berbew | 36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2025, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe
Size

359KB
MD5

1e82d175933f2965db12c70bbc9d5533
SHA1

6847ffc99a826e700ce82a97c3aac3f2adff741f
SHA256

36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb
SHA512

b55d6ec6c13d9c14d12375a21d9dad3997e865eea62c1f98f7610c99c0cb66d9c60fa87390f9a920f70c5379697c36c38dcc788366e1ceb02d91b8b531e877a0
SSDEEP

6144:CNZH0zvr//3YVrOigcC6oQ6+EcC6oQ6+YahBQyiTACPTRN6+YahBQyiTAgiuMRl0:/kK9E6n9E6vah6yiMCPTRN6vah6yib6S

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Alelqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omdppiif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hahokfag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebaplnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Haaaaeim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohhnbhok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbicpfdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcghg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdpaeehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dcffnbee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhikci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plpjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmlkhofd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jiglnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jljbeali.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeheqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmkdcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfjjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jihbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halhfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcmfnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hplbickp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iedjmioj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpogkhnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nmigoagp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncabfkqo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plbfdekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mljmhflh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpiecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Monjjgkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aimogakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bddjpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hffken32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnnccl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmhbqbae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gemkelcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jenmcggo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjhmbihg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fpimlfke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefgbh32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4468	Lqkgbcff.exe
4528	Lmbhgd32.exe
3680	Lnadagbm.exe
1300	Lqpamb32.exe
3092	Mkhapk32.exe
2376	Mgobel32.exe
2012	Mcecjmkl.exe
3320	Mjokgg32.exe
3392	Mgclpkac.exe
2360	Mnmdme32.exe
4600	Mcjmel32.exe
4824	Mgehfkop.exe
216	Mnpabe32.exe
3236	Mmbanbmg.exe
4028	Meiioonj.exe
540	Nclikl32.exe
3204	Nghekkmn.exe
1764	Njfagf32.exe
804	Nnbnhedj.exe
4004	Napjdpcn.exe
4780	Nelfeo32.exe
1740	Ncofplba.exe
3868	Nlfnaicd.exe
1936	Njinmf32.exe
3748	Nmgjia32.exe
4812	Nabfjpak.exe
5008	Ncabfkqo.exe
2412	Nlhkgi32.exe
3520	Nnfgcd32.exe
2668	Nmigoagp.exe
4340	Neqopnhb.exe
2404	Nccokk32.exe
728	Nlkgmh32.exe
4836	Nnicid32.exe
4372	Nagpeo32.exe
2816	Neclenfo.exe
2324	Nhahaiec.exe
1440	Njpdnedf.exe
1920	Nnkpnclp.exe
3532	Najmjokc.exe
116	Odhifjkg.exe
3656	Oloahhki.exe
3056	Onnmdcjm.exe
3112	Oalipoiq.exe
3052	Oeheqm32.exe
2616	Ohfami32.exe
3576	Ojdnid32.exe
4256	Omcjep32.exe
4060	Oejbfmpg.exe
3476	Ohhnbhok.exe
4784	Ojgjndno.exe
4700	Omegjomb.exe
3996	Oelolmnd.exe
4716	Ohkkhhmh.exe
2316	Ojigdcll.exe
3468	Omgcpokp.exe
100	Oeokal32.exe
1168	Ohmhmh32.exe
4952	Okkdic32.exe
4692	Oogpjbbb.exe
4964	Paelfmaf.exe
5140	Pddhbipj.exe
5176	Plkpcfal.exe
5212	Poimpapp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fkaokcqj.dll	Mhjhmhhd.exe
File opened for modification	C:\Windows\SysWOW64\Mcjmel32.exe	Mnmdme32.exe
File created	C:\Windows\SysWOW64\Nmigoagp.exe	Nnfgcd32.exe
File created	C:\Windows\SysWOW64\Cghane32.dll	Cleegp32.exe
File opened for modification	C:\Windows\SysWOW64\Iiopca32.exe	Ieccbbkn.exe
File created	C:\Windows\SysWOW64\Aimogakj.exe	Abcgjg32.exe
File created	C:\Windows\SysWOW64\Dgihop32.exe	Djegekil.exe
File opened for modification	C:\Windows\SysWOW64\Fcbnpnme.exe	Fglnkm32.exe
File created	C:\Windows\SysWOW64\Lmafqb32.dll	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Ljqhkckn.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Ahfmpnql.exe	Akblfj32.exe
File created	C:\Windows\SysWOW64\Iimcma32.exe	Iafkld32.exe
File opened for modification	C:\Windows\SysWOW64\Kedlip32.exe	Jpgdai32.exe
File opened for modification	C:\Windows\SysWOW64\Omalpc32.exe	Oonlfo32.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Nlfnaicd.exe
File created	C:\Windows\SysWOW64\Kdflmg32.dll	Plkpcfal.exe
File created	C:\Windows\SysWOW64\Dlofiddl.dll	Hifmmb32.exe
File created	C:\Windows\SysWOW64\Cpogkhnl.exe	Cienon32.exe
File created	C:\Windows\SysWOW64\Bgeemcfc.dll	Napjdpcn.exe
File opened for modification	C:\Windows\SysWOW64\Bahkih32.exe	Bojomm32.exe
File opened for modification	C:\Windows\SysWOW64\Jiglnf32.exe	Jghpbk32.exe
File created	C:\Windows\SysWOW64\Appfnncn.dll	Klahfp32.exe
File created	C:\Windows\SysWOW64\Lnjgfb32.exe	Lfbped32.exe
File created	C:\Windows\SysWOW64\Njmqnobn.exe	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Pjbcplpe.exe
File created	C:\Windows\SysWOW64\Biepfnpi.dll	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Ncabfkqo.exe	Nabfjpak.exe
File created	C:\Windows\SysWOW64\Lfipab32.dll	Eiokinbk.exe
File opened for modification	C:\Windows\SysWOW64\Glgcbf32.exe	Gmdcfidg.exe
File opened for modification	C:\Windows\SysWOW64\Lhqefjpo.exe	Lpepbgbd.exe
File opened for modification	C:\Windows\SysWOW64\Mjnnbk32.exe	Mljmhflh.exe
File opened for modification	C:\Windows\SysWOW64\Ojemig32.exe	Ofjqihnn.exe
File created	C:\Windows\SysWOW64\Gclafmej.exe	Ggepalof.exe
File created	C:\Windows\SysWOW64\Gaakdpkj.dll	Ohfami32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhnbhok.exe	Oejbfmpg.exe
File opened for modification	C:\Windows\SysWOW64\Iedjmioj.exe	Ibfnqmpf.exe
File created	C:\Windows\SysWOW64\Dmokdgeg.dll	Loighj32.exe
File opened for modification	C:\Windows\SysWOW64\Dhbebj32.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Khlklj32.exe	Khiofk32.exe
File created	C:\Windows\SysWOW64\Fkemhahj.dll	Nlhkgi32.exe
File opened for modification	C:\Windows\SysWOW64\Geohklaa.exe	Gbalopbn.exe
File opened for modification	C:\Windows\SysWOW64\Jofalmmp.exe	Jlgepanl.exe
File opened for modification	C:\Windows\SysWOW64\Mhjhmhhd.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Aciihh32.dll	Nclikl32.exe
File created	C:\Windows\SysWOW64\Ojdnid32.exe	Ohfami32.exe
File created	C:\Windows\SysWOW64\Hojpmg32.dll	Pddhbipj.exe
File created	C:\Windows\SysWOW64\Gmdcfidg.exe	Gemkelcd.exe
File created	C:\Windows\SysWOW64\Pghien32.dll	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Lphdhn32.dll	Jikoopij.exe
File created	C:\Windows\SysWOW64\Oqhoeb32.exe	Niojoeel.exe
File created	C:\Windows\SysWOW64\Fohhdm32.dll	Cpcpfg32.exe
File created	C:\Windows\SysWOW64\Akccap32.exe	Ahdged32.exe
File opened for modification	C:\Windows\SysWOW64\Adndoe32.exe	Aekddhcb.exe
File created	C:\Windows\SysWOW64\Jhglpo32.dll	Ckeimm32.exe
File created	C:\Windows\SysWOW64\Eiahnnph.exe	Ebgpad32.exe
File created	C:\Windows\SysWOW64\Hoobdp32.exe	Hplbickp.exe
File created	C:\Windows\SysWOW64\Jiglnf32.exe	Jghpbk32.exe
File created	C:\Windows\SysWOW64\Ombnni32.dll	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Kheekkjl.exe	Kpiqfima.exe
File created	C:\Windows\SysWOW64\Gnepna32.exe	Glgcbf32.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hefnkkkj.exe
File created	C:\Windows\SysWOW64\Pgpecj32.dll	Kflide32.exe
File opened for modification	C:\Windows\SysWOW64\Mnegbp32.exe	Mfnoqc32.exe
File opened for modification	C:\Windows\SysWOW64\Hahokfag.exe	Giljfddl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12504	12420	WerFault.exe	618

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnngpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmgjia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibegfglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohhnbhok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiahnnph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npbceggm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpnoncim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmlkhofd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljceqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnphoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pddhbipj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlbcnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifomll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmhbqbae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loofnccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgehfkop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojigdcll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkoch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qeodhjmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eehicoel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpbflg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iidphgcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbcncibp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojdnid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Addaif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hefnkkkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpqjjjjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqpamb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckmonl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mokmdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhldbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glgcbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkijdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahkih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmqnobn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpchib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmhlgmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhenj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdgged32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eblimcdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imnocf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdpaeehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcecjmkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkkjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiglnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lokdnjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plpjoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oophlo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enpmld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fneggdhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccdihbgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edoencdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmhdkknd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlblcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffceip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bochmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmcjpl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eiokinbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmkigh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lqkqhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fglnkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfgdjh32.dll"	Odhifjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmkhgho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fiodpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dafppp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbgkei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aafemk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bafndi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Monjjgkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eklajcmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnmdme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdfehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdfehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmlkhofd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cndeii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fflohaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibingd32.dll"	Ffqhcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhejhfp.dll"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imffkelf.dll"	Eoepebho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Giljfddl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abcgjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aooold32.dll"	Lckiihok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpmkebjc.dll"	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhikci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdkgabfn.dll"	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhhfif32.dll"	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndnljbeg.dll"	Lgdidgjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpqfid32.dll"	Ganldgib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdohflaf.dll"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnakbdid.dll"	Dcffnbee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdencf32.dll"	Nelfeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckgofgjn.dll"	Ahdged32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdgged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ennqfenp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdnhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccmbmpbk.dll"	Oloahhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmpdihki.dll"	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qedegh32.dll"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll"	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlbejloe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkcaoef.dll"	Nggnadib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbcncibp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgfcalbj.dll"	Qklmpalf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfeaopqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafmjm32.dll"	Iojbpo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4468	1344	36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe	85
PID 1344 wrote to memory of 4468	1344	36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe	85
PID 1344 wrote to memory of 4468	1344	36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe	85
PID 4468 wrote to memory of 4528	4468	Lqkgbcff.exe	86
PID 4468 wrote to memory of 4528	4468	Lqkgbcff.exe	86
PID 4468 wrote to memory of 4528	4468	Lqkgbcff.exe	86
PID 4528 wrote to memory of 3680	4528	Lmbhgd32.exe	87
PID 4528 wrote to memory of 3680	4528	Lmbhgd32.exe	87
PID 4528 wrote to memory of 3680	4528	Lmbhgd32.exe	87
PID 3680 wrote to memory of 1300	3680	Lnadagbm.exe	88
PID 3680 wrote to memory of 1300	3680	Lnadagbm.exe	88
PID 3680 wrote to memory of 1300	3680	Lnadagbm.exe	88
PID 1300 wrote to memory of 3092	1300	Lqpamb32.exe	89
PID 1300 wrote to memory of 3092	1300	Lqpamb32.exe	89
PID 1300 wrote to memory of 3092	1300	Lqpamb32.exe	89
PID 3092 wrote to memory of 2376	3092	Mkhapk32.exe	91
PID 3092 wrote to memory of 2376	3092	Mkhapk32.exe	91
PID 3092 wrote to memory of 2376	3092	Mkhapk32.exe	91
PID 2376 wrote to memory of 2012	2376	Mgobel32.exe	92
PID 2376 wrote to memory of 2012	2376	Mgobel32.exe	92
PID 2376 wrote to memory of 2012	2376	Mgobel32.exe	92
PID 2012 wrote to memory of 3320	2012	Mcecjmkl.exe	93
PID 2012 wrote to memory of 3320	2012	Mcecjmkl.exe	93
PID 2012 wrote to memory of 3320	2012	Mcecjmkl.exe	93
PID 3320 wrote to memory of 3392	3320	Mjokgg32.exe	95
PID 3320 wrote to memory of 3392	3320	Mjokgg32.exe	95
PID 3320 wrote to memory of 3392	3320	Mjokgg32.exe	95
PID 3392 wrote to memory of 2360	3392	Mgclpkac.exe	96
PID 3392 wrote to memory of 2360	3392	Mgclpkac.exe	96
PID 3392 wrote to memory of 2360	3392	Mgclpkac.exe	96
PID 2360 wrote to memory of 4600	2360	Mnmdme32.exe	97
PID 2360 wrote to memory of 4600	2360	Mnmdme32.exe	97
PID 2360 wrote to memory of 4600	2360	Mnmdme32.exe	97
PID 4600 wrote to memory of 4824	4600	Mcjmel32.exe	98
PID 4600 wrote to memory of 4824	4600	Mcjmel32.exe	98
PID 4600 wrote to memory of 4824	4600	Mcjmel32.exe	98
PID 4824 wrote to memory of 216	4824	Mgehfkop.exe	99
PID 4824 wrote to memory of 216	4824	Mgehfkop.exe	99
PID 4824 wrote to memory of 216	4824	Mgehfkop.exe	99
PID 216 wrote to memory of 3236	216	Mnpabe32.exe	100
PID 216 wrote to memory of 3236	216	Mnpabe32.exe	100
PID 216 wrote to memory of 3236	216	Mnpabe32.exe	100
PID 3236 wrote to memory of 4028	3236	Mmbanbmg.exe	101
PID 3236 wrote to memory of 4028	3236	Mmbanbmg.exe	101
PID 3236 wrote to memory of 4028	3236	Mmbanbmg.exe	101
PID 4028 wrote to memory of 540	4028	Meiioonj.exe	102
PID 4028 wrote to memory of 540	4028	Meiioonj.exe	102
PID 4028 wrote to memory of 540	4028	Meiioonj.exe	102
PID 540 wrote to memory of 3204	540	Nclikl32.exe	103
PID 540 wrote to memory of 3204	540	Nclikl32.exe	103
PID 540 wrote to memory of 3204	540	Nclikl32.exe	103
PID 3204 wrote to memory of 1764	3204	Nghekkmn.exe	104
PID 3204 wrote to memory of 1764	3204	Nghekkmn.exe	104
PID 3204 wrote to memory of 1764	3204	Nghekkmn.exe	104
PID 1764 wrote to memory of 804	1764	Njfagf32.exe	105
PID 1764 wrote to memory of 804	1764	Njfagf32.exe	105
PID 1764 wrote to memory of 804	1764	Njfagf32.exe	105
PID 804 wrote to memory of 4004	804	Nnbnhedj.exe	106
PID 804 wrote to memory of 4004	804	Nnbnhedj.exe	106
PID 804 wrote to memory of 4004	804	Nnbnhedj.exe	106
PID 4004 wrote to memory of 4780	4004	Napjdpcn.exe	107
PID 4004 wrote to memory of 4780	4004	Napjdpcn.exe	107
PID 4004 wrote to memory of 4780	4004	Napjdpcn.exe	107
PID 4780 wrote to memory of 1740	4780	Nelfeo32.exe	108

C:\Users\Admin\AppData\Local\Temp\36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe
"C:\Users\Admin\AppData\Local\Temp\36b14d469fdd4552e6cfd35a7399f1408ca165d325bf5cae95636a08829165cb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\Lqkgbcff.exe
  C:\Windows\system32\Lqkgbcff.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\Lmbhgd32.exe
    C:\Windows\system32\Lmbhgd32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\SysWOW64\Lnadagbm.exe
      C:\Windows\system32\Lnadagbm.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3680
    - - C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1300
      - C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        23⤵
        Executes dropped EXE
        
        PID:1740
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3868
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        25⤵
        Executes dropped EXE
        
        PID:1936
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2412
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3520
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        32⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        33⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        34⤵
        Executes dropped EXE
        
        PID:728
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        35⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        36⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        37⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        38⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        39⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        40⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        41⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        44⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        45⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2616
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3576
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        49⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4060
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        52⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        53⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        54⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        55⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        57⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        58⤵
        Executes dropped EXE
        
        PID:100
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        59⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        60⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        61⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        62⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        65⤵
        Executes dropped EXE
        
        PID:5212
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        66⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        69⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        70⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        71⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        73⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        74⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        77⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        78⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        79⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        80⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        81⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        82⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        83⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        84⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:6000
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        87⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        88⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        89⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        90⤵
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:408
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        93⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        94⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        95⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        96⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        97⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        98⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        99⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        101⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        102⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        103⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        104⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        105⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        107⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        108⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        111⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        113⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        114⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        116⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        117⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        118⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        119⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        121⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        124⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        125⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        126⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        127⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        128⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        129⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        130⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        131⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        132⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        134⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        135⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        137⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        138⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        139⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        140⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        141⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        142⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        143⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        144⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        145⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        148⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        150⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        153⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        154⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        155⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:7140
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        157⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        158⤵
        Modifies registry class
        
        PID:2384
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        159⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        161⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        164⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        165⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        169⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        170⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        171⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        172⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        173⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        175⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        177⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        179⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        181⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        183⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        184⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        185⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        186⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        187⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        188⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        189⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        190⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        191⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        192⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        193⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        196⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        198⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        199⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        200⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2556
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        202⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        203⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        204⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        205⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        206⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        207⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        208⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        210⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        211⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        213⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        215⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:6268
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        219⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        220⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7372
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        222⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        223⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:7540
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        226⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        227⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        228⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        230⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        231⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        232⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        233⤵
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        235⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        236⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        237⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        238⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:8152
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        241⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        242⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        243⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        245⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        246⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7548
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7612
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        249⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        250⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        251⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        253⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        255⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        256⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        257⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        259⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        260⤵
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        261⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        262⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        263⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        264⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        265⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        266⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        267⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        268⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        270⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        271⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8436
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        273⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        274⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        275⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        277⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        278⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        279⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        280⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        281⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        282⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        283⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        284⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        285⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8956
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:8992
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        288⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        289⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        290⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        291⤵
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        293⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        294⤵
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        295⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        296⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        297⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        298⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        299⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        300⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        301⤵
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        302⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        303⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        304⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        305⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9132
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        308⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        310⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        311⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8576
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        314⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        315⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        316⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9184
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        318⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        319⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        320⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        321⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        322⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        323⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        325⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        326⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        327⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        328⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        329⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        330⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        331⤵
        Modifies registry class
        
        PID:9368
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9404
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9440
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9476
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        335⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        336⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        337⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9644
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        339⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        340⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        341⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        342⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        343⤵
        Drops file in System32 directory
        
        PID:9824
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        344⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        345⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        346⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        347⤵
        System Location Discovery: System Language Discovery
        
        PID:9968
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        348⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        349⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        350⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        351⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        352⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        353⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        354⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9264
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        356⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        357⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        358⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        359⤵
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        360⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        361⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        362⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        363⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        365⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        366⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        367⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        368⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        369⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        370⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        371⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        372⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        373⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        374⤵
        Modifies registry class
        
        PID:9640
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        375⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        376⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3024
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4524
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        379⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        380⤵
        Drops file in System32 directory
        
        PID:10100
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:9596
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        382⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        383⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        384⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        385⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9748
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        388⤵
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        389⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        390⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        391⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        392⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        393⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        394⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        395⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        396⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        397⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        398⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        399⤵
        Modifies registry class
        
        PID:10600
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        400⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        401⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        402⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10748
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        404⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        405⤵
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10856
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        407⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        408⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        409⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10972
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11008
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        411⤵
        Modifies registry class
        
        PID:11044
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        412⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        413⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        414⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11188
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        416⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        417⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        418⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        419⤵
        System Location Discovery: System Language Discovery
        
        PID:10340
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        420⤵
        Drops file in System32 directory
        
        PID:10408
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        421⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10584
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        423⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        424⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        425⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        426⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        427⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10968
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        429⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        430⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        431⤵
        Modifies registry class
        
        PID:11176
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        432⤵
        System Location Discovery: System Language Discovery
        
        PID:11248
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        433⤵
        Drops file in System32 directory
        
        PID:10264
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        434⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        435⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        436⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        437⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        438⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        439⤵
        Modifies registry class
        
        PID:11004
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        440⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        441⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10332
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        443⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        444⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        445⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10680
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        446⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        447⤵
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        448⤵
        Modifies registry class
        
        PID:11224
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        449⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10628
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        451⤵
        Drops file in System32 directory
        
        PID:10880
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        452⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        453⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        454⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        455⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        456⤵
        Modifies registry class
        
        PID:10744
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:11284
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11332
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        459⤵
        Drops file in System32 directory
        
        PID:11384
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:11420
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11456
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        462⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        463⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        464⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        465⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        466⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        467⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        468⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        469⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        470⤵
        Drops file in System32 directory
        
        PID:11892
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        471⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        472⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        473⤵
        Drops file in System32 directory
        
        PID:12004
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        474⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        476⤵
        Drops file in System32 directory
        
        PID:12112
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        477⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        478⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12184
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12220
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        480⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        481⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        482⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11380
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11444
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11516
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        486⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        487⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11624
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11672
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        489⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        490⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        491⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        492⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        493⤵
        System Location Discovery: System Language Discovery
        
        PID:11920
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        494⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        495⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        496⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        497⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        498⤵
        Drops file in System32 directory
        
        PID:12248
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        500⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        501⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        502⤵
        Drops file in System32 directory
        
        PID:11612
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        503⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11784
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11876
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        506⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        507⤵
        System Location Discovery: System Language Discovery
        
        PID:12108
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        508⤵
        Drops file in System32 directory
        
        PID:12204
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        509⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        510⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        511⤵
        System Location Discovery: System Language Discovery
        
        PID:11680
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        512⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        513⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        514⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        515⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        516⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12168
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        518⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11592
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        519⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        520⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        521⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        522⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        523⤵
        Drops file in System32 directory
        
        PID:12348
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        524⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        525⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12420 -s 220
        526⤵
        Program crash
        
        PID:12504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 12420 -ip 12420
1⤵
PID:12480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aalmimfd.exe

Filesize
64KB

MD5
67fc0088c124047ccf487720deb7f65e

SHA1
0fc2284140a68b82d72b259b54ed550bc9397ef0

SHA256
f92d8bc9f21a29e0d88cc6a0f2f0f536308d36f4638431002bebe85efaee7010

SHA512
0e7b7674cf38717e616e1defd3cc74e46c927f61e1fc739f35b1119557a5ed3f7e562dd1dadc54fffb9a44e6fa30418bb084707a56ab2d7ebc43eeb555bc90a0

Download Submit
C:\Windows\SysWOW64\Bagmdllg.exe

Filesize
359KB

MD5
573db06696fe72806ecb534c243beea4

SHA1
f96f297d1a10262914eec5c43fdf2428f8ee9b23

SHA256
1eff363f11455fb3e5cc34974a8dd51872cc163601a60a9b55d7cf95fba5fb8d

SHA512
0dfa2fc346119a9e27e5f5f07a0d36f58974217b369e615bbfc2f7c42bb1971b2cb57ab918ca1edfd5c0e29d20f978b3fba736f61e63858a784810fe2fe48db6

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
359KB

MD5
ea20dab93e9b8ed41587a8da11629be1

SHA1
8acb96bfc905d2d36ddfa2ffee93a2638cf60397

SHA256
1ec1a27ecc1f1efdcd5ecb82df7a4f99c3a96aa35624768d31cb60332c066a78

SHA512
292ed6c9d4da411dd47138f62d18f09cbc59ba0d7681279e78771f29c90d5f605fa1462f49fd00242cd2feb3ca13268bfcca9efaadf48a3802280c114a6f76a5

Download Submit
C:\Windows\SysWOW64\Bogkmgba.exe

Filesize
359KB

MD5
5e474a5ac0105e64d3dfee2efda79e7e

SHA1
895351f60bcd6471961c461173070266e831483c

SHA256
ed287c32311f4650ed4bbe1ed9b964f69fff0eb44295ab554fa5d88ed15856ba

SHA512
b02a6e0a3ccfcfe7e73d2d6a595c2dfb63ad626f08e76177f5e8b2da52bcd658b5f524a7ba694a04ea9b082aea1ca714e1a4303ef8bcb3dc7bd402825bf81e7b

Download Submit
C:\Windows\SysWOW64\Cpcpfg32.exe

Filesize
359KB

MD5
91f9a2027eb45fc9d76fbe9cfef2d9cc

SHA1
ec891194011501574522ddfb5c69cfa9a0e75595

SHA256
72ca9edfa8f5dbde4b0c24183807521804d8ad6f566e1138a9bda545af08e94a

SHA512
90e9824a35e1e9cb0f2a1bc31f4fe3e36e3218ca88787079be19e5377a016cb1d6ec18d9375d55c52f4a8ceff36f3963f5274c723e1b4954f0cadf36f764884f

Download Submit
C:\Windows\SysWOW64\Dcffnbee.exe

Filesize
359KB

MD5
04721824810ce333554ab38240433b6e

SHA1
d1c023c2d4ea7397151ceb0892241bc889e20a6a

SHA256
939434e0608586149aa053888a5a7fc0106005a407665e4afba6a25701517a54

SHA512
d6329996f9cf6a8e04d63c158e811b4ba7105896f5246c1d782bba65986f088b4d29b354e03110c92ccb62127cf0584fedfa38903a1fb71539ff8662ffec18fd

Download Submit
C:\Windows\SysWOW64\Dggbcf32.exe

Filesize
359KB

MD5
d7475383b55ee7a628e5d5c9141cfaf4

SHA1
ba1fbc9fb54d924ca09f0d22b82d7227b751245e

SHA256
5692f8071f5d8459e82586eebf38e083f147bd5d6786d60b79938b0f1fb47c4a

SHA512
3e91df80f60e972a4ac2ef021fe1073c9dc606339a81d8b601a71193b9c5a903fe48114d505dac99e4bb16537b35acf9ae9f762d067499a3d38b57f0c4a36fe7

Download Submit
C:\Windows\SysWOW64\Djegekil.exe

Filesize
359KB

MD5
3159b05efb2eaf747b803109e405154a

SHA1
5b9bd3034e757408120c60113d843a442b6e274c

SHA256
a36561112e06c4ed45d73275e51e8c6176cb440790f872de73554975c2d1ac37

SHA512
ded6c934fb27cccd1cf857c0f345f6f97c40dc2904d6a9a721ae098d7c2fcbb9fd1caf6a5ab87167b1d39e7970870c046be980f607ee344f729dbb2e73486112

Download Submit
C:\Windows\SysWOW64\Ejccgi32.exe

Filesize
359KB

MD5
b9994f8e8b0f68d043db464e3cc628af

SHA1
472fc6873660e8c5e2b81970fbb8678ee4024524

SHA256
3866e21bdd0dd237ea5101ad2911f1b3b4473ad229ff17e4967c61825a0541bb

SHA512
2dec66c7e4f57e5036ebe57cf122a82419f024e599bfac012c0f37a56b4b155e688b18c3030aaef63e7771da1ba11a93dc06e640d267f363ef6b6c4c5a552d1d

Download Submit
C:\Windows\SysWOW64\Ejnocehc.dll

Filesize
7KB

MD5
4ed61d5e0bebb53ea653a84cc92aa31a

SHA1
cec21166f72a11d23ebd282cbd61ffa1d40fe706

SHA256
5cc0a2c5bd7b64bfb5b92da15cfb82765b55394da235680a959b46c4c3075a0e

SHA512
935b3a08a118bf62021c5aa6a6459ea1f6c3da18920e750e888cb372098aeab021dbb785ed49c71523c94e27ac364851ce4580d55dbd2634c334fc5ba617bae0

Download Submit
C:\Windows\SysWOW64\Eppjfgcp.exe

Filesize
359KB

MD5
4ce2a356f88257bf671816b668019e1d

SHA1
3648de17a7de5efe0282f714a7170156750c2e83

SHA256
81cb260a149099b45708f3dfb74c11d94c17d5e82b0633e23c61e965c0d6204e

SHA512
1262dc70d72cef213f8ecae1010aafd9904d31f948dd302eb07f2d2b87b92d409a8979a19c1afb75a5efaf5c41a1b48f8c04d556b3852d3bc03f3eff007435e3

Download Submit
C:\Windows\SysWOW64\Fbbicl32.exe

Filesize
359KB

MD5
ff98a22d39829531ead3780d1cd4ef4c

SHA1
78a0da4919aca02edbbff902883a6bbb8f3c0bf8

SHA256
9b5817711f5f68e44cedae72963b50042ee371c5012ebb7b7ae05dd2fcd366c7

SHA512
a276832f53ae3f5f6ff54cbafd2abd65a46b8511361b05cc50adb57ba2b00de134ba35b3c4d9518518a6d5bff6e36a90cbfe7a84421584eb36731ff1182fb027

Download Submit
C:\Windows\SysWOW64\Fmfgek32.exe

Filesize
359KB

MD5
4f4c89ce060f0b4a6f6e75c695bd2f85

SHA1
62b32a5897b399c97f610513187bb397e718d110

SHA256
c8ed860867f2e0fc4512fcad58546ef4f06d98a1af291e15656c5e007c3105df

SHA512
c5471a503881fdec881b32675a029aabe37fcade67ce894916b6be7514563e3603c692f7a2312a6dab04b70ca63f1ea2d37c991569a81062ad5f0783824412ca

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
359KB

MD5
3f9809a3fb11a8876a8d80190ab305b2

SHA1
243efcefad567bfe5bc7529de477aaa08a3b2d20

SHA256
302e6b96285878836a575eb36571ddbd4ccb91a33438a8f49699f40aba300eec

SHA512
032ca8b7663a3303a8d69260fd91ed36a95e40fe4601c3ad0a124f8a3a54bd4dc9457ab78cef787abe19fdb22beddda198722cb3fb5f12a21470aa50ade4f8fb

Download Submit
C:\Windows\SysWOW64\Fnbcgn32.exe

Filesize
359KB

MD5
5e7aaaaf0d1ca6d1d6393e93fc5e1026

SHA1
57144c07d0632403040dc07747456b6f4ccfcd91

SHA256
bb12f1a8c7e4e174780886554e906ace58b9ca55cfa799dfb0aba98eaed3ddc6

SHA512
7659268c63ac7bfe765fe34f18dcfff9bfba60947d8a9daf598c6a8a8f21f5cd63d6404c8d35557cddb9365cef38a5649e71e89f4f6fda6ea22fc9353bb3fb64

Download Submit
C:\Windows\SysWOW64\Fnipbc32.exe

Filesize
359KB

MD5
20db284140219ef4318be3014386cbd5

SHA1
68150f41c7918c596d9b03f8f866edbea4abc1dc

SHA256
4a56b56885d990784cce12d441f7b705145f12c8c71bb72167ae10aeb484f6c0

SHA512
ea7ea58ba96e00d620a251b34d96c8392e26dd354b9b514b8157fdbcb100985439f752f842a66ab61271e4c12fa855714ae7268bde3c507b5095d18784eda820

Download Submit
C:\Windows\SysWOW64\Gbchdp32.exe

Filesize
359KB

MD5
67965adcb81600196883241887369b6e

SHA1
2604c77dee04972bed0aa2feb2900ae0adee1eb6

SHA256
5cc789fc743b557b98aa9caaf9bb694eef98e546a05f9dad94a8db0ae35311fd

SHA512
079eda24939f89684191dcf04eae9129ac7bdbb5fbec438823a2fa7d9cf11ced6127eb5eaefd28f1ddca90541fd6ecf24a406ad90f33c47aa6d5316d47b64fe5

Download Submit
C:\Windows\SysWOW64\Gmojkj32.exe

Filesize
359KB

MD5
de028c6aa969fb61720fcd67a380a877

SHA1
0cd5cfe4c1739dd4947734e9c1feb3a3e19f5c03

SHA256
2f536b35822f13b89414794914b66f97068006490aeae6f269c044726af1c8a9

SHA512
decbcf7d5092c5838c19834db0e188f5c63878dc19c591401278eef69016677c181591cf867b023e0f61e1f76890c231a35de1988844d7be0570910628c6d407

Download Submit
C:\Windows\SysWOW64\Gnepna32.exe

Filesize
359KB

MD5
54399d7382792d1f56ba1af38bbaf2ff

SHA1
d249530c2f762ff773044cdfced03791ce15b8f0

SHA256
75b70cfad7fca2b2d40de50e53c599648d26aa2d1b6d3543baeb25cb1d0a213a

SHA512
1b73d0cb2da9c62121bd8e864748a982728378f18fec5be52e665524f3eac39460dcf6e6e3f41caab91b4381ce35af0fcda90091712cbf16e4435f4633b2e315

Download Submit
C:\Windows\SysWOW64\Gnnccl32.exe

Filesize
359KB

MD5
8a89793fb1d63b7a3e08f883d4909293

SHA1
2a1b3903accdce6b9faf616db845881ea15ddd55

SHA256
2b737ffa3d190327a1275aa6373688c35ad02fdc9882ca81c9f31e62915dddb8

SHA512
de8e971547247eef528e9c00f672b0af780698638d7ac559e17890a870fecff82f968533e02694a8c99b87b61ed080cd7cb6fa847c43f8d25b152404ed83c403

Download Submit
C:\Windows\SysWOW64\Haaaaeim.exe

Filesize
359KB

MD5
a1e6b148d2388c2d2e56e8796bbdfdef

SHA1
bd835e027e74f8712823102dafc5b39147641850

SHA256
19f7b416c618e9692c72bb6edc560e6d1f44dd3ad2c434313afbd653411f9efb

SHA512
393aefbe7640a27b473cc324eda1f7dbe69ac2cc4bfa70eec5be8477ad5c765722f191517221096ec0cbbef285979001938853179e067cb912f6c76ff16e76b8

Download Submit
C:\Windows\SysWOW64\Hahokfag.exe

Filesize
359KB

MD5
955a3a4992763b5317f537877123f8b6

SHA1
910a3fb8503298e82e392d1a538e6811b44a1e55

SHA256
124badf7f76fb4ca7573342f9abc1abdc6145914854e654c01eaa3b22880dcd2

SHA512
fa148d1de0ac14f3029bc1d1bc144ee8770edb0a19e85e57318d46e9205a53c379a50a388c7cc8838005b1bf06a2d6ebe87966d732f0e73211cea4c4f3f817ed

Download Submit
C:\Windows\SysWOW64\Hefnkkkj.exe

Filesize
359KB

MD5
67ca42924b58aef932b6683d77d9aae5

SHA1
a1791218e730dd5f7e23ebf2fdf66b036086a71d

SHA256
bae902b47ac44c4dbf82dfcae01779f369f161fbd0a7dbc604917c1dde39b55f

SHA512
0f4d37376cabea89a64b778963498497d7cf5b0a8793330a6d03e7a87573b91f542c0f979923ee93d48b970cef8ad4452a8f1dddc8f97ecbe8ef900400a75222

Download Submit
C:\Windows\SysWOW64\Hffken32.exe

Filesize
359KB

MD5
10e9ddfddcd7b40a876d8c300b25a4c1

SHA1
61d57e4d36eb8cdf925b07f2b1c303b46a24b21f

SHA256
2057dc80deda3b08ec6be2a2df2510650992764feaf212f8f1a035b229e4eef7

SHA512
d38d7a2c86358afd81108300e302d69c0f6615c1547b03c5317f8d65f1fe41ce7c019189b1e075df10cafd3198683568cd524e126b294cf56dcad58692a5dc0e

Download Submit
C:\Windows\SysWOW64\Hoclopne.exe

Filesize
359KB

MD5
31629ddc112ea6694245f748b793699c

SHA1
51de57bcfa1652117a0b4499e34535f11a303ea3

SHA256
8c4a11b5e05758e42e4f2bbb91020cc6935f183a38f97669c9fab6c42f60f4d9

SHA512
b416663742b5fc061b4dd2b717df1e3d51dc2d0856db282c5e503842880afb89f310bb6455977a68b23e8cb8e0eb0c512b8cb5f227a644517fc0d48e581291dc

Download Submit
C:\Windows\SysWOW64\Hpnoncim.exe

Filesize
359KB

MD5
1d4cca7df0ca0a2c15090de6f7793814

SHA1
e089a6d36c4bdac662aa9f77f780da8d7761ad22

SHA256
01acc6b1afad9406fab3348e8cdab1f90c6ce298934bdcf01f1fe5e295818925

SHA512
1de869d2c129ed43b34cf8f6a6353e2f717708333c2863df13ef3254df8133db12cc7f1b1f1665304c5a518d6ff3ba013636d7c92bbf1dcfd5cc6ddc550566d1

Download Submit
C:\Windows\SysWOW64\Iacngdgj.exe

Filesize
359KB

MD5
2792e013c16373e2869cd9bee9c1a98f

SHA1
bfd76196c0c67b78385856d6e204173d17477c53

SHA256
a88314096be924240968dd953074e86586a3330a7ed6c742d74767b2d196ea9e

SHA512
4646ba435e862b6c9ad8a78b4235b1e19b31c2c0e10bf78a45dcb3e96cd3ecba9be3bd52364348948958ff64d09a9ba85a173d0c74d1f539a39d6e188c70feb3

Download Submit
C:\Windows\SysWOW64\Ibgdlg32.exe

Filesize
359KB

MD5
2f61ff60844a392c0cdbb24e467fd0c3

SHA1
f9d3c33e4afd85c1c0021b0266720110764f1236

SHA256
116511fd4bb128a6c79a0abc913c4aabe7ecd7dd15d290a16becb728549a9640

SHA512
441eb59c9400edb18b3d4756a903bdfbf31180471f35842dcb12c94e64da78f0102432e9ec014a74a2272c0bd5a26e7626b81303d04251424d49e66658e1bf5c

Download Submit
C:\Windows\SysWOW64\Iefgbh32.exe

Filesize
359KB

MD5
885178cec9de506b67b340c4c5f3fb49

SHA1
6f81d3a72ceaff668b1b4c00edc3edd2b1057f76

SHA256
a74da446e7c0477ca9dd532f2c716a08f9ea59643a038c4f75a8741b6dae6740

SHA512
219cfdda47aa04caee178c94222ce4e37445dd2a68d3c36f82cbee2b09586264d7ab4d1868ccfe77fc50eac3a080271d472b7d19ea48794a8252e31e297cbf24

Download Submit
C:\Windows\SysWOW64\Ifmqfm32.exe

Filesize
359KB

MD5
ef2bca72b0686abe087f831a8659c5c0

SHA1
ed228922dee8f9955bb44b7e7b975697f1626327

SHA256
d970134f16fdd38974ace7a50b5858c2c2ab2e4ba31f7ab4467508728368c204

SHA512
0eb98b72e05b853a0a090847b5f183740376a8cead26b92c56bef2d17efb4164325e5305a10254cb32087c113abee63ffff3829b30cdf91e463b4db01bcdbb43

Download Submit
C:\Windows\SysWOW64\Jihbip32.exe

Filesize
359KB

MD5
b8d2d6fa1fe28e792017c21e7d2ee9b2

SHA1
9dfff3edc22e04519bb4e5ed98ef10e56d0a38df

SHA256
84ce2a3e5dc9411fdc1c8766c85a732cf565c5d9c7a8cd336c9a0a53dc04249b

SHA512
fe7eea3dce14a7ff083fa3076eb9345e1632b3f5e64eb6821212b1221ee51bd34431bfd3abd94243bf40f069c4e1a2e1dff5e1c67933ea93c1dc7571786492f6

Download Submit
C:\Windows\SysWOW64\Jlbejloe.exe

Filesize
359KB

MD5
28550bcd7edbd103461303a9e0d7f881

SHA1
06fa4277b88bce04fb052c66046bc63c71e577d7

SHA256
e1f14aac4bb56ea7c0533114f80077c82adc1d0a73dcb5aee85a37d00fb050f3

SHA512
6bb8980f59c5b6c164e2e5218cd04ef3967a841d3f1fe42b4503d4c440607a6ba348210f39083dc84114091496445cffd0099fdb6ff0665ffb6497f14c1198de

Download Submit
C:\Windows\SysWOW64\Jljbeali.exe

Filesize
359KB

MD5
b8b9f7ce1b5d29be6f9a7d8023cb64dc

SHA1
55419ef354f83035d90e298440d9c29836195294

SHA256
6f060faeaa32d91f8a7981e929a064ea3c9a630f88b845954a612ac622eb02d0

SHA512
e20f77e637e9825287b0f7434453232c6707bded3ade78ee497cc88b7d66997ed73fe9969dcc2cc51480ff8418e0528ec6340edd2ef9221361de5b136077a7b0

Download Submit
C:\Windows\SysWOW64\Jnlkedai.exe

Filesize
359KB

MD5
1aaedd1109026893a6a148ef0a4d8205

SHA1
4a2681050f8d084cf76778c5dad303396f231d9e

SHA256
16d696326e5085b2e143cbcddc40db58883c49f059d1f138f7e8512d423903c2

SHA512
81c660f280fb523e3d97b49eba0c07c247470b042a7e637f26c0107e4ae843fc59cd366f8345cd4c8e5c9ef14b2a19eb37a4fa135a1fac763be29534eaffa6f2

Download Submit
C:\Windows\SysWOW64\Kfpcoefj.exe

Filesize
359KB

MD5
c1dea193915925b02b9cbbb707482bdf

SHA1
e09c1510b556d67e2af59e232c316e4193db055b

SHA256
ec61e4d4ece70eb4aa6a31a44850badb493b5946bbe080f4837fff4759b1705e

SHA512
41cb8e3871d6a1b206a84e50ec84bddcf45074e7be9fbdcf418bbb06e67f828089c6d7aed0c67e866f80aab1351d99f506bd6d25b1e0ad05fb5e1347663d948d

Download Submit
C:\Windows\SysWOW64\Kgiiiidd.exe

Filesize
359KB

MD5
7af7a46c9f5db71846879332e7601ec3

SHA1
d5bfe2389f67833389bdc358922da9c34e5ae545

SHA256
66030d87025dfe7b9e46e812f6d375416a2959d65a29e84afb8224df573a9a70

SHA512
19b1633485ccdec430a06c1c8e5e42b6e0e6c42bea40534165b80aa2f949327799ce01dbbdbd45a403a3235f0b6d772184d90fc1905629d21da6f9e50396ebfa

Download Submit
C:\Windows\SysWOW64\Khlklj32.exe

Filesize
359KB

MD5
8c03c83d89be34baa4c0e2a45a7913f3

SHA1
a49cea0bc329413d638faee6ec1a3c66c600c07c

SHA256
c20cfc6d76e458dcbf290b91b22eaa84bd0cbc73083dcb6eca96690fb1b6f933

SHA512
218bb8a59b67d9bb592d241129e3c48c11b9644d6fa05dbc5ce9644a0e85de945fdfe5d751b8ec153082297c469d1a689c188e178b8c77d30493472d50449837

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
359KB

MD5
5d72dcbc5f825d46523c2ba573f68b81

SHA1
b63d752768785364473401d03c09df1b0d28376b

SHA256
42b14a786400cf22788e6a8369877be12e274c9532c5f7cef4e7f0b19395caea

SHA512
4b930a76affd12c464bf1694d8bcdf8c323f77b68271ddcb60def88493b1b47d08e9a0ded078dc1fa7de02f16cc0db49d3e8f3d008fcdf24e8c753bd60222fda

Download Submit
C:\Windows\SysWOW64\Kodnmkap.exe

Filesize
359KB

MD5
2fe5b25533a69f092b172fe8a3b31f7d

SHA1
3f5b2a432f54a1759aab176064db93f92898eb92

SHA256
4299634be3934614ff74ce1f98703d6ac59623db8e19cdf29e324ee60b493458

SHA512
00d4e8da9d1fcebdb34ee487a7ef65f1ce74194e03aaf6b2880b054db5a4447b781fe5d77e0a02274a16e219e956bc1a4ff85f40e17a54bbd91b3851ff45a822

Download Submit
C:\Windows\SysWOW64\Lfjfecno.exe

Filesize
359KB

MD5
3a3ecb557680a21e10bfe0b050250464

SHA1
f5ce0b65b06ba19654268ec25cf77045e9b2999b

SHA256
b8152e7221c852d485189a1bff30638d87716b965abc40cc6141fd3c1ede2009

SHA512
a71f9cfc48818815e0da94f216ff3e76366ee9851f57f03fd9c2ddf225ceb3cf546aecbcea26a6adde1905b93103a439b632549c3ecdbc29112c495229517c84

Download Submit
C:\Windows\SysWOW64\Lmbhgd32.exe

Filesize
359KB

MD5
94b8f68dc52e64970fb720950ff0927b

SHA1
6b21474f560d44858858a55f8370c2c6da05676d

SHA256
88ae4c42506739dcb0648fc742834f81182ca25ca13033a46489d28d776ff977

SHA512
58966c2f5adba4e8d7a9c5395f14e43438a2834024568462fcb3fa378d1933f062dcc4c298c096e5ac871201b971b0c7018609a31c34c367f44518a65bcff76e

Download Submit
C:\Windows\SysWOW64\Lnadagbm.exe

Filesize
359KB

MD5
b06512eecf2d49b8a0b317277ff72cdc

SHA1
7592cdbaf1029ead0878b117ffab629971f9a09f

SHA256
8c6576c30e951897de9cfae8feec055a75e8af299f6ccd4ff04ee9b9a84bc1c2

SHA512
2ad992bd4c3ea54cf1926490d0d018192f6f6dff3ff83a89ab4d12a00697cf80dd7a966091f777fa9b03a597a5b8afdb611bfd5b2139daf7ff70b1aeb079f3b0

Download Submit
C:\Windows\SysWOW64\Lqkgbcff.exe

Filesize
359KB

MD5
4b83c0051b2f47fd405ecf3cf0a5fc91

SHA1
48e31474a49d5c00dba6db509ef847581fc279a7

SHA256
c9cbab75eb32d3b46eb1a56c7d06f52411e9fb970d0c070bdada36e34908cb47

SHA512
2293e6bd471e2610509ccdd4ec69458f8f6b5d02aa27c5e5aa76410556315caee3861a53ecd7179c4b8d9b61782ec969f03d4a4e293ddcc3b760be2bf1131cc4

Download Submit
C:\Windows\SysWOW64\Lqkqhm32.exe

Filesize
359KB

MD5
4c5dafe58ee762e8f9522441a361dcff

SHA1
ace11367b34cc3a16391ace8544c7d0004bfbdd4

SHA256
70defb07ccc92056dce32c3b3bf3c24765932bc2129108a706a05689532d7fd6

SHA512
7e43f062f48de613bcc7c88ca8ccfccc4f776b3c6fbcb158aa3c4e0d3b2150bf8688a53e4bc305c571970ac2ce7e1dcbf50c607ab6de0e945cf02072239ed3b8

Download Submit
C:\Windows\SysWOW64\Lqpamb32.exe

Filesize
359KB

MD5
370ff284a6f5ba6c45ddb9c35d861bc3

SHA1
b8abfaab9af0fd6dd3a67a9852b3d38f3badf65b

SHA256
a825f141ce97229b3212e943b22bb684a79a54833042b8791519b7b63a69914e

SHA512
bf96600dad9a1b7e41854c0681722b49142d036691b9eeffcda9a492ea555b952c11806d03b5316d4dc9bbe14a77bc4b454f49abe7d0b0a3070a50f83d5c9587

Download Submit
C:\Windows\SysWOW64\Mcecjmkl.exe

Filesize
359KB

MD5
7ec2bc8501e6f301b5c0952c081ec77e

SHA1
622ad32b36c9e3988fac646e614de9d6ac3069ec

SHA256
784b3c14eac600cb7d1715d6f5b22c6e122b9e2e6e100097b0b122b486c18f46

SHA512
6df63991bb9d10cfc88b571943990886b7fa96ef472a22cc3e95955227ae1fd01665792ef67da67140cfd09ca42dbd8f3bd5b239ce24eed440724a5474c40542

Download Submit
C:\Windows\SysWOW64\Mcjmel32.exe

Filesize
359KB

MD5
15c8a836e98dac6b0cdaf147c6af928b

SHA1
43d4d9da799d372d577b1f026cd7008af4d2ca02

SHA256
73fe63ecb8c575adeda6176853d34e61f58d344a7409c63ec76c50db034b52fa

SHA512
7fe9c61e3382e66dbb204c70fac995871bc8ffefeb6d3f9a457ddb14783b34d54fa4cd3d395bed650e04595b0df902637334717d1257629f9c5e72b47bb62c79

Download Submit
C:\Windows\SysWOW64\Meiioonj.exe

Filesize
359KB

MD5
6f2d9cde8845d946fd8651c9543075b6

SHA1
b8b380d73d77971fea54d66c47942307373081d1

SHA256
01c71775d568c71b67db184d025ef15d28c56479f9d4c5f64c5a24141525020e

SHA512
9da486fcb9a3aaeafd773b49446f33de579cc5af3d32ad86762035a7793aca64a72e4523500a8fdecc7264530e4f149ba7df4a2e1e6520b273a71d2f345fd25d

Download Submit
C:\Windows\SysWOW64\Mfeeabda.exe

Filesize
128KB

MD5
0b452e9ad65071785f08e35fee8983d6

SHA1
d9699ac6e4822f860d35384fc40a1b4dc645bb0d

SHA256
3832d227828b134c27eed975c3f6e96c0e4f01ce03bcc4de4980e3c824ab8899

SHA512
15222102c5b1411fc3f8efcad2256cff5ab8dfef2fdea3008a84c179cd7927fbbacd8d3e428e1ec3a1a5616d4a0e8a7d26beb291087be15f927114d789c5acb5

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
359KB

MD5
0efef6b9720da47846d53ea10bd3e9f5

SHA1
db6029f77c39b90294057e78a7e4f8b27aefac5a

SHA256
7de15782fe198c56580c240730b77f6d79846618cc6ced1a4588b7403a5603cc

SHA512
0707516f9f15e77f43ba7cd4539f9fb8e43e1d9fe8901305ef245a6085d6f966183119ed5c7c1b8cd0d27afeccf3a571583a7def4b63a9d7a82947a56e6a15e9

Download Submit
C:\Windows\SysWOW64\Mgehfkop.exe

Filesize
359KB

MD5
f441353e7a15409b6f3efb13a4a74528

SHA1
17bc14384ac0145863d8e9c2976474c83bd0a090

SHA256
25860b235650048759d4be8cdd663f93a8643ae6c373c98a152963189abdcc40

SHA512
bd9af6a6e8879a65d85d306fda0a7864ad393eeb1d64a3ab6203c2c08096b63373cada68b35bfd5da2f9a480456ae6e714a6061dc095ca5c6186b89bccf339ca

Download Submit
C:\Windows\SysWOW64\Mgobel32.exe

Filesize
359KB

MD5
3a437c917483dbd4388253178bdcdb6b

SHA1
72d15904c94d01ef20d42b027c21874492ee89ab

SHA256
4838e9529042d29a7136e615959f9a0d61769d21b8124f64d053ebb776d4ec98

SHA512
a892a3461734e16917e9bcb4899277851f3eb47193f4c5ca3a02888f11a4b24ceefd5d6387df9225379a5a68ffb6e000a5bab1ed6ce362e484488a6a81eb6c32

Download Submit
C:\Windows\SysWOW64\Mhanngbl.exe

Filesize
359KB

MD5
963f22203bbecbc2964f0acae17ee604

SHA1
2845ddfafcc587a352643517fabec8c4309a2d70

SHA256
4a76e8785452baa2c002105a2cb1d597e9cd39fded341ac59b24b6e5790da719

SHA512
cec6ca362194d9bb0872b6d8dfadfbbd10cc47bf03cd5f14e1ac20e9f5b37995c2faaf06f27aa8dfe7385308c9f4891e8b164a97f6a7361c43bb2b58534edc02

Download Submit
C:\Windows\SysWOW64\Mhjhmhhd.exe

Filesize
359KB

MD5
ec3e6e4566352f0762d98795c9d18bed

SHA1
377e306045c298cf33599ac02b4951d8e11cf4f6

SHA256
d942a180c3cbe1b176352df21afd09aa2c68e254ebb995999bdce61e1c1f2e23

SHA512
7c3466ab3e4a6057b4748316eb38582c808e39428787f4604f8ef424b6ed5ef1bd9acd5147eeef6c7453ebf63d50c1d8dbe1ef03eb5f80db53c8b20c93aacbde

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
359KB

MD5
530e5a8cace37268fded5a1b3e7384a5

SHA1
59c4d15ab33b746932572d1f48e1ae79e57f7515

SHA256
59a1f3188ddb392f09fdb65ae06a14caddbd20d5261b61d3df99e33cae3ddb39

SHA512
4a0b8e90c9ddaefdf287968fa81fd257fb7c5e41847e80e56ec9ab249b16198ad5da929b334a92a950c6c86b48dbeabfaddbc7eecf937d36220ccb51e40c0e2e

Download Submit
C:\Windows\SysWOW64\Mkhapk32.exe

Filesize
359KB

MD5
96f216fa5cc7f148b9bb2032fc54ffff

SHA1
905c4bb2c89d7fa0abeb0c9064b1d9a329f54e59

SHA256
bab76f1edb8487b5130e34ff39139bd2624091f79970b869abed867929bf72f9

SHA512
b62e513ac942ff14d54222775818ed4a6fe8e186c39032e93b7fd9a823f63e9a5c2747563d849292a7c1c298ef549d64e42149d9ff8239ee79c400f5ea6cf69f

Download Submit
C:\Windows\SysWOW64\Mmbanbmg.exe

Filesize
359KB

MD5
0b348a8fea72a91a3bc17651709710a2

SHA1
3ce4e2eaf1691e99fb552c17936c782d676c84a3

SHA256
4f7c402d7c44e253cc58b3eda5b32d2b701566d1d33905777b9c58b44b5ba57d

SHA512
f0ac9c8924560646e0b543973fae8027251ebab08bc4c4e546a4b01f951732e01d4043dc66421a17a264211e4ec2544d8a216beb15fccc40c909aea4f9782e01

Download Submit
C:\Windows\SysWOW64\Mnmdme32.exe

Filesize
359KB

MD5
acdc50484b9f24d96a081618bebe0085

SHA1
7eac759effecc324b9a2da65633a7a1dd02e2bf9

SHA256
3b5721b11d7860ecb1a4d6a9fc0a78ee73457197b8c268c722c8409bd70e15d1

SHA512
d20b5989ee53d40c335fa77bc5ff0e530d747b8343f5f5e2b626d3af181288595fa4b69607d051956a9bef478f94af722598d9df2d4d735c57440eb0d70e385e

Download Submit
C:\Windows\SysWOW64\Mnpabe32.exe

Filesize
359KB

MD5
9e1928b1a9ccb1f53d3a0cf99b296bde

SHA1
e00e75bc8fbffa0080beb0d9b0c92755c6fbd465

SHA256
5ca1723f6f3540e40cb55744f7b28256acbd7fd25d77e301e611e1392061c729

SHA512
5af5141613d67bc95e13cbc811b2a26f7b6fe088ad3470bd1d8086a65dde75049ee7843c33dd8df64e65e574348f183e432c3a99cd0486c02378e8de31163ae9

Download Submit
C:\Windows\SysWOW64\Monjjgkb.exe

Filesize
359KB

MD5
2c7145ad4434f9aaec01c21b041259cf

SHA1
3fdb17bf666b181c83820383d060ed7b4db8cc51

SHA256
8fa0822798de7144020ea2620d9630d40a303dcd36574c51be8a8755caa225c2

SHA512
52627e353f91233ebe898665f0d29280cbba81b26f44b1d3a9619b476a58c26df07b76728d86afadbb876c4cb05bfe713c303ca7f5d69e3385163003b13b399a

Download Submit
C:\Windows\SysWOW64\Nabfjpak.exe

Filesize
359KB

MD5
7f4351440a5ca375b4c5a78fb51e7237

SHA1
9059f3265817fc7db907664745fdf8dcf3b0d8f9

SHA256
03d3223d21c74e3cf2afc0e9400f2bc58101d38b2587488d496ff676c5cf216d

SHA512
3acfacc8eba7a350b22213adecbf524ba3437ee4f0b5caed2d24fc8af1876cdc0b1dce6d7e6d54490abc6bb247294c6dedd30c29cd4f3f7261bc161b8b89c052

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
359KB

MD5
51eb967fbffa81277fd4e10fd6dac78a

SHA1
f911a136c55fc0b565fd23c0067368c1e7e5ff56

SHA256
383d53efb5450ef9dfd0f4b92afa142949174700b880174a920649ddcdbedc2e

SHA512
233e323517001f8a66b08420f1580062b23ee3be027fb053c25f16cbce43b3777f95c8756613fe4c096b8346add9247ab5205640d7e7113a45a6b146edb858c7

Download Submit
C:\Windows\SysWOW64\Ncabfkqo.exe

Filesize
359KB

MD5
0ced706cddaa434c3cd1f1da9371c245

SHA1
295eefa7714af783b87aef95eaec5dbfc1dab7b3

SHA256
6de16063ef13cf94c98cf6731fa0275ba6619ac93dfb5049f831dbc10fb07a10

SHA512
52f4b0c8361f11edac860bb216427a666a9750bd27647a061d976121420351680e978ff006c374c9d6455eee39a6bd64de0a8d301c3df44d74b415171caeb663

Download Submit
C:\Windows\SysWOW64\Nccokk32.exe

Filesize
359KB

MD5
c21a43cb7388874deb4dbb59b1981598

SHA1
ab507ec036791aeb2ee5fce345331f3513b3f67d

SHA256
239aa3bf7581dbe6b036b086714b46f6d1e7f8e9a8448d31999338757ac6bd18

SHA512
a172822f96faaa36546c0ee90cf046d2917353887deea7acc8bdc94131842690b46ace52e793c7084235f94cb61373c4bbc79ec7e9ef47cc6b406183f5270fd1

Download Submit
C:\Windows\SysWOW64\Nclikl32.exe

Filesize
359KB

MD5
8679c2d6da2ce7f8b103359715bd80e5

SHA1
fab12ba29551abc1f22bd4aac936134b3f14d4c8

SHA256
bed7c852b9818bae0b2e83a96c55a8fdbf240c94ceea5b2fd7d12ec28b1a4f5b

SHA512
ffca1e440c4c2d2aea8485646217f51b1cba9de61b8a4652e9ae6cbe3543b3e6c4120357149e1b263106c32a7d4b48aea32b3e8b1c2c7fe47701c47ab518d182

Download Submit
C:\Windows\SysWOW64\Ncofplba.exe

Filesize
359KB

MD5
d1bc202f2ac1308e8306bd483714b8e1

SHA1
b0957223be3b3994e58b72a2a2aaa186d96e32cb

SHA256
6e43b9815c8a5747efeef2c566e1b857c8c267e92dd8b3b481030b096027f9e2

SHA512
e2496b2f38e723f78838c855f6101d06d57f23ef6cf53eef23366786005f813b75564268f57bd71db945ac42dd50a1e56d01c2de24186dae36f456ad5a115a32

Download Submit
C:\Windows\SysWOW64\Nelfeo32.exe

Filesize
359KB

MD5
becc0a6a21100304f8b6a95467e99333

SHA1
b76391c01b10e100954b978927c8a14761bcc47f

SHA256
197d4032ac86ae05e49c107c3a577b782720f105723bced7517cda4a1abd6b75

SHA512
8ba138f999af64ff3a29fee9e6633ca9d734ff283bc7f7789366755e9e5adeecc5ab9ce752bc6365f3c888b50a47b777cb348eaed9c818aa6e43e306b67e9eb8

Download Submit
C:\Windows\SysWOW64\Neqopnhb.exe

Filesize
359KB

MD5
f998bacc528cc29debd97d41f849efdf

SHA1
980218a02730a531889ff5e8ca6ae5b69d6f4598

SHA256
633f6eb34aeca1224729595f5d4a049b1cf3e9e51e7724d8c88a2b72e564d0e2

SHA512
dfec2f984c1ce818453e50787c6fd53b74be041ccf587e10fa99780b3742ff6c89f447f4935791f9af3b1725da80c9f545410538841a25f6bf6980ef8bb8dbb1

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
359KB

MD5
df5485ffc94e3500c054b6bbf6383c99

SHA1
44bba4b0f2252b998b2225bbfa37a2981a5a0158

SHA256
bbc94a1edec252839ecc00dd24ea67dd004dad01bb0b6b01897bf4be2a2b01f0

SHA512
c14271c747ddacdf685926c8d830a4a0e7266241aff4eb3b9fe91caea06cedd4953f80dad8f874e7e7dc05bac09fd7d20e9c6f11b5a2f4535dd59472e30ba4b0

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
359KB

MD5
4cbdaa68d24204bdc03b346ab7d80c51

SHA1
1c72f08404ffcf094b9a6548ca5fbd85cbbbe9cc

SHA256
1fa82db7c94206b897d122a4db44d059497004261ac9381c71da2ca348a3aded

SHA512
07bcea482513ce48ce2edebc8a4dd77e106822f7e62c199ba3f5e26e4e1f837031ab4c3f1c722ed5a8bd5cd17144bb865dd5f887b7b578c1bccebd29999ed3ec

Download Submit
C:\Windows\SysWOW64\Njinmf32.exe

Filesize
359KB

MD5
306e528614851dcd96d830ec16744858

SHA1
999321ca39103839ee5e1e0d0176ccc71b0ee5bc

SHA256
664e06fd94fda3f8096e3e576e9ab476de3de7e2cfc1cbc6a4051bffa738354c

SHA512
9d433f9968afd8c782876439ce2d63cdb556b8e01ad645c14abc79698711ad5738408296f72458a631f943546ea530669f98b0c14fd945e6de797432578c2c41

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
359KB

MD5
ecc0a89f34e57b2d4a4c98bc40d5c9e9

SHA1
33662fa8ec1a30d65779061a7d0dcc66cb469b11

SHA256
fa6c32ce87fd1960bb66a3511c2a48abd692f18541d6c98f39f1254dd4e59bf8

SHA512
bb1a264bccd05a89c4eb3feef3f6f0e4ed1ef3ecbdccea9a4bc003291c0769bfa5e74ebefcf1962e84d0764f2cb420de68ca9cc98b037876ea159b61a662f594

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
359KB

MD5
7c13ee26e51e165fe3c7088603c72662

SHA1
31c363e81f60dad36f186f4bc565288e8d6294bb

SHA256
52f6d37a941a013358e0a6b6d9f3d1b7920548c5a74e38d1fbbb8760272313be

SHA512
f47ef95a9ecf1b8eb9bd546fbc5da16cd62388535c9849eca035911197feda0582f7f570c5daf67b33a10f503e9eb3205b11181b0acc0066e558bcf132571a6a

Download Submit
C:\Windows\SysWOW64\Nlhkgi32.exe

Filesize
359KB

MD5
81c86f8a069f0510b6d6f6dbefaa103e

SHA1
18899449d4cb30a96a52314ec5ce336e7e25ed22

SHA256
f40b7d4ef9305ec4b889f651ef6383824c15b8501f10eaa773eccca6edce46be

SHA512
64abe62362c3b8748c8a357a8a70d0071eae0394528a1c6de1854a523b5701fb259e7fc0ec094a915c9d7cba5b653b40643e49945350e70dae5feb135fa3b024

Download Submit
C:\Windows\SysWOW64\Nmbjcljl.exe

Filesize
359KB

MD5
4a3aaf2e0a6359858c203d78ab053662

SHA1
7c2ec875f16feb2cc02614975e04718b105c1847

SHA256
94fa5191d4711effbe3619eb4c95eee8be13232c1ce1154ec13b14360a58a71d

SHA512
88516b7777fff383cad2328b83575e14e153b0af2d3d0732935ba703c82263adfb9d2cce29cb57f902ffc29c510926f402b88cc5a7c105e7a7aeb61e7dbc76c2

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
359KB

MD5
2602e7f6345e6ffd1079d27569da9836

SHA1
70313b75f11aa0536d6ce416cd251df41c07e465

SHA256
ade3d4820978bd58c46f09f5a66285d4771c25f64f57dc489d847d40a0ec72a9

SHA512
4157b7cede385c82c66a1bfc14a7aa6f19c4bc8f998389e799fc3829615afc97c2aead40c2005b7c6b4b814c74e31b023d3eeb75195c0f8f77b278910248ee2c

Download Submit
C:\Windows\SysWOW64\Nmigoagp.exe

Filesize
359KB

MD5
73546cec7e968ce5cd74984f8e5a0cc3

SHA1
5ca2dce4f5fae52e2482874f493e44df8606dff7

SHA256
004186a68269ce277074e37bd196d5f38c13ebfcb12650cec3d904b36e8499be

SHA512
7f212123898d2dbc32182f55660ba7dd8631b4e185e8f0bc6da1814584db3d28ea0b0fcb7206759d0b77f593bfa44e58bbee155b1c142fa583958eb05f17dcf1

Download Submit
C:\Windows\SysWOW64\Nnbnhedj.exe

Filesize
359KB

MD5
822f49d41021cfc387b97f564d7960f0

SHA1
4623a98b0e9a816d4caafa626cee31eb7f204954

SHA256
b3cb1ae2ca74f4384f8d888d5576e1c545607036057da0f3d00b9a06e01ac492

SHA512
186ffd8154bf79ec291f4107712c1b6354705569fe4e589973236a06efe86f92f3e9c4b07b7ef859e3a9bbf6913594a963efc44c0ebd149bc06952ee165e38f3

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
359KB

MD5
d11e7735ffd5afa0b3d93366d74b1ef1

SHA1
efa29acdd0d7f87e8c2780fb4acb27a06dfce8b3

SHA256
8fc37cd6a370c06bb18e7f87a021f092b25295e4a0f04c8ea3cb59a69b99b3b2

SHA512
91c9f2af10428f30ff38f96be38119f18396c25bcfe3ccd35761d0696afaa098a858542317eb2abe5e2fd74d54d33c100d20a71053e1e106efaaefe35c6b35fa

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
359KB

MD5
7f1b5d000baad79b0b2415975863a0df

SHA1
63881f2386bf3049eae1e6db7b5c06d3b6ffef06

SHA256
3d21786f84211736db095d80c997aa2ddd65c21512d5870472b23ebfa87acb74

SHA512
cb4f175466222a99197909f0934484cb8cc4a5907a5a8803ea081149a2b6c47e76038d5dc5eaf83c329a68aa925267aa187c7c74aa501572b7c85d07251804fb

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
359KB

MD5
5b6eee79e49b94281f4c1ba97f7b1e77

SHA1
43f209b320094ec9a4366da421757ff16a74f4be

SHA256
4fde35c3e21e90a7c9fc5dde4c8d7ef65786cc93ad11f1afd6242782b680fdd5

SHA512
5a830724af62e60557cee0a0108795d7ce28d73d6f619c5cfcf6b3546ecbd39d9fbb57116f141ea23f8bd9c2b43f73a230c17b682579800edb90bef6db24b9d0

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
359KB

MD5
54d97371febf8abd63d1a0470b7cda28

SHA1
a06a3b7bbb1f03f539d74a60b8e92656676ea604

SHA256
b16b778a200707fc1ad0b45a6ac1a40f52d077df33f1489349e44d69ba7f91e4

SHA512
2df16245a87a80a26b24a9ef03c9b751b7e54b9e68a60ef62af72fca3c5e84b7b3de39967f0cbd8e5b857be59792f6b1341e04810164195c8c7c4b62a4345f38

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
359KB

MD5
beb0e31f71201229123966016423cb67

SHA1
462f2447d99eb5a0cc0d5602b1c811a5d772c8ca

SHA256
a748554f2740d9add67c306cc5f52707d00abf763d74d616c690b5e6ac2140a7

SHA512
fb39d43b6c96bada389187ac83f6632caf7c5cb962a7bf195d061c55bd261d5d3a3b78b068c260403d186cc8ea0e10dbe56d1a41d175408bb74a7045fcb262a6

Download Submit
C:\Windows\SysWOW64\Omalpc32.exe

Filesize
359KB

MD5
a4920fcc16897fe2ff4ff0f4e3afb17d

SHA1
38a6f997e4bd33693e123a1adf8bc44f5f5c1f84

SHA256
a135f8bad50828b610b876c9edfe5d51dd4a45aeb593e15f131f365b4267e58c

SHA512
7b402919eeb33b39b85dc3f79d341a738b7c05b175360165e5d535d46cf908ec5cb88cf0ba5d00116f64d4c2b3494dd1147c2f808adf0927cbf59b665ea7975f

Download Submit
C:\Windows\SysWOW64\Oonlfo32.exe

Filesize
359KB

MD5
2b8007a88eeb6b65a08b4b2347284077

SHA1
3086e7913b7b41ac3189d6327ca41565b8aa3409

SHA256
2a9ba28367fc7f2420f94e39e5328aeace663b407601c04d6b0fe90facda89fe

SHA512
8c9bc710b64541cd66d493d61bcf1b57fe96adfa39670160ce4fd592ea6a105651c83ef1599f2fa4c69b49031d12ce60323a12a9f1eb5f554bc42fa62a5008d3

Download Submit
C:\Windows\SysWOW64\Pbhgoh32.exe

Filesize
359KB

MD5
282c6105c42a9b9da4634988eff1103e

SHA1
bee81bf73509d45e6b8c7a23f60185f1a4938ae6

SHA256
26b4a0265ac2155d90b1bce66a70a4639d5b01cddd3cd6f237e9cc11f3a1bdfa

SHA512
a8a7b5f292dac03d623675b361e9115aa9a5f3abcad468f5547ee926c6b0b6977b47013d42e860cdb7d538fb19ac2c82c7722a08b8f72011322f6afaef49b80a

Download Submit
C:\Windows\SysWOW64\Pcgdhkem.exe

Filesize
359KB

MD5
9a94f2c7bdbbc147a26be6b4ffb11de5

SHA1
79315d4ff3e19356117869162b208b40a17eb95f

SHA256
7fdbd6405ec9bf31088cd806d572065f7514f0f20190ea95d565bb9f6bb5ba2a

SHA512
7825c4032fc54773bed88139c72c465c109317344147bc410df4b383fd1484b93206d87edd82e94c0d8305192d33ad127e183faac54d94b1de4b222ea7e724bd

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
359KB

MD5
fa6c5a7bf165076b1f49ba6a3adeb3a6

SHA1
ab6f277235a4d94e08fb7e107d95b27ce91c5d45

SHA256
452782c95bae6955d5a1728232b56c716e4155fa38914241920cd3314d823939

SHA512
0da9592e76976f1ffa44702b67057070690f6f49f217e0df8cd43219c40fb121f951a317b4f21afb4b696837064a8ab298086fcf6a140b31ea99eb83beb4eae1

Download Submit
C:\Windows\SysWOW64\Pjkmomfn.exe

Filesize
359KB

MD5
f15ab15f30f8452dcf33987d1d7b4b40

SHA1
f3029c3289285ea286710aceaa7d7c6c0e51e321

SHA256
1051af440092d9a62dc79884b909264636d579f47df6ae4e5eaa0abc33d8bd21

SHA512
7843b6fb4698b8af5edfc81358e5318816b64022989d21da50de87c81c1c7c4219da30f79bebf834a6b5b0387c8999b8d99314271045418426a9853ed627a63f

Download Submit
C:\Windows\SysWOW64\Qfjjpf32.exe

Filesize
359KB

MD5
bf033ddaa5cc63a663b6e7a770ed35c4

SHA1
9d80b52b4d90afca85f0a73be5777d0715992342

SHA256
fd1f4e6987dc7ceae5aad01471b2b6f8a41af46348f2e7c675a413962f896746

SHA512
f52ff83c77ee7ce94f7125a6c16f0094491091b4a055b23139084cac3a90a119be9422c7d195fe9a8e0c8aa9b5b2261fab57d0e37ce262088ac89a16884619f2

Download Submit
memory/116-313-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/216-109-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/216-613-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/540-132-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/540-633-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/728-266-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/804-652-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/804-156-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1300-557-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1300-32-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1344-530-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1344-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1440-295-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1740-179-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1740-671-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1764-646-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1764-147-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1920-301-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1936-195-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1936-683-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2012-56-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2012-576-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2360-79-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2360-593-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2376-569-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2376-48-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2404-260-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2412-228-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2616-343-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2668-244-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2816-284-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3024-3134-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3052-337-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3056-325-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3092-39-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3092-564-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3112-331-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3204-640-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3236-116-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3236-619-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3320-63-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3320-581-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3392-588-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3392-76-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3412-607-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3476-367-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3520-236-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3532-307-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3576-349-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3656-319-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3680-28-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3680-552-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3748-204-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3868-188-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3868-677-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4004-164-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4004-659-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4028-625-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4028-125-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4060-361-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4256-355-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4340-252-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4372-278-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4468-537-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4468-8-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4528-545-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4528-15-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4600-92-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4600-600-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4700-379-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4780-172-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4780-664-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4784-373-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4800-614-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4812-694-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4812-212-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4824-95-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4824-605-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4836-272-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5008-220-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5148-627-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5200-634-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5248-445-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5284-451-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5324-457-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5332-647-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5404-468-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5440-474-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5480-480-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5520-486-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5560-492-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5600-502-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5680-509-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5756-520-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5832-532-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5872-539-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5916-546-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/7316-3250-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/7792-3261-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/8792-3209-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/8868-3208-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/9264-3156-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/9276-3139-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/11188-3096-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/11212-3070-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/11784-3006-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/11876-3007-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads