berbew | a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43

Analysis

max time kernel
104s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe
Size

96KB
MD5

22426411b2b7e69d5592419829eb6174
SHA1

abc82f2b86cb1e13f619ec592a0864cc3dc12362
SHA256

a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43
SHA512

cc09ef3f800bda2c832f544fa9bc3a7626fcfb1ff5a92be08691ee3619ad5c77779ff9ce8e793e6aae26436f3f19b6edea638749f80817e474a5c0b0bae98b60
SSDEEP

1536:bWcsmonucCSpk8b5w9mqy7jvEgUVtQduV9jojTIvjr:ichonNCSprbu9m37j8NVtQd69jc0v

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiaoid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbfgppo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkjeomld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfigpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkjeomld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gikdkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egohdegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfigpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdehni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onnmdcjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plpjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qklmpalf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhgonidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jihbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fffhifdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdmkhgho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlepcdoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfpell32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcinna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmflbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdccbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aekddhcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngndaccj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Knhakh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pefabkej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkdcbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efccmidp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hginecde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qeodhjmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojiiafp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Filapfbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Malpia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiahnnph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiaael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglhld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfqmpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckfphc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfkbde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkalplel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmbhgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efjbcakl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjhloj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgaokl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nndjndbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ponfka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pejkmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qeodhjmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmfeidbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iolhkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemooo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgccinoe.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4884	Bcinna32.exe
3904	Bheffh32.exe
4796	Bkdcbd32.exe
1452	Cfigpm32.exe
1316	Ckfphc32.exe
3424	Cobkhb32.exe
4620	Cmflbf32.exe
4464	Codhnb32.exe
4804	Cbbdjm32.exe
4904	Cmhigf32.exe
4972	Ccbadp32.exe
1784	Cfqmpl32.exe
4404	Coiaiakf.exe
1160	Cfcjfk32.exe
1772	Ckpbnb32.exe
952	Dfefkkqp.exe
3656	Diccgfpd.exe
1884	Dcigeooj.exe
3772	Dfgcakon.exe
4784	Dkdliame.exe
5036	Dfjpfj32.exe
3184	Dmdhcddh.exe
2656	Dbqqkkbo.exe
3968	Dmfeidbe.exe
4196	Dcpmen32.exe
436	Dimenegi.exe
2460	Dlkbjqgm.exe
4624	Ecbjkngo.exe
4420	Ejlbhh32.exe
3272	Epikpo32.exe
1604	Efccmidp.exe
2884	Eiaoid32.exe
1144	Ecgcfm32.exe
2128	Ejalcgkg.exe
116	Emphocjj.exe
4844	Eblpgjha.exe
3532	Eifhdd32.exe
4412	Eppqqn32.exe
2004	Efjimhnh.exe
3804	Ejfeng32.exe
2352	Emdajb32.exe
3128	Fbajbi32.exe
768	Fikbocki.exe
4120	Flinkojm.exe
632	Fdqfll32.exe
3620	Fjjnifbl.exe
1504	Fmikeaap.exe
2228	Fdccbl32.exe
1340	Fjmkoeqi.exe
2548	Flngfn32.exe
4372	Fdepgkgj.exe
4868	Fjohde32.exe
1132	Flqdlnde.exe
4360	Fffhifdk.exe
5044	Fjadje32.exe
2092	Glcaambb.exe
1372	Gbmingjo.exe
4212	Gmbmkpie.exe
2528	Gpqjglii.exe
3144	Gfkbde32.exe
3036	Glgjlm32.exe
4468	Gbabigfj.exe
4812	Gkhkjd32.exe
4800	Gpecbk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eifhdd32.exe	Eblpgjha.exe
File created	C:\Windows\SysWOW64\Kqdaadln.exe	Kmieae32.exe
File created	C:\Windows\SysWOW64\Llgmeiqa.dll	Mgclpkac.exe
File created	C:\Windows\SysWOW64\Bnfihkqm.exe	Akglloai.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Iophkojl.dll	Kqmkae32.exe
File opened for modification	C:\Windows\SysWOW64\Mnmdme32.exe	Mjahlgpf.exe
File opened for modification	C:\Windows\SysWOW64\Fechomko.exe	Ffqhcq32.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hmmfmhll.exe
File created	C:\Windows\SysWOW64\Fqibbo32.dll	Jokkgl32.exe
File created	C:\Windows\SysWOW64\Ehmjob32.dll	Lqojclne.exe
File created	C:\Windows\SysWOW64\Onkidm32.exe	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Kqbdldnq.exe	Kmfhkf32.exe
File created	C:\Windows\SysWOW64\Bjjhhfnd.dll	Bkaobnio.exe
File opened for modification	C:\Windows\SysWOW64\Iikmbh32.exe	Ifmqfm32.exe
File created	C:\Windows\SysWOW64\Jaonbc32.exe	Jpnakk32.exe
File created	C:\Windows\SysWOW64\Lafmjp32.exe	Kadpdp32.exe
File opened for modification	C:\Windows\SysWOW64\Llnnmhfe.exe	Lcfidb32.exe
File created	C:\Windows\SysWOW64\Cmhigf32.exe	Cbbdjm32.exe
File created	C:\Windows\SysWOW64\Egacbb32.dll	Ikbfgppo.exe
File opened for modification	C:\Windows\SysWOW64\Qmhlgmmm.exe	Qoelkp32.exe
File created	C:\Windows\SysWOW64\Cjceejee.dll	Pfdjinjo.exe
File opened for modification	C:\Windows\SysWOW64\Aajohjon.exe	Anobgl32.exe
File created	C:\Windows\SysWOW64\Gfqnichl.dll	Ckclhn32.exe
File created	C:\Windows\SysWOW64\Fihnomjp.exe	Efjbcakl.exe
File opened for modification	C:\Windows\SysWOW64\Akccap32.exe	Alpbecod.exe
File created	C:\Windows\SysWOW64\Jkakadbk.dll	Ckpbnb32.exe
File created	C:\Windows\SysWOW64\Dfgcakon.exe	Dcigeooj.exe
File created	C:\Windows\SysWOW64\Efjimhnh.exe	Eppqqn32.exe
File created	C:\Windows\SysWOW64\Fjjnifbl.exe	Fdqfll32.exe
File created	C:\Windows\SysWOW64\Kiljgf32.dll	Dmlkhofd.exe
File opened for modification	C:\Windows\SysWOW64\Ojqcnhkl.exe	Ofckhj32.exe
File created	C:\Windows\SysWOW64\Oikjkc32.exe	Ofjqihnn.exe
File created	C:\Windows\SysWOW64\Bnhenj32.exe	Bkjiao32.exe
File opened for modification	C:\Windows\SysWOW64\Joekag32.exe	Jihbip32.exe
File created	C:\Windows\SysWOW64\Paihlpfi.exe	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Mgclpkac.exe	Meepdp32.exe
File opened for modification	C:\Windows\SysWOW64\Nmenca32.exe	Nnbnhedj.exe
File opened for modification	C:\Windows\SysWOW64\Pdfehh32.exe	Pecellgl.exe
File opened for modification	C:\Windows\SysWOW64\Ifomll32.exe	Iohejo32.exe
File created	C:\Windows\SysWOW64\Ofckhj32.exe	Njljch32.exe
File created	C:\Windows\SysWOW64\Lqpamb32.exe	Lnadagbm.exe
File created	C:\Windows\SysWOW64\Jhghaf32.dll	Olfghg32.exe
File created	C:\Windows\SysWOW64\Amoljp32.dll	Aknifq32.exe
File created	C:\Windows\SysWOW64\Hmmfmhll.exe	Hibjli32.exe
File opened for modification	C:\Windows\SysWOW64\Jepjhg32.exe	Jmeede32.exe
File created	C:\Windows\SysWOW64\Pmapoggk.dll	Giecfejd.exe
File opened for modification	C:\Windows\SysWOW64\Lcfidb32.exe	Lafmjp32.exe
File created	C:\Windows\SysWOW64\Jhdnigno.dll	Ilccoh32.exe
File created	C:\Windows\SysWOW64\Lgjijmin.exe	Lekmnajj.exe
File created	C:\Windows\SysWOW64\Jheldb32.dll	Mjokgg32.exe
File created	C:\Windows\SysWOW64\Ohhnbhok.exe	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Jongga32.dll	Fbjena32.exe
File created	C:\Windows\SysWOW64\Ocjggbdl.dll	Glgjlm32.exe
File opened for modification	C:\Windows\SysWOW64\Kclgmq32.exe	Kqmkae32.exe
File created	C:\Windows\SysWOW64\Jjgobjmp.dll	Nndjndbh.exe
File created	C:\Windows\SysWOW64\Dnmhpg32.exe	Dokgdkeh.exe
File created	C:\Windows\SysWOW64\Hmpcbhji.exe	Hehkajig.exe
File created	C:\Windows\SysWOW64\Fcokoohi.dll	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Jknfcofa.exe	Jddnfd32.exe
File created	C:\Windows\SysWOW64\Bhhqlkph.dll	Kjccdkki.exe
File created	C:\Windows\SysWOW64\Kmfhkf32.exe	Kjhloj32.exe
File created	C:\Windows\SysWOW64\Jeciaina.dll	Dbkqfe32.exe
File created	C:\Windows\SysWOW64\Jgpmmp32.exe	Jdaaaeqg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13900	13816	WerFault.exe	691

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klekfinp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nabfjpak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfehh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giecfejd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loofnccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfcjfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkeekk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhahaiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbbpmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fimhjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmafajfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iafkld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glcaambb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Injmcmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjccdkki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blqllqqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efblbbqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geaepk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfojdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkhkjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnmkfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omegjomb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkjiao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddjpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbpjaeoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keimof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieccbbkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mapppn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfbaalbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaleemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmdhcddh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojfcdnjc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihdldn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpnakk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Diccgfpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpchib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mogcihaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbajbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipeeobbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onkidm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aefjii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dheibpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edgbii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfgcakon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipmbjgpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkjnfkma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcecjmkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkpmdbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phdnngdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lomqcjie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkadfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oalipoiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacoqnci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okkdic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imkbnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjhloj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgobel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Najmjokc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jngbjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdnhih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpnjah32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejoigd32.dll"	Jjlmclqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maiccajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leifdf32.dll"	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkgmdnki.dll"	Dkahilkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbiockdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldipha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iidphgcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Joahqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkphhg32.dll"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkaokcqj.dll"	Mhjhmhhd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfcjfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhblk32.dll"	Poimpapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglmfnhm.dll"	Bemqih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bheffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjkblhfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkegpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emdajb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knooej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcecjmkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbihjifh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiabl32.dll"	Mjkblhfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmpdihki.dll"	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnlkedai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlofcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mebcop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Poimpapp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Joahqn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Onnmdcjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bndfbikc.dll"	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmflbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fajbad32.dll"	Hginecde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgfhfd32.dll"	Klekfinp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccbadp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efjimhnh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdkdgchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgamhc32.dll"	Dhgonidg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gaqhjggp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pecellgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fnlmhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfdqcn32.dll"	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhlkdj32.dll"	Paoollik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anaomkdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopnfa32.dll"	Pdkoch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Badanigc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnidloo.dll"	Blqllqqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hlepcdoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfgomdnj.dll"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghgmioe.dll"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmikeaap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcecjmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nlhkgi32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4884	4608	a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe	84
PID 4608 wrote to memory of 4884	4608	a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe	84
PID 4608 wrote to memory of 4884	4608	a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe	84
PID 4884 wrote to memory of 3904	4884	Bcinna32.exe	85
PID 4884 wrote to memory of 3904	4884	Bcinna32.exe	85
PID 4884 wrote to memory of 3904	4884	Bcinna32.exe	85
PID 3904 wrote to memory of 4796	3904	Bheffh32.exe	86
PID 3904 wrote to memory of 4796	3904	Bheffh32.exe	86
PID 3904 wrote to memory of 4796	3904	Bheffh32.exe	86
PID 4796 wrote to memory of 1452	4796	Bkdcbd32.exe	87
PID 4796 wrote to memory of 1452	4796	Bkdcbd32.exe	87
PID 4796 wrote to memory of 1452	4796	Bkdcbd32.exe	87
PID 1452 wrote to memory of 1316	1452	Cfigpm32.exe	88
PID 1452 wrote to memory of 1316	1452	Cfigpm32.exe	88
PID 1452 wrote to memory of 1316	1452	Cfigpm32.exe	88
PID 1316 wrote to memory of 3424	1316	Ckfphc32.exe	89
PID 1316 wrote to memory of 3424	1316	Ckfphc32.exe	89
PID 1316 wrote to memory of 3424	1316	Ckfphc32.exe	89
PID 3424 wrote to memory of 4620	3424	Cobkhb32.exe	90
PID 3424 wrote to memory of 4620	3424	Cobkhb32.exe	90
PID 3424 wrote to memory of 4620	3424	Cobkhb32.exe	90
PID 4620 wrote to memory of 4464	4620	Cmflbf32.exe	92
PID 4620 wrote to memory of 4464	4620	Cmflbf32.exe	92
PID 4620 wrote to memory of 4464	4620	Cmflbf32.exe	92
PID 4464 wrote to memory of 4804	4464	Codhnb32.exe	93
PID 4464 wrote to memory of 4804	4464	Codhnb32.exe	93
PID 4464 wrote to memory of 4804	4464	Codhnb32.exe	93
PID 4804 wrote to memory of 4904	4804	Cbbdjm32.exe	94
PID 4804 wrote to memory of 4904	4804	Cbbdjm32.exe	94
PID 4804 wrote to memory of 4904	4804	Cbbdjm32.exe	94
PID 4904 wrote to memory of 4972	4904	Cmhigf32.exe	95
PID 4904 wrote to memory of 4972	4904	Cmhigf32.exe	95
PID 4904 wrote to memory of 4972	4904	Cmhigf32.exe	95
PID 4972 wrote to memory of 1784	4972	Ccbadp32.exe	96
PID 4972 wrote to memory of 1784	4972	Ccbadp32.exe	96
PID 4972 wrote to memory of 1784	4972	Ccbadp32.exe	96
PID 1784 wrote to memory of 4404	1784	Cfqmpl32.exe	97
PID 1784 wrote to memory of 4404	1784	Cfqmpl32.exe	97
PID 1784 wrote to memory of 4404	1784	Cfqmpl32.exe	97
PID 4404 wrote to memory of 1160	4404	Coiaiakf.exe	98
PID 4404 wrote to memory of 1160	4404	Coiaiakf.exe	98
PID 4404 wrote to memory of 1160	4404	Coiaiakf.exe	98
PID 1160 wrote to memory of 1772	1160	Cfcjfk32.exe	99
PID 1160 wrote to memory of 1772	1160	Cfcjfk32.exe	99
PID 1160 wrote to memory of 1772	1160	Cfcjfk32.exe	99
PID 1772 wrote to memory of 952	1772	Ckpbnb32.exe	100
PID 1772 wrote to memory of 952	1772	Ckpbnb32.exe	100
PID 1772 wrote to memory of 952	1772	Ckpbnb32.exe	100
PID 952 wrote to memory of 3656	952	Dfefkkqp.exe	101
PID 952 wrote to memory of 3656	952	Dfefkkqp.exe	101
PID 952 wrote to memory of 3656	952	Dfefkkqp.exe	101
PID 3656 wrote to memory of 1884	3656	Diccgfpd.exe	103
PID 3656 wrote to memory of 1884	3656	Diccgfpd.exe	103
PID 3656 wrote to memory of 1884	3656	Diccgfpd.exe	103
PID 1884 wrote to memory of 3772	1884	Dcigeooj.exe	104
PID 1884 wrote to memory of 3772	1884	Dcigeooj.exe	104
PID 1884 wrote to memory of 3772	1884	Dcigeooj.exe	104
PID 3772 wrote to memory of 4784	3772	Dfgcakon.exe	105
PID 3772 wrote to memory of 4784	3772	Dfgcakon.exe	105
PID 3772 wrote to memory of 4784	3772	Dfgcakon.exe	105
PID 4784 wrote to memory of 5036	4784	Dkdliame.exe	106
PID 4784 wrote to memory of 5036	4784	Dkdliame.exe	106
PID 4784 wrote to memory of 5036	4784	Dkdliame.exe	106
PID 5036 wrote to memory of 3184	5036	Dfjpfj32.exe	107

C:\Users\Admin\AppData\Local\Temp\a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe
"C:\Users\Admin\AppData\Local\Temp\a7683ec7ca26b7ecd5f4c8f1029511e119c6e17f296fbb88c478a50cd0185f43.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\Bcinna32.exe
  C:\Windows\system32\Bcinna32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\Bheffh32.exe
    C:\Windows\system32\Bheffh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\SysWOW64\Bkdcbd32.exe
      C:\Windows\system32\Bkdcbd32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1452
      - C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1316
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3184
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        24⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        26⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        27⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        29⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        30⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        31⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        34⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        35⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        36⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4844
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        38⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4412
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        41⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        44⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        45⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:632
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        47⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        50⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        51⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        52⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        53⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        54⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        56⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        58⤵
        Executes dropped EXE
        
        PID:1372
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        59⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        60⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3036
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        63⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        65⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        66⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        67⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        68⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        69⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1820
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        71⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        72⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        73⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        74⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        75⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        77⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        78⤵
        
        PID:608
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        79⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        80⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        81⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        82⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        84⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        85⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        86⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        90⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        91⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        92⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        93⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        94⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        95⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        96⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        97⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        98⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        99⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        100⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        101⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        102⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        103⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        104⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        105⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        106⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        107⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        108⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        109⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        110⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        111⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5592
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        112⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        113⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        115⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        116⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        117⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        118⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        119⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        120⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        121⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        124⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        125⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        126⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        127⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        129⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        130⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        133⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        134⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        135⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        136⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        137⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        138⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        139⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        140⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        142⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        145⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        146⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        148⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        150⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        151⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        152⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        153⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        154⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        155⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        156⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        158⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        159⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        160⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        161⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        162⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        163⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        166⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        167⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        168⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        169⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        172⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        173⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        175⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        176⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        177⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6652
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        179⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        180⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        182⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        183⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        184⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        185⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        186⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        188⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        189⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        190⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        191⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        194⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        195⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        196⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        197⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        198⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        199⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        200⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        201⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        202⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        203⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        204⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        205⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        207⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        208⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        209⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        211⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        214⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        215⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        216⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        217⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        218⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        219⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        220⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        221⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        222⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:7236
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        224⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        225⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        227⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        228⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        230⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        231⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        233⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        234⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        235⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        236⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        237⤵
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        238⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        239⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7612
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7952
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        245⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        250⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        251⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        252⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        253⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        254⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        257⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        258⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        259⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        260⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        261⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        262⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        264⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8380
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        266⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        267⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        269⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        270⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        271⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        272⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        274⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        275⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        276⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        277⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        278⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        279⤵
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        280⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        282⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        283⤵
        Drops file in System32 directory
        
        PID:9176
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        284⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        285⤵
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        286⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        287⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        288⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        289⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        290⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        292⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        293⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        294⤵
        Drops file in System32 directory
        
        PID:8848
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        295⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        296⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        297⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        298⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        299⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        300⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        301⤵
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        302⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        303⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        304⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        305⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        306⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:8836
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        308⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        309⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        310⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        311⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        312⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        313⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        314⤵
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        315⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        316⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        317⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        318⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        319⤵
        Drops file in System32 directory
        
        PID:8620
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        320⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        321⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        322⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        323⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        324⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        325⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        326⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        327⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        328⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        329⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        330⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        331⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        332⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        333⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        334⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        335⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        336⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        337⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        338⤵
        Drops file in System32 directory
        
        PID:9648
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        339⤵
        Drops file in System32 directory
        
        PID:9700
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        340⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        341⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        342⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        343⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        344⤵
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10036
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        346⤵
        Drops file in System32 directory
        
        PID:10068
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10112
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:10156
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        349⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        350⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        351⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        352⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:9476
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        354⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        355⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        356⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        357⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        358⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        359⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        360⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        361⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        362⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        363⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        364⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        365⤵
        System Location Discovery: System Language Discovery
        
        PID:9496
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9620
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        367⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        368⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        369⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        370⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        371⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        372⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        373⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        374⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        375⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        376⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9420
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        378⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        379⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        380⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        381⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        382⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        383⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        384⤵
        System Location Discovery: System Language Discovery
        
        PID:10180
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        385⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        386⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10296
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        387⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10384
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        389⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        390⤵
        Modifies registry class
        
        PID:10472
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        391⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        392⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        393⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10632
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        395⤵
        Drops file in System32 directory
        
        PID:10668
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        396⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        397⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        398⤵
        System Location Discovery: System Language Discovery
        
        PID:10776
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        399⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        400⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        401⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        402⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        403⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        405⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:11068
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11104
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        408⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        409⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        410⤵
        Drops file in System32 directory
        
        PID:11212
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        411⤵
        Drops file in System32 directory
        
        PID:11244
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        412⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        413⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        414⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        415⤵
        Drops file in System32 directory
        
        PID:10440
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        416⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        417⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10640
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        419⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10784
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        421⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        422⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        423⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        424⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:11132
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        426⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        427⤵
        Drops file in System32 directory
        
        PID:11256
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        428⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        429⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        431⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        432⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        433⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        434⤵
        Modifies registry class
        
        PID:11092
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        435⤵
        System Location Discovery: System Language Discovery
        
        PID:11184
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        436⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        437⤵
        Modifies registry class
        
        PID:10508
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        438⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        439⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        440⤵
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        441⤵
        Modifies registry class
        
        PID:560
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        442⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        443⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        444⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        445⤵
        Drops file in System32 directory
        
        PID:3004
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        446⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        447⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        448⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        449⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        450⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        451⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        453⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        454⤵
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        455⤵
        Modifies registry class
        
        PID:11036
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        456⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        457⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        458⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        459⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:11344
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        461⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        462⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        463⤵
        Drops file in System32 directory
        
        PID:11452
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        464⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        465⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        466⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:11596
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        468⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        469⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        470⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        471⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        472⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        473⤵
        Drops file in System32 directory
        
        PID:11820
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        474⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11896
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        476⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11968
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        478⤵
        Drops file in System32 directory
        
        PID:12004
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        479⤵
        System Location Discovery: System Language Discovery
        
        PID:12044
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        480⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        481⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        482⤵
        System Location Discovery: System Language Discovery
        
        PID:12152
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        483⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        484⤵
        System Location Discovery: System Language Discovery
        
        PID:12228
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        485⤵
        Modifies registry class
        
        PID:12264
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        486⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        487⤵
        Drops file in System32 directory
        
        PID:11364
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        488⤵
        Drops file in System32 directory
        
        PID:11424
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        489⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        490⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        491⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        492⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        493⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        494⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        495⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        496⤵
        Modifies registry class
        
        PID:11916
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        497⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        498⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        499⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12176
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        501⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        502⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        503⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        504⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        505⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        506⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        507⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        508⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        509⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        510⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        511⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        512⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        513⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        514⤵
        Modifies registry class
        
        PID:12028
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        515⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        516⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        517⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12256
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        519⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        520⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12144
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        522⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        523⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        524⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        525⤵
        System Location Discovery: System Language Discovery
        
        PID:12428
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        526⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        527⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        528⤵
        System Location Discovery: System Language Discovery
        
        PID:12536
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        529⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12608
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        531⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        532⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12720
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        534⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        535⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12792
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12828
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        537⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        538⤵
        Modifies registry class
        
        PID:12904
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        539⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        540⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        541⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        542⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        543⤵
        Modifies registry class
        
        PID:13088
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        544⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        545⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        546⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        547⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        548⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        549⤵
        System Location Discovery: System Language Discovery
        
        PID:13308
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        550⤵
        System Location Discovery: System Language Discovery
        
        PID:12340
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12416
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        552⤵
        System Location Discovery: System Language Discovery
        
        PID:12484
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        553⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        554⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12600
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        555⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        556⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12800
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        558⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        559⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        560⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        561⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        562⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        563⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        564⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        565⤵
        System Location Discovery: System Language Discovery
        
        PID:13304
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        566⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12380
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12524
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        568⤵
        Drops file in System32 directory
        
        PID:12664
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        569⤵
        Drops file in System32 directory
        
        PID:12776
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        570⤵
        Drops file in System32 directory
        
        PID:12888
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        571⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        572⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        573⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        574⤵
        System Location Discovery: System Language Discovery
        
        PID:12376
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        575⤵
        Modifies registry class
        
        PID:12532
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        576⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        577⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12988
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        578⤵
        System Location Discovery: System Language Discovery
        
        PID:13208
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        579⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        580⤵
        Modifies registry class
        
        PID:12784
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        581⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        582⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        583⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        584⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        585⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        586⤵
        Drops file in System32 directory
        
        PID:13368
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        587⤵
        Drops file in System32 directory
        
        PID:13408
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        588⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        589⤵
        
        PID:13480
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        590⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        591⤵
        Drops file in System32 directory
        
        PID:13552
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        592⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        593⤵
        System Location Discovery: System Language Discovery
        
        PID:13628
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        594⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13700
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        596⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        597⤵
        System Location Discovery: System Language Discovery
        
        PID:13780
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        598⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13816 -s 420
        599⤵
        Program crash
        
        PID:13900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 13816 -ip 13816
1⤵
PID:13876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amcehdod.exe

Filesize
96KB

MD5
b4644e5c4bc0e81fecc3e691662238e0

SHA1
34ef51ff6f2b98a56bc3b6c51d0710afabe5308c

SHA256
91fcdef3d13d38895be16de2c5d8bd46d66eba629efa161d1384063d74a4211e

SHA512
c8d08cc9d84bcec765e8128f96f4ed9e5c561ac842f995684450da5ddf27dd96632a013dc37dbbd2e5cbdaf1cfe36c6def26f30869a5afc559177a1f3e9b65db

Download Submit
C:\Windows\SysWOW64\Bcinna32.exe

Filesize
96KB

MD5
51f0fe472a687b2026235f83e2a56994

SHA1
c48674cdd851a0dc362f1b7b681c274a22829e49

SHA256
e57dff3e22dac69bd2186427c40386d86f27dda2eb67f7fc4a2ebe53110850e8

SHA512
9d413e40c7396f813ebea510b2087b3f2edec400383efe6062e15edaf68412dd1e5f44595a7b74a17546a370fb4ab4838fea53d82dba75ce165dd2352bc16a34

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
96KB

MD5
dd1d10640d5642cf80606eec59a4ab46

SHA1
834f041405f19c4bdcd762361cd8689e3bf4401e

SHA256
a87910186d1453e461445f0c1987a23f1fb7b6adf1915db53a46f48c60813a8e

SHA512
90b561ee8674ad0992614a7058f7adbe08a9e62bd1f4d978b8e31c5469daa5a520c62399b6d79b863ea41c1593f1d91cab27c682f7ee2456a3a80257cf40e4f5

Download Submit
C:\Windows\SysWOW64\Bkdcbd32.exe

Filesize
96KB

MD5
265fc7b47904ebb19b98a40a418ccc78

SHA1
89f32324e0d0c3125afc856ecaa789e1729acc24

SHA256
b6cb3751749b7a2d4f162617e4ba090c4c29c81b72af94a74a7e44437ea5c127

SHA512
e4f57bcf5c173b4231234e4920f8897278e7d2c482754a59d36e4b048fe3ed3ac5e686ff4078240b8755393ed452be90e8538f314a7cfb8540f5e0cd6b99d534

Download Submit
C:\Windows\SysWOW64\Bklfgo32.exe

Filesize
96KB

MD5
d9dc4f1ca9466c0e694b844e98dc631a

SHA1
122cfc5fe20407a3486bf9e25814d3c580fa4df1

SHA256
fe21afbb7c1019ccdd2116e91fcbd6e26bac8a38ec23b1d4c8f7b1b08c73d3d5

SHA512
1d284b1c729809165856127ba07fa62f5b4128a5ddff72a094188f489f6983998802dfb9ad39630074ac5c248f3f9c8f411181eda28057753f1671ff87f11708

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
96KB

MD5
64efe74ac0f3f3082e19a5c907ac2e56

SHA1
14f129338805d1d171bc98f999dcce7986c6747d

SHA256
7fe807d01897ac131648a951cdb53517d6f2f4658baa32ad4d57ed14b2fe2f0d

SHA512
bda25ba67078c47c32efdcddbf75c167322f936dfa6eb1cec5aee7b7e7d1726ffd56bcd91497e98ebd3416340f8761c37d389638391d260ab4fe98e440e68a94

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
96KB

MD5
f005e6c18170cd25f9a74f5e5aab1151

SHA1
6b26802c2bc87d71c51cf291ea4bed57c30bb9cd

SHA256
2072c79ac4ea0e850568a194fb2b81311a54ea93c7b9d29259d204b1c238a16c

SHA512
b3e34458d91783189c9594ab1d5e505bc2db89a3072b759b42ffe89792f15beba206498d56ff089ee89354850a7584ade665729eb3844910e0c4d1751767986a

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
96KB

MD5
bdc3a854a62400ee60eb03b41217686a

SHA1
1a60908d8b464fe9add088fe221f33940737c60f

SHA256
03f0dfb0c9cf4923d06cd98cc9fa87c3ebfe3412b81e15538c6d1902e9baa9cc

SHA512
4a25156fd598d9ba25498a4ca95eecec510556767b817d708de921c99ec5de476e2e8b376fe8554731d1c894293c93bfeb192e7d2d7e2b50d26c20b6f08cca89

Download Submit
C:\Windows\SysWOW64\Cfigpm32.exe

Filesize
96KB

MD5
d9aba357874ed6388afbcd680f3dd038

SHA1
60939d13e64c42cbd43034a98ba45dcbfc321a49

SHA256
62ba43aa86f5770491eeb5df7589cbf4b8025edb5999ffbfb34e52a607077557

SHA512
bb45ec2e1dd30113e0657732c578f0d8ac90d52af56b0b065266052c92cf9dff03a03f85f9856662860ffc0cfb85a9df825032dfe4a6cbef94f65a98bd97231d

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
96KB

MD5
909a2568b92a542e2013fb0d1a909c21

SHA1
d6a21dd53e955399de6b03ae02e6444f93fec38e

SHA256
2d72ed0e86a016dba86af8c8b9c95b138f633057d5fd791521c6659fb766aea2

SHA512
c631ef8eb5d5011a2a1cc3ffbc2db4955d6e7d4c39c2a63126ca211b5949f55e42d2c1403de928413f3938a4b0f3399f97fc32582ab8c9c1eee11050e5ccb0a5

Download Submit
C:\Windows\SysWOW64\Ckfphc32.exe

Filesize
96KB

MD5
5b660af9a31f5a323f729e397352db04

SHA1
7454105703b0d6ff9b9b7828af11d697476eefc8

SHA256
1f9453c244e127ffbc1d2150075b9fd2a752de12df84afdc2d1c5960db510517

SHA512
a91fe32879a67304a586c05a401ecbd79e235586d2df9849bc24a8a84cd6beae16619de1077c3f2df13c7ff6c22a0a44aaf3dcb43837577f5bd023213ec32b93

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
96KB

MD5
868d1089f4729feee2a69b07b58ea7e8

SHA1
2e391a3328a2ee27228b230650de07f36ae22ecf

SHA256
fd7d4709c895af399d30c81fc794874d7c1ca5fc1f7b71e7abb7620144331b83

SHA512
94638e3e2749968930e0e5faa5af11432fc8b00b1d25515db5f07a742c5791b1287a4fb9f9e630af09b6e5b5d5cb66635a4a13853ab3854e2e8c2cda2f8c6216

Download Submit
C:\Windows\SysWOW64\Clgbmp32.exe

Filesize
96KB

MD5
1365c29142ca547cb212709911904f3e

SHA1
29e9f0d687cafe9f308c594729b5131ef848821c

SHA256
c9a9280dd2054f2fed02df837a74b18e3d68c520f68a2a6313433914735e3097

SHA512
627fffafc607aa575088d13e00cff3cf3b99bb6117aec61242a9911064774f861993548ac66447aa266f9bae188e560d470623680be282ebced4f80ba045dbfa

Download Submit
C:\Windows\SysWOW64\Cljobphg.exe

Filesize
96KB

MD5
011d104f1e84e1aeb3cc8a26dae94156

SHA1
bf4fcf8c92093d0429cb08760ecf8eeadd62f144

SHA256
ab86baf08eb549aa10d83e8b8b67c3405eaa5646590edeadfb2721be9fb40a2d

SHA512
767e4a5e0a2ee13f3298e6e29413f6377f214a3a7517a8cf9c50d5b4103a4aa7566449abe3df23a5fb7d641c6f28a0ab053be3815a3e9f546d692c5ddd52e7cb

Download Submit
C:\Windows\SysWOW64\Cmflbf32.exe

Filesize
96KB

MD5
07746f91d3c7bd3990237cadbfedb1ba

SHA1
2aa2fee8cbfd582afa94b62152c662093e7cb78f

SHA256
a4558f178ea12eeffffeea12f4b3ac8bc93388a4826f243ce45dc26e0241a31e

SHA512
f5c538af351601a81bbe16e7daff423a9325ddfef1df21aa623f35959d85d7a0850501c494de25edea83d1ec7f760d71b56576e0e10cb24cb4db92823130bedc

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
96KB

MD5
0ffbdfff2d3fdcaaa9dd7228d917c852

SHA1
a186d324643635a466d7c1104581a93c3bad1abc

SHA256
c21d1dbf3bdd98a0bf6e5490ba785e62a1aea5a8247133b022697e64c961280b

SHA512
ac16acecab8ad6ddb441206ab4ccefb76cd791939e7b9827cd79fabb0ae3ecdea3ed0d0e3374b09656965bfcfffb3ffa39d66cf37824715dfff568806ac3f23e

Download Submit
C:\Windows\SysWOW64\Cnhgjaml.exe

Filesize
96KB

MD5
b080b20a084e124bc8f1f0b90f1a3891

SHA1
4fb92aa4dc8e320cb459957c3273635e6afd893e

SHA256
45a8ce64b3b5a94e26dac5d66a861a64d41c62113c0044afecb9ef60e26f6b18

SHA512
b6d8767a395bd794b11e7e1e39ff32bda784ffc57011c4f8203ca9be968a129aab8fcc2ea072d1f81fd9ca507e12eb88d0772f1b3aa9cab676ebde852c41848a

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
96KB

MD5
4626c55b451e7c9b0a6d2c889cbe25cb

SHA1
3af8c7690a98fa3cd736f859089179664f2f14ca

SHA256
d860d38547fb5f29f419924b2c832164c51648c17b7d2bbd8778ed57e8918f30

SHA512
0aeb357f0e1416dabfade4997171aee947032fd7ff8e220ce42359c7dd3f7f48ba8a7943d261fa5a3768df7fe9114f2f254219fb61b62d584911a3fef76e12cd

Download Submit
C:\Windows\SysWOW64\Codhnb32.exe

Filesize
96KB

MD5
2cd98b58ef9d96179c12c7870633200f

SHA1
8e634b0280a5ecfa6723d55f954d33a51aea4402

SHA256
e0ce37531b7f99930a0823b8daec20c7bd0b1b44d47f77d7d732eb6415f37c7f

SHA512
fae47d0a61ff35dc31826c9d0de9a215d71aea0b77c95fcabbffee8434953fa05e20e28a61ae39d31bc05305d4650e495b10fe8b03490586335aa22fc1241ab8

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
96KB

MD5
7d51424b19594918cff20a0acbd26017

SHA1
7c153b9328e3f46b5f1d18045bde1a469029c395

SHA256
8fda5e52c12cbab05c92dd388e0e7807475f71a1753a0f83f34fe3d3e44e32c1

SHA512
8d0bfcb9a8c696e866cb93e38ccde1dd6e653d4ae5e4c43a6288fdb962435f8fee2ea41cee70bbf18e99913a5495374afef1ce541a47a94b0090378b9da16527

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
96KB

MD5
7c27cdeb1d0a839b02d872a17eed801e

SHA1
60eedf7696b2ad97a932c233dfdd9976bef01e4b

SHA256
106638f93d18136c1dcba5e6f6bed00a5132924655db60b50062ce8c3895b622

SHA512
41b897969e2f8d4c850eeb6a6b7a25f81dcd8dfeb48bf0824d954be1353b284c83a31f7f0dfbe2774a7f87212aab761b262e0b026e03fbc876220e3841d2e944

Download Submit
C:\Windows\SysWOW64\Dcigeooj.exe

Filesize
96KB

MD5
2076dd7e56279e4a0d108b2ff7eee5c7

SHA1
f4a778751568df67a864233a0ee1dbf1dc5f6899

SHA256
118b8dbe36d44dab66f162472e9dc5e6cf894a54c83d198d00ec2d200b2ffa5a

SHA512
6a1aa2b2f2c69e792804b6ff23e9fae7069b3728f8ce0c7552fb03b2f58d072f046acb2d6f79bd0d2b49d03d387d55e29669df2bbec3319be5b5862431e43d15

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
96KB

MD5
2cb25f6a4b51c8abce8f69d528d507ef

SHA1
a982175815bc335404dcad7d8eb6bf6fd2b9364b

SHA256
89468d604ab5892a39b7d605a73ad292b832131115c237d17b18833811e3a330

SHA512
36ac6cf35e932aac6e4528473fd0dbdf197ee228a899decf7276dd9f879cd3d8a9d3162b4d75f278cb87b4880663810d13ac26ce05264d781ded623b00e17d34

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
96KB

MD5
b0f9f13b759a0449a7a377ad5ddce274

SHA1
68eab75f9c32bc5b0e5aa8eb076f953ccbe8165f

SHA256
aee17110f3e364d4cbf6d9481b747952da490c0ee254ed8db339a4388c890c30

SHA512
fe3e0f1030bd7bab13e714e1c7e808acd2c88dd788b9db740f7bd8370e0737f368ed01d981541190e34846f1d4cb66f552b61f1d5478be90c173564f0fa81c9d

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
96KB

MD5
7a7aaf6ae6a2304fcf1c808f143c3902

SHA1
845586fa149dd506bd4f34427fd16c9744ef0069

SHA256
c5e91f0994298ea007be47e9931bf6b90bb40bab23c640c3a17a7a0594f566fc

SHA512
4675c1dd6b24fb4b39e1580d45c460ee6fb97eaa4479eeff72d42b2d97e74b5561343dbe2d20a248ce4d3630298976f995490ff40332205ee3f4657f8398e83f

Download Submit
C:\Windows\SysWOW64\Dfjpfj32.exe

Filesize
96KB

MD5
c70180d973f2a718ef7caf5970e9a788

SHA1
9ec4f76e9bc5df33f03f22b6ffbcb0a64c49d81f

SHA256
3a8e2aa65636cbb5c4c8f5414be29087e08ee0d5c1404abd6273fe39c34ba2a5

SHA512
283d316ee891225028bb328479e3d0789181d1cb74085632d943abc84dfb618ff506c419f7b32ae14ede97d4a5eb83940802268bd80b67e671b04c7e38e76edb

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
96KB

MD5
aaaf54ccaeba9302a6477243b98a5a81

SHA1
daa2f6901c170dbaa01ebc77691101cca75c8ff8

SHA256
f6c51ba26933b877340f7d9e24132d2daab548b9552ab6c100823d8f527b34e4

SHA512
e149fd3d4aabe1153a62e8761470f2e22ff5d781c10240de2d2292fba8ba83a9820eec2bde775bf4653c3a4f6e2fec3c9cddc5454dc2df5bfdc659b4b6a1a8c1

Download Submit
C:\Windows\SysWOW64\Dgeenfog.exe

Filesize
96KB

MD5
1276a60fd0e2978340b4bdafe0bce271

SHA1
ea18329542d714f06566f5a00fedd8463fe833fc

SHA256
612f01b6a70d6ae9db187a9aca2b4355f6b94b8a250c1cc9cfc8d4fe01da8969

SHA512
ce4b6277decdf5822a32ffaa86715a954be48b6bd89137594e2520f21c22147f0da230d19aede10e089e7006e898799e337c03473c1666c192597d08c6e32439

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
96KB

MD5
8d3d23bbaebcbb756803cd54ecbb0952

SHA1
85c002b06aae4f097caafaa1ab736afedbe92ff6

SHA256
47e830f774e8652f416ad4e27912a938f43d67723a9acd15c535b8ab411d2fdd

SHA512
2841cf41dd533f234063f2b759f696a4c7255faad6f42ad22aca9cd92600c6fb03d79c99dfec993a5a841e867458f355856bc5e73652f6407d55f0b21616b84d

Download Submit
C:\Windows\SysWOW64\Dimenegi.exe

Filesize
96KB

MD5
963a927a92a2cc9edd1f6bd754305c01

SHA1
2723140edd0b922253f98bf1250aa6064cde5f4d

SHA256
9621d74f7f2fe0dac00d1bc988eaf470bc654acac605bec95344739db4faf48a

SHA512
aea0cc0037d6114fe03706331342211542de9ba14b68ec0a80356bdbd022f499272c41dcca8528134b0939847e29c0a2e41c54a44da1972838723da7205b45ac

Download Submit
C:\Windows\SysWOW64\Dkdliame.exe

Filesize
96KB

MD5
e8c53e8ea92d125a57b45b4801b9d760

SHA1
99a7c48fb003b99a6d50cacb23a9744faccb189e

SHA256
c9545de9a994eb71c30c4543df1441bbe54628f8c09a305588ddb4f6b3b2513f

SHA512
425d09fac60a35916cafb12c9a7221dc42942b0441e69e927b2e9baa3053ace0e3552a53aa741ffef462e5f8804ddd9ced4a4afcc105a8c7b1b4fe1c3e7f7b34

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
96KB

MD5
84bdf02bc9f10ef9e00d3f831442933d

SHA1
69683ffaf6c772fff4561b64303b9687a6d5e681

SHA256
98238413541de722b0aebd90e4fee7dbc9e90390cfad7b8d211f21f7800d2381

SHA512
081877b51f0ef32f4f81b672057dafc3c95b0b708945df71519889efd2ff0d78868ff724fccdaacf73c0233bf13d3e3a6504ef1018903c68a0e658ab2a98fab6

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
96KB

MD5
b20aa3a2703ad36838f12f4c21cfc958

SHA1
c8d92f5ebcade8840bff48fd55b7a570cd047952

SHA256
36d2130caf2528e1f69d60fd9bbe2420364ee12864b4d1b6847c6c11750db013

SHA512
1912f95ff4fd788f670bc633ca72a5cfd358a10efa83aff41486b1d1e1351fb20e2ec21a5067a4351173a4d85cbff7639a5361f95f021eae8e322f2d32ef3d45

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
96KB

MD5
d28b040393f0e66bfc73aaac2555d81a

SHA1
99d77c3acbd00ab6091017b03f686c884f96a7bf

SHA256
b3c2c609c54bfb5b49322e4f6674d56534133c3c1bfa1f86c33c2e75d231f526

SHA512
35209a9bf61b2afb7299d45506e8e901c9684006ad9ae983c82a62f430bf84b537f186c040af37ac9ca96d7c0ad44f8abf6fc2b61455044f2f836e1754e82b44

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
96KB

MD5
f38ace7dfa8d1571dbc91486be1c5444

SHA1
31766b7f2380266f83fa9923feb6a7171485ffb9

SHA256
443886f6de502b60e2e4943dcd04618c9d7137e841d55fb1ed2c2ec96687ce93

SHA512
7cbc9e6d2243def3f90087858c8dc0ec8aaaf370007cf96fcd66ba62fede67082da4e05765808be2b366743ba6963f66bc898e52abfbfbdb50b49507fbf2653a

Download Submit
C:\Windows\SysWOW64\Edgbii32.exe

Filesize
96KB

MD5
12727b671930abaf99dd5cb45c49a58e

SHA1
bd3ee21c818a7652a6f8d835d3dc6222d2645263

SHA256
7b61aa328e2bd6dfa9c3490f59e66a54dfd8e641710f389baf3771629ac05398

SHA512
cc50f6f623d028be0f99a6891b82e67d6660b803b95d8f5a0f82c3daea340c1578794219b102b1852ea9a8f6bc7ac4448ccaedce17759afb98cbcaaa86fb5cc1

Download Submit
C:\Windows\SysWOW64\Efccmidp.exe

Filesize
96KB

MD5
bcf89d6febbd03c70bd3f0a3becbfd04

SHA1
a1755acb9a8f1f969071ca04a1c38c0fee8b284d

SHA256
2aa24af01f51c95f142f2e44aa66e4133cbdf2666748f4b2de0bc701a73b44de

SHA512
d369db456d5777632382655d53095add4da6a24032967b55a7466b2ba58ea8b129baf4115dacdbabbb45b3b9577a12ab722243c6f267e08b0c2f67a571d979b2

Download Submit
C:\Windows\SysWOW64\Egohdegl.exe

Filesize
96KB

MD5
9de600f5322905560f7d1090651646ba

SHA1
55fda8e37e88cf7ad981e90cd2c7add796ed870b

SHA256
b83c8954caab18b482406839a35a5fb97ad77782324b2799b85ba54edfdb8f79

SHA512
f0e8516b838a1083d5e02354f28274092384d47d8e96c083883fcfb001face7748d80467d678c86bf6328784e9b283ca6230386297d66e210a67758bda7fc7eb

Download Submit
C:\Windows\SysWOW64\Eiahnnph.exe

Filesize
96KB

MD5
c142c2503d453d127df0c704d3476d9d

SHA1
4c8be36f4c03a5bc37b056c17eac63abbc414fba

SHA256
11f7af60eddade6697eff70f75333b529817042f2990bcfaa9fd15c71e5a0438

SHA512
4849e2a36c38baee88de0c8f43bf59ed961bfcfecd142e7ba74bbb44be89cdaead984ba011b0c1970cccc15cf893578bea87d7b4446d315e0cdd9a805f136e41

Download Submit
C:\Windows\SysWOW64\Eiaoid32.exe

Filesize
96KB

MD5
5537bc41999c8d31d6b9ec9daa4feb71

SHA1
f1ccfb01396cafd3a772e3a13976408b900106aa

SHA256
af0d3e07d55617ea750dbf6c527963d6be875f17c0e3f887f053e98f8b685729

SHA512
34f66df9ca9d67a8e23fb481417ff273f197062130cf32f2c0307e373bcaf5ab23fe7b853195ac6e6cb7afe27532075279e989356f133bd4d10cb415a4dd9390

Download Submit
C:\Windows\SysWOW64\Ejlbhh32.exe

Filesize
96KB

MD5
75cd2fa4861c70a7c18f144866b68b59

SHA1
5aed4d233896fb3942443b47fa462a428b72d182

SHA256
83e80d4801c2785223d84e2f8f10ac41b2e7488b44921a67019c82c1034c96bb

SHA512
54c2b40f579ab0fda94a20acdc15b83ec7fa3dce6818902335f70091b95908ae068977f881853d0a0f77c110efd86a8e94bf75974929218f7f4699077a7fdf93

Download Submit
C:\Windows\SysWOW64\Emdajb32.exe

Filesize
96KB

MD5
e6a87bcc81005f6151848bd5f155d230

SHA1
b9114ba525a49f5ef802d8a68bef4a653044e045

SHA256
bdbea20dcef3d407713b5cbfc4213f7ad72790a9c7bf2d1807933ae797a7cbbc

SHA512
cfce4a834794b2ae7c9ee353c00e12efdb43c49d6cbcfe45d77dba509154ebce66d6985e21faf8ae386a54d1e4d42ca96104b31dd80f8b3a89d5e19c18058cb6

Download Submit
C:\Windows\SysWOW64\Epikpo32.exe

Filesize
96KB

MD5
78f35dd7b1d989d6c60a5c50e491b391

SHA1
db14bd58e78c7f00b1409b46e96551149b133e3e

SHA256
3c45f065ac4fd6b91dfc374f5bed0dccc148aacfe699d1d30440c225ce4319a1

SHA512
af1d10de9048c047a2720e01a72cfb6012294395f202454067532eb064a96d51e0fc38508baf4cf29c50548ad8b67e986f2d11751f9d18b2769e5cab08759335

Download Submit
C:\Windows\SysWOW64\Fbjena32.exe

Filesize
96KB

MD5
2448f5aff2bc39d58f00d3458f5b9a89

SHA1
4757175087e89e759b662890a77e0fe100f11ca9

SHA256
427c5f21b26d5269ed0bde41b8055951616510c484d3233ccf2f472efd879e16

SHA512
0690194e047d1f226f1cee12207724bb10381a823dd5fb017e508e6c82f9e8d72192eda531e7995aecabc46ce76338f51bc4b4d47022356f23c70c653795416c

Download Submit
C:\Windows\SysWOW64\Fflohaij.exe

Filesize
96KB

MD5
a7283dab9826bdd2ea7294127d3ffff4

SHA1
12806da9f294f16cbfa91e48e030d503446a4915

SHA256
76781b224f24b290c8003548a023bd7913467f5f610ef96918785f142f681ec1

SHA512
e5d0893930529cb84584ee680d3ae05b7e86e2f4b9f23e4f1e705e4319562b59083c2361dca217d25030fc5761b2a20679dee87d60c384013f57d0f243a09b9b

Download Submit
C:\Windows\SysWOW64\Fqgedh32.exe

Filesize
96KB

MD5
8689e979916555f6df2520a557729755

SHA1
87c4059bdb11d05552b48b939023d2268f724b7b

SHA256
448fa3835d97039a72a34f1f8cb84b5d297fac2167f56371497ce80b586f38ff

SHA512
906ca6000d8faa85ed3b6cb39bb2fbec0d65632f1adfd0a6692ad006ff8b1129b77d9274f1e0639de44285062dee6de6a8e52ff6b1c794f8399a7819d3f915e4

Download Submit
C:\Windows\SysWOW64\Gnpphljo.exe

Filesize
96KB

MD5
f63996c8928d2f035ec82280c53645f5

SHA1
1c32a977a305bc001bee98d307fb3d2479a6e198

SHA256
f994dfee7545b272bb43b5e6de76b4d8c68b35293fa34a6e8add8651a95b3e0f

SHA512
47bab7c818bad47d82e63273ae47b8ef1cc6e1659ec8361d0b9ecc21839ff24e8cce97e29dad7a4f6e60c799549ff73389fc9d3332e99a550c5ac3819733c4b9

Download Submit
C:\Windows\SysWOW64\Gojiiafp.exe

Filesize
96KB

MD5
f2b05e45682be744678fe303b6835975

SHA1
ac3baccc50d268b7c8f4d013c939162fc6fd6da0

SHA256
81f83f490c10c0b51fbbacfaaa9507b7dbbc7cfa09b1ccc8032f5d1d9c144a31

SHA512
fd7a5b0d4a424904a32f1ff8867251766be6093dd72591150d1d11c5a1a7419f1836d66f75d579e195dd9128bf1df2b5ba5d7511d2918c6ab36696331736af50

Download Submit
C:\Windows\SysWOW64\Hbohpn32.exe

Filesize
96KB

MD5
1aa1640380c51f3596ec0c5dc28bee77

SHA1
1e848367aac9eea62e24f3ee3415e97daef2f330

SHA256
65dca46e5ab6d2252e3212773a08158a5d7d3deab2d749c3c35e8a1703073c97

SHA512
c3f0dc202f03ad0ae0fd96e56866063ed8b32e4a101bb890b226b3fe61a32fae03d9db4aebaa60a9f30169850566fb51b2619a54c540421f805d47265d6f82cc

Download Submit
C:\Windows\SysWOW64\Hkpqkcpd.exe

Filesize
96KB

MD5
ef745ecc7ec6ad12ca58eab398a9a4ba

SHA1
cdbcdd5c61b57e928e776969a24ce2b7dccce5f7

SHA256
d03ae76026de4d2b7dd0ef7deb665d41d3b66953e8b074a12f0573cb85d9026f

SHA512
71f039ac2b3d37cf1342dd4a76928b5a598e01cc8c82fad1061e8ef7ab12cc4769ac72c5ef11813e5e7a15bf2b5e4052264f32cf584b37ff5b0e06324e7dc7d8

Download Submit
C:\Windows\SysWOW64\Hlkfbocp.exe

Filesize
96KB

MD5
3306c6d237701af82367fec01821286c

SHA1
2fceeaad3694043ba056fc6f2e138f243cb6f9e7

SHA256
2304d2c2f64481e2e2dbb2db8b3b7c286107a4cc2e157a9c8fad59a1035c3835

SHA512
b4b3a07b84766954843978cc20dd08e29350eb6ba797eacd9abfd187a490eb97c3ffa5670eafdbc3edddd644a2a07f4e12b72583d6a56e10cb684e55cd5dfeab

Download Submit
C:\Windows\SysWOW64\Ieccbbkn.exe

Filesize
96KB

MD5
600dfcf397ec7ad9d0d2c20e9e6eaa85

SHA1
17fa6b362c8b9d0eb121505876762ab4a8b182d4

SHA256
8fb971e9f0ca79d41cdd1f54ff0e4a9f8eea10edaf786ed82c2127bd4dacfd33

SHA512
5ee5934fe1f3e6974eaf73aea003bc60b8dc15c009d57763b451b5db9091ffe08b9831865c970d9043aaa25eddcb933bc0255abb231404a8b2f72e4448ca8705

Download Submit
C:\Windows\SysWOW64\Ijqmhnko.exe

Filesize
96KB

MD5
95a62b730e905af4883273d44f5bb84c

SHA1
f985fc26f09ed525dd35315515fca4cebe04558e

SHA256
3395feadfbb9d31a7a19385645bade8b82ebc92c48b39e959fe2e29eee1f7426

SHA512
3a08ecbe88f951650e93bab01d849d173159100e817c657cb334512ea4106c0680d8ac696956205b35e0638d15766a5c5b40245ac4f042a258e58f745b378203

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
96KB

MD5
c6dbe7257847b8abb9b3030d4836a6d0

SHA1
f3fe1d657d7d95b932f3929630abcd66ca8b1182

SHA256
2887eee93b83f152fdd2850e353a0d09fe6912b8e52cbd006f36cc1f745d5c68

SHA512
070db400086cafa2862abbfa09b578b234ded6e0ce48d4c9bd6f11c3a428015984a35cea022635d20eb251ac5a8d06bf269e4a14eeec96bdf3ae5f7fb9aa300d

Download Submit
C:\Windows\SysWOW64\Jklinohd.exe

Filesize
96KB

MD5
c650eb9964f0e8e91b4f58aa817fb6a3

SHA1
386be657a4c501d8db4d71781ae76a0d2f8aca8a

SHA256
0376c3e69176015595cdc4200f4e0edc478ba3088c01890101198cb77cba5ba2

SHA512
98f859e89bafcdab973c1d0f960201ebc7215fc083a98639f354020a4f7efb8ba42cd044d4e748d55c2d47c14e0126938b133c72d5099f964727321f19c323b9

Download Submit
C:\Windows\SysWOW64\Jokkgl32.exe

Filesize
96KB

MD5
eb8e232dab3085d80c4a295a62f1dd7b

SHA1
0c44c10f7af84e7474faa2fbbfd58b0545578609

SHA256
f87b2d53b97cd45b776f8c75252d64fc1f9c8d0202d1caca7585d169965b2271

SHA512
a6281a7ade6600256cd35e82fbe409a3bc41b299d9774640426d9d387455ed56a329334b36cb1d5e8b79ae53caf1e54e4395b94b88dd658056d49b6315baa3ac

Download Submit
C:\Windows\SysWOW64\Kcpahpmd.exe

Filesize
96KB

MD5
e14cbe93cc872653b9b422a538728df1

SHA1
76532a2eaca945ed50ff3f60349babb1f5385b0c

SHA256
3223c7b993904ed4f8bc80f5a56ab89f391909a2aa31589d0b3ca6eb68b469d8

SHA512
90b11feb1f5b7937e438949222e001b49a5bf4e7fb19a730060122ecdb61af5649207aa50c1b9ad2aaa8f815db04b71ba7a5e67664d74918591e97c87e1f90f8

Download Submit
C:\Windows\SysWOW64\Keimof32.exe

Filesize
96KB

MD5
9c806faf7a08d781d440c92008e71de5

SHA1
9b8f9929a051eb37830b014d45b97089c7c93cd8

SHA256
83d04114503d053d42d7f6dce14b4a21ffee1786b2cd3c447f6e022528ee6777

SHA512
80ad8e221a96f9063bd761115afc0e5630ac4c867702c397d83fd8213ae2665a1bdf02999d566eef0246a471467e47e127c6b37947982f9e7d1eaf997e0c8d50

Download Submit
C:\Windows\SysWOW64\Kemooo32.exe

Filesize
96KB

MD5
b4ecd53e1f1674d81153b5e0e6374723

SHA1
ca27498168a009535c7a3cb9ae0a2ed43adc9c22

SHA256
715d056c8f2e5775cd8010d0c35a78873928fa70bc867ae61b766b2226caee3d

SHA512
0d3edd4c3336f4ab0db8ced16aaf0f79a022aee221612160bef10098093aa0478ff596db50b541962fd8e444d45101cde49e1df3ad8a0afdf3975cc4284e393d

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
96KB

MD5
188b60eee6f9fba02c7842d8e834df88

SHA1
03480cffde1d75ca13425ea4258343b45b29dbbe

SHA256
6fec2be6556b3da3445f87d909b7187a5120c310ffcb46e52d017954ca42262c

SHA512
1f3467e07d7f08247c33d2213e47ba30d0b5d3aa85a5286936dd4cb1e63f2cfd09c4ec657f40c2f644d9fe48475102bc338088fc753ac117f2484ddd5e064696

Download Submit
C:\Windows\SysWOW64\Kplmliko.exe

Filesize
96KB

MD5
1db9436900f1b080d6f933761149d20b

SHA1
3ccc5f3f45bfd846f0f3085bf527a88de9819ced

SHA256
1cc5ecf5ae72a9e1f94da3b242cf3b50e9f02b2597edbe4059584c7c909f2aa3

SHA512
99bc1e08c0a9377be536852cac6a52ec90c6f2955e40605ae0bffb8c7905aa5bd85accdacfad2b71ee6668a2aebba55e8b8212abb57682990b297d4756def475

Download Submit
C:\Windows\SysWOW64\Llnnmhfe.exe

Filesize
96KB

MD5
e59def0e931249005549e5687972fb92

SHA1
5e73284b00641602be445942122adb8be08aed6a

SHA256
183cbade7ce7188d369096ec060ac9f9ea5342789af9bd3182744e37e7769942

SHA512
3cf6da3d1ad3a022ee34b9e4e0407e249898ecb2e56b74c4db40066a89a1c34c72d3e24bfee14306c8f702e8ab6c60749bef5fb95213b0064c3b17ef6464c370

Download Submit
C:\Windows\SysWOW64\Lncjlq32.exe

Filesize
96KB

MD5
fded302edd915f441d4d7f2a17e2f194

SHA1
cb09403fe8d3d291c7810097d2810358744d72be

SHA256
d4d2c43e847814261f0379e26a056dda6d2ee0f06246ae810529c013a78149cb

SHA512
1035263ed8f8abbd59498c9fe6862cbe6426449fd865dfde8b624fa884b7780ac44b9f31ae79eab2d7b773e68ba4f6b0f8dfa6fc1a901aef879f2dbc01af63a8

Download Submit
C:\Windows\SysWOW64\Mhldbh32.exe

Filesize
96KB

MD5
80832921b9d4589e805d4abf8078e496

SHA1
aab911cb8a7d8ff02ef09df58922a8fc077cd8c5

SHA256
fdf8366981cecb41f7900eeac0532bfae248b2807a8a4d86a26a68f0014e7e48

SHA512
3e3b41c401cde73276e1d812609953c617b15108999e746559613d3f8a178cecee2b813eb2be5b7beac027c22d8357088bfae80a57ff4b357bfdebf2c110802f

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
96KB

MD5
288d6ea17c4c750d8bdd21af62d3a63d

SHA1
991a7e1faf7ca620e2a93ee05d98f6738a691b97

SHA256
4eac7c479a78faf68f4951cf895ebbe96af3ed18217e973ec5c6d8c0c83472bc

SHA512
b6e1b812b1e063eff57c0392168ce2c91d43931287a4f1ffcaa4beb236586238fd9b6b08a541b040472517dc7948c3b06805535447f0046deb3d7b5c571669f9

Download Submit
C:\Windows\SysWOW64\Njljch32.exe

Filesize
96KB

MD5
b1897cea651d06900e147000f86ec887

SHA1
3144796e57e756e734c2b744c3239bf6ef61c939

SHA256
bce5d265a51d6ef39cb0bebb69da4e9a7717660da995599538fddfcf503768a1

SHA512
aab0adde5563208b783807e69857687e98d2fcf93b2387968384f02317090de072094190183164a0e1aaaaa2b3cf6c783dc8fe807043f66c829976123b526818

Download Submit
C:\Windows\SysWOW64\Nlmdbh32.exe

Filesize
96KB

MD5
5b117b8b6c76fc2af682670fdacf5f5e

SHA1
ac238c2c38049fd247544d44b05745cae69c7930

SHA256
4cb932b79f0f71f1a0073b2bad6d42ca6059007f8d17c4184cb7f05014368862

SHA512
b6336e17ca07efb211277a17d8ee01419147088e99e7f4f9a287655c4bd5e946bac2f3dc8ca2109995c2083e6d71b07f812982b77cc14750d202f985155831c5

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
96KB

MD5
bfa8c2faa136dd4878e659ac0ac333e2

SHA1
5c05a9f00fef4dcfcf8d476482205da0750491f0

SHA256
123f1c88d512f69ee882d057fc912b20972599133e00b8f296ee4723526f6d1f

SHA512
e9ffa7a8aedb085ad59f1156a02c78a16a8b221a02341ebd4dd08170fec16ab7d7906689dcf91481e9742e212887540927d96e3ad8478432a382c6c054b44812

Download Submit
C:\Windows\SysWOW64\Nmlddqem.exe

Filesize
96KB

MD5
9af3a6fa597f4a7452dfaf5844b8e4c8

SHA1
7c3b3b42b4ff3ac917fb2ef059210d753bbc793c

SHA256
30e6de7b8964520d8b6ed875971ffaa51388db35efb1ab4e0607e7e6f58d4581

SHA512
c3ba628d0bf29a2dcdca133827c86b275d7fd25451a48f055cc737b07f9a069576b4bc91deaae9f31a7f11ae9afcff9666a2754c0151ce8388f214be0eafff13

Download Submit
C:\Windows\SysWOW64\Omgmeigd.exe

Filesize
96KB

MD5
7b1a28d89c27ec1fc65ec845cb877607

SHA1
a132385545a8628240a9f77ac5d6bd19c3313b97

SHA256
e341f22bf7245d53cae162146e708ccb995ca65728d3485faec63882b5df3e20

SHA512
37bc3d0c410d31864cfb5a201f11bb409b5c00f0803510cec7d7a99f93e6bc6dc582b0d24c6ef5a13311c4c447c4aca4114b0f12bb4825bba06b39531175103e

Download Submit
C:\Windows\SysWOW64\Opngmi32.dll

Filesize
7KB

MD5
4f494abc436260401f72bf2415f0f391

SHA1
6899816fe9093123165f11bb879457dcb5ef5777

SHA256
3ce4efea7b32e008f9a7ced420dad90a60f87323babe97744875d58e7166cb32

SHA512
378413c535533d20900f146c30e5d81be347cf3092a53e469ec080fe1da7b5d00aaa0bf575b333dd84217f0564d9c01f18b4647fd587e8965d3d10151ce8d6dd

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
96KB

MD5
f9804a16f3e551b019a3ea1bad9ef085

SHA1
4581a88c6ef112dc604e06d76aaedb1cfb6fa1e8

SHA256
45352ef4066f8682b2452a1a26eb3ea15031cebd53bda4e618d0174c669d02b4

SHA512
d63e886a19a404f3f896268a5f1736df976be922ab8110456a3587b36f0b3e7907e69c556acc6d3a913d5c8d0d8a9b90a2f23103ac1ae3037a144b63e8f486a9

Download Submit
C:\Windows\SysWOW64\Pififb32.exe

Filesize
96KB

MD5
2cc14fc289c58b7fd3733bc7c848dc04

SHA1
47547b55238a89664e030340fa8e773187db6f87

SHA256
cd58179ec5d0d10deb11ce9c21ade4c0194ab4768cc7994ca88145ccebd54373

SHA512
672fe8b6aee73c2e93cbdd368861547a7474d933d4366d6ba499d31482aceb21414aebe82ad474a387dad7a79af99d464b5a8bcb4a49f37a3ef308d5ffb226b8

Download Submit
C:\Windows\SysWOW64\Pmlfqh32.exe

Filesize
96KB

MD5
619dbaa1de9b5d1bbc1f8f16c2e6de0c

SHA1
a0d08b3e3ece4caa64ffbd77862a5df93584ea65

SHA256
a06d020288ffe3f50b7c8143775cdd8b7a38ab8eb099db9322888f7f6df5ea05

SHA512
232918fde3e921da4568deec738834460cc4dfc361dfb2bfc6d31dcee08a1959703e76cfd3cd0ddefe9d3f78fa0ad6bb6a7716af226f15cded6589cb44b9eea1

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
96KB

MD5
e74b27fa0565ab191a314870e1e7a784

SHA1
08e2e0328f1f57c8cb2005b3386b9454629627e6

SHA256
9a4178aea96af6dce76bd393d5cb8eb7bdbe59cc9fe220243a99a2241e37aef5

SHA512
d77ad85b3d0e64631875f66e00361ea3a1f5c717e98be5c206cbdfdbb994060197862f6fa6b190df26d7b7995ef65686a5a3bfd3df0f482c829d0e06ae42a668

Download Submit
C:\Windows\SysWOW64\Qhkdof32.exe

Filesize
96KB

MD5
d4d3c554d251a3c4b46f3e8a5a7c7ee3

SHA1
ace18c6f208bfd64a37e642d68278de661340089

SHA256
2f1c8c578f9e6081f3c0db9ddfb2caa8da5dc68bf3c03687c426819a1ed5f176

SHA512
81adb36a103472864172741c1703451c3dd060a732ee1195722e44be500d911c3a3c849f5532d7d7127187092804351f092e820c64bf66194ce29efe57d10102

Download Submit
memory/64-514-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/116-274-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/392-460-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/436-208-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/608-526-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/632-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/768-322-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/952-127-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1132-382-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1144-262-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1160-111-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-44-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1340-358-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1372-406-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1452-572-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1452-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1504-346-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1604-248-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1772-119-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1784-96-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1820-478-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1884-144-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2004-298-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-400-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2128-268-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-352-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2324-508-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2352-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2460-216-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2528-418-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2548-364-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-466-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-183-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2660-494-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2884-255-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3036-430-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3128-316-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3144-424-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3184-176-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3240-573-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3272-245-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3404-559-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3424-585-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3424-47-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3532-286-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3540-488-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3620-340-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3656-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3700-520-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3772-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3804-304-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3864-532-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3904-558-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3904-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3968-191-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4072-455-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4120-328-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4196-199-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4212-412-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4216-496-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4360-388-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4364-538-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4372-370-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4404-103-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4412-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4420-235-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4428-566-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4460-472-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4464-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4464-599-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4468-436-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4560-552-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4608-544-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4608-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4616-502-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4620-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4620-592-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4624-229-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4784-160-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4796-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4796-565-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4800-448-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4804-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4812-442-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4844-280-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4868-376-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4884-551-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4884-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4904-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4972-88-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5036-167-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5044-394-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5064-545-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5152-583-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5196-586-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5240-593-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads