class
        
        PID:10756
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        449⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        450⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        451⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        452⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        453⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        454⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        455⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        456⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        457⤵
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        458⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        459⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        460⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        461⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        462⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        463⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        464⤵
        Drops file in System32 directory
        
        PID:11376
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        465⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11472
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11516
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        468⤵
        Modifies registry class
        
        PID:11560
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        469⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        470⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        471⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11736
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        473⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        474⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        475⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:11912
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11956
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12000
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        479⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:12088
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        481⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        482⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        483⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        484⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        485⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        486⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        487⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11496
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11572
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        490⤵
        Modifies registry class
        
        PID:11656
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        491⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11788
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        493⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11928
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        495⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        496⤵
        Modifies registry class
        
        PID:12056
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        497⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        498⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        499⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        500⤵
        Modifies registry class
        
        PID:11312
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        501⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11568
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        503⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        504⤵
        System Location Discovery: System Language Discovery
        
        PID:11816
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        505⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        506⤵
        Modifies registry class
        
        PID:12040
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        507⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        508⤵
        System Location Discovery: System Language Discovery
        
        PID:11292
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        509⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11444 -s 400
        510⤵
        Program crash
        
        PID:11776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 11444 -ip 11444
1⤵
PID:11644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aajohjon.exe

Filesize
55KB

MD5
af293cf5aba872f4b8541b315d30981b

SHA1
9972f652ab763c957e342179b8248961e195e00c

SHA256
3276fbe0b6c4df4625def9353319081938db9871ddd3986b0ba9e0d38b652b80

SHA512
5d2175df0c9c3a74b25d66c8b0c452e1585c73de9039fe23c36fd2fd5f33fd877cfe1e271757869be87267c2c77d81407b6fd95060d67432627d9bc0f32d0d32

Download Submit
C:\Windows\SysWOW64\Aaldccip.exe

Filesize
55KB

MD5
2d72aaba95bf5f20eccf1efee6e46c08

SHA1
e9ffbeacd1e2149611249a7a1d394c66b3c0d69c

SHA256
b80ff9f6b66e1f3777fd447981282e269187fe0ca70eda361915a44583d393cf

SHA512
18f8a33cf58e97273ab449c44f452faff2ed3a562eec2cd4ca472e2712bdb8e50f9ff72a2aca5341dbb83bc685eedca06b18030c08446604ce2c0dcd0ec07527

Download Submit
C:\Windows\SysWOW64\Adcjop32.exe

Filesize
55KB

MD5
6c51184b0de60ecd08c0302bfe253660

SHA1
062433b8278ced13c13ef02b933e35b988529089

SHA256
b7041e5629301704b13917268119293c80a6015c4324194dd26087453cddca53

SHA512
a0ca6d2a4e7cf55401c910d483c397a7f1b125306e06a96ee34f1e48fa717ec572f69be2c261660f006cea055278eb1a9b735d1f838e3dc8ed44b293fd4cedc4

Download Submit
C:\Windows\SysWOW64\Addaif32.exe

Filesize
55KB

MD5
630acfed79cc3c460e6d72a3dc197de4

SHA1
bcaf377af45b3edd804372c227a312512570e24c

SHA256
374e73b9898a1c3b53900b55934ab04430c09ca57f7401753aef1bc579450369

SHA512
2fbc1539a3c84666d0fe432c66189659361bd7125d30dc9610d4d393efbfc1e90e7fdbcbe64d5c27c8bcdfb283f1717b42f8258c4dc5dee4b4b25d9584e570c6

Download Submit
C:\Windows\SysWOW64\Adkgje32.exe

Filesize
55KB

MD5
e0848e612be4d7f01f03bb2624972197

SHA1
46fca6fa8a1e5b895d7ee048621052278da0bb49

SHA256
e11b83b3d995ed5f6ca7b6d1c7bd9bb7ce1f90650483d2323bcddc5774135986

SHA512
fc6f51446d3054512453504c8e89cea2b978186e1c39f0127ebbb726d04772afd98b92be32b1a5fb26245b745ba82d24a59d15f2ea16367d4737f215696c6523

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
55KB

MD5
3087e046a85cdb6dcbf557ba478d6b55

SHA1
eb422e3d4c4d14aa5699503c69271342f790349b

SHA256
82e2f3e431fa405ec856949e2d29800e8097a98b380c0dbcf1d89261d93faa6e

SHA512
6a6c4a2524dc7987a5f3a6192656a71685cfa926cf46c55ab7764996f8ae9e2a1f6f488e929867ca66a37fda7e79897463722f7bb02553153df38ef1dccb8d41

Download Submit
C:\Windows\SysWOW64\Anmfbl32.exe

Filesize
55KB

MD5
82d3e6105828301722757a9c1fcc8b6b

SHA1
a8bb70f293ed4da95db6b48704705acf1f2ad3d3

SHA256
ded8cc1f038d92f6e5cb6fe1882da985d0ad2c04a9d47eed87a6502b27537063

SHA512
885b6877247306de7f80aa815a8306cd7d19a38a9d2a2f3d754f3903fb5ed495e9519ff724c0b73badb936edac7879179d15770e90fd2d64ca336a91ec53b385

Download Submit
C:\Windows\SysWOW64\Baadiiif.exe

Filesize
55KB

MD5
36e9801eec48c20c2b69f2ba4b42ac75

SHA1
2c317fd45167ea211c2172eba57d99a0bdde4738

SHA256
48d5bd2439beb9875a4df373f21737572a44745ef8a2d14ad4f403cab7ca5239

SHA512
0196def8dd07f211fc4ef89106c5f5acf3fb4534731a8a70f8cd442bcb3587ce2cfef6ce008003c9c46f6ff0c67dcd9e42acbd51a7ce12edac49e64c25633907

Download Submit
C:\Windows\SysWOW64\Badanigc.exe

Filesize
55KB

MD5
879db49094ded29e6bc09aa570be6819

SHA1
58cc6394a1fb07cf73db16c8b86085f16bee30e8

SHA256
1a3e6a45261675cc1e7ca4648d9543b7debcb2405466a62e7d63b0bdd157a1d0

SHA512
5e82af3d2c041180676b45241729544d3a067a90e4500268d1919c2979910d541fef847fba98bc334fdf05f2dfdb38fa061f7d70883b28da00402db4abdddf01

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
55KB

MD5
665840ba34e581a88709bec019e663f5

SHA1
7531d1380ef89638de2d2c1076afb64e2a3f4cdb

SHA256
5e5cca96d633188dac9a8fea799bfbde9f9db57561a8a0c78c6eefd29537d378

SHA512
dcad91a9366a97fdef0677346df2f492a72d66b61d315f3d2a3e5f74a4e65f8cb22354cf2fa162e9ad28e84da08b8e693307be8043dfb1d2d6b67a106a2c8135

Download Submit
C:\Windows\SysWOW64\Bdagpnbk.exe

Filesize
55KB

MD5
3aaaa6794b4aa3a77754d24df4730dce

SHA1
c1b8e2bff11027e304b26b031749be31b8b23144

SHA256
86930ebecc68f4a40c9426881fd12f63d1f58f2b63f10011906fc37a4d840a28

SHA512
83d100844fbb182d958ddf54d37d2d58c89c029b31e32b39498057a350afdba86c5f966747723ec7dfa3cca87f88e42c2f803c872a059dcd5082cf36fc9e22e3

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
55KB

MD5
4771324965e7225b007d1221562e1e41

SHA1
372a66b1528c15e921985d4bc47c2fcd403ea853

SHA256
a8132f7e2822855794c259efc6575409b1cc56a6d65aff664f90c5b03b7e455c

SHA512
60b8d552b8c2b7917fe8c9c83d862b06c9f2460a767cfe2f5831eb9145bce873bc4f40ed60f5057c05f7d651c890a13d13d771cae6e761337caa7ab74676d61c

Download Submit
C:\Windows\SysWOW64\Bebjdgmj.exe

Filesize
55KB

MD5
fb2b96986a05efc53d88018215d418bc

SHA1
34527bfd3d5eac1d120d5c0279530ae6f5ce72ac

SHA256
f2183abfb76f093c9042a6aa6f4bd98b7f7ace60ebfd347da3e9f34e5ebd36cc

SHA512
b5f28eedbe87d65a04473be0dde4e63a726675462a9969c18abdf56aa3068a59e349423bc8fc1febfb0cbe6f1f701370c4afafee09ca2fa3b4f12728008b981e

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
55KB

MD5
d2677db7225a7d7756653c550f3a9bda

SHA1
8eca2f33d7a85c4ce1768e8a8addf38740a9f583

SHA256
783ae23ddbaa119597e39778c3a9d36b1005532ff1e453aafc7d353a408396e2

SHA512
45759d911895815e2134d69ba9576f378c9b6e0bd8f5bea01b35c4d194b45f30fac82d1351661f8ff9381b5dd2ff2da9887e65b7d50c12729cc991015a24d9f3

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
55KB

MD5
57cbe5b72ceebb28a59c692cf39ce96d

SHA1
30291ac63e76188fdc89d3a831627a360167d27c

SHA256
50de7cb7dc847ed4c302fff28f61505b6d84858fa138b8dcc3a827ea073ecc24

SHA512
2d7c9b796d73e7af9088c7c14c0ec6ce4937d99b32af2f9fe7d8cb45c0248899d4be12a0206595a6046af562a3d0a996a5ee023e3cb47d8c7dda487dca262861

Download Submit
C:\Windows\SysWOW64\Bomkcm32.exe

Filesize
55KB

MD5
2dd92937651420e3ef0fb2ae4cb8a4c6

SHA1
99e41151bf95eb803f19f94b0244f0ae54305a56

SHA256
4f4ab21225e5a4e49946122a25916eb58363ce77e6c5f9cf1806d40ccf8dee2d

SHA512
cd343a30cb85abc8ae3903198bde07e9a2b3a3bbbba7e3ec2b1bc80577757fc98ea1f82feeea7c95f7897de710cec585fcd2393ff3c737cc6bdd1b9cfe8601b0

Download Submit
C:\Windows\SysWOW64\Cacckp32.exe

Filesize
55KB

MD5
0f942464d56679008988e950e2b32c67

SHA1
f91276dd57e85c4b087110aa8ae407fa793e3112

SHA256
64b2a5e004a099fbf0e51eee2deed6cd61ca3d9f21e39de201ab5bff67c12097

SHA512
c2075141727de5628e47c1c1137620db4a360cc0709c97bb27d7140319581da0b6d103b6bd3e362e8ac76c84bd66bfde6bb4a07e5774bf2c11fffad82fa9ac78

Download Submit
C:\Windows\SysWOW64\Cbpajgmf.exe

Filesize
55KB

MD5
62140952435873f9ac38acf3d2de1766

SHA1
b3bffcdbf5972219dc2a86ed7b679487b68d13a9

SHA256
09c72df64945bc523f207dfe49f7e291a41ca5abbe326e444b93d9c64fac893f

SHA512
110a249bd64e1ef7cea9773eee90c3f14358e6fbe2032798fab02d398ca422dd4676a95e5c17ee1af50bc2e8dbd7b97f558f5a50c225d1b35a7ffa7e36713048

Download Submit
C:\Windows\SysWOW64\Cgifbhid.exe

Filesize
55KB

MD5
eca8e922ece9af49b210c925f2da9325

SHA1
f904b8ff0be966389b30a8b57a8f781253f3004e

SHA256
e5f56f86e815b18d69d185377493a7a06d2a5200073a7be25cf810770cf86202

SHA512
dc82c3e90b8414ff480fbc2db91c26bd8c215dc7a17f06ebbeac1618116ced37221b9413a3cd28428101dfb8d5d1c2f9731c5f65b164ca9b5f65367fcd674fd4

Download Submit
C:\Windows\SysWOW64\Ckgohf32.exe

Filesize
55KB

MD5
59a4bd1becdedb115774aa8b416c1b54

SHA1
cde41813dff573f3e2156996bca1d69cfa3002ad

SHA256
2dda3e1b234844df4254aa5f6f1ba91b41e28af64a211ec16d5eed7e7c74c50c

SHA512
c863448f9b67538c0285d5687efc347d0171675bc8809455a7c2fc8d473e83f82a585ba0814a0d91e98979128546414b9d3cd0c40774914b68f99fcf02775029

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
55KB

MD5
96f758b0ba9e39a57a7068253e41c45e

SHA1
79e7305ded1fa8724e00cdb171a4b94aa851ebfb

SHA256
7b96f3fedfd8ae2ba7ad810a5fe037aecb008feca543833921f65754240b42c7

SHA512
973f62ed4291c5b04500507cf284933655293301b215fa4a0454849760963d60fe65f083d43f812113221727fdbbc744b65da3cd608e525e0963e2164b5ba608

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
55KB

MD5
fed18b8fa0d00bfb3ea0c7975a5b7bc1

SHA1
f93629963605666f8155c972e0c18299f5fc613d

SHA256
004ccee179ad140805a228d21a88fee5bd6a53e432fc86c2e627a1c73b6f9a20

SHA512
0b598cd6fdec4e8abd2341619ea09e84e1113b14cc0bdd8f3d1580a815659cca913f86fc68bc886944322f4024e8122fbe62552965215a450fb1b55942a77080

Download Submit
C:\Windows\SysWOW64\Dbicpfdk.exe

Filesize
55KB

MD5
fc7c215ca3a53c89e9db3d25fb0fe361

SHA1
4229a799417e572cc8c892c47226520a0c3d123c

SHA256
f7973425ac7306cbdcd9d020c5c803f47fd50960b345e24d448b6994e12d13b7

SHA512
72711bc85058ed2043f3482c7d636fbe30568cab57bc4c5a2847da4017f5af529da97709fdf26fbfa1fa7263482e874a56e52f84cb72bfdccfc31b1bbaa30e7c

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
55KB

MD5
8b12e077aa07bb543071488944e339e6

SHA1
22fc63edc016f6d62e6644ff783ff7ac7d23b4a8

SHA256
b70f1f85ef0b1520fe2d894addefd6468500630c44b508efa284bb53431b90e9

SHA512
0302b8e346088498321680b1b1815919e7efb0a5039798e955475f3b476566a5b7bbc24210c02f6a109852b0d02fccefe97ef9a101d6204a9f5e8bae623813bb

Download Submit
C:\Windows\SysWOW64\Dcigeooj.exe

Filesize
55KB

MD5
3abbd9179f23c9d2bb8643c89450e241

SHA1
e319ee4e4bda65b79aed0072ec5850cdbcb8ec52

SHA256
71f3408807a9a40a48e04169370936f59d6b300213df367b5df72dc246194f5d

SHA512
3a0095db9125da76e3fdf2bd8bc1e452638d59cc82692628aab3bedb83ee92495f9638b2386e126eafb672e1e8cbedf4e31b7f859c9c2d6d3ce48b6820b9850c

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
55KB

MD5
0e4ff4abab9be3c807f5b25293e8d18f

SHA1
c0378f42902db3dfe316ade80b4d42c1330bd05a

SHA256
44762a2ccd492c5f0a531fce90de68e424274714389fcbb92526517753c8f851

SHA512
44db78ad4a6bd9dc96f5ed62bb76bd79d93bef9d3bfc1876aba1f49de3cbf206f16ce096165af7e059fd725d48424b6daf13071d32ae206601ea97375830da7a

Download Submit
C:\Windows\SysWOW64\Ddgibkpc.exe

Filesize
55KB

MD5
33f6b1d5d4df08d05b59bc0a32449ad9

SHA1
a5a58f0fbb5f03c07b3c3b2849cc2db5f42a6da5

SHA256
832dd86536bf6e8f98d0abb031d26fb2546a0852bd62c26d2d447cbcea8e1650

SHA512
21d7c8b165095250e22ca0c2659122af6f9e3578394001fdbca8f9524b85f4d3a195e6af9998b4151e960b571322592c89cdc9a9417b4f07ba0be4de7e19daf6

Download Submit
C:\Windows\SysWOW64\Dfjpfj32.exe

Filesize
55KB

MD5
fd075ca9ee358712ca7f3f59fec0d75a

SHA1
b78fe9203570245901cd19741d3df770833f9990

SHA256
7ec806875b6654456260b895aa790472649bc9f9ea71fc0c532aa74ac4046162

SHA512
60564804972332e4586d60153c03b2b788895dae97bc93a817ba006298618c1804f9b47f41ef7ece98fd11ab5a40f479a3bd56c2585438175f3e950c239cb61b

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
55KB

MD5
56227b6b849fa48c800d3eb2ffe7229c

SHA1
6a562c3ac348eb02356c387c8afc0c8aca321ac9

SHA256
34280354aa2fdd34a0df2d29619ac23cfe7600586f1c7408ebe0deeaf813cfab

SHA512
ddbc4390e5bc6161a2851f4141b5f0f67fb2fe2e3ece9c4210342ee7af7060329ab54e60d70c13e1303592e4a7c73dee3b7a1fcabe7122dfc1d32305a5cbff0a

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
55KB

MD5
2ecdb60ffcff376cc112e04fc10c1d67

SHA1
edecf964b8f8a837c71797a942085b30d7e48b72

SHA256
a5733eafddfa52fbbab73f0658fa56f7b18cbdae06f92d43025ea413d31620da

SHA512
05bcc905f7f4c5c787d7486cfdce5b7e4b32cce6cfc05efde4e59cd2b3b2ee35c30e4b5bfd2e6b2d8d778f8d3e079fb84c4c8e1af70e029d36babcce61f2ca4f

Download Submit
C:\Windows\SysWOW64\Dihlbf32.exe

Filesize
55KB

MD5
b02cb5fc6e6c114979728d2cc76ac28e

SHA1
3b2071b83d0e9dcd4458021db912b705bd55ef94

SHA256
82642962e3a028a0d3531495a275e3233ac846bc788cc3cedce8c4404c2e8ea1

SHA512
f40eb2a3806bdef8f8eed72e0261a6b3e47a2cb17a9fa791c50e94542f082b45ad2d489f18ed1e13f12a6e366460de11f53164c40d4fa07c1e9f1748c28b81b6

Download Submit
C:\Windows\SysWOW64\Dikihe32.exe

Filesize
55KB

MD5
8c1c60452100fc527191624ab2424337

SHA1
20d29d71d194be9890b3c620dcdd6a83836691d1

SHA256
0dd705b87fe11dc7216181716ac6762e2f51b715a8091addd40cdbc98029c65f

SHA512
781fcb75f4492e624aa9077d184c216ae978ce78172094853bd339260ce824083cc2921d985d2aa68080e53942e968a4339a10182a1dcfeb2295692d8ceaf27f

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
55KB

MD5
3fec8fa1eeb43702d28837e222bf7a72

SHA1
784a6d489fb76a91c755f84ea3dd1018c20ea46b

SHA256
6989502fbcb049fe1708aa52d71a9cbf3e40a175254e197d69ee46d81d1aa14b

SHA512
61fb6699aacee81d63cfae83a9ea43a9a5d87a148b169d9026297b76dbff971fe65b1c3e9a70b3193484d0e680e286e04fce679535ddad12de4751bb7a95a5ed

Download Submit
C:\Windows\SysWOW64\Djcoai32.exe

Filesize
55KB

MD5
3f756d8f471c0a8f11b35ba57d6b5278

SHA1
4ab87d1ad4fc410bb1b60a9eeef5183985dc37ae

SHA256
b64e72b56a298bc29b6e6a6de6542cbb495d678f59a42f3e45b52562c4bf5505

SHA512
9513a96080fb2162ac807bdc83c1658af92f263cd7a2eebf23d0046ede368e787af288ea4942cf47fae6038a2a24cd42f2cff4a630c9c9b917c8285a669a78b6

Download Submit
C:\Windows\SysWOW64\Dkbocbog.exe

Filesize
55KB

MD5
5cd3e901e195e34cf13d2b8fd135bb30

SHA1
23d84a4eda825693f680dace51d6df46cc045ada

SHA256
ac3688218b51f62dc9c18ea5c021a3c3849d998b0d5391a00901e8401183e6b7

SHA512
c008741a52a09a7bbca15bb265b3ed59ac1654430197ee1adb43b9c60d48aa31496dcb76b99e0fef95569d87aee2103453390ed44259bf80f357d46849b98fe9

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
55KB

MD5
5600c8df26965c7b8ae11778bf9a2e50

SHA1
2c8cbc5d460bce37d59fabf5d722b461acbc0154

SHA256
bac5f3629a43a892cace3c7fec4b4b89b541ea36f5132cb74a7a41602e26f9ea

SHA512
d100056ec951ba2a227815636c10333a6a1fe1f4aa7067bc54a0e7fe42829fe21c4a5e8fbe78e336aedd7a25ec0f85daa9f9b65e717bad6a9c920b722fc4022b

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
55KB

MD5
dc3489efbcccfcc2253459728c9a3080

SHA1
24e61dd36d166c9137c8f620d5ad042b55feb284

SHA256
d39138b96407252a47ac19e14e499d1f40ee8ed19720ae36d3df6207dd1bbd2b

SHA512
e2a2c635c821098e1e86004ddc43fa4373f8bac8af1d1d8ffb96ccfa287ce9f57af0f15ddc3a802ff69370b007235ac29fccc11529cab89c8ebd5c1ecece2c28

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
55KB

MD5
69c2cf60b214ca12b7f80dd86bceb326

SHA1
bdfcc331c19f1d6a40f9a2c696474cbbf3acc2c6

SHA256
a254bb20662776b81b9e1d31678b474f08a13dfbafee159b9ccb1c104f022b9f

SHA512
8eb1f00e1c5d883a12c30d0e987f338c85b652685d153d78c9ef970fb9d7c972cab5db4460fc3e8901efea0f78e70046e4f206e422b877ac8281114ca6279dea

Download Submit
C:\Windows\SysWOW64\Dmalne32.exe

Filesize
55KB

MD5
cae49747fa5e79993d178d1623c3b1de

SHA1
a18b0a633f14f629b2992e6581c7f099f5b0becd

SHA256
acd76cbb26304bd67d7a133942eba55de5e6fea38cb34d177c851ca21ccfd7cb

SHA512
a233abcd4f6e205aaf7ac45386841c8190817625a4bece25ce508f8416e2c9cb62507ece40f9f708ecbdac413f054c5727b11a256520df8831f5593318258a6b

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
55KB

MD5
eade19ec2b5eed0a9a736f90a5adf734

SHA1
2b34248fed052a5d20141d505965db887c936252

SHA256
c16d05ed292b38f6773be1f8e1f65e062a82b89b8f400d442f91dface5470205

SHA512
d7c3f64d981532998351fa3accd68b3485e9b03985f6d1c4bbc956e63c90acd270dd5aa2ef86ddc2ada3262169047e1320c3576fa667247c4298ca1e74eb62c3

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
55KB

MD5
618dd7bae516e78899bfeb4e069259e0

SHA1
44701ef7fc61658d309be757b3d228de2af815b6

SHA256
fe9ee616457f4e81927f767ed970b72af94fe2cbe5fcc02487d3f9521ec8fa57

SHA512
aead492f9ebf4ced8fb495424d23bffe785228a9279fc71839ca01db765051fc99b6a48e58cc939001e0127aeafa6f5b2d52f7de66da6a4f5d80c1086b9fd454

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
55KB

MD5
1ff8bfdc26d91cf61c9fdbb5f30cb328

SHA1
6b4d1fd56929e38d2024ecc584c475c8f0d8f203

SHA256
d7a66ec07da904fee48b8f2aa8a671ebee123d1b4b7e8442af712919fdda77a0

SHA512
9dcf217dbd107c787cb73ddf1b650c02642c58d3e35e9c8c56d22a6292a01631f48fc6c367bd0057e5ea474aaf1ca5edcc94f322fed8a79ce649bdef06b1a7c7

Download Submit
C:\Windows\SysWOW64\Ebgpad32.exe

Filesize
55KB

MD5
9fba6e045356436c0c04d1b01953bc61

SHA1
e6c9d68b45b148198307cf4ce1a985f6ddeb28af

SHA256
cd7f4907e2fad0eb50c410e2f331e0e4d0b85aa1af8cd36ca8b52d1af76ae558

SHA512
c254e88662255ff21cbc4b3762db9c434d48c96959f867a8776ca1a1335021ecb1894d023cecce61dad4f2d0a6c6cfff24ad14bed10e99b91205380830841318

Download Submit
C:\Windows\SysWOW64\Ebimgcfi.exe

Filesize
55KB

MD5
a40c7ffab77355980d8634a945f37e8a

SHA1
8425673d174a0bec0eb2c24859ab5703bb591c41

SHA256
a119aa4747397e6b8ff0f9453ab83ba45c6df3571041eb4340ad26e3acedf969

SHA512
2618fec607d079d926a21fa8d83151981ec1fb69fb877db35d55f8191b9b507a835d545c5f9fe894e41d584b45d6cfd50c5c2c08fd3c017890e2e7647b04fd74

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
55KB

MD5
404b6e99755bdb0ee0a3217880720d95

SHA1
edbe6b25a1c242efc5973a50f03961603997ea80

SHA256
68b4a762ed926474dd65f30de320fc8465eb13b2b1d514841f4df2b04a5a8f15

SHA512
3699c5927119838952b6f51b5ef94ada4f0c9060ac5c0e8c1ec37ca0bfbf971b519d34c2841e2034108bb3df3be024daa1667ae275e9b92c7d33337b0a2ee400

Download Submit
C:\Windows\SysWOW64\Ebommi32.exe

Filesize
55KB

MD5
5398b86c6c5a69018141143736b9a921

SHA1
836283bf3cac00d124dc1b4dced6b47e53abead2

SHA256
d97576cb62f6fe4064a567a6a02ac351bbadb3816b5d6b5df9a660a639401bd2

SHA512
a5fb953258b66e363ebd51121e247052517461c77418023d9465b6aaf6566ff75d10ec01930e809a389121a6b24c594adcb98f8d00d8983bd7b201299a5aafeb

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
55KB

MD5
cedaa07337aedad3e195b5193daa1e86

SHA1
ac6f5abdf11dfe6dc3c6ec0d5fa9d07b49ac5136

SHA256
b1ba8af385fb7ee50f0ca3b8f46adfb38242d487cf2c4c838b3c334e0b582e7d

SHA512
9f59c6e4708e68bb28e03474159ebc8064eaaa1e62fae412046603eb1032049510061a4174865030f23be266c514875c0253269878efdc434498fc6fe362eea0

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
55KB

MD5
f353433bbc2a586c2269aeba558e30a4

SHA1
cd423ded514b97caaf9ee85f9a26581443f7e82c

SHA256
fd48a7bd0b0cc15d956f91eee621b508706fbfe906a42177f2f8ac624d547614

SHA512
b63ffa7aaad2e8f2d4616feaec4c5766606380379f739cfb85c21bd20ae5e74bc24cae581d81c3c91d3c615dba2186dc89dc74f0cd71d5e9d84d0074061e0ff5

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
55KB

MD5
c7e20a386139429ca856a5bb3c9daef0

SHA1
0f9228c7e4e60f4ec7ef632f2dc60f9bf98b3346

SHA256
baa7562dc4c38ea17e85374c1c1261bf86104b657f6f2fa5c18d4ef17362d96a

SHA512
2eaafc6b458db7d6551ef1c98473db2c8882edd1425a3bc9c4165bbbe36d772cc10348557c88ff42c9f59186ea67c9ffa116dcf7348f714a7233f445cc24cbce

Download Submit
C:\Windows\SysWOW64\Efccmidp.exe

Filesize
55KB

MD5
1780a5d4184d3427d7bc6e26979b2de8

SHA1
a79aa9dda607005c3916336130681d3edbd35472

SHA256
db64ded34dc028d07fc969888512b431c72335dd7af15b674435f59a2ca4fed1

SHA512
877bd6600e9156e8067e36e9879d74a2e5331677f3b2042cc4980d296ecee70da4c7ddce169bac908cd7f729b27f9614d4d3c858f1058af7cab837f8d0bb87a5

Download Submit
C:\Windows\SysWOW64\Efhlhh32.exe

Filesize
55KB

MD5
bdaa8288ad87bf1159d4879d24a705e2

SHA1
7ed54dc2c04341bab61a64df776687b50f220081

SHA256
20ad0f9748e7cafc7554c45ff8fdbcf92428e55cb1af0ed1fda41e3fbbbe5602

SHA512
cf4d5e414ff4296607a10ba195463f76a943ae63e051582a1dd80a315252f8e3021be112be13e4a6286a1d0cfd1ea55675bfcd7235dbdcddec90dfc8306df1d8

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
55KB

MD5
3b4428c9794890c8913ac74edb9e172c

SHA1
064d5d213ff224cc7df5f16e8df0c3304b09f3a9

SHA256
dca666351cec5b9946d261cddfc56a948a43406c90da15a9d0abd401056b2161

SHA512
883372cb4b0a68025607b9d07bf18cfcb3a3eb0a011ea057d5b57d3d4da4410672762f259e4d9631a44d07f402aa5f157776c7596f65728aef9dd311479bec95

Download Submit
C:\Windows\SysWOW64\Eiieicml.exe

Filesize
55KB

MD5
680de9b58caa6a52b50b27e78f10b589

SHA1
4deab5f0bbd6c5c3385a79a1c320e599dd37c0b5

SHA256
3d9c2ca4a5d2f1989ae02f6df8b42da9bdb66b961fe81e899e54e14f6b137170

SHA512
0d459112af1b27a330867588bb4c2aa95e0f6618e08272abb23dafacd0d3f22a94caa3548b300a91825686e767d60b4f0630646fd994e604b27e19ffbec9a13f

Download Submit
C:\Windows\SysWOW64\Eiloco32.exe

Filesize
55KB

MD5
18e29117ec46d448b5ecc5736061daa0

SHA1
4728555e07c4e54c71f95354ded1e1a2a45ea2cd

SHA256
4fe74f26448bc35b3acd69555e06adf4fc59fc0df2b4dacbac3c9432b679dff4

SHA512
95313fc6d04fc5b7842de2076393bf622f87ad8f8d78a14486266435d0573b6125cec1b6e14e170a4c32f153e44a23a86cf57e9dbd32496e7b9d4317cb3df67a

Download Submit
C:\Windows\SysWOW64\Elgaeolp.exe

Filesize
55KB

MD5
8c30dc0b4e596fe8ca66840f63cb723f

SHA1
bb5decb1ec5eda1dcb6a32e2d89b7aa132695ffb

SHA256
770370b07770eefaa28b1702590e73b64b46909ba04368c37d896a05bf100621

SHA512
25b8260cc649f86c145b72d8ff85a0d805fefbdc27f3a1d8ce2c77ffca68075d6c425ddc08fc65c14d6ecb20cabdebfaa936d5d1df157a23aae1bfbd46e94d4a

Download Submit
C:\Windows\SysWOW64\Emanjldl.exe

Filesize
55KB

MD5
d4a33d01a3f4221d7346cea7defd8a84

SHA1
31d4ed62b9180526515c951c70ab79d65c3427f7

SHA256
dd27b8450b520283864cb27f505486f25d12a445191611133a1baf6d8e62681a

SHA512
f4bfd4a761379981693dae1dab5e786dc36a4f6e91aac843d420d20d4bcdf4570659a87d7476b79f69eb5daa9d6ebc8013b60e0eaff120de92fa1864f8a70b29

Download Submit
C:\Windows\SysWOW64\Embddb32.exe

Filesize
55KB

MD5
f410d4a0f59806144dfa09e07af864cb

SHA1
70b74a3f1bd212ae3ce9f0e24d28b39bc4c8a995

SHA256
4d712562250cdce4e33374b193e8183488f557673e2545a367083ee6dcce9652

SHA512
ab5b57ce881ed3fe589f480d34facbed11a4add2da0f0f9e4fcd0244f62d3334cbdaec3fa1f47ee79916915141a734ef87f2693e2e34372dd41edda6ab94663c

Download Submit
C:\Windows\SysWOW64\Emkndc32.exe

Filesize
55KB

MD5
df7332a8ee4a20694890f5171301701d

SHA1
d6b3deccc0637d5522d77315b9a058a811042fb8

SHA256
4b9148f70a79d0388f64e5f077237dbe1484162ae8a0a1d93cb3d6d3d27b5139

SHA512
5f7546fba2130c3e42b5963bb112110fb1db1fe3ce076678534a325dc16af7f290744d63127b3cbd20dd7a4670025ed5691afe429618d54075209b843af0f1e5

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
55KB

MD5
14ef629033ef3ef558f9faa59e6e2e3e

SHA1
73d847ecaa4ea7349e431dc1dcb1e038f48f3756

SHA256
d102fee181fb61ec57351c11b592d36c43e46ee61591532ee912433f04feca1a

SHA512
1d759e71ab0ee5798ee5e8c75d652d3296b83f5958033ff67a87f9633f467ae95e3249cd434868e9390ddfb7de7841b8caeca27dd8615d2070d6616c09f8fc46

Download Submit
C:\Windows\SysWOW64\Eplgeokq.exe

Filesize
55KB

MD5
eb348364326f120026fe5f378cc3871a

SHA1
3258181bfa3f431f17913314512ca48492992033

SHA256
2f3f968bb95af47ff1bb5795cdb78c1684cd514e05c1ddfbd5ac6baac5087316

SHA512
fd174ccc83b8f8f2fa4001a526380b1233e4547ed621b233a36d200874a2288a3669ced69e46e491c3896c6232727f95ebfd9825f1b0dd48be1d7e969143272f

Download Submit
C:\Windows\SysWOW64\Epndknin.exe

Filesize
55KB

MD5
3f84e93a342bbb518d8e0fcec7df6e0e

SHA1
7e0250590b3b865c13c2619580681a866e52a51f

SHA256
1612c5609ec6c32fe0e308635aa35fcf4256244dfc4828d0590f9bec75ac1796

SHA512
c2dfa89876b985f39aadddec6803f1bc3a6f85b19cf7a8e12f2624c25242321e0858f1249b639638bd17331dcef5d4314b371611ca576e469a82cdbf0aa8a3b2

Download Submit
C:\Windows\SysWOW64\Eppqqn32.exe

Filesize
55KB

MD5
917152d83a2b17e54aff46f505581f30

SHA1
1127181724acbb510363cd793695b6fe78a03ca6

SHA256
1c0ffd32f0551bc50764fdb689a6811c97e7a74640062b9294fbd6b2b6c2ad62

SHA512
a569a019958feb8dc04c4453a8d0e95209243c74f9ab0be10b0c02db73eecc3a2cb0d4649974461314329bfd67a4cfc4e212e25396b54bb57a4f1102e6391bc8

Download Submit
C:\Windows\SysWOW64\Fechomko.exe

Filesize
55KB

MD5
f96c44ccf906bbc1c02df922e0606726

SHA1
9cc2f1f1a23141218f3024407f234c577f5cd8e2

SHA256
164fd09932cebf853b297c79554362866469624303d3e3acbaa4b8e3358c19b9

SHA512
bec3c118cf169225973260b4c05e9165c3492e94424bd03ff675cfb2cbb707e369a17ac229d92ac5229d9ef05adff9dde534805f6054840c09403f2c6f825238

Download Submit
C:\Windows\SysWOW64\Feoodn32.exe

Filesize
55KB

MD5
22b8ca4818ba0f003812e9ca70e47c5a

SHA1
984323f3f1bfdbbf39e3455e70baca1165d99b47

SHA256
b1b0ce5427439599fb08336677d1f277121cc6fc77d85f783eb1ba03b4da4de8

SHA512
cec483a0016a3ec732459df95de38c962f473d016366b41d7c766c46bea7bbe3abe43c7595e76207061bfb168936488639b8e505a673ad75aaa7e0f8b377b96b

Download Submit
C:\Windows\SysWOW64\Gidnkkpc.exe

Filesize
55KB

MD5
e93f16c923a3c45230102cb4d3f5d103

SHA1
a71d105a344007f1ce74bbb42577b69e34198af1

SHA256
6b426b70173a4c091752224cb8e8130b437bc21d97f05b588ea7f0c48413f1ea

SHA512
f752f1ec12484d151def1039aa0f731a9b78ea46046bc39a1b2da2cbc8361d0679679639960599936627288c93a12b30998b9aacbb84c5b702695ac04d2c1216

Download Submit
C:\Windows\SysWOW64\Gikdkj32.exe

Filesize
55KB

MD5
84b2b157c3bafa6c12c0f476e57323dd

SHA1
542819cbebc5fa46fb6b9122c4eb3257ed77f82b

SHA256
69343613ced3237881d1ec607183ccc3c56eb351733f1a9d57221ea5248e0d40

SHA512
c29397fc625fa027d014aa1f61cc410ec1d3988fc478b6ac3c2b411cd834705fa6862e0520a7a72a17ff638a64410abfb0448ee779f4d096d82cdd1052ae42ae

Download Submit
C:\Windows\SysWOW64\Hdehni32.exe

Filesize
55KB

MD5
fe669169cfbd38f84939ba9d37f59c26

SHA1
2eb47ceeb40c487fe19c3421f58972c92ea3f73d

SHA256
7d097f097cab5504aafc86ed1424cf1ac3ecb350c4df7178d939476854165f9a

SHA512
8dbecb19b0fe964f077b62d83a8ec5b8274be2d6667cfbb9d692d9d900f3293de442672fdd3f43d97c39eadae84a11d573244bb379cf31058e9d25bcf6a319e5

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
55KB

MD5
936057db8a4efd0dbec89069b50d9b97

SHA1
9042a338a8a9387d17305b467796935e6630def3

SHA256
ea84e62482975b0da57fc057622dbc8b19c55bc99c08111a2480340fd704a9f5

SHA512
46aea46ac0d2b4ae80dde35baf98febb8c74631e122abfa5b17bc791b5c4201dedc910bdad41faee82064ad9669d4ff440ccf2cb7d9c02b3a8be1772df24c1c1

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
55KB

MD5
d10892a2f24bb7dbfa5c7254249fe8ba

SHA1
8a31d14fa82fcf0853029638a3bc57c9f3af6f4d

SHA256
3d33348e4def310091e171a66ec3ddeef777efa2a9cfc0ccbc05833c838ee2aa

SHA512
135edd7e78488603b66a4e9724c446300471b4a2afd4e6f6058b86b41f5d3a5f7ef0ea35610aaa75a66fe545f55359dd3f0eff518d02162689190b768e29c5cb

Download Submit
C:\Windows\SysWOW64\Hmdlmg32.exe

Filesize
55KB

MD5
cce7035e542c531ef58232fd74233416

SHA1
72fbea0a024c14c220c01b566aa8e2c843b080cc

SHA256
392af66e559777e16d4ae8fc799986519a84032cf08516c42665ccaff2c2315b

SHA512
79475a047b38111966aaf89606984f31586317bf88a7e6e1b967e4103eb5beb3521450bf8c28cf8e2cc2162451a1e2975e516397b1f1ace96bb2e63b391d4460

Download Submit
C:\Windows\SysWOW64\Iknmla32.exe

Filesize
55KB

MD5
1d207700a6527a42166958925c03538e

SHA1
5dc1d91888319412af746b29509e2d34b16298d9

SHA256
9e458941ed561856078fc6c1fc99e93b4fd3331128c2e73a4ae56a6b23839277

SHA512
195b61eef9292619a5b4e44eb8a50f9abc0308d3858bc613f46fbc267220d067d0659eb6d885121a6b8513117ebb00ade1d5e4ecc7130c3b0712c38766cecba5

Download Submit
C:\Windows\SysWOW64\Iomoenej.exe

Filesize
55KB

MD5
036668ec2eaccaff15a73b859bcd31d0

SHA1
5ab537f68dbc307eb5fb2e6dc7e1a269e2f6f1b5

SHA256
9deed0c3e9459512eeb483a9b9e9fa1a5075596a708e92664a829d2f7e264e5b

SHA512
ba7426e0498abad70cad51768e7dc5f48802d9d5cd0a58418410411a3783d58cf993651b053a231070ab7a2187127bd3b094faad83dd0f1e633178378f2cfbbd

Download Submit
C:\Windows\SysWOW64\Ioolkncg.exe

Filesize
55KB

MD5
46e4c49ce527fd53ef43eac83a0a23d1

SHA1
85c1089a379dd10dd216850afbb346ce0d6d72e0

SHA256
a8a44acf0f7b26b69c7f36ba11eab669cedca68b1fc78b9ca49712c35ab45125

SHA512
0186ae048720cab955b5cb167204bf8ed123e3b209dc2354009ec0ee469e0781c971b02c40b64f8338afd10206ce9e7e08ac74752f5c8c86449a2423749d2975

Download Submit
C:\Windows\SysWOW64\Ipjedh32.exe

Filesize
55KB

MD5
b9088f0a94962a272f723d2377dc89d6

SHA1
b4b8444ec6afe479d32ed778babfb22979e83fd5

SHA256
1b7d471969801cea23b1a62edfda3004dd9eac5cbbce9944ea5ead3c27b6e71c

SHA512
56082567688ca0312b7cfed6d3fe0c53085694320512e7460949f0e2f21ecb3ed78b16547e3ffe9b9a28b9d0b85503ef244199d0b3c7aa436733c3f0416df9cc

Download Submit
C:\Windows\SysWOW64\Joahqn32.exe

Filesize
55KB

MD5
735adbc12137779a815f0df5ed003e57

SHA1
1a11197b81ca1d6997881b261790370acefb5858

SHA256
5e7f4b23ee49672dc73c34842dba0558040bff926023b0193ae2adaf71f3bcd9

SHA512
7430d9e91ad84b2dea713cd6270005d2fc88616d27ee07748d4f9967fc61814a821ad64f6535e965ff09e14bb998fca7a2cfa0dcad756d6210b1ca38cca0a943

Download Submit
C:\Windows\SysWOW64\Jpcapp32.exe

Filesize
55KB

MD5
a4c33db1177c4aadd87ea12911247c78

SHA1
e208192393e88e58b61e032377f3bd397e2137de

SHA256
cc358d2f469ab249dabe9309f79158fef0e1aa60ab46707951859600c3634997

SHA512
be7e2a5226945e7548230a92194731c513bc61c1ac29ff60e16991c155186bf97761db6dc86c8f5502c0b416415aec4d2d456be345f8d5a3aa76d5adc09cdfc1

Download Submit
C:\Windows\SysWOW64\Jqhafffk.exe

Filesize
55KB

MD5
b8decff01cdba885792637b2d82e637c

SHA1
fb5e5dc3f6c14652f303e1ffc2a39696c573de6e

SHA256
b9ea503f45b70e07839cb3f59fafeebeaf4535cb4caa2979fb176c360214b9cb

SHA512
25e2938a3988bd87a0c302ace27f6920d8aa6e08e736e8af665d4851aa6617c9be428940e934d2495ceabf0d7b5511c7e9c53fbf54944622c2647ae3118daf77

Download Submit
C:\Windows\SysWOW64\Kcmmhj32.exe

Filesize
55KB

MD5
a7b87ba56050d6e96b770956384cbe90

SHA1
4ee55eea370f1d720daaaa5166ebc8740ba8fb75

SHA256
2df145b90cc4a587b23bde71b64a11717536d110b1a9e99d4d2254dd9143fde7

SHA512
36447a3d58e3847bf412fd7760f0171cec696d726281c51d3f8d37fd56fa31faa3daec3bbefd83366fb93a836eaaca8e62e615836bd64daae81886bfdd5296c5

Download Submit
C:\Windows\SysWOW64\Kjblje32.exe

Filesize
55KB

MD5
504909e5292b2d16bee9dfe95e09b201

SHA1
306f5e2a97889001208e44339a821eb7f09bde3d

SHA256
f1605dc2a8fd55cfb11fbf3cad691840dfc8041db7299bdecbcebefe339f8951

SHA512
ca339cc125548e07d7b09ccdd99a00d20f4ab37efed09f43eb9e5e79f54b77733694173b6f067ee4b8916383a9e6636eda056c162798ae1e9742724d5e942ef1

Download Submit
C:\Windows\SysWOW64\Kkeldnpi.exe

Filesize
55KB

MD5
830316edc66862b46e8b34a91c1c87c4

SHA1
77130d18de690f795cfefb17074a9bcfcdcf6b48

SHA256
3145bc8d3862c770a07c9140e7ea7243db0c7ee9368569a8d0906847753a0713

SHA512
a4241d101cba41c3ea5104760aa809ca65336222ee7ecbba1a14f13f4170da4979fc082598690b74be09f9988c2835987978e3f22f322d5248daf7f0d62412e3

Download Submit
C:\Windows\SysWOW64\Kmdlffhj.exe

Filesize
55KB

MD5
376759003a67a1a9c64c242e94735d7e

SHA1
b13ecf270525aa367727e1a4698b9b9295b96a9c

SHA256
9490014120539e350fd09b25ced025c079af5105949f18d2f56198a75caa2409

SHA512
f85a0057473154c21a459717b2f5706ef2109804562627718de9c702ffd5a1cdc8b78c5e0ffbac25b2a690dfab6f728d17bbd51df0a5d7385909cba606d62653

Download Submit
C:\Windows\SysWOW64\Lcggio32.exe

Filesize
55KB

MD5
5eb6aa06611744d592a428ee6f241b2d

SHA1
a86bb7667b57bef12a9675c4e1412b6feb3a29dd

SHA256
02ea6914c6a15780fc6cf9d9679f93efc3a7a78b13de910b21ee02bd307f7074

SHA512
52c708e01b2607d7e70b7513a1263ba5ed3dbd035122a613cd2bade4c69d2fc3a64a6799643dd9b9083b3c3c19faa70c1abdac9ca7e87eaa4618f21f08d7d7b0

Download Submit
C:\Windows\SysWOW64\Lflbkcll.exe

Filesize
55KB

MD5
1723fae676941d999b0411a2bbf47fdd

SHA1
1384345a5fa80ca55f68ad1116d60f16b31b28da

SHA256
7e8e5aec3799e31eb835b8b49d5ac8226331159c5d2e74fa0f9e4dbd00673ea8

SHA512
02973b1507602b1f51409961637bdf0e5ce8c324b9eceeb9cdccd14f01250f0f4aac47c52f7d0fa5758fc99bdb16ddbc68b087586cf6cc55e95abbde416ad2cf

Download Submit
C:\Windows\SysWOW64\Lnjgfb32.exe

Filesize
55KB

MD5
44959fe101db51f93f387581762f9653

SHA1
205368099f77f9cd63f877d633601e0858a4fc96

SHA256
8e25be3c0507725cd6f1a970a0ae7f3e0326cb4ed5fe08625f4dd296acb903b4

SHA512
bd87f71cb64fc3d8f5c840ba2b8a952945baed1219a142f5e8350c879cfc0e5a3a71b9c7ddca45bb7df5050791ee30dbf7d090f4f53b5e5f1eec2988cf6e6ba1

Download Submit
C:\Windows\SysWOW64\Lqndhcdc.exe

Filesize
55KB

MD5
d6956fd2286eb350a0181515dff02184

SHA1
566bf4d29c29a16cfc52cb56f526da65f114d733

SHA256
f20e7cc6a049c7c6976ac8a8c12bce7fbca7923e36e53e3eee2d6cf12ecf49ae

SHA512
1a07a4c8109692de96baa324edcb9c8663760e987cc3c31a4b1487060b2cd644e54962edf7d915059164f04b6888ec4c7abd02735a1767a33e824d979bb5608c

Download Submit
C:\Windows\SysWOW64\Mmnhcb32.exe

Filesize
55KB

MD5
d1ac188bd63ef058b79768b4e0115944

SHA1
7b8bfa95037cff8ede7e6aa3666555d7c73a2970

SHA256
529fe1fc7a175c18636fac1775244e2a2b9cff1849156df8dc32758d4eafc371

SHA512
69f73c916f042957eba2894c755fb4922505840b1d731edc9ff8c5574d5db44b252b5a318f4bace99f06bf610e9f44304931dbd5cd268651b4c17f79b8c3f639

Download Submit
C:\Windows\SysWOW64\Modgdicm.exe

Filesize
55KB

MD5
713340bb7fd97b81fd02988bccf22f8a

SHA1
4ea5e866e0a43e5278d8c86a6a482b1121bba488

SHA256
cc4d4b0dfe5f84d045e2662861b5b84dd65409f8455f54e44690fb9ff4269e8d

SHA512
0e90b2568057970b17f29653c1a31847d8a428c61f2d07ba97f4757533ae031b868fc776c242ad05944a382381c63f5622d1b0abad84728a9c04174001ef4023

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
55KB

MD5
32602e3584dd51956ec030da1d02b0a9

SHA1
07149b1962b8adcf344afe3dec56536489058f51

SHA256
fdaf242af17c9137221c2e3c8365a4e9432fefb9cc6a02f2a389bc2c8d676a6c

SHA512
1c6651b9aa3836ecd636a0859ada381b8b32f13f45d112c98b2b21712f0f58cb5371bf05a1108e941f02114dfc005bc408b995e8e13fa756984254e2ee83d9a2

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
55KB

MD5
1a2e3c7bf7cad5a5c4db1a5ef9d6d724

SHA1
2755dbd59d6a5a73364d64d37d83c396fef12f6d

SHA256
6b59c526c7cdd38de00b7398580af42f1a9438f8c1ec84ef26aeb035bf5d4635

SHA512
d0cd82409458e1a17da709d924c0bba9cb92f8506496b2e11477122a585f1af2cdf9566e9f9853dc4375f5d663ecf53191c13250d3f0b3e4a5911a466f4c9234

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
55KB

MD5
a3af00f5bb44878849b90ec4bef8ac1a

SHA1
04bb2a6a2954aa4172a8e000429bf887ef8e8ef9

SHA256
e16cb110a6647fe9f91f364bcb2f4908b04b81b9bec0247e4a1b7e7c8594a7d3

SHA512
dcc6c40d718550a1639a21e26a10909d71f4c82b4e3ae31c26abb369444f13a51ec5fef8335a1350745a2a61e3b05373c1c2aaacdfa2d70a2f19a488338b4fd9

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
55KB

MD5
fa091829981f6a0b9679d190ed57d2b5

SHA1
bb40fd01889ddbb6ae4a38be4b6056b2abdf0fbf

SHA256
2a7328b2ebee97253a178a318e7419d8cb15b98cb8d70618b98bc3ec3b32d5d0

SHA512
387b0edb51cef4d417ee0ee6cca2b877aeb4144caff8f2a036e94dd5e94f3b9df8e7c3860b044194d8cc70a78fce430eb00273e388da2d49de2bf846b035bdb9

Download Submit
C:\Windows\SysWOW64\Ocohmc32.exe

Filesize
55KB

MD5
155574f66813c719d4e5b869f0a05e72

SHA1
e7aa3ddf42de8aab4fca15f4511350ce49117c1a

SHA256
6f5d75def3d365c168427bc0b93264fec3d98bc8faaffa72da1710012e6b0e71

SHA512
8c4d5ee70a69f41be0b850a7f05542a745b215e1670be98c68d5b67c4df7cb5032814d4ecc6414c9b2f9988af3b24582200d492bb8c909d49f4d46db4944ff64

Download Submit
C:\Windows\SysWOW64\Odoogi32.exe

Filesize
55KB

MD5
a9b91772cca62118e218530045560859

SHA1
b7182fbe3acfc1ce830f68ca28af54f401bd1eea

SHA256
08d18110d4dc180c876e8dc54d54dee3b7d3c9e71d58ba44cc6edcf045196b80

SHA512
bdf6fb5db6434475a7f70328e73cc4332cda6731e224186e78d4c54b68e5730839084014ac0e790bb639d494292e83fa11020e2302064cff3b7c98a99df202c4

Download Submit
C:\Windows\SysWOW64\Omcjep32.exe

Filesize
55KB

MD5
487c5fe00a1dc0051b14d72bd88a5991

SHA1
7c75228b825c55260f55906f72d144d0390e3675

SHA256
fb5755b22eefba92952bce5a9297b9b486e53f1c3ca7702f41b0694922ace033

SHA512
b3fc99ae3b45c650f3197c271a2f28de46c52799d288fe389a89230b35891b511acbbc1e0af72b06387d28877248ea2ec0e3b193a46f2282009a29bc86176547

Download Submit
C:\Windows\SysWOW64\Omjpeo32.exe

Filesize
55KB

MD5
27af1bf91230f2239b88aa7b3c377513

SHA1
6ffa56b6fc4fffe3d9588486679a5440000ee168

SHA256
72b5190b7fee412c91b783dec28527d107040551bd352631bad8e0c99a21f5dd

SHA512
93eb113bff74f627b7060bf6f1af3c4c9c5d87a625688b6199ca974d65ff39d71c36848f11b80a25bb612431ec2ed11d020a67d612fe1d4f1fac3ef4ee7bed3c

Download Submit
C:\Windows\SysWOW64\Opeiadfg.exe

Filesize
55KB

MD5
9f6316d0ec8ac6022bb5f0c0ce2f1cc6

SHA1
f6be194d3c0d969fd14ffae4eaaad8360ba75a72

SHA256
4965928926c8c1c1ab76fdc0bf7e98a10a8554df1d924ae2350ba19dcd27a7d7

SHA512
103ac7a3d85748df6e748140a8457423254bcc623004133730a05431222b7220fde69ea0f7e7c06e000b1d7975b77f006c5b6b77f5166b6db048e105309ef06e

Download Submit
C:\Windows\SysWOW64\Pagbaglh.exe

Filesize
55KB

MD5
bb374729ac5a3460a6848b889893821a

SHA1
b65f79310567fbf99baf873a6d627efe90b72866

SHA256
b91d0999b412f9a5b150f588c14fc787b298cad99294af95016ea3f43b39238f

SHA512
3718d79e7b780fea2896a091cc880b67091640561f6c51ecbaab6a5c80aeda3c2fad9c5504388043fc29adc0f5e00cab601358dc72cfdeade2c3454deb6cc5c2

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
55KB

MD5
758cc768a0a9ec6942559c69fcdaa984

SHA1
3b792dcc65190959211fa23ce0ae2b65c181689b

SHA256
ce3474605c0bfc6bd12952cdb49b8a76ac85fa2b9767144aacee51d88d052bac

SHA512
687ece6e1f627d356052906ea0e41213a48c6086dc12a2b45b6546ea3867cef59a35e098371ffeee998ce7f90338ca462e285b0b207e405d7add5900cbcadcd6

Download Submit
C:\Windows\SysWOW64\Phdnngdn.exe

Filesize
55KB

MD5
e7cbb369d487c5640abc151fdef69d31

SHA1
551aad0f642ca26565f758922da26abee8b6f315

SHA256
e1908df97a2a75a3cc63e583d66ca2d6336488f3e2f597bad680cf7f421f2c82

SHA512
e2b53e457a6fb6231a051cf9cf279296dd430f1afc6330f3a353b5e20b43807236b8fc2568baee2331f4c1a29a0a4523529db8280c296c9f8049b211b8a98dac

Download Submit
C:\Windows\SysWOW64\Phfjcf32.exe

Filesize
55KB

MD5
607bca0aa2695939161c214ebcb8de27

SHA1
4f401e975b5a4a28a4e4092d03420db27b090e97

SHA256
64492ee015e631b7aab8751f9e4fceace0b172cbd939f45c4bdb8312927187f3

SHA512
f848787f31585b665454af7039c4b796e0a1fe990634f4ad0040128c6ad15d470d669418262137488c64b6f4c477cec49794e850b723ecb5fd4965fef6420b35

Download Submit
C:\Windows\SysWOW64\Pjpfjl32.exe

Filesize
55KB

MD5
6203b9f75dc7177c6dcce9c71dff2a81

SHA1
908c35cecc14e787af274dbedd3bfd97a22042b8

SHA256
713347085e617ea7aaa78d96ab4b65c37f4a14759c967b72b687bd9eff8c3c8e

SHA512
e4994e756915187d7d245dfc4b7629735ab77400938fd0cc208aea49165f73cd0a0524970edb7521e457d81208b4bb14bc2e4628dc741e79a65414f21d95d659

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
55KB

MD5
ef015b65e0598b724fb6ed226e7429c7

SHA1
7723877270385a16737e0459830476d878e5bc93

SHA256
5f12067f3d3d0b7a976e81df71606fdd960bffe0977d7910f8318d026d77c72a

SHA512
a6fb3847dcad35f098d15bff028f72887ebf4343dc4e212bd20927def930bd20888023919e6e826dbbd5f5078fd59baf65d2823512a90a1a46c93b1a4745f1c1

Download Submit
C:\Windows\SysWOW64\Qaalblgi.exe

Filesize
55KB

MD5
d51b73be17b20fee4a4f010e8c993f38

SHA1
8368e4abe2b643c7aac101b5816a777a8a9d4c7b

SHA256
ac528a69b1583fbf76debfc665af7de56e4b92253d59c8466f4279ae2d84ea2a

SHA512
db46ac075f6a8716b10ccf46a211d5ca457af247422c6eec39436b440f28a1a31e65f9c85725db11d4c6307b08e5cf6c8f4c4359ad7f43f21d770924eb03603c

Download Submit
C:\Windows\SysWOW64\Qhjmdp32.exe

Filesize
55KB

MD5
f18383aae9374247e9f5d496abeb0df1

SHA1
0442e4ac9b9f34a4b82762a066767e4ce886cf16

SHA256
0815967ba8a10d95efd497b81481ab48c905ecbdf8fbc1321d589dd6c61b87dd

SHA512
e84af66a2c9e2e65a0838205ba4852c3d4a5fa736da48b267f5b1995fa73d4e5bf9d4f1fe5908cdc294152245a66670ca1394a5e577e208aea6e494ccf247ccf

Download Submit
C:\Windows\SysWOW64\Qklmpalf.exe

Filesize
55KB

MD5
091d8b3972d1b307d8f3f867d58788a8

SHA1
b78a4c2faa2624d339a36386a961ba7ed60e6cdb

SHA256
4ffef3340e2e83ab403f25f6796fe84091175122c99ea2e7d1881297a534a2df

SHA512
147860b9eaf6a805d175ff66fa49879bd8a8bf0ce0522a40b9728c10e0e997c39d5345a64f28848a7d46d6d3b5a8dba45491ade71045ad6f91ac1aadcd44ba65

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
55KB

MD5
77a48ac2e19d83dfaacb96aa68993489

SHA1
378d99e33d913def6e1b839876129aecd3880c8f

SHA256
93e85680c9599c3d2fc4e82624347f4c3e93a155770117c5cefd70d03a9c3b7b

SHA512
9fc49ca8e0f9987930a86efa67cc59d5832744048b1b85936b35234fa9a13057ccccd3fa806761f5e7032ed8f286761878269da5ea39f94003c6ecd287bcb13c

Download Submit
memory/116-337-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/436-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/556-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/556-593-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/740-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/764-478-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/808-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/884-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1184-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1204-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1248-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1248-551-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1468-526-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1488-573-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1520-484-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1596-231-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1612-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1676-472-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1776-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1848-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1864-594-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1896-565-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1896-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1984-586-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1984-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2148-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2320-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2344-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2352-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2352-572-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-579-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2492-454-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2604-520-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-587-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2724-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2808-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2888-496-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2916-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2924-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3004-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3016-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3040-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3080-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3216-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3236-566-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3248-514-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3288-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3404-538-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3420-460-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3472-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3500-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3512-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3560-552-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3580-559-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3588-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3624-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3652-580-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3752-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3916-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3952-508-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3996-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4000-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4084-502-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4100-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4136-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4248-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4324-344-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4328-448-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4332-545-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4336-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4352-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4412-544-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4412-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4432-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4484-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4504-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4584-326-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4620-532-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4640-350-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4676-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4684-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4744-223-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4756-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4756-558-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4792-215-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4844-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4872-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4892-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4928-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4952-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4972-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5044-466-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5064-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5076-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5092-490-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads