berbew | 1ffeee4fa123b8e22b96b8551f92ce55d69120ab024309c8a76e39a460f33e57

Analysis

max time kernel
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
Size 320KB
Sample260717-tthkjsft2m
SHA256 1ffeee4fa123b8e22b96b8551f92ce55d69120ab024309c8a76e39a460f33e57
MD5 f9ea04a385ee822cd71ca34c4de3a7dd
SHA1 20ccb0c5a5bdc84636dcbc31f6a652dc7c255d9c
SHA512 e9ec99182877d7714cb12cf23b51642fbd4be2ba425fe1b46eb94e830f143455fbe7719d70a7b8c0b8e0da8d6b6033d26491e362e16823ee2062ca4a3fdfab81
SSDEEP 3072:uABL0Iu1Ox2CFfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dBLgOHfV/Ah1G/AcQ///NR5fn
TLSH
T15D64FC1A2A3009EACDED1FB5AD0249D8A241EAB014F1F17E6123DFDCD8F5DA2D945F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkkjfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgdedj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqgldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plndma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgeibicb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdnlmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emkeho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiobmjkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojpdgjid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkcehaof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajcdhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfgjcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgclgcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkljka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icalij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecoahmhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npcokpln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgebif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fipbnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbgaecjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fipkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjadck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiomppkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bblcda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejhgkgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjjmlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohkkanbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhipiihc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkfjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coigllel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnnidjcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noaoagca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeidan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaccdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doeifpkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdgdpdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjedpkne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlcaeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaliidon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppopcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pojccmii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmakgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Engjol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feoomd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conagl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Empococc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckkilhjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejaklmpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anjifbpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhbie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaibcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdjgbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabofaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbbodj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncfmhecp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pploli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckealm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqblbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboiaoff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffobbmpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddgghfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjmokmji.exe

Executes dropped EXE 64 IoCs

pid	Process
2280	Qnfkgfdp.exe
3952	Qkjlpk32.exe
4260	Aejfjocb.exe
944	Ajfobfaj.exe
5132	Aaqgop32.exe
4844	Adockl32.exe
1696	Andghd32.exe
1724	Aaccdp32.exe
1100	Blhhaigj.exe
2680	Bbbpnc32.exe
4516	Bdcmfkde.exe
1912	Bjnece32.exe
4820	Bagmpoco.exe
5384	Bhaeli32.exe
6032	Bjpaheio.exe
1840	Bajjeo32.exe
1216	Bhdbaihi.exe
4684	Bbifobho.exe
3068	Bdkbgj32.exe
2936	Bjdkcd32.exe
1404	Bblcda32.exe
716	Chhkmh32.exe
2300	Ckghid32.exe
5116	Cellfm32.exe
1096	Clfdcgkj.exe
1032	Cbqlpabf.exe
4908	Cdaigi32.exe
3788	Ckladcoa.exe
2808	Cbcieqpd.exe
636	Cddemi32.exe
4992	Cknnjcmo.exe
5508	Cahffmel.exe
4628	Clmjcfdb.exe
1620	Cbgbpp32.exe
572	Cdiohhbm.exe
3060	Dkbgeb32.exe
5456	Dampal32.exe
4544	Dhfhnfhc.exe
4180	Doqpkq32.exe
5712	Dejhgkgm.exe
4488	Dldpde32.exe
2444	Dboiaoff.exe
3196	Dhkaif32.exe
4232	Doeifpkk.exe
5956	Ddbbngjb.exe
4132	Dkljka32.exe
4904	Dafbhkhl.exe
5200	Elkfed32.exe
4832	Eceoanpo.exe
3980	Ehbgjenf.exe
4300	Echkgnnl.exe
5664	Edihof32.exe
1388	Eoollocp.exe
4248	Eehdii32.exe
4324	Ekemap32.exe
4308	Eaoenjqa.exe
4556	Ehimkd32.exe
2624	Ecoahmhd.exe
5500	Fdpnpe32.exe
1116	Fkjfloeo.exe
2000	Ffpjihee.exe
3900	Fljcfa32.exe
3812	Fcckcl32.exe
2508	Fhpckb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ddbbngjb.exe	Doeifpkk.exe
File opened for modification	C:\Windows\SysWOW64\Fdijkmbl.exe	Fajnoabh.exe
File created	C:\Windows\SysWOW64\Mhdjonng.exe	Mfcmge32.exe
File created	C:\Windows\SysWOW64\Adblnh32.dll	Eiahhdee.exe
File created	C:\Windows\SysWOW64\Hfmpgi32.dll	Geohdago.exe
File created	C:\Windows\SysWOW64\Koodka32.exe	Knnhdied.exe
File opened for modification	C:\Windows\SysWOW64\Mhgfdmle.exe	Mbjnlfnn.exe
File created	C:\Windows\SysWOW64\Lnmkpm32.exe	Lddgghfo.exe
File created	C:\Windows\SysWOW64\Emjgcc32.exe	Efpofi32.exe
File created	C:\Windows\SysWOW64\Lfpmgnmk.dll	Efpofi32.exe
File opened for modification	C:\Windows\SysWOW64\Jljbogaf.exe	Jgmjfpco.exe
File created	C:\Windows\SysWOW64\Hgebif32.exe	Hfdfanoa.exe
File opened for modification	C:\Windows\SysWOW64\Bagmpoco.exe	Bjnece32.exe
File created	C:\Windows\SysWOW64\Clomaf32.dll	Odocbmfd.exe
File created	C:\Windows\SysWOW64\Enmencke.dll	Caebfg32.exe
File created	C:\Windows\SysWOW64\Qdhocgme.dll	Eaddcnad.exe
File created	C:\Windows\SysWOW64\Ahbndm32.dll	Ibjibg32.exe
File created	C:\Windows\SysWOW64\Jdpkoalc.exe	Jnfcbg32.exe
File created	C:\Windows\SysWOW64\Caciik32.dll	Injmlbkh.exe
File created	C:\Windows\SysWOW64\Jggjpgmc.exe	Ilafcomm.exe
File created	C:\Windows\SysWOW64\Heimmh32.dll	Ecoahmhd.exe
File opened for modification	C:\Windows\SysWOW64\Ibeqgdpf.exe	Hodgei32.exe
File opened for modification	C:\Windows\SysWOW64\Jbpihlbn.exe	Ifihckmi.exe
File created	C:\Windows\SysWOW64\Ekhocd32.dll	Eigohp32.exe
File created	C:\Windows\SysWOW64\Offoebpp.dll	Dbicjlji.exe
File created	C:\Windows\SysWOW64\Mgnldkgj.exe	Mgkoolil.exe
File created	C:\Windows\SysWOW64\Kdlmmmim.dll	Ppeikjle.exe
File created	C:\Windows\SysWOW64\Qobhepjf.exe	Qanhkk32.exe
File created	C:\Windows\SysWOW64\Ifefbbdj.exe	Imjddmpl.exe
File opened for modification	C:\Windows\SysWOW64\Oepipo32.exe	Oofacdaj.exe
File opened for modification	C:\Windows\SysWOW64\Plndma32.exe	Piphaf32.exe
File created	C:\Windows\SysWOW64\Gofnqfah.dll	Ehndhn32.exe
File created	C:\Windows\SysWOW64\Faeihogj.exe	Foclpf32.exe
File created	C:\Windows\SysWOW64\Gceikh32.dll	Fniiabfd.exe
File created	C:\Windows\SysWOW64\Laiiie32.exe	Lllaqn32.exe
File created	C:\Windows\SysWOW64\Kafphi32.dll	Imjddmpl.exe
File created	C:\Windows\SysWOW64\Ahcmje32.dll	Mgclja32.exe
File opened for modification	C:\Windows\SysWOW64\Ojpdgjid.exe	Odfljp32.exe
File created	C:\Windows\SysWOW64\Ehjaal32.dll	Amgefl32.exe
File opened for modification	C:\Windows\SysWOW64\Bpaanfce.exe	Bopefnnf.exe
File created	C:\Windows\SysWOW64\Bbbpnc32.exe	Blhhaigj.exe
File created	C:\Windows\SysWOW64\Fdgdpdgj.exe	Fojlhmic.exe
File created	C:\Windows\SysWOW64\Cmlckhig.exe	Caebfg32.exe
File created	C:\Windows\SysWOW64\Mlkldmjf.exe	Mfoclflo.exe
File opened for modification	C:\Windows\SysWOW64\Nelmik32.exe	Nobdlqnc.exe
File created	C:\Windows\SysWOW64\Adjhld32.dll	Mjokpm32.exe
File opened for modification	C:\Windows\SysWOW64\Alnfiifd.exe	Aecnmo32.exe
File created	C:\Windows\SysWOW64\Oklegcdn.dll	Cpkddd32.exe
File created	C:\Windows\SysWOW64\Adfekcef.dll	Echkgnnl.exe
File created	C:\Windows\SysWOW64\Oidlhbem.dll	Ajnkmjqj.exe
File opened for modification	C:\Windows\SysWOW64\Ebocpd32.exe	Eoagdi32.exe
File created	C:\Windows\SysWOW64\Lckicnei.exe	Lmaafcml.exe
File created	C:\Windows\SysWOW64\Pjhpccnn.exe	Pcnhfi32.exe
File created	C:\Windows\SysWOW64\Lppgkh32.dll	Doojni32.exe
File opened for modification	C:\Windows\SysWOW64\Khplia32.exe	Kbccak32.exe
File created	C:\Windows\SysWOW64\Bikqfc32.dll	Kdqecc32.exe
File created	C:\Windows\SysWOW64\Pafcjijo.exe	Piknfgmd.exe
File created	C:\Windows\SysWOW64\Jjlmmbfo.exe	Jdodekhg.exe
File opened for modification	C:\Windows\SysWOW64\Ohceqo32.exe	Ojpdgjid.exe
File opened for modification	C:\Windows\SysWOW64\Bklfqd32.exe	Bdbndjld.exe
File opened for modification	C:\Windows\SysWOW64\Fagenneg.exe	Fniiabfd.exe
File created	C:\Windows\SysWOW64\Qnfkgfdp.exe	2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
File created	C:\Windows\SysWOW64\Hanppc32.dll	Jbobnf32.exe
File created	C:\Windows\SysWOW64\Jqgldb32.exe	Jdpkoalc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10788	10172	WerFault.exe	1068

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbifobho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejhgkgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbnjfefo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Injcginc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdaigi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiglen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagcndq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdfobe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qemoff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fllkjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekbce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnlgekkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oenljoji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqffdejj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peahpa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gblbmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagidhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbojfkjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfpcpefb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqhammje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpofbobf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjnece32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoagdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liikiccg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcqife32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nacmnlkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aklddmep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjmokmji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jljbogaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgmbmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geohdago.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knioij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaiiffjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpfonnab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcahgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaqbdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfcmpdjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmdach32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagmpoco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnlloj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oofacdaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpiqpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeolonem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oepipo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeidan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmmjpjpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pojccmii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnmblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gegkilik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhcdnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oefpoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdgcmqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgmjfpco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaonlhbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dampal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eibfmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajbmmcii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiiejnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibeqgdpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfgddi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kojdflkl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkobdeok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egkkpjcf.dll"	Injcginc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmkfjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdjqienq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfahlfko.dll"	Bdagidhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhcdnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcpacb32.dll"	Loqejjad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfcebf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jedodcbl.dll"	Kpncbemh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnjked32.dll"	Npcokpln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhoonfbe.dll"	Bcghlnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Konoldoa.dll"	Idbonc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kengqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nacmnlkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oblmnmjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgahnjpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jehoemmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmfha32.dll"	Bcqife32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jljanf32.dll"	Boabkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iciaji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfdgcmqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebimqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppkieoal.dll"	Hfhgdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cglbanmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbbpnc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqfokblg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaejbobp.dll"	Mlflog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Achbkl32.dll"	Madjbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekioo32.dll"	Cgnogmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mipchg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggilng32.dll"	Igfkpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcqdkcfn.dll"	Jcmkehcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcnmccfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcocmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhaepmgf.dll"	Ldeonbkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgihppgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnknkbdk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nobdlqnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbeece32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpeplmha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nogcjmhj.dll"	Hdfobe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibhja32.dll"	Lgamhjja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iljpbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndaboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfeahffl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppeikjle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coigllel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpadpm32.dll"	Gbmaog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miabik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebgpkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fiekhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggcjphja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppmammbl.dll"	Kjccna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkbohc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcndlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkqokn32.dll"	Fnipliip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akpbae32.dll"	Kcmmap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Keifneoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbpjgmbe.dll"	Eilomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dalhgfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idbfhiko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Loqejjad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpaibe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdlgm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2280	4376	2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe	90
PID 2280 wrote to memory of 3952	2280	Qnfkgfdp.exe	91
PID 3952 wrote to memory of 4260	3952	Qkjlpk32.exe	92
PID 4260 wrote to memory of 944	4260	Aejfjocb.exe	93
PID 944 wrote to memory of 5132	944	Ajfobfaj.exe	94
PID 5132 wrote to memory of 4844	5132	Aaqgop32.exe	95
PID 4844 wrote to memory of 1696	4844	Adockl32.exe	96
PID 1696 wrote to memory of 1724	1696	Andghd32.exe	97
PID 1724 wrote to memory of 1100	1724	Aaccdp32.exe	98
PID 1100 wrote to memory of 2680	1100	Blhhaigj.exe	99
PID 2680 wrote to memory of 4516	2680	Bbbpnc32.exe	100
PID 4516 wrote to memory of 1912	4516	Bdcmfkde.exe	101
PID 1912 wrote to memory of 4820	1912	Bjnece32.exe	102
PID 4820 wrote to memory of 5384	4820	Bagmpoco.exe	103
PID 5384 wrote to memory of 6032	5384	Bhaeli32.exe	104
PID 6032 wrote to memory of 1840	6032	Bjpaheio.exe	105
PID 1840 wrote to memory of 1216	1840	Bajjeo32.exe	106
PID 1216 wrote to memory of 4684	1216	Bhdbaihi.exe	107
PID 4684 wrote to memory of 3068	4684	Bbifobho.exe	108
PID 3068 wrote to memory of 2936	3068	Bdkbgj32.exe	109
PID 2936 wrote to memory of 1404	2936	Bjdkcd32.exe	110
PID 1404 wrote to memory of 716	1404	Bblcda32.exe	111
PID 716 wrote to memory of 2300	716	Chhkmh32.exe	112
PID 2300 wrote to memory of 5116	2300	Ckghid32.exe	113
PID 5116 wrote to memory of 1096	5116	Cellfm32.exe	114
PID 1096 wrote to memory of 1032	1096	Clfdcgkj.exe	115
PID 1032 wrote to memory of 4908	1032	Cbqlpabf.exe	116
PID 4908 wrote to memory of 3788	4908	Cdaigi32.exe	117
PID 3788 wrote to memory of 2808	3788	Ckladcoa.exe	118
PID 2808 wrote to memory of 636	2808	Cbcieqpd.exe	119
PID 636 wrote to memory of 4992	636	Cddemi32.exe	120
PID 4992 wrote to memory of 5508	4992	Cknnjcmo.exe	121
PID 5508 wrote to memory of 4628	5508	Cahffmel.exe	122
PID 4628 wrote to memory of 1620	4628	Clmjcfdb.exe	123
PID 1620 wrote to memory of 572	1620	Cbgbpp32.exe	124
PID 572 wrote to memory of 3060	572	Cdiohhbm.exe	125
PID 3060 wrote to memory of 5456	3060	Dkbgeb32.exe	126
PID 5456 wrote to memory of 4544	5456	Dampal32.exe	127
PID 4544 wrote to memory of 4180	4544	Dhfhnfhc.exe	128
PID 4180 wrote to memory of 5712	4180	Doqpkq32.exe	129
PID 5712 wrote to memory of 4488	5712	Dejhgkgm.exe	130
PID 4488 wrote to memory of 2444	4488	Dldpde32.exe	131
PID 2444 wrote to memory of 3196	2444	Dboiaoff.exe	132
PID 3196 wrote to memory of 4232	3196	Dhkaif32.exe	133
PID 4232 wrote to memory of 5956	4232	Doeifpkk.exe	134
PID 5956 wrote to memory of 4132	5956	Ddbbngjb.exe	135
PID 4132 wrote to memory of 4904	4132	Dkljka32.exe	136
PID 4904 wrote to memory of 5200	4904	Dafbhkhl.exe	137
PID 5200 wrote to memory of 4832	5200	Elkfed32.exe	138
PID 4832 wrote to memory of 3980	4832	Eceoanpo.exe	139
PID 3980 wrote to memory of 4300	3980	Ehbgjenf.exe	140
PID 4300 wrote to memory of 5664	4300	Echkgnnl.exe	141
PID 5664 wrote to memory of 1388	5664	Edihof32.exe	142
PID 1388 wrote to memory of 4248	1388	Eoollocp.exe	143
PID 4248 wrote to memory of 4324	4248	Eehdii32.exe	144
PID 4324 wrote to memory of 4308	4324	Ekemap32.exe	145
PID 4308 wrote to memory of 4556	4308	Eaoenjqa.exe	146
PID 4556 wrote to memory of 2624	4556	Ehimkd32.exe	147
PID 2624 wrote to memory of 5500	2624	Ecoahmhd.exe	148
PID 5500 wrote to memory of 1116	5500	Fdpnpe32.exe	149
PID 1116 wrote to memory of 2000	1116	Fkjfloeo.exe	150
PID 2000 wrote to memory of 3900	2000	Ffpjihee.exe	151
PID 3900 wrote to memory of 3812	3900	Fljcfa32.exe	152
PID 3812 wrote to memory of 2508	3812	Fcckcl32.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f9ea04a385ee822cd71ca34c4de3a7dd_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\Qnfkgfdp.exe
  C:\Windows\system32\Qnfkgfdp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\Qkjlpk32.exe
    C:\Windows\system32\Qkjlpk32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\SysWOW64\Aejfjocb.exe
      C:\Windows\system32\Aejfjocb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Windows\SysWOW64\Ajfobfaj.exe
        
        C:\Windows\system32\Ajfobfaj.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:944
      - C:\Windows\SysWOW64\Aaqgop32.exe
        
        C:\Windows\system32\Aaqgop32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Windows\SysWOW64\Adockl32.exe
        
        C:\Windows\system32\Adockl32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Andghd32.exe
        
        C:\Windows\system32\Andghd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Aaccdp32.exe
        
        C:\Windows\system32\Aaccdp32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Blhhaigj.exe
        
        C:\Windows\system32\Blhhaigj.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\Bbbpnc32.exe
        
        C:\Windows\system32\Bbbpnc32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SysWOW64\Bdcmfkde.exe
        
        C:\Windows\system32\Bdcmfkde.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Bjnece32.exe
        
        C:\Windows\system32\Bjnece32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Bagmpoco.exe
        
        C:\Windows\system32\Bagmpoco.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Windows\SysWOW64\Bjpaheio.exe
        
        C:\Windows\system32\Bjpaheio.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6032
        
        C:\Windows\SysWOW64\Bajjeo32.exe
        
        C:\Windows\system32\Bajjeo32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Bhdbaihi.exe
        
        C:\Windows\system32\Bhdbaihi.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Bbifobho.exe
        
        C:\Windows\system32\Bbifobho.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Bdkbgj32.exe
        
        C:\Windows\system32\Bdkbgj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Bjdkcd32.exe
        
        C:\Windows\system32\Bjdkcd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\Ckghid32.exe
        
        C:\Windows\system32\Ckghid32.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Cbqlpabf.exe
        
        C:\Windows\system32\Cbqlpabf.exe
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Cdaigi32.exe
        
        C:\Windows\system32\Cdaigi32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Ckladcoa.exe
        
        C:\Windows\system32\Ckladcoa.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Cbcieqpd.exe
        
        C:\Windows\system32\Cbcieqpd.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Cddemi32.exe
        
        C:\Windows\system32\Cddemi32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\SysWOW64\Cknnjcmo.exe
        
        C:\Windows\system32\Cknnjcmo.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Cahffmel.exe
        
        C:\Windows\system32\Cahffmel.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\Clmjcfdb.exe
        
        C:\Windows\system32\Clmjcfdb.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Cbgbpp32.exe
        
        C:\Windows\system32\Cbgbpp32.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Cdiohhbm.exe
        
        C:\Windows\system32\Cdiohhbm.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Windows\SysWOW64\Dkbgeb32.exe
        
        C:\Windows\system32\Dkbgeb32.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Dampal32.exe
        
        C:\Windows\system32\Dampal32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5456
        
        C:\Windows\SysWOW64\Dhfhnfhc.exe
        
        C:\Windows\system32\Dhfhnfhc.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Doqpkq32.exe
        
        C:\Windows\system32\Doqpkq32.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Dejhgkgm.exe
        
        C:\Windows\system32\Dejhgkgm.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5712
        
        C:\Windows\SysWOW64\Dldpde32.exe
        
        C:\Windows\system32\Dldpde32.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Dboiaoff.exe
        
        C:\Windows\system32\Dboiaoff.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Dhkaif32.exe
        
        C:\Windows\system32\Dhkaif32.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Doeifpkk.exe
        
        C:\Windows\system32\Doeifpkk.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\SysWOW64\Dkljka32.exe
        
        C:\Windows\system32\Dkljka32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Dafbhkhl.exe
        
        C:\Windows\system32\Dafbhkhl.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Elkfed32.exe
        
        C:\Windows\system32\Elkfed32.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5200
        
        C:\Windows\SysWOW64\Eceoanpo.exe
        
        C:\Windows\system32\Eceoanpo.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Ehbgjenf.exe
        
        C:\Windows\system32\Ehbgjenf.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Echkgnnl.exe
        
        C:\Windows\system32\Echkgnnl.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Edihof32.exe
        
        C:\Windows\system32\Edihof32.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5664
        
        C:\Windows\SysWOW64\Eoollocp.exe
        
        C:\Windows\system32\Eoollocp.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Eehdii32.exe
        
        C:\Windows\system32\Eehdii32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Ekemap32.exe
        
        C:\Windows\system32\Ekemap32.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Eaoenjqa.exe
        
        C:\Windows\system32\Eaoenjqa.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Ehimkd32.exe
        
        C:\Windows\system32\Ehimkd32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Ecoahmhd.exe
        
        C:\Windows\system32\Ecoahmhd.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Fdpnpe32.exe
        
        C:\Windows\system32\Fdpnpe32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\SysWOW64\Fkjfloeo.exe
        
        C:\Windows\system32\Fkjfloeo.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Fljcfa32.exe
        
        C:\Windows\system32\Fljcfa32.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Fcckcl32.exe
        
        C:\Windows\system32\Fcckcl32.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Fhpckb32.exe
        
        C:\Windows\system32\Fhpckb32.exe
        65⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Fojlhmic.exe
        
        C:\Windows\system32\Fojlhmic.exe
        66⤵
        Drops file in System32 directory
        
        PID:2944
        
        C:\Windows\SysWOW64\Fdgdpdgj.exe
        
        C:\Windows\system32\Fdgdpdgj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4472
        
        C:\Windows\SysWOW64\Gbmaog32.exe
        
        C:\Windows\system32\Gbmaog32.exe
        68⤵
        Modifies registry class
        
        PID:3888
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        69⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Gfkjef32.exe
        
        C:\Windows\system32\Gfkjef32.exe
        70⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Gkhbnm32.exe
        
        C:\Windows\system32\Gkhbnm32.exe
        71⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        72⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Gfpcpefb.exe
        
        C:\Windows\system32\Gfpcpefb.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
        
        C:\Windows\SysWOW64\Gfbpfedp.exe
        
        C:\Windows\system32\Gfbpfedp.exe
        74⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gkoinlbg.exe
        
        C:\Windows\system32\Gkoinlbg.exe
        75⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        76⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Homadjin.exe
        
        C:\Windows\system32\Homadjin.exe
        77⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Hbnjfefo.exe
        
        C:\Windows\system32\Hbnjfefo.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Windows\SysWOW64\Hmcocn32.exe
        
        C:\Windows\system32\Hmcocn32.exe
        79⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Hbpgle32.exe
        
        C:\Windows\system32\Hbpgle32.exe
        80⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        81⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Ibeqgdpf.exe
        
        C:\Windows\system32\Ibeqgdpf.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Imjddmpl.exe
        
        C:\Windows\system32\Imjddmpl.exe
        83⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Ifefbbdj.exe
        
        C:\Windows\system32\Ifefbbdj.exe
        84⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Imonol32.exe
        
        C:\Windows\system32\Imonol32.exe
        85⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        86⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        87⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        89⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Jcbibeki.exe
        
        C:\Windows\system32\Jcbibeki.exe
        90⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        91⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Jmmjpjpg.exe
        
        C:\Windows\system32\Jmmjpjpg.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Windows\SysWOW64\Jehoemmb.exe
        
        C:\Windows\system32\Jehoemmb.exe
        93⤵
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        94⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        95⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Kboldq32.exe
        
        C:\Windows\system32\Kboldq32.exe
        96⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        97⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        98⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        99⤵
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        100⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Kfanen32.exe
        
        C:\Windows\system32\Kfanen32.exe
        101⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Ldeonbkd.exe
        
        C:\Windows\system32\Ldeonbkd.exe
        102⤵
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Llpcceho.exe
        
        C:\Windows\system32\Llpcceho.exe
        103⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Leihlj32.exe
        
        C:\Windows\system32\Leihlj32.exe
        104⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Ldjhib32.exe
        
        C:\Windows\system32\Ldjhib32.exe
        105⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Lifqbi32.exe
        
        C:\Windows\system32\Lifqbi32.exe
        106⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Ldleoa32.exe
        
        C:\Windows\system32\Ldleoa32.exe
        107⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Liimgh32.exe
        
        C:\Windows\system32\Liimgh32.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Lbabpn32.exe
        
        C:\Windows\system32\Lbabpn32.exe
        109⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Mljficpd.exe
        
        C:\Windows\system32\Mljficpd.exe
        110⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        111⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Mllcocna.exe
        
        C:\Windows\system32\Mllcocna.exe
        112⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Mipchg32.exe
        
        C:\Windows\system32\Mipchg32.exe
        113⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Mdehep32.exe
        
        C:\Windows\system32\Mdehep32.exe
        114⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Mmnlnfcb.exe
        
        C:\Windows\system32\Mmnlnfcb.exe
        115⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Mckefmai.exe
        
        C:\Windows\system32\Mckefmai.exe
        116⤵
        
        PID:604
        
        C:\Windows\SysWOW64\Mnpice32.exe
        
        C:\Windows\system32\Mnpice32.exe
        117⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Mcmall32.exe
        
        C:\Windows\system32\Mcmall32.exe
        118⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Ndmnfofi.exe
        
        C:\Windows\system32\Ndmnfofi.exe
        119⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        120⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Npcokpln.exe
        
        C:\Windows\system32\Npcokpln.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Nepgcgje.exe
        
        C:\Windows\system32\Nepgcgje.exe
        122⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        123⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        124⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Nnjljd32.exe
        
        C:\Windows\system32\Nnjljd32.exe
        125⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Ndcdfnpa.exe
        
        C:\Windows\system32\Ndcdfnpa.exe
        126⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        127⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        128⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Onneeceo.exe
        
        C:\Windows\system32\Onneeceo.exe
        129⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Oggjni32.exe
        
        C:\Windows\system32\Oggjni32.exe
        130⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Olcbfp32.exe
        
        C:\Windows\system32\Olcbfp32.exe
        131⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Ogifci32.exe
        
        C:\Windows\system32\Ogifci32.exe
        132⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        133⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        134⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        135⤵
        Drops file in System32 directory
        
        PID:5840
        
        C:\Windows\SysWOW64\Omjhgoco.exe
        
        C:\Windows\system32\Omjhgoco.exe
        136⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Pfcmpdjp.exe
        
        C:\Windows\system32\Pfcmpdjp.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Windows\SysWOW64\Pqhammje.exe
        
        C:\Windows\system32\Pqhammje.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Windows\SysWOW64\Pjaefc32.exe
        
        C:\Windows\system32\Pjaefc32.exe
        139⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Pcijoh32.exe
        
        C:\Windows\system32\Pcijoh32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Pmangnmg.exe
        
        C:\Windows\system32\Pmangnmg.exe
        141⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Pfjcpc32.exe
        
        C:\Windows\system32\Pfjcpc32.exe
        142⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        143⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Pjhlfb32.exe
        
        C:\Windows\system32\Pjhlfb32.exe
        144⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        145⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Qjjhla32.exe
        
        C:\Windows\system32\Qjjhla32.exe
        146⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Qqdqilph.exe
        
        C:\Windows\system32\Qqdqilph.exe
        147⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Qfaiabnp.exe
        
        C:\Windows\system32\Qfaiabnp.exe
        148⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Qqfmnk32.exe
        
        C:\Windows\system32\Qqfmnk32.exe
        149⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Afcffb32.exe
        
        C:\Windows\system32\Afcffb32.exe
        150⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ammnclcj.exe
        
        C:\Windows\system32\Ammnclcj.exe
        151⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Agcbqecp.exe
        
        C:\Windows\system32\Agcbqecp.exe
        152⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Acicefid.exe
        
        C:\Windows\system32\Acicefid.exe
        153⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ajckbp32.exe
        
        C:\Windows\system32\Ajckbp32.exe
        154⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Aeiooi32.exe
        
        C:\Windows\system32\Aeiooi32.exe
        155⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Anadho32.exe
        
        C:\Windows\system32\Anadho32.exe
        156⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Acnlqe32.exe
        
        C:\Windows\system32\Acnlqe32.exe
        157⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ajhdmplk.exe
        
        C:\Windows\system32\Ajhdmplk.exe
        158⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Bcqife32.exe
        
        C:\Windows\system32\Bcqife32.exe
        159⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Bminokil.exe
        
        C:\Windows\system32\Bminokil.exe
        160⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Bccfleqi.exe
        
        C:\Windows\system32\Bccfleqi.exe
        161⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Bnhjinpo.exe
        
        C:\Windows\system32\Bnhjinpo.exe
        162⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Bebbeh32.exe
        
        C:\Windows\system32\Bebbeh32.exe
        163⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Bjokno32.exe
        
        C:\Windows\system32\Bjokno32.exe
        164⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        165⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Bjagcndq.exe
        
        C:\Windows\system32\Bjagcndq.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
        
        C:\Windows\SysWOW64\Bcjlld32.exe
        
        C:\Windows\system32\Bcjlld32.exe
        167⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Bmbpeiaa.exe
        
        C:\Windows\system32\Bmbpeiaa.exe
        168⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        169⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Capikhgh.exe
        
        C:\Windows\system32\Capikhgh.exe
        170⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Cjindm32.exe
        
        C:\Windows\system32\Cjindm32.exe
        171⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Cenaaf32.exe
        
        C:\Windows\system32\Cenaaf32.exe
        172⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Cjkjjmlf.exe
        
        C:\Windows\system32\Cjkjjmlf.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6972
        
        C:\Windows\SysWOW64\Caebfg32.exe
        
        C:\Windows\system32\Caebfg32.exe
        174⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Cmlckhig.exe
        
        C:\Windows\system32\Cmlckhig.exe
        175⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Cokpekpj.exe
        
        C:\Windows\system32\Cokpekpj.exe
        176⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        177⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Dalhgfmk.exe
        
        C:\Windows\system32\Dalhgfmk.exe
        178⤵
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Dfiaomkb.exe
        
        C:\Windows\system32\Dfiaomkb.exe
        179⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Daneme32.exe
        
        C:\Windows\system32\Daneme32.exe
        180⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Daqbbe32.exe
        
        C:\Windows\system32\Daqbbe32.exe
        181⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Dfmjjl32.exe
        
        C:\Windows\system32\Dfmjjl32.exe
        182⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Dacohegc.exe
        
        C:\Windows\system32\Dacohegc.exe
        183⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Dkkcqj32.exe
        
        C:\Windows\system32\Dkkcqj32.exe
        184⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Eddhipdd.exe
        
        C:\Windows\system32\Eddhipdd.exe
        185⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Eahhcd32.exe
        
        C:\Windows\system32\Eahhcd32.exe
        186⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Ehappnjj.exe
        
        C:\Windows\system32\Ehappnjj.exe
        187⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Emniheha.exe
        
        C:\Windows\system32\Emniheha.exe
        188⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Eehnnb32.exe
        
        C:\Windows\system32\Eehnnb32.exe
        189⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Egijfjmp.exe
        
        C:\Windows\system32\Egijfjmp.exe
        190⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Edmjpoli.exe
        
        C:\Windows\system32\Edmjpoli.exe
        191⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Fneohd32.exe
        
        C:\Windows\system32\Fneohd32.exe
        192⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Fhkcfmbp.exe
        
        C:\Windows\system32\Fhkcfmbp.exe
        193⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Fnhlndqg.exe
        
        C:\Windows\system32\Fnhlndqg.exe
        194⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Fhmpkmpm.exe
        
        C:\Windows\system32\Fhmpkmpm.exe
        195⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Fafddb32.exe
        
        C:\Windows\system32\Fafddb32.exe
        196⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Fgbmliee.exe
        
        C:\Windows\system32\Fgbmliee.exe
        197⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Fnmeic32.exe
        
        C:\Windows\system32\Fnmeic32.exe
        198⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Fdfmfmdo.exe
        
        C:\Windows\system32\Fdfmfmdo.exe
        199⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fgeibicb.exe
        
        C:\Windows\system32\Fgeibicb.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Fajnoabh.exe
        
        C:\Windows\system32\Fajnoabh.exe
        201⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Fdijkmbl.exe
        
        C:\Windows\system32\Fdijkmbl.exe
        202⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Gkcbhgii.exe
        
        C:\Windows\system32\Gkcbhgii.exe
        203⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Gamjea32.exe
        
        C:\Windows\system32\Gamjea32.exe
        204⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ghgbakhb.exe
        
        C:\Windows\system32\Ghgbakhb.exe
        205⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Goqkne32.exe
        
        C:\Windows\system32\Goqkne32.exe
        206⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Gaogja32.exe
        
        C:\Windows\system32\Gaogja32.exe
        207⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ghiogkfp.exe
        
        C:\Windows\system32\Ghiogkfp.exe
        208⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Gochceml.exe
        
        C:\Windows\system32\Gochceml.exe
        209⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Gdppllld.exe
        
        C:\Windows\system32\Gdppllld.exe
        210⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Gkjhif32.exe
        
        C:\Windows\system32\Gkjhif32.exe
        211⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Gadqepkn.exe
        
        C:\Windows\system32\Gadqepkn.exe
        212⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Gdbmalja.exe
        
        C:\Windows\system32\Gdbmalja.exe
        213⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        214⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Gafmkp32.exe
        
        C:\Windows\system32\Gafmkp32.exe
        215⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Gddigk32.exe
        
        C:\Windows\system32\Gddigk32.exe
        216⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Hkobdeok.exe
        
        C:\Windows\system32\Hkobdeok.exe
        217⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Hfdfanoa.exe
        
        C:\Windows\system32\Hfdfanoa.exe
        218⤵
        Drops file in System32 directory
        
        PID:7804
        
        C:\Windows\SysWOW64\Hgebif32.exe
        
        C:\Windows\system32\Hgebif32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Hffbfn32.exe
        
        C:\Windows\system32\Hffbfn32.exe
        220⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Hkckoe32.exe
        
        C:\Windows\system32\Hkckoe32.exe
        221⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Hbmclobc.exe
        
        C:\Windows\system32\Hbmclobc.exe
        222⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hkehdd32.exe
        
        C:\Windows\system32\Hkehdd32.exe
        223⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Hdnlmj32.exe
        
        C:\Windows\system32\Hdnlmj32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Hkhdjdgq.exe
        
        C:\Windows\system32\Hkhdjdgq.exe
        225⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Hfmigmgf.exe
        
        C:\Windows\system32\Hfmigmgf.exe
        226⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Iofmpb32.exe
        
        C:\Windows\system32\Iofmpb32.exe
        227⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        228⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Iohjebkd.exe
        
        C:\Windows\system32\Iohjebkd.exe
        229⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Igcojdhp.exe
        
        C:\Windows\system32\Igcojdhp.exe
        230⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Ibicgmhe.exe
        
        C:\Windows\system32\Ibicgmhe.exe
        231⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Igfkpd32.exe
        
        C:\Windows\system32\Igfkpd32.exe
        232⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Ibkpmm32.exe
        
        C:\Windows\system32\Ibkpmm32.exe
        233⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ighhed32.exe
        
        C:\Windows\system32\Ighhed32.exe
        234⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ifihckmi.exe
        
        C:\Windows\system32\Ifihckmi.exe
        235⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Jbpihlbn.exe
        
        C:\Windows\system32\Jbpihlbn.exe
        236⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        237⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Jkkjfa32.exe
        
        C:\Windows\system32\Jkkjfa32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Jfpocjfa.exe
        
        C:\Windows\system32\Jfpocjfa.exe
        239⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Jgakkb32.exe
        
        C:\Windows\system32\Jgakkb32.exe
        240⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Jbgoik32.exe
        
        C:\Windows\system32\Jbgoik32.exe
        241⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Jiageecb.exe
        
        C:\Windows\system32\Jiageecb.exe
        242⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Kehhjfif.exe
        
        C:\Windows\system32\Kehhjfif.exe
        243⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Kpmlhoil.exe
        
        C:\Windows\system32\Kpmlhoil.exe
        244⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Kfgddi32.exe
        
        C:\Windows\system32\Kfgddi32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7236
        
        C:\Windows\SysWOW64\Knbiil32.exe
        
        C:\Windows\system32\Knbiil32.exe
        246⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Klfjbpmn.exe
        
        C:\Windows\system32\Klfjbpmn.exe
        247⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Kbpboj32.exe
        
        C:\Windows\system32\Kbpboj32.exe
        248⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Kbbodj32.exe
        
        C:\Windows\system32\Kbbodj32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Kimgad32.exe
        
        C:\Windows\system32\Kimgad32.exe
        250⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Kpfonnab.exe
        
        C:\Windows\system32\Kpfonnab.exe
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7900
        
        C:\Windows\SysWOW64\Liocgc32.exe
        
        C:\Windows\system32\Liocgc32.exe
        252⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Lnlloj32.exe
        
        C:\Windows\system32\Lnlloj32.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:8156
        
        C:\Windows\SysWOW64\Lfcdph32.exe
        
        C:\Windows\system32\Lfcdph32.exe
        254⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        256⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Loqejjad.exe
        
        C:\Windows\system32\Loqejjad.exe
        257⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Lifjgb32.exe
        
        C:\Windows\system32\Lifjgb32.exe
        258⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Locbpi32.exe
        
        C:\Windows\system32\Locbpi32.exe
        259⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Lemjlcgo.exe
        
        C:\Windows\system32\Lemjlcgo.exe
        260⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        261⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Mflgff32.exe
        
        C:\Windows\system32\Mflgff32.exe
        262⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Mhncnodp.exe
        
        C:\Windows\system32\Mhncnodp.exe
        263⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Mfoclflo.exe
        
        C:\Windows\system32\Mfoclflo.exe
        264⤵
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Mlkldmjf.exe
        
        C:\Windows\system32\Mlkldmjf.exe
        265⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Mfaqafjl.exe
        
        C:\Windows\system32\Mfaqafjl.exe
        266⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Mlnijmhc.exe
        
        C:\Windows\system32\Mlnijmhc.exe
        267⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Mfcmge32.exe
        
        C:\Windows\system32\Mfcmge32.exe
        268⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Mhdjonng.exe
        
        C:\Windows\system32\Mhdjonng.exe
        269⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Mbjnlfnn.exe
        
        C:\Windows\system32\Mbjnlfnn.exe
        270⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Mhgfdmle.exe
        
        C:\Windows\system32\Mhgfdmle.exe
        271⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Noaoagca.exe
        
        C:\Windows\system32\Noaoagca.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Nhicjm32.exe
        
        C:\Windows\system32\Nhicjm32.exe
        273⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Nppkkj32.exe
        
        C:\Windows\system32\Nppkkj32.exe
        274⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Nhlpom32.exe
        
        C:\Windows\system32\Nhlpom32.exe
        275⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Noehlgol.exe
        
        C:\Windows\system32\Noehlgol.exe
        276⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Neppiagi.exe
        
        C:\Windows\system32\Neppiagi.exe
        277⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Nccqbeec.exe
        
        C:\Windows\system32\Nccqbeec.exe
        278⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Nimioo32.exe
        
        C:\Windows\system32\Nimioo32.exe
        279⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ncfmhecp.exe
        
        C:\Windows\system32\Ncfmhecp.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8788
        
        C:\Windows\SysWOW64\Nhbfpl32.exe
        
        C:\Windows\system32\Nhbfpl32.exe
        281⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ochjmd32.exe
        
        C:\Windows\system32\Ochjmd32.exe
        282⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Oibbjoij.exe
        
        C:\Windows\system32\Oibbjoij.exe
        283⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Oplkgi32.exe
        
        C:\Windows\system32\Oplkgi32.exe
        284⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Ogfccchd.exe
        
        C:\Windows\system32\Ogfccchd.exe
        285⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Olcklj32.exe
        
        C:\Windows\system32\Olcklj32.exe
        286⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Oiglen32.exe
        
        C:\Windows\system32\Oiglen32.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:9024
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        288⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Oenljoji.exe
        
        C:\Windows\system32\Oenljoji.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
        
        C:\Windows\SysWOW64\Oofacdaj.exe
        
        C:\Windows\system32\Oofacdaj.exe
        290⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9124
        
        C:\Windows\SysWOW64\Oepipo32.exe
        
        C:\Windows\system32\Oepipo32.exe
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:9164
        
        C:\Windows\SysWOW64\Pljalipc.exe
        
        C:\Windows\system32\Pljalipc.exe
        292⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Pjnbfmom.exe
        
        C:\Windows\system32\Pjnbfmom.exe
        293⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Pphjbgfj.exe
        
        C:\Windows\system32\Pphjbgfj.exe
        294⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pfdbknda.exe
        
        C:\Windows\system32\Pfdbknda.exe
        295⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Pomgcc32.exe
        
        C:\Windows\system32\Pomgcc32.exe
        296⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Pjbkal32.exe
        
        C:\Windows\system32\Pjbkal32.exe
        297⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Pplcnf32.exe
        
        C:\Windows\system32\Pplcnf32.exe
        298⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Pgfljqia.exe
        
        C:\Windows\system32\Pgfljqia.exe
        299⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        301⤵
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Qleahgff.exe
        
        C:\Windows\system32\Qleahgff.exe
        302⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Qgkeep32.exe
        
        C:\Windows\system32\Qgkeep32.exe
        303⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Qlhnng32.exe
        
        C:\Windows\system32\Qlhnng32.exe
        304⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        305⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Aqffdejj.exe
        
        C:\Windows\system32\Aqffdejj.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        307⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Acfoep32.exe
        
        C:\Windows\system32\Acfoep32.exe
        308⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Amodnenk.exe
        
        C:\Windows\system32\Amodnenk.exe
        309⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Acilkp32.exe
        
        C:\Windows\system32\Acilkp32.exe
        310⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Ajcdhj32.exe
        
        C:\Windows\system32\Ajcdhj32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8524
        
        C:\Windows\SysWOW64\Aopmpq32.exe
        
        C:\Windows\system32\Aopmpq32.exe
        312⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Afjemkbi.exe
        
        C:\Windows\system32\Afjemkbi.exe
        313⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Aobieq32.exe
        
        C:\Windows\system32\Aobieq32.exe
        314⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Bijnnf32.exe
        
        C:\Windows\system32\Bijnnf32.exe
        315⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Bfnnhj32.exe
        
        C:\Windows\system32\Bfnnhj32.exe
        316⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Bqdbec32.exe
        
        C:\Windows\system32\Bqdbec32.exe
        317⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Bcboan32.exe
        
        C:\Windows\system32\Bcboan32.exe
        318⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Bqfokblg.exe
        
        C:\Windows\system32\Bqfokblg.exe
        319⤵
        Modifies registry class
        
        PID:9172
        
        C:\Windows\SysWOW64\Bjodch32.exe
        
        C:\Windows\system32\Bjodch32.exe
        320⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Bcghlnih.exe
        
        C:\Windows\system32\Bcghlnih.exe
        321⤵
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Bqkifb32.exe
        
        C:\Windows\system32\Bqkifb32.exe
        322⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Cifmjd32.exe
        
        C:\Windows\system32\Cifmjd32.exe
        323⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Cggnhlml.exe
        
        C:\Windows\system32\Cggnhlml.exe
        324⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Cmdfpbkc.exe
        
        C:\Windows\system32\Cmdfpbkc.exe
        325⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        326⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Cabofaaj.exe
        
        C:\Windows\system32\Cabofaaj.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Cimckcoe.exe
        
        C:\Windows\system32\Cimckcoe.exe
        328⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Cgndikgd.exe
        
        C:\Windows\system32\Cgndikgd.exe
        329⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Cafhap32.exe
        
        C:\Windows\system32\Cafhap32.exe
        330⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Djomjfde.exe
        
        C:\Windows\system32\Djomjfde.exe
        331⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Dplebmbl.exe
        
        C:\Windows\system32\Dplebmbl.exe
        332⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Dakampio.exe
        
        C:\Windows\system32\Dakampio.exe
        333⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Dhejij32.exe
        
        C:\Windows\system32\Dhejij32.exe
        334⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Diffabgj.exe
        
        C:\Windows\system32\Diffabgj.exe
        335⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Dclknkfp.exe
        
        C:\Windows\system32\Dclknkfp.exe
        336⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Dmdogpmq.exe
        
        C:\Windows\system32\Dmdogpmq.exe
        337⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Ddngdj32.exe
        
        C:\Windows\system32\Ddngdj32.exe
        338⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Djhpqdlj.exe
        
        C:\Windows\system32\Djhpqdlj.exe
        339⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Dpehikja.exe
        
        C:\Windows\system32\Dpehikja.exe
        340⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Ejklfd32.exe
        
        C:\Windows\system32\Ejklfd32.exe
        341⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Eaddcnad.exe
        
        C:\Windows\system32\Eaddcnad.exe
        342⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Ehomph32.exe
        
        C:\Windows\system32\Ehomph32.exe
        343⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Emkeho32.exe
        
        C:\Windows\system32\Emkeho32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9948
        
        C:\Windows\SysWOW64\Ehaieh32.exe
        
        C:\Windows\system32\Ehaieh32.exe
        345⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Eibfmp32.exe
        
        C:\Windows\system32\Eibfmp32.exe
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
        
        C:\Windows\SysWOW64\Eplnijdj.exe
        
        C:\Windows\system32\Eplnijdj.exe
        347⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Effffd32.exe
        
        C:\Windows\system32\Effffd32.exe
        348⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Empococc.exe
        
        C:\Windows\system32\Empococc.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10108
        
        C:\Windows\SysWOW64\Ehecpgbi.exe
        
        C:\Windows\system32\Ehecpgbi.exe
        350⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Eigohp32.exe
        
        C:\Windows\system32\Eigohp32.exe
        351⤵
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\Fdlcehhn.exe
        
        C:\Windows\system32\Fdlcehhn.exe
        352⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Fiilmofe.exe
        
        C:\Windows\system32\Fiilmofe.exe
        353⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Fdopkhfk.exe
        
        C:\Windows\system32\Fdopkhfk.exe
        354⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Ffmmgceo.exe
        
        C:\Windows\system32\Ffmmgceo.exe
        355⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Fpeapilo.exe
        
        C:\Windows\system32\Fpeapilo.exe
        356⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Fhmiqfma.exe
        
        C:\Windows\system32\Fhmiqfma.exe
        357⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Fmiaimki.exe
        
        C:\Windows\system32\Fmiaimki.exe
        358⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Fhofffjo.exe
        
        C:\Windows\system32\Fhofffjo.exe
        359⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Fipbnn32.exe
        
        C:\Windows\system32\Fipbnn32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9636
        
        C:\Windows\SysWOW64\Fagjolao.exe
        
        C:\Windows\system32\Fagjolao.exe
        361⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Fhablf32.exe
        
        C:\Windows\system32\Fhablf32.exe
        362⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Gpmgph32.exe
        
        C:\Windows\system32\Gpmgph32.exe
        363⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Gielinlg.exe
        
        C:\Windows\system32\Gielinlg.exe
        364⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Ghflgedf.exe
        
        C:\Windows\system32\Ghflgedf.exe
        365⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ganppk32.exe
        
        C:\Windows\system32\Ganppk32.exe
        366⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Ggkiha32.exe
        
        C:\Windows\system32\Ggkiha32.exe
        367⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Gaqmej32.exe
        
        C:\Windows\system32\Gaqmej32.exe
        368⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Ghkebd32.exe
        
        C:\Windows\system32\Ghkebd32.exe
        369⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Gilajmfp.exe
        
        C:\Windows\system32\Gilajmfp.exe
        370⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ghmbhd32.exe
        
        C:\Windows\system32\Ghmbhd32.exe
        371⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Haefqjeo.exe
        
        C:\Windows\system32\Haefqjeo.exe
        372⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Hhoomd32.exe
        
        C:\Windows\system32\Hhoomd32.exe
        373⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Hnlgekkc.exe
        
        C:\Windows\system32\Hnlgekkc.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:9736
        
        C:\Windows\SysWOW64\Hdfobe32.exe
        
        C:\Windows\system32\Hdfobe32.exe
        375⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Hnodkjhq.exe
        
        C:\Windows\system32\Hnodkjhq.exe
        376⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Hdhlhd32.exe
        
        C:\Windows\system32\Hdhlhd32.exe
        377⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Hjedpkne.exe
        
        C:\Windows\system32\Hjedpkne.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Hpomme32.exe
        
        C:\Windows\system32\Hpomme32.exe
        379⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Hkeajn32.exe
        
        C:\Windows\system32\Hkeajn32.exe
        380⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Hpaibe32.exe
        
        C:\Windows\system32\Hpaibe32.exe
        381⤵
        Modifies registry class
        
        PID:9944
        
        C:\Windows\SysWOW64\Hhiacb32.exe
        
        C:\Windows\system32\Hhiacb32.exe
        382⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Hjjnkkjp.exe
        
        C:\Windows\system32\Hjjnkkjp.exe
        383⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Idpbhc32.exe
        
        C:\Windows\system32\Idpbhc32.exe
        384⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Ikijenab.exe
        
        C:\Windows\system32\Ikijenab.exe
        385⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        386⤵
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Igpkjo32.exe
        
        C:\Windows\system32\Igpkjo32.exe
        387⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Injcginc.exe
        
        C:\Windows\system32\Injcginc.exe
        388⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10296
        
        C:\Windows\SysWOW64\Igbhpned.exe
        
        C:\Windows\system32\Igbhpned.exe
        389⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        390⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ihbdja32.exe
        
        C:\Windows\system32\Ihbdja32.exe
        391⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        392⤵
        Drops file in System32 directory
        
        PID:10424
        
        C:\Windows\SysWOW64\Ihdaoajd.exe
        
        C:\Windows\system32\Ihdaoajd.exe
        393⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Jjfngi32.exe
        
        C:\Windows\system32\Jjfngi32.exe
        394⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Jhgneqha.exe
        
        C:\Windows\system32\Jhgneqha.exe
        395⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        396⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        397⤵
        Drops file in System32 directory
        
        PID:10592
        
        C:\Windows\SysWOW64\Jglkfmmi.exe
        
        C:\Windows\system32\Jglkfmmi.exe
        398⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Jnfcbg32.exe
        
        C:\Windows\system32\Jnfcbg32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10656
        
        C:\Windows\SysWOW64\Jdpkoalc.exe
        
        C:\Windows\system32\Jdpkoalc.exe
        400⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Jqgldb32.exe
        
        C:\Windows\system32\Jqgldb32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10720
        
        C:\Windows\SysWOW64\Jhndepbi.exe
        
        C:\Windows\system32\Jhndepbi.exe
        402⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        403⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Jdddjq32.exe
        
        C:\Windows\system32\Jdddjq32.exe
        404⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Kjambg32.exe
        
        C:\Windows\system32\Kjambg32.exe
        405⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Kqkeoama.exe
        
        C:\Windows\system32\Kqkeoama.exe
        406⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Knofif32.exe
        
        C:\Windows\system32\Knofif32.exe
        407⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Kghjakbl.exe
        
        C:\Windows\system32\Kghjakbl.exe
        408⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Knabne32.exe
        
        C:\Windows\system32\Knabne32.exe
        409⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        410⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Kkechjib.exe
        
        C:\Windows\system32\Kkechjib.exe
        411⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Kengqo32.exe
        
        C:\Windows\system32\Kengqo32.exe
        412⤵
        Modifies registry class
        
        PID:11084
        
        C:\Windows\SysWOW64\Kjkpif32.exe
        
        C:\Windows\system32\Kjkpif32.exe
        413⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Kepdfo32.exe
        
        C:\Windows\system32\Kepdfo32.exe
        414⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Ljmmnf32.exe
        
        C:\Windows\system32\Ljmmnf32.exe
        415⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Lagekp32.exe
        
        C:\Windows\system32\Lagekp32.exe
        416⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        417⤵
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Lbgaecjg.exe
        
        C:\Windows\system32\Lbgaecjg.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10260
        
        C:\Windows\SysWOW64\Lgcjmjho.exe
        
        C:\Windows\system32\Lgcjmjho.exe
        419⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        420⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Legjgn32.exe
        
        C:\Windows\system32\Legjgn32.exe
        421⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Lankloml.exe
        
        C:\Windows\system32\Lankloml.exe
        422⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Lhhchi32.exe
        
        C:\Windows\system32\Lhhchi32.exe
        423⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Ljfodd32.exe
        
        C:\Windows\system32\Ljfodd32.exe
        424⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Laqhao32.exe
        
        C:\Windows\system32\Laqhao32.exe
        425⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Mlflog32.exe
        
        C:\Windows\system32\Mlflog32.exe
        426⤵
        Modifies registry class
        
        PID:10780
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        427⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Mjkipdpg.exe
        
        C:\Windows\system32\Mjkipdpg.exe
        428⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Mhoiih32.exe
        
        C:\Windows\system32\Mhoiih32.exe
        429⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Mjneec32.exe
        
        C:\Windows\system32\Mjneec32.exe
        430⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Magnbnea.exe
        
        C:\Windows\system32\Magnbnea.exe
        431⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Mnknkbdk.exe
        
        C:\Windows\system32\Mnknkbdk.exe
        432⤵
        Modifies registry class
        
        PID:11172
        
        C:\Windows\SysWOW64\Miabik32.exe
        
        C:\Windows\system32\Miabik32.exe
        433⤵
        Modifies registry class
        
        PID:11236
        
        C:\Windows\SysWOW64\Mlooef32.exe
        
        C:\Windows\system32\Mlooef32.exe
        434⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Nhfpjghi.exe
        
        C:\Windows\system32\Nhfpjghi.exe
        435⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Nophfa32.exe
        
        C:\Windows\system32\Nophfa32.exe
        436⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Nejpckgc.exe
        
        C:\Windows\system32\Nejpckgc.exe
        437⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Nldhpeop.exe
        
        C:\Windows\system32\Nldhpeop.exe
        438⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Nobdlqnc.exe
        
        C:\Windows\system32\Nobdlqnc.exe
        439⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10960
        
        C:\Windows\SysWOW64\Nelmik32.exe
        
        C:\Windows\system32\Nelmik32.exe
        440⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Nkieab32.exe
        
        C:\Windows\system32\Nkieab32.exe
        441⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Nacmnlkd.exe
        
        C:\Windows\system32\Nacmnlkd.exe
        442⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10384
        
        C:\Windows\SysWOW64\Nhmejf32.exe
        
        C:\Windows\system32\Nhmejf32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10644
        
        C:\Windows\SysWOW64\Nbcjhobg.exe
        
        C:\Windows\system32\Nbcjhobg.exe
        444⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Nimbdi32.exe
        
        C:\Windows\system32\Nimbdi32.exe
        445⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Noijmp32.exe
        
        C:\Windows\system32\Noijmp32.exe
        446⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Ohboeenl.exe
        
        C:\Windows\system32\Ohboeenl.exe
        447⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Oolgbpei.exe
        
        C:\Windows\system32\Oolgbpei.exe
        448⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Oefpoi32.exe
        
        C:\Windows\system32\Oefpoi32.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:10420
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        450⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Ohfhqd32.exe
        
        C:\Windows\system32\Ohfhqd32.exe
        451⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Oblmnmjl.exe
        
        C:\Windows\system32\Oblmnmjl.exe
        452⤵
        Modifies registry class
        
        PID:11344
        
        C:\Windows\SysWOW64\Ohiefdhd.exe
        
        C:\Windows\system32\Ohiefdhd.exe
        453⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Oocmcn32.exe
        
        C:\Windows\system32\Oocmcn32.exe
        454⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Oemephgn.exe
        
        C:\Windows\system32\Oemephgn.exe
        455⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Okjnhpee.exe
        
        C:\Windows\system32\Okjnhpee.exe
        456⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Piknfgmd.exe
        
        C:\Windows\system32\Piknfgmd.exe
        457⤵
        Drops file in System32 directory
        
        PID:11504
        
        C:\Windows\SysWOW64\Pafcjijo.exe
        
        C:\Windows\system32\Pafcjijo.exe
        458⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Phpkgc32.exe
        
        C:\Windows\system32\Phpkgc32.exe
        459⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Pojccmii.exe
        
        C:\Windows\system32\Pojccmii.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11600
        
        C:\Windows\SysWOW64\Piphaf32.exe
        
        C:\Windows\system32\Piphaf32.exe
        461⤵
        Drops file in System32 directory
        
        PID:11632
        
        C:\Windows\SysWOW64\Plndma32.exe
        
        C:\Windows\system32\Plndma32.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11664
        
        C:\Windows\SysWOW64\Pchljlpo.exe
        
        C:\Windows\system32\Pchljlpo.exe
        463⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Phddbbnf.exe
        
        C:\Windows\system32\Phddbbnf.exe
        464⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Pkcannmj.exe
        
        C:\Windows\system32\Pkcannmj.exe
        465⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Pehekgmp.exe
        
        C:\Windows\system32\Pehekgmp.exe
        466⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Poajdlcq.exe
        
        C:\Windows\system32\Poajdlcq.exe
        467⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        468⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Qkhjim32.exe
        
        C:\Windows\system32\Qkhjim32.exe
        469⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Qemoff32.exe
        
        C:\Windows\system32\Qemoff32.exe
        470⤵
        System Location Discovery: System Language Discovery
        
        PID:11924
        
        C:\Windows\SysWOW64\Qlggcp32.exe
        
        C:\Windows\system32\Qlggcp32.exe
        471⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Acaopjgd.exe
        
        C:\Windows\system32\Acaopjgd.exe
        472⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Aepklffh.exe
        
        C:\Windows\system32\Aepklffh.exe
        473⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Aklddmep.exe
        
        C:\Windows\system32\Aklddmep.exe
        474⤵
        System Location Discovery: System Language Discovery
        
        PID:12052
        
        C:\Windows\SysWOW64\Ajndbd32.exe
        
        C:\Windows\system32\Ajndbd32.exe
        475⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Akoqjl32.exe
        
        C:\Windows\system32\Akoqjl32.exe
        476⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Aaiiffjj.exe
        
        C:\Windows\system32\Aaiiffjj.exe
        477⤵
        System Location Discovery: System Language Discovery
        
        PID:12172
        
        C:\Windows\SysWOW64\Ahbacq32.exe
        
        C:\Windows\system32\Ahbacq32.exe
        478⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Aomipkic.exe
        
        C:\Windows\system32\Aomipkic.exe
        479⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Ajbmmcii.exe
        
        C:\Windows\system32\Ajbmmcii.exe
        480⤵
        System Location Discovery: System Language Discovery
        
        PID:12268
        
        C:\Windows\SysWOW64\Alqjiohm.exe
        
        C:\Windows\system32\Alqjiohm.exe
        481⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Afinbdon.exe
        
        C:\Windows\system32\Afinbdon.exe
        482⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Boabkj32.exe
        
        C:\Windows\system32\Boabkj32.exe
        483⤵
        Modifies registry class
        
        PID:11428
        
        C:\Windows\SysWOW64\Bjgghc32.exe
        
        C:\Windows\system32\Bjgghc32.exe
        484⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Bkhcpkkb.exe
        
        C:\Windows\system32\Bkhcpkkb.exe
        485⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Bbbkmebo.exe
        
        C:\Windows\system32\Bbbkmebo.exe
        486⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Bhldio32.exe
        
        C:\Windows\system32\Bhldio32.exe
        487⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        488⤵
        System Location Discovery: System Language Discovery
        
        PID:11780
        
        C:\Windows\SysWOW64\Bjlpcbqo.exe
        
        C:\Windows\system32\Bjlpcbqo.exe
        489⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        490⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Bbgehd32.exe
        
        C:\Windows\system32\Bbgehd32.exe
        491⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Bmliem32.exe
        
        C:\Windows\system32\Bmliem32.exe
        492⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Bbiamd32.exe
        
        C:\Windows\system32\Bbiamd32.exe
        493⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Cfgjcb32.exe
        
        C:\Windows\system32\Cfgjcb32.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11448
        
        C:\Windows\SysWOW64\Cooolhin.exe
        
        C:\Windows\system32\Cooolhin.exe
        495⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Cfigib32.exe
        
        C:\Windows\system32\Cfigib32.exe
        496⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Cobkbhgk.exe
        
        C:\Windows\system32\Cobkbhgk.exe
        497⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Cfldob32.exe
        
        C:\Windows\system32\Cfldob32.exe
        498⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Cijpkmml.exe
        
        C:\Windows\system32\Cijpkmml.exe
        499⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Codhgg32.exe
        
        C:\Windows\system32\Codhgg32.exe
        500⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        501⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Ckkilhjm.exe
        
        C:\Windows\system32\Ckkilhjm.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12120
        
        C:\Windows\SysWOW64\Cbeaib32.exe
        
        C:\Windows\system32\Cbeaib32.exe
        503⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Dkmebh32.exe
        
        C:\Windows\system32\Dkmebh32.exe
        504⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Dfcjoa32.exe
        
        C:\Windows\system32\Dfcjoa32.exe
        505⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Dmmblkpm.exe
        
        C:\Windows\system32\Dmmblkpm.exe
        506⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Dbikdbnd.exe
        
        C:\Windows\system32\Dbikdbnd.exe
        507⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Diccal32.exe
        
        C:\Windows\system32\Diccal32.exe
        508⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        509⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Dfgcjpdk.exe
        
        C:\Windows\system32\Dfgcjpdk.exe
        510⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Dmakgj32.exe
        
        C:\Windows\system32\Dmakgj32.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1484
        
        C:\Windows\SysWOW64\Dpphcf32.exe
        
        C:\Windows\system32\Dpphcf32.exe
        512⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        513⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Dcnqid32.exe
        
        C:\Windows\system32\Dcnqid32.exe
        514⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Ebcmjqej.exe
        
        C:\Windows\system32\Ebcmjqej.exe
        515⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Elkbcf32.exe
        
        C:\Windows\system32\Elkbcf32.exe
        516⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        517⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Eiobmjkd.exe
        
        C:\Windows\system32\Eiobmjkd.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3704
        
        C:\Windows\SysWOW64\Ebggep32.exe
        
        C:\Windows\system32\Ebggep32.exe
        519⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Ejoogm32.exe
        
        C:\Windows\system32\Ejoogm32.exe
        520⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Eplgod32.exe
        
        C:\Windows\system32\Eplgod32.exe
        521⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Ejaklmpd.exe
        
        C:\Windows\system32\Ejaklmpd.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4144
        
        C:\Windows\SysWOW64\Elbhde32.exe
        
        C:\Windows\system32\Elbhde32.exe
        523⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Eblpqono.exe
        
        C:\Windows\system32\Eblpqono.exe
        524⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Fmbdnhme.exe
        
        C:\Windows\system32\Fmbdnhme.exe
        525⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Fbomfokl.exe
        
        C:\Windows\system32\Fbomfokl.exe
        526⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Fmdach32.exe
        
        C:\Windows\system32\Fmdach32.exe
        527⤵
        System Location Discovery: System Language Discovery
        
        PID:11432
        
        C:\Windows\SysWOW64\Fdnipbbo.exe
        
        C:\Windows\system32\Fdnipbbo.exe
        528⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Fjhaml32.exe
        
        C:\Windows\system32\Fjhaml32.exe
        529⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Fpejec32.exe
        
        C:\Windows\system32\Fpejec32.exe
        530⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Ffobbmpp.exe
        
        C:\Windows\system32\Ffobbmpp.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3792
        
        C:\Windows\SysWOW64\Fllkjd32.exe
        
        C:\Windows\system32\Fllkjd32.exe
        532⤵
        System Location Discovery: System Language Discovery
        
        PID:5608
        
        C:\Windows\SysWOW64\Fbecgned.exe
        
        C:\Windows\system32\Fbecgned.exe
        533⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Fipkch32.exe
        
        C:\Windows\system32\Fipkch32.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4548
        
        C:\Windows\SysWOW64\Gjadck32.exe
        
        C:\Windows\system32\Gjadck32.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3412
        
        C:\Windows\SysWOW64\Gdjilphb.exe
        
        C:\Windows\system32\Gdjilphb.exe
        536⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        537⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Glenpb32.exe
        
        C:\Windows\system32\Glenpb32.exe
        538⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Gdleap32.exe
        
        C:\Windows\system32\Gdleap32.exe
        539⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Gmdjjemp.exe
        
        C:\Windows\system32\Gmdjjemp.exe
        540⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Gpcffalc.exe
        
        C:\Windows\system32\Gpcffalc.exe
        541⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        542⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Gljgkb32.exe
        
        C:\Windows\system32\Gljgkb32.exe
        543⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Hgokikan.exe
        
        C:\Windows\system32\Hgokikan.exe
        544⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Hmicee32.exe
        
        C:\Windows\system32\Hmicee32.exe
        545⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Hdclbopg.exe
        
        C:\Windows\system32\Hdclbopg.exe
        546⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Hgahnjpk.exe
        
        C:\Windows\system32\Hgahnjpk.exe
        547⤵
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        548⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Hgdedj32.exe
        
        C:\Windows\system32\Hgdedj32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4172
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        550⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Hkbmjhdo.exe
        
        C:\Windows\system32\Hkbmjhdo.exe
        551⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        552⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        553⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        554⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Ilhcmpeg.exe
        
        C:\Windows\system32\Ilhcmpeg.exe
        555⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Icalij32.exe
        
        C:\Windows\system32\Icalij32.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4568
        
        C:\Windows\SysWOW64\Iljpbp32.exe
        
        C:\Windows\system32\Iljpbp32.exe
        557⤵
        Modifies registry class
        
        PID:3436
        
        C:\Windows\SysWOW64\Igpdph32.exe
        
        C:\Windows\system32\Igpdph32.exe
        558⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        559⤵
        Drops file in System32 directory
        
        PID:12196
        
        C:\Windows\SysWOW64\Iphihnjk.exe
        
        C:\Windows\system32\Iphihnjk.exe
        560⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Iknmfg32.exe
        
        C:\Windows\system32\Iknmfg32.exe
        561⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Iloimopp.exe
        
        C:\Windows\system32\Iloimopp.exe
        562⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Iciaji32.exe
        
        C:\Windows\system32\Iciaji32.exe
        563⤵
        Modifies registry class
        
        PID:3876
        
        C:\Windows\SysWOW64\Ikpjkf32.exe
        
        C:\Windows\system32\Ikpjkf32.exe
        564⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Ilafcomm.exe
        
        C:\Windows\system32\Ilafcomm.exe
        565⤵
        Drops file in System32 directory
        
        PID:4200
        
        C:\Windows\SysWOW64\Jggjpgmc.exe
        
        C:\Windows\system32\Jggjpgmc.exe
        566⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Jlcchn32.exe
        
        C:\Windows\system32\Jlcchn32.exe
        567⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Jcmkehcg.exe
        
        C:\Windows\system32\Jcmkehcg.exe
        568⤵
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Jjgcbb32.exe
        
        C:\Windows\system32\Jjgcbb32.exe
        569⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Jdmgok32.exe
        
        C:\Windows\system32\Jdmgok32.exe
        570⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Jjjpgb32.exe
        
        C:\Windows\system32\Jjjpgb32.exe
        571⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Jdodekhg.exe
        
        C:\Windows\system32\Jdodekhg.exe
        572⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Jjlmmbfo.exe
        
        C:\Windows\system32\Jjlmmbfo.exe
        573⤵
        
        PID:584
        
        C:\Windows\SysWOW64\Jdaajkfd.exe
        
        C:\Windows\system32\Jdaajkfd.exe
        574⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        575⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Kknfmdko.exe
        
        C:\Windows\system32\Kknfmdko.exe
        576⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Kmobdm32.exe
        
        C:\Windows\system32\Kmobdm32.exe
        577⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Kcikagij.exe
        
        C:\Windows\system32\Kcikagij.exe
        578⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Kjccna32.exe
        
        C:\Windows\system32\Kjccna32.exe
        579⤵
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Kqmkjk32.exe
        
        C:\Windows\system32\Kqmkjk32.exe
        580⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Kkbohc32.exe
        
        C:\Windows\system32\Kkbohc32.exe
        581⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Knaldo32.exe
        
        C:\Windows\system32\Knaldo32.exe
        582⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Kcndlf32.exe
        
        C:\Windows\system32\Kcndlf32.exe
        583⤵
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        584⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        585⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Kcpqafba.exe
        
        C:\Windows\system32\Kcpqafba.exe
        586⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Knfeoobh.exe
        
        C:\Windows\system32\Knfeoobh.exe
        587⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Lcbngeqo.exe
        
        C:\Windows\system32\Lcbngeqo.exe
        588⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Ljmfdp32.exe
        
        C:\Windows\system32\Ljmfdp32.exe
        589⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Lcejmeol.exe
        
        C:\Windows\system32\Lcejmeol.exe
        590⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Ljobiofi.exe
        
        C:\Windows\system32\Ljobiofi.exe
        591⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Lddgghfo.exe
        
        C:\Windows\system32\Lddgghfo.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12376
        
        C:\Windows\SysWOW64\Lnmkpm32.exe
        
        C:\Windows\system32\Lnmkpm32.exe
        593⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Ldgclgcl.exe
        
        C:\Windows\system32\Ldgclgcl.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12556
        
        C:\Windows\SysWOW64\Ljcldo32.exe
        
        C:\Windows\system32\Ljcldo32.exe
        595⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Leipbg32.exe
        
        C:\Windows\system32\Leipbg32.exe
        596⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Lnadkmhj.exe
        
        C:\Windows\system32\Lnadkmhj.exe
        597⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Mcnmccfa.exe
        
        C:\Windows\system32\Mcnmccfa.exe
        598⤵
        Modifies registry class
        
        PID:12744
        
        C:\Windows\SysWOW64\Mjhepnno.exe
        
        C:\Windows\system32\Mjhepnno.exe
        599⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Menimfnd.exe
        
        C:\Windows\system32\Menimfnd.exe
        600⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Mkhajq32.exe
        
        C:\Windows\system32\Mkhajq32.exe
        601⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Madjbg32.exe
        
        C:\Windows\system32\Madjbg32.exe
        602⤵
        Modifies registry class
        
        PID:12904
        
        C:\Windows\SysWOW64\Mjmokmji.exe
        
        C:\Windows\system32\Mjmokmji.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12944
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        604⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Mjokpm32.exe
        
        C:\Windows\system32\Mjokpm32.exe
        605⤵
        Drops file in System32 directory
        
        PID:13024
        
        C:\Windows\SysWOW64\Maicmgoc.exe
        
        C:\Windows\system32\Maicmgoc.exe
        606⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Mgclja32.exe
        
        C:\Windows\system32\Mgclja32.exe
        607⤵
        Drops file in System32 directory
        
        PID:13096
        
        C:\Windows\SysWOW64\Nnmdfknm.exe
        
        C:\Windows\system32\Nnmdfknm.exe
        608⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Ncjmob32.exe
        
        C:\Windows\system32\Ncjmob32.exe
        609⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        610⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Neiiiecg.exe
        
        C:\Windows\system32\Neiiiecg.exe
        611⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Nlcaeo32.exe
        
        C:\Windows\system32\Nlcaeo32.exe
        612⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13288
        
        C:\Windows\SysWOW64\Ncofjaho.exe
        
        C:\Windows\system32\Ncofjaho.exe
        613⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Ndaboafl.exe
        
        C:\Windows\system32\Ndaboafl.exe
        614⤵
        Modifies registry class
        
        PID:12532
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        615⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Neqoidmo.exe
        
        C:\Windows\system32\Neqoidmo.exe
        616⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        617⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Odfljp32.exe
        
        C:\Windows\system32\Odfljp32.exe
        618⤵
        Drops file in System32 directory
        
        PID:12720
        
        C:\Windows\SysWOW64\Ojpdgjid.exe
        
        C:\Windows\system32\Ojpdgjid.exe
        619⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12760
        
        C:\Windows\SysWOW64\Ohceqo32.exe
        
        C:\Windows\system32\Ohceqo32.exe
        620⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Oaliidon.exe
        
        C:\Windows\system32\Oaliidon.exe
        621⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4748
        
        C:\Windows\SysWOW64\Ohfafn32.exe
        
        C:\Windows\system32\Ohfafn32.exe
        622⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Oopjchnh.exe
        
        C:\Windows\system32\Oopjchnh.exe
        623⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        624⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Ojgjhicl.exe
        
        C:\Windows\system32\Ojgjhicl.exe
        625⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Oaqbdc32.exe
        
        C:\Windows\system32\Oaqbdc32.exe
        626⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
        
        C:\Windows\SysWOW64\Ohkkanbe.exe
        
        C:\Windows\system32\Ohkkanbe.exe
        627⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13144
        
        C:\Windows\SysWOW64\Podcnh32.exe
        
        C:\Windows\system32\Podcnh32.exe
        628⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Peokkbao.exe
        
        C:\Windows\system32\Peokkbao.exe
        629⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Pkkdci32.exe
        
        C:\Windows\system32\Pkkdci32.exe
        630⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Peahpa32.exe
        
        C:\Windows\system32\Peahpa32.exe
        631⤵
        System Location Discovery: System Language Discovery
        
        PID:12476
        
        C:\Windows\SysWOW64\Poliog32.exe
        
        C:\Windows\system32\Poliog32.exe
        632⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Peeakakg.exe
        
        C:\Windows\system32\Peeakakg.exe
        633⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Plpjhk32.exe
        
        C:\Windows\system32\Plpjhk32.exe
        634⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        635⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Pdkolm32.exe
        
        C:\Windows\system32\Pdkolm32.exe
        636⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Qopbjf32.exe
        
        C:\Windows\system32\Qopbjf32.exe
        637⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Qaoofaoi.exe
        
        C:\Windows\system32\Qaoofaoi.exe
        638⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Qhigbl32.exe
        
        C:\Windows\system32\Qhigbl32.exe
        639⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Qoboofnb.exe
        
        C:\Windows\system32\Qoboofnb.exe
        640⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Qdphgmlj.exe
        
        C:\Windows\system32\Qdphgmlj.exe
        641⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        642⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        643⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Ahmqnkbp.exe
        
        C:\Windows\system32\Ahmqnkbp.exe
        644⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Anjifbpg.exe
        
        C:\Windows\system32\Anjifbpg.exe
        645⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13216
        
        C:\Windows\SysWOW64\Aeaagoaj.exe
        
        C:\Windows\system32\Aeaagoaj.exe
        646⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Akniofoa.exe
        
        C:\Windows\system32\Akniofoa.exe
        647⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\Aecnmo32.exe
        
        C:\Windows\system32\Aecnmo32.exe
        648⤵
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Alnfiifd.exe
        
        C:\Windows\system32\Alnfiifd.exe
        649⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Aajoapdk.exe
        
        C:\Windows\system32\Aajoapdk.exe
        650⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Alpboida.exe
        
        C:\Windows\system32\Alpboida.exe
        651⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Aonokdce.exe
        
        C:\Windows\system32\Aonokdce.exe
        652⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Aehghn32.exe
        
        C:\Windows\system32\Aehghn32.exe
        653⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Bhipiihc.exe
        
        C:\Windows\system32\Bhipiihc.exe
        654⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3240
        
        C:\Windows\SysWOW64\Bnfiapfj.exe
        
        C:\Windows\system32\Bnfiapfj.exe
        655⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Bdpanj32.exe
        
        C:\Windows\system32\Bdpanj32.exe
        656⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        657⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Bdbndjld.exe
        
        C:\Windows\system32\Bdbndjld.exe
        658⤵
        Drops file in System32 directory
        
        PID:13188
        
        C:\Windows\SysWOW64\Bklfqd32.exe
        
        C:\Windows\system32\Bklfqd32.exe
        659⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Bafnmnjn.exe
        
        C:\Windows\system32\Bafnmnjn.exe
        660⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Bhpfjh32.exe
        
        C:\Windows\system32\Bhpfjh32.exe
        661⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Bojogb32.exe
        
        C:\Windows\system32\Bojogb32.exe
        662⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Cfdgcmqd.exe
        
        C:\Windows\system32\Cfdgcmqd.exe
        663⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12404
        
        C:\Windows\SysWOW64\Chbcphph.exe
        
        C:\Windows\system32\Chbcphph.exe
        664⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        665⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        666⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Ckclacmi.exe
        
        C:\Windows\system32\Ckclacmi.exe
        667⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Cfipol32.exe
        
        C:\Windows\system32\Cfipol32.exe
        668⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Chglkg32.exe
        
        C:\Windows\system32\Chglkg32.exe
        669⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Cfkmdl32.exe
        
        C:\Windows\system32\Cfkmdl32.exe
        670⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Chiipg32.exe
        
        C:\Windows\system32\Chiipg32.exe
        671⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Cnfahn32.exe
        
        C:\Windows\system32\Cnfahn32.exe
        672⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Cfmijkhj.exe
        
        C:\Windows\system32\Cfmijkhj.exe
        673⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        674⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Dfbcek32.exe
        
        C:\Windows\system32\Dfbcek32.exe
        675⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Dkokma32.exe
        
        C:\Windows\system32\Dkokma32.exe
        676⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Dbicjlji.exe
        
        C:\Windows\system32\Dbicjlji.exe
        677⤵
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\Diclff32.exe
        
        C:\Windows\system32\Diclff32.exe
        678⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Dfglpjqo.exe
        
        C:\Windows\system32\Dfglpjqo.exe
        679⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Dkcehaof.exe
        
        C:\Windows\system32\Dkcehaof.exe
        680⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Dfiiejnl.exe
        
        C:\Windows\system32\Dfiiejnl.exe
        681⤵
        System Location Discovery: System Language Discovery
        
        PID:12856
        
        C:\Windows\SysWOW64\Dmcabd32.exe
        
        C:\Windows\system32\Dmcabd32.exe
        682⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Efkfkilj.exe
        
        C:\Windows\system32\Efkfkilj.exe
        683⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        684⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Engjol32.exe
        
        C:\Windows\system32\Engjol32.exe
        685⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Eilomd32.exe
        
        C:\Windows\system32\Eilomd32.exe
        686⤵
        Modifies registry class
        
        PID:12440
        
        C:\Windows\SysWOW64\Eofgioah.exe
        
        C:\Windows\system32\Eofgioah.exe
        687⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Efpofi32.exe
        
        C:\Windows\system32\Efpofi32.exe
        688⤵
        Drops file in System32 directory
        
        PID:2696
        
        C:\Windows\SysWOW64\Emjgcc32.exe
        
        C:\Windows\system32\Emjgcc32.exe
        689⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ebgpkj32.exe
        
        C:\Windows\system32\Ebgpkj32.exe
        690⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Eiahhdee.exe
        
        C:\Windows\system32\Eiahhdee.exe
        691⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Ebimqi32.exe
        
        C:\Windows\system32\Ebimqi32.exe
        692⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Fnpmej32.exe
        
        C:\Windows\system32\Fnpmej32.exe
        693⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Fieacc32.exe
        
        C:\Windows\system32\Fieacc32.exe
        694⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Fppjpmim.exe
        
        C:\Windows\system32\Fppjpmim.exe
        695⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ffiblg32.exe
        
        C:\Windows\system32\Ffiblg32.exe
        696⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fpbfem32.exe
        
        C:\Windows\system32\Fpbfem32.exe
        697⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Feoomd32.exe
        
        C:\Windows\system32\Feoomd32.exe
        698⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Fpdckm32.exe
        
        C:\Windows\system32\Fpdckm32.exe
        699⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Fealcc32.exe
        
        C:\Windows\system32\Fealcc32.exe
        700⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Fnipliip.exe
        
        C:\Windows\system32\Fnipliip.exe
        701⤵
        Modifies registry class
        
        PID:2256
        
        C:\Windows\SysWOW64\Fechhcal.exe
        
        C:\Windows\system32\Fechhcal.exe
        702⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gpimflqb.exe
        
        C:\Windows\system32\Gpimflqb.exe
        703⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gfcebf32.exe
        
        C:\Windows\system32\Gfcebf32.exe
        704⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        705⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Gfeahffl.exe
        
        C:\Windows\system32\Gfeahffl.exe
        706⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Glbjpmdd.exe
        
        C:\Windows\system32\Glbjpmdd.exe
        707⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Gblbmg32.exe
        
        C:\Windows\system32\Gblbmg32.exe
        708⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Gmafjp32.exe
        
        C:\Windows\system32\Gmafjp32.exe
        709⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Gbnobf32.exe
        
        C:\Windows\system32\Gbnobf32.exe
        710⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Geohdago.exe
        
        C:\Windows\system32\Geohdago.exe
        711⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Windows\SysWOW64\Himqjpme.exe
        
        C:\Windows\system32\Himqjpme.exe
        712⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        713⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Hiomppkc.exe
        
        C:\Windows\system32\Hiomppkc.exe
        714⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:720
        
        C:\Windows\SysWOW64\Hlnjlkjf.exe
        
        C:\Windows\system32\Hlnjlkjf.exe
        715⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Hbhbie32.exe
        
        C:\Windows\system32\Hbhbie32.exe
        716⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Hmmffnai.exe
        
        C:\Windows\system32\Hmmffnai.exe
        717⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Hoobnf32.exe
        
        C:\Windows\system32\Hoobnf32.exe
        718⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Hehkjpod.exe
        
        C:\Windows\system32\Hehkjpod.exe
        719⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Hpnohinj.exe
        
        C:\Windows\system32\Hpnohinj.exe
        720⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Hfhgdc32.exe
        
        C:\Windows\system32\Hfhgdc32.exe
        721⤵
        Modifies registry class
        
        PID:724
        
        C:\Windows\SysWOW64\Imbpam32.exe
        
        C:\Windows\system32\Imbpam32.exe
        722⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Iocliecb.exe
        
        C:\Windows\system32\Iocliecb.exe
        723⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Ifjdjbdd.exe
        
        C:\Windows\system32\Ifjdjbdd.exe
        724⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Imdlgm32.exe
        
        C:\Windows\system32\Imdlgm32.exe
        725⤵
        Modifies registry class
        
        PID:7188
        
        C:\Windows\SysWOW64\Ipbhch32.exe
        
        C:\Windows\system32\Ipbhch32.exe
        726⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Igmqpbab.exe
        
        C:\Windows\system32\Igmqpbab.exe
        727⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ipeehhhb.exe
        
        C:\Windows\system32\Ipeehhhb.exe
        728⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Igomeb32.exe
        
        C:\Windows\system32\Igomeb32.exe
        729⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Imieblgl.exe
        
        C:\Windows\system32\Imieblgl.exe
        730⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Iojbid32.exe
        
        C:\Windows\system32\Iojbid32.exe
        731⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Iedjfodg.exe
        
        C:\Windows\system32\Iedjfodg.exe
        732⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Jplkig32.exe
        
        C:\Windows\system32\Jplkig32.exe
        733⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Jeidan32.exe
        
        C:\Windows\system32\Jeidan32.exe
        734⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Windows\SysWOW64\Jlclnhho.exe
        
        C:\Windows\system32\Jlclnhho.exe
        735⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Jekqgnno.exe
        
        C:\Windows\system32\Jekqgnno.exe
        736⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Jmbhhkoa.exe
        
        C:\Windows\system32\Jmbhhkoa.exe
        737⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Jocepc32.exe
        
        C:\Windows\system32\Jocepc32.exe
        738⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Jenmlmll.exe
        
        C:\Windows\system32\Jenmlmll.exe
        739⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Jlgeig32.exe
        
        C:\Windows\system32\Jlgeig32.exe
        740⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        741⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7772
        
        C:\Windows\SysWOW64\Jljbogaf.exe
        
        C:\Windows\system32\Jljbogaf.exe
        742⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
        
        C:\Windows\SysWOW64\Jcdjka32.exe
        
        C:\Windows\system32\Jcdjka32.exe
        743⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Knioij32.exe
        
        C:\Windows\system32\Knioij32.exe
        744⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
        
        C:\Windows\SysWOW64\Kokkqbog.exe
        
        C:\Windows\system32\Kokkqbog.exe
        745⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kedcml32.exe
        
        C:\Windows\system32\Kedcml32.exe
        746⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Kloljf32.exe
        
        C:\Windows\system32\Kloljf32.exe
        747⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Kchdfpen.exe
        
        C:\Windows\system32\Kchdfpen.exe
        748⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        749⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Koodka32.exe
        
        C:\Windows\system32\Koodka32.exe
        750⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        751⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Kcmmap32.exe
        
        C:\Windows\system32\Kcmmap32.exe
        752⤵
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Knbaoh32.exe
        
        C:\Windows\system32\Knbaoh32.exe
        753⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Kodnfqgm.exe
        
        C:\Windows\system32\Kodnfqgm.exe
        754⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        755⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Lgmbmn32.exe
        
        C:\Windows\system32\Lgmbmn32.exe
        756⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
        
        C:\Windows\SysWOW64\Lngkjhmi.exe
        
        C:\Windows\system32\Lngkjhmi.exe
        757⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Lcdcbokq.exe
        
        C:\Windows\system32\Lcdcbokq.exe
        758⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Lnjgpgkf.exe
        
        C:\Windows\system32\Lnjgpgkf.exe
        759⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        760⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Lfeldj32.exe
        
        C:\Windows\system32\Lfeldj32.exe
        761⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Lmodqdpo.exe
        
        C:\Windows\system32\Lmodqdpo.exe
        762⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Lfgiii32.exe
        
        C:\Windows\system32\Lfgiii32.exe
        763⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Lmaafcml.exe
        
        C:\Windows\system32\Lmaafcml.exe
        764⤵
        Drops file in System32 directory
        
        PID:7712
        
        C:\Windows\SysWOW64\Lckicnei.exe
        
        C:\Windows\system32\Lckicnei.exe
        765⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Mmcnlc32.exe
        
        C:\Windows\system32\Mmcnlc32.exe
        766⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Mflbdibj.exe
        
        C:\Windows\system32\Mflbdibj.exe
        767⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Mqafbaap.exe
        
        C:\Windows\system32\Mqafbaap.exe
        768⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Mgkoolil.exe
        
        C:\Windows\system32\Mgkoolil.exe
        769⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Mgnldkgj.exe
        
        C:\Windows\system32\Mgnldkgj.exe
        770⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Mmkdlbea.exe
        
        C:\Windows\system32\Mmkdlbea.exe
        771⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Mcdlil32.exe
        
        C:\Windows\system32\Mcdlil32.exe
        772⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Mjodff32.exe
        
        C:\Windows\system32\Mjodff32.exe
        773⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Mokmnm32.exe
        
        C:\Windows\system32\Mokmnm32.exe
        774⤵
        
        PID:200
        
        C:\Windows\SysWOW64\Njaakf32.exe
        
        C:\Windows\system32\Njaakf32.exe
        775⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Nmomga32.exe
        
        C:\Windows\system32\Nmomga32.exe
        776⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Nfhbpghl.exe
        
        C:\Windows\system32\Nfhbpghl.exe
        777⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Nmajmaoi.exe
        
        C:\Windows\system32\Nmajmaoi.exe
        778⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Nggnjjoo.exe
        
        C:\Windows\system32\Nggnjjoo.exe
        779⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Nnafgd32.exe
        
        C:\Windows\system32\Nnafgd32.exe
        780⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Npbcollj.exe
        
        C:\Windows\system32\Npbcollj.exe
        781⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Njhglelp.exe
        
        C:\Windows\system32\Njhglelp.exe
        782⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        783⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Njjdae32.exe
        
        C:\Windows\system32\Njjdae32.exe
        784⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Npgmjl32.exe
        
        C:\Windows\system32\Npgmjl32.exe
        785⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ojmqgd32.exe
        
        C:\Windows\system32\Ojmqgd32.exe
        786⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Oafido32.exe
        
        C:\Windows\system32\Oafido32.exe
        787⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ofcale32.exe
        
        C:\Windows\system32\Ofcale32.exe
        788⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        789⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\Ocjokijf.exe
        
        C:\Windows\system32\Ocjokijf.exe
        790⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\Onochbjl.exe
        
        C:\Windows\system32\Onochbjl.exe
        791⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        792⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        793⤵
        
        PID:13624
        
        C:\Windows\SysWOW64\Pcnhfi32.exe
        
        C:\Windows\system32\Pcnhfi32.exe
        794⤵
        Drops file in System32 directory
        
        PID:13660
        
        C:\Windows\SysWOW64\Pjhpccnn.exe
        
        C:\Windows\system32\Pjhpccnn.exe
        795⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\Ppeikjle.exe
        
        C:\Windows\system32\Ppeikjle.exe
        796⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13728
        
        C:\Windows\SysWOW64\Phlqlgmg.exe
        
        C:\Windows\system32\Phlqlgmg.exe
        797⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\Pmiidnko.exe
        
        C:\Windows\system32\Pmiidnko.exe
        798⤵
        
        PID:13800
        
        C:\Windows\SysWOW64\Phombg32.exe
        
        C:\Windows\system32\Phombg32.exe
        799⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\Pmkfjn32.exe
        
        C:\Windows\system32\Pmkfjn32.exe
        800⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13872
        
        C:\Windows\SysWOW64\Ppjbfi32.exe
        
        C:\Windows\system32\Ppjbfi32.exe
        801⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Pnkbdqpo.exe
        
        C:\Windows\system32\Pnkbdqpo.exe
        802⤵
        
        PID:13944
        
        C:\Windows\SysWOW64\Pploli32.exe
        
        C:\Windows\system32\Pploli32.exe
        803⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13976
        
        C:\Windows\SysWOW64\Pffghc32.exe
        
        C:\Windows\system32\Pffghc32.exe
        804⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        805⤵
        
        PID:14052
        
        C:\Windows\SysWOW64\Qdjgbg32.exe
        
        C:\Windows\system32\Qdjgbg32.exe
        806⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14092
        
        C:\Windows\SysWOW64\Qanhkk32.exe
        
        C:\Windows\system32\Qanhkk32.exe
        807⤵
        Drops file in System32 directory
        
        PID:14260
        
        C:\Windows\SysWOW64\Qobhepjf.exe
        
        C:\Windows\system32\Qobhepjf.exe
        808⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\Apcemh32.exe
        
        C:\Windows\system32\Apcemh32.exe
        809⤵
        
        PID:14332
        
        C:\Windows\SysWOW64\Afmmibga.exe
        
        C:\Windows\system32\Afmmibga.exe
        810⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Amgefl32.exe
        
        C:\Windows\system32\Amgefl32.exe
        811⤵
        Drops file in System32 directory
        
        PID:13356
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        812⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        813⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\Aaenlj32.exe
        
        C:\Windows\system32\Aaenlj32.exe
        814⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        815⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Aoioeo32.exe
        
        C:\Windows\system32\Aoioeo32.exe
        816⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Apjkmgjm.exe
        
        C:\Windows\system32\Apjkmgjm.exe
        817⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\Aokkknbl.exe
        
        C:\Windows\system32\Aokkknbl.exe
        818⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Apmhbf32.exe
        
        C:\Windows\system32\Apmhbf32.exe
        819⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Akblpo32.exe
        
        C:\Windows\system32\Akblpo32.exe
        820⤵
        System Location Discovery: System Language Discovery
        
        PID:13668
        
        C:\Windows\SysWOW64\Bdjqienq.exe
        
        C:\Windows\system32\Bdjqienq.exe
        821⤵
        Modifies registry class
        
        PID:13720
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        822⤵
        Drops file in System32 directory
        
        PID:8988
        
        C:\Windows\SysWOW64\Bpaanfce.exe
        
        C:\Windows\system32\Bpaanfce.exe
        823⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\Bkgekock.exe
        
        C:\Windows\system32\Bkgekock.exe
        824⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        825⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Bkibqnah.exe
        
        C:\Windows\system32\Bkibqnah.exe
        826⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\Bdagidhi.exe
        
        C:\Windows\system32\Bdagidhi.exe
        827⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:14120
        
        C:\Windows\SysWOW64\Bkkofn32.exe
        
        C:\Windows\system32\Bkkofn32.exe
        828⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Bphgoe32.exe
        
        C:\Windows\system32\Bphgoe32.exe
        829⤵
        
        PID:14192
        
        C:\Windows\SysWOW64\Coigllel.exe
        
        C:\Windows\system32\Coigllel.exe
        830⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:14224
        
        C:\Windows\SysWOW64\Cpkddd32.exe
        
        C:\Windows\system32\Cpkddd32.exe
        831⤵
        Drops file in System32 directory
        
        PID:14268
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        832⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Chdikajj.exe
        
        C:\Windows\system32\Chdikajj.exe
        833⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Conagl32.exe
        
        C:\Windows\system32\Conagl32.exe
        834⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13360
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        835⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ckealm32.exe
        
        C:\Windows\system32\Ckealm32.exe
        836⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8540
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        837⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        838⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        839⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Cgnogmkl.exe
        
        C:\Windows\system32\Cgnogmkl.exe
        840⤵
        Modifies registry class
        
        PID:13620
        
        C:\Windows\SysWOW64\Dnhgcgbi.exe
        
        C:\Windows\system32\Dnhgcgbi.exe
        841⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Dgpllm32.exe
        
        C:\Windows\system32\Dgpllm32.exe
        842⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Dogdnj32.exe
        
        C:\Windows\system32\Dogdnj32.exe
        843⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\Dddlfa32.exe
        
        C:\Windows\system32\Dddlfa32.exe
        844⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Dgbhbm32.exe
        
        C:\Windows\system32\Dgbhbm32.exe
        845⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Dqkmkb32.exe
        
        C:\Windows\system32\Dqkmkb32.exe
        846⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Dgeegled.exe
        
        C:\Windows\system32\Dgeegled.exe
        847⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Dakieedj.exe
        
        C:\Windows\system32\Dakieedj.exe
        848⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        849⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\Doojni32.exe
        
        C:\Windows\system32\Doojni32.exe
        850⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Dqpffaib.exe
        
        C:\Windows\system32\Dqpffaib.exe
        851⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Eoagdi32.exe
        
        C:\Windows\system32\Eoagdi32.exe
        852⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:14316
        
        C:\Windows\SysWOW64\Ebocpd32.exe
        
        C:\Windows\system32\Ebocpd32.exe
        853⤵
        
        PID:13352
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        854⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Ebapednb.exe
        
        C:\Windows\system32\Ebapednb.exe
        855⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Edplapnf.exe
        
        C:\Windows\system32\Edplapnf.exe
        856⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Enhpje32.exe
        
        C:\Windows\system32\Enhpje32.exe
        857⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ehndhn32.exe
        
        C:\Windows\system32\Ehndhn32.exe
        858⤵
        Drops file in System32 directory
        
        PID:13592
        
        C:\Windows\SysWOW64\Ekladi32.exe
        
        C:\Windows\system32\Ekladi32.exe
        859⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Ebfiqcjm.exe
        
        C:\Windows\system32\Ebfiqcjm.exe
        860⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\Egcaij32.exe
        
        C:\Windows\system32\Egcaij32.exe
        861⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Ebiffc32.exe
        
        C:\Windows\system32\Ebiffc32.exe
        862⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Edgbbo32.exe
        
        C:\Windows\system32\Edgbbo32.exe
        863⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Fomfpg32.exe
        
        C:\Windows\system32\Fomfpg32.exe
        864⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Fiekhm32.exe
        
        C:\Windows\system32\Fiekhm32.exe
        865⤵
        Modifies registry class
        
        PID:14188
        
        C:\Windows\SysWOW64\Fkfcjh32.exe
        
        C:\Windows\system32\Fkfcjh32.exe
        866⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Fqblbo32.exe
        
        C:\Windows\system32\Fqblbo32.exe
        867⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Foclpf32.exe
        
        C:\Windows\system32\Foclpf32.exe
        868⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Faeihogj.exe
        
        C:\Windows\system32\Faeihogj.exe
        869⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Fgoadi32.exe
        
        C:\Windows\system32\Fgoadi32.exe
        870⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Fniiabfd.exe
        
        C:\Windows\system32\Fniiabfd.exe
        871⤵
        Drops file in System32 directory
        
        PID:9400
        
        C:\Windows\SysWOW64\Fagenneg.exe
        
        C:\Windows\system32\Fagenneg.exe
        872⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Gohfkemf.exe
        
        C:\Windows\system32\Gohfkemf.exe
        873⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Gaibcn32.exe
        
        C:\Windows\system32\Gaibcn32.exe
        874⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8312
        
        C:\Windows\SysWOW64\Ggcjphja.exe
        
        C:\Windows\system32\Ggcjphja.exe
        875⤵
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Gnmblb32.exe
        
        C:\Windows\system32\Gnmblb32.exe
        876⤵
        System Location Discovery: System Language Discovery
        
        PID:8580
        
        C:\Windows\SysWOW64\Gegkilik.exe
        
        C:\Windows\system32\Gegkilik.exe
        877⤵
        System Location Discovery: System Language Discovery
        
        PID:13900
        
        C:\Windows\SysWOW64\Gkacff32.exe
        
        C:\Windows\system32\Gkacff32.exe
        878⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Gbkkbp32.exe
        
        C:\Windows\system32\Gbkkbp32.exe
        879⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\Gghdkg32.exe
        
        C:\Windows\system32\Gghdkg32.exe
        880⤵
        
        PID:14040
        
        C:\Windows\SysWOW64\Gnblgani.exe
        
        C:\Windows\system32\Gnblgani.exe
        881⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ggjqqg32.exe
        
        C:\Windows\system32\Ggjqqg32.exe
        882⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Gndima32.exe
        
        C:\Windows\system32\Gndima32.exe
        883⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\Haceil32.exe
        
        C:\Windows\system32\Haceil32.exe
        884⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\Hlhife32.exe
        
        C:\Windows\system32\Hlhife32.exe
        885⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hlkfle32.exe
        
        C:\Windows\system32\Hlkfle32.exe
        886⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Hbenio32.exe
        
        C:\Windows\system32\Hbenio32.exe
        887⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Hhagaf32.exe
        
        C:\Windows\system32\Hhagaf32.exe
        888⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Hnkonpeo.exe
        
        C:\Windows\system32\Hnkonpeo.exe
        889⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Heegjj32.exe
        
        C:\Windows\system32\Heegjj32.exe
        890⤵
        
        PID:13896
        
        C:\Windows\SysWOW64\Hlppgddh.exe
        
        C:\Windows\system32\Hlppgddh.exe
        891⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Halhpkbp.exe
        
        C:\Windows\system32\Halhpkbp.exe
        892⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Hpmhmbko.exe
        
        C:\Windows\system32\Hpmhmbko.exe
        893⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Iejqeiif.exe
        
        C:\Windows\system32\Iejqeiif.exe
        894⤵
        
        PID:14076
        
        C:\Windows\SysWOW64\Ippecbil.exe
        
        C:\Windows\system32\Ippecbil.exe
        895⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Iaaakj32.exe
        
        C:\Windows\system32\Iaaakj32.exe
        896⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ipbahb32.exe
        
        C:\Windows\system32\Ipbahb32.exe
        897⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Ihmfmd32.exe
        
        C:\Windows\system32\Ihmfmd32.exe
        898⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Ibcjjm32.exe
        
        C:\Windows\system32\Ibcjjm32.exe
        899⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Ihpcbdba.exe
        
        C:\Windows\system32\Ihpcbdba.exe
        900⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Iahgki32.exe
        
        C:\Windows\system32\Iahgki32.exe
        901⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ipihiaqa.exe
        
        C:\Windows\system32\Ipihiaqa.exe
        902⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Jehmgg32.exe
        
        C:\Windows\system32\Jehmgg32.exe
        903⤵
        
        PID:13952
        
        C:\Windows\SysWOW64\Jhficc32.exe
        
        C:\Windows\system32\Jhficc32.exe
        904⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\Joqapmcf.exe
        
        C:\Windows\system32\Joqapmcf.exe
        905⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Jaonlhbj.exe
        
        C:\Windows\system32\Jaonlhbj.exe
        906⤵
        System Location Discovery: System Language Discovery
        
        PID:10048
        
        C:\Windows\SysWOW64\Jldbiabp.exe
        
        C:\Windows\system32\Jldbiabp.exe
        907⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Jbojfkjm.exe
        
        C:\Windows\system32\Jbojfkjm.exe
        908⤵
        System Location Discovery: System Language Discovery
        
        PID:9604
        
        C:\Windows\SysWOW64\Jemfbgiq.exe
        
        C:\Windows\system32\Jemfbgiq.exe
        909⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Jlgooa32.exe
        
        C:\Windows\system32\Jlgooa32.exe
        910⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Jeocgfgn.exe
        
        C:\Windows\system32\Jeocgfgn.exe
        911⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Jhnocbfa.exe
        
        C:\Windows\system32\Jhnocbfa.exe
        912⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Kbccak32.exe
        
        C:\Windows\system32\Kbccak32.exe
        913⤵
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Khplia32.exe
        
        C:\Windows\system32\Khplia32.exe
        914⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Kojdflkl.exe
        
        C:\Windows\system32\Kojdflkl.exe
        915⤵
        System Location Discovery: System Language Discovery
        
        PID:10576
        
        C:\Windows\SysWOW64\Kedlbf32.exe
        
        C:\Windows\system32\Kedlbf32.exe
        916⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Kpiqpo32.exe
        
        C:\Windows\system32\Kpiqpo32.exe
        917⤵
        System Location Discovery: System Language Discovery
        
        PID:10224
        
        C:\Windows\SysWOW64\Kakmhg32.exe
        
        C:\Windows\system32\Kakmhg32.exe
        918⤵
        
        PID:13940
        
        C:\Windows\SysWOW64\Koonak32.exe
        
        C:\Windows\system32\Koonak32.exe
        919⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Keifneoc.exe
        
        C:\Windows\system32\Keifneoc.exe
        920⤵
        Modifies registry class
        
        PID:9880
        
        C:\Windows\SysWOW64\Kpnjknni.exe
        
        C:\Windows\system32\Kpnjknni.exe
        921⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Kekbce32.exe
        
        C:\Windows\system32\Kekbce32.exe
        922⤵
        System Location Discovery: System Language Discovery
        
        PID:10868
        
        C:\Windows\SysWOW64\Lcocmi32.exe
        
        C:\Windows\system32\Lcocmi32.exe
        923⤵
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Liikiccg.exe
        
        C:\Windows\system32\Liikiccg.exe
        924⤵
        System Location Discovery: System Language Discovery
        
        PID:10900
        
        C:\Windows\SysWOW64\Lpccfm32.exe
        
        C:\Windows\system32\Lpccfm32.exe
        925⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ladpnepb.exe
        
        C:\Windows\system32\Ladpnepb.exe
        926⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Lpeplmha.exe
        
        C:\Windows\system32\Lpeplmha.exe
        927⤵
        Modifies registry class
        
        PID:10692
        
        C:\Windows\SysWOW64\Lafmce32.exe
        
        C:\Windows\system32\Lafmce32.exe
        928⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Lllaqn32.exe
        
        C:\Windows\system32\Lllaqn32.exe
        929⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Laiiie32.exe
        
        C:\Windows\system32\Laiiie32.exe
        930⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Llnnfnlc.exe
        
        C:\Windows\system32\Llnnfnlc.exe
        931⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Lakfodjj.exe
        
        C:\Windows\system32\Lakfodjj.exe
        932⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Lhenko32.exe
        
        C:\Windows\system32\Lhenko32.exe
        933⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Moofhiid.exe
        
        C:\Windows\system32\Moofhiid.exe
        934⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Mjdkeaij.exe
        
        C:\Windows\system32\Mjdkeaij.exe
        935⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Moacnh32.exe
        
        C:\Windows\system32\Moacnh32.exe
        936⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Mledgm32.exe
        
        C:\Windows\system32\Mledgm32.exe
        937⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Mcolcgmh.exe
        
        C:\Windows\system32\Mcolcgmh.exe
        938⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Mlhqll32.exe
        
        C:\Windows\system32\Mlhqll32.exe
        939⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Mcaiif32.exe
        
        C:\Windows\system32\Mcaiif32.exe
        940⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Mohingqi.exe
        
        C:\Windows\system32\Mohingqi.exe
        941⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Mjnnkpqo.exe
        
        C:\Windows\system32\Mjnnkpqo.exe
        942⤵
        
        PID:13316
        
        C:\Windows\SysWOW64\Ncfbdfgp.exe
        
        C:\Windows\system32\Ncfbdfgp.exe
        943⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Njpjap32.exe
        
        C:\Windows\system32\Njpjap32.exe
        944⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Nciojeem.exe
        
        C:\Windows\system32\Nciojeem.exe
        945⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Nmacbk32.exe
        
        C:\Windows\system32\Nmacbk32.exe
        946⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Nckkoe32.exe
        
        C:\Windows\system32\Nckkoe32.exe
        947⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Nmcphkik.exe
        
        C:\Windows\system32\Nmcphkik.exe
        948⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ncmhee32.exe
        
        C:\Windows\system32\Ncmhee32.exe
        949⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Nmfmnjgh.exe
        
        C:\Windows\system32\Nmfmnjgh.exe
        950⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Ncpejd32.exe
        
        C:\Windows\system32\Ncpejd32.exe
        951⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Njjmgo32.exe
        
        C:\Windows\system32\Njjmgo32.exe
        952⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Oqcedino.exe
        
        C:\Windows\system32\Oqcedino.exe
        953⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Ofqnlplf.exe
        
        C:\Windows\system32\Ofqnlplf.exe
        954⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Omjfij32.exe
        
        C:\Windows\system32\Omjfij32.exe
        955⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Ofckao32.exe
        
        C:\Windows\system32\Ofckao32.exe
        956⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Ommcniap.exe
        
        C:\Windows\system32\Ommcniap.exe
        957⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Ocgkkc32.exe
        
        C:\Windows\system32\Ocgkkc32.exe
        958⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Ojcpmm32.exe
        
        C:\Windows\system32\Ojcpmm32.exe
        959⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Oqmhjged.exe
        
        C:\Windows\system32\Oqmhjged.exe
        960⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Pihmojco.exe
        
        C:\Windows\system32\Pihmojco.exe
        961⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Pcnalbce.exe
        
        C:\Windows\system32\Pcnalbce.exe
        962⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Pijjdial.exe
        
        C:\Windows\system32\Pijjdial.exe
        963⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Pcpnab32.exe
        
        C:\Windows\system32\Pcpnab32.exe
        964⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Pjjfnlho.exe
        
        C:\Windows\system32\Pjjfnlho.exe
        965⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Ppgofcff.exe
        
        C:\Windows\system32\Ppgofcff.exe
        966⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Pjlcclfl.exe
        
        C:\Windows\system32\Pjlcclfl.exe
        967⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Pafkpfni.exe
        
        C:\Windows\system32\Pafkpfni.exe
        968⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Pjopil32.exe
        
        C:\Windows\system32\Pjopil32.exe
        969⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Pmmleg32.exe
        
        C:\Windows\system32\Pmmleg32.exe
        970⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Qjalok32.exe
        
        C:\Windows\system32\Qjalok32.exe
        971⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Qakdke32.exe
        
        C:\Windows\system32\Qakdke32.exe
        972⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Qblacnob.exe
        
        C:\Windows\system32\Qblacnob.exe
        973⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Qmbepfoh.exe
        
        C:\Windows\system32\Qmbepfoh.exe
        974⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Abonimmp.exe
        
        C:\Windows\system32\Abonimmp.exe
        975⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Amdbffme.exe
        
        C:\Windows\system32\Amdbffme.exe
        976⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Abajnm32.exe
        
        C:\Windows\system32\Abajnm32.exe
        977⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Aikbkgcj.exe
        
        C:\Windows\system32\Aikbkgcj.exe
        978⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Abcgdm32.exe
        
        C:\Windows\system32\Abcgdm32.exe
        979⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Aimoqgqg.exe
        
        C:\Windows\system32\Aimoqgqg.exe
        980⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10172 -s 448
        981⤵
        Program crash
        
        PID:10788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 10172 -ip 10172
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaccdp32.exe

Path C:\Windows\SysWOW64\Aaccdp32.exe
Size 320KB
SHA256 72694c97e90a3c87428d9346ad7efb5cd834fc0e819625a3498f1d995bd476c3
MD5 10563129b7f80f705a63da2051ebe12f
SHA1 c2215636bde62a603ccf2d58ffbe93c83573a584
SHA512 3074e0b8a9789357863522e50daf9f00336b2a2c7f00690434674c9f00c9f8f59736c4d1e693648b07316a4daa6b7eb66577cb152d9927d7d6d566a3335a3455
SSDEEP 3072:og3n/h3dA+UwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ogPXA+UV/Ah1G/AcQ///NR5fn
TLSH
T1A5642F19263409EACEED1BB6EC1249D85242E8F114F1E13E6927DFDCD8E6DA2DD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aaqgop32.exe

Path C:\Windows\SysWOW64\Aaqgop32.exe
Size 320KB
SHA256 7b122c24c4f42e3f466ec178c828bdb7e195141bcc105bdc70b09de78accf909
MD5 d22c9ae7caccab69d2cf8cd3cfefebce
SHA1 198ccb673cf9e41d219ae86b2c8b7494c21c6879
SHA512 1ce1881aacea5c2904479cf0756449b9d8429a1f87a33e1c45dec93de8ce0c81b43833ab628d3ca596cd05bebba761133671b5b6e4e7aef60a0d9eb1f3a44995
SSDEEP 3072:dbpZSdRKar2UHkwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dbpZSdRMUHkwV/Ah1G/AcQ///NR5fn
TLSH
T15564305A2A3009EACEED1FB6AC0649D85141F9F014F1E23E6123DFDCD9E4DA6D909F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adockl32.exe

Path C:\Windows\SysWOW64\Adockl32.exe
Size 320KB
SHA256 88f979158ce228fa9285932655686e20989ee3fbd5085320e9eabd9e10a8d43e
MD5 45538ac4b223b38f012d7760abeb6229
SHA1 6877c0fa5f3d50c3af25fe1200629a2b51cd7ab6
SHA512 5f5cc5cc7ff20998bf9dcf7eb2b2c6cea2fd956448f0397a4c710373847196d20ca1405a4c0c2b532c1e66a547c584fd94d8c89cd07caba97c205907e1e0162b
SSDEEP 3072:6SrIiygLwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:drIoLV/Ah1G/AcQ///NR5fn
TLSH
T1436431192A3409FACEED1FB6AD1249D89241E9F014F1E13E6123EFDCC9E4DA2D815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aejfjocb.exe

Path C:\Windows\SysWOW64\Aejfjocb.exe
Size 320KB
SHA256 c2add497b6763ef973691ff2ceaedfaec3b1bc59f709b64ec9c83ec5d954b897
MD5 25e0aa1bc23a4f502beeb9c81b1a9f8e
SHA1 bfc03a617cf90e11ccebd7f20a94eaf499f84fed
SHA512 5e5ca8417bcc99600251daa3cfbc58b523d579adc02e556c27aa0b3a566bf4b0981fb4821797bf3da52214ac1b02ff1513905080b7911158ae7b28880f194ee3
SSDEEP 3072:SzYI8MrPGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Qt8MrPGV/Ah1G/AcQ///NR5fn
TLSH
T114640B192A3409EACEFD1BB5AD124DD89181E8F514F1E13E6523DFDCC8E4DA6D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ajfobfaj.exe

Path C:\Windows\SysWOW64\Ajfobfaj.exe
Size 320KB
SHA256 8b8db7de0a98cbf18a74f167eb02ddc5089b4a061342cc15dedfd9e64052a532
MD5 5f4602220d97e6cb6e272972a25676a6
SHA1 a8ac18b8bbea55dc1207d009614d8c825ff4e778
SHA512 d1db84500d341c5a0ba7756db267ef3c18b47ed5168d92137c6d639065846e522814c74a9c88c6c4db00ef5b39be51491beb1980942cac70ee68e44df9fc8e84
SSDEEP 3072:/u55Kxl8G9nouwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/uGZouV/Ah1G/AcQ///NR5fn
TLSH
T16D641E192A3409EACDED1BB5BC9249D89241E9F014F1E23E6123DFDCD8E5DE6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Andghd32.exe

Path C:\Windows\SysWOW64\Andghd32.exe
Size 320KB
SHA256 390b35bc6909152e064d7bc59d50ba4841c504b8019dd9ee217754c2cd5704ab
MD5 ffe6ae4db1b56932aa8a4312f120326b
SHA1 6e74a032dd6134e284ca94e8a22bd627285f0259
SHA512 a01cdd442a1e8ef5fd5e0fdcdadb946a008d954a110387f8a04eb789176772a0168a2a72df2100cf3b83c5ad5e1a2a412421d1a2586b2e2aa0640fcc745e1912
SSDEEP 6144:eK3h8iYjVbBL75kjTJV/Ah1G/AcQ///NR5fn:13h81nLKjI/Nv
TLSH
T13C643E19663409EACEED2BB5BC028DD84241E9F154F1E13E6623DFDCD9E4DA2D824F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bagmpoco.exe

Path C:\Windows\SysWOW64\Bagmpoco.exe
Size 320KB
SHA256 dd0464147d49a1cbe128f12aa7fddfd8668de386567a0d49ab6001e875280359
MD5 765780d0b91cbf465e4f4161a76b001d
SHA1 c1c038bdb34049e0d2a288a8ad61d4e6bbd7e444
SHA512 69c1e9a1feadf6f4b9487a0e4194a595c068b96922188b5f7008e391808ae017afd71b000fbf9ce4eedb3d9ffb011ae9b8a9efe9f279c748a850c8c2e775c493
SSDEEP 3072:I6mmGcOhbyj0e9d2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:I6mm8bywed2V/Ah1G/AcQ///NR5fn
TLSH
T11B640C192A3509EACEED2BB6AC1249D85141E9F214F1E33E6133DFDCD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bajjeo32.exe

Path C:\Windows\SysWOW64\Bajjeo32.exe
Size 320KB
SHA256 af578fe9af466e74428edece710617a4b6e27f0bb6110fca1d876fd02eeb6112
MD5 558cb8dae9d02215c2fd4476f66a5df3
SHA1 7986adbeee881d8bf6a6da536b7895d121daebc8
SHA512 10c0d7e873fcb4f0be5a29d9b5fc3fc58389afb83112a445f39369c76731303a541300b089b624f73f5852e2ea68946a30d86da01f630ca35b61c3d24430ccf3
SSDEEP 3072:CffkRtYC2jj9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CffkRJ2jj9V/Ah1G/AcQ///NR5fn
TLSH
T162643119263409FACDED1BB5AC1249D89142F9F414F2E13E6563DFDCD8E6EA6C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbbpnc32.exe

Path C:\Windows\SysWOW64\Bbbpnc32.exe
Size 320KB
SHA256 7e8ea6e78ab02aa5a032bf2912773cf0c2695279704dcefb1835b5c4b91feff3
MD5 381283f804a8945144cadb639d937cf1
SHA1 2e835c7fe334e4e34699db18520ff2a40710faa3
SHA512 a3838a04cb8163a7880fad76e9f8519df6502203af2be582f2e7eb39572aa3c5b7a7b302ca0b5e469c68dfba14317a9e3522b70c78dc79c6f493f922bc841be3
SSDEEP 3072:MgmFLRZIwA9swS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/mFLRZIj9sV/Ah1G/AcQ///NR5fn
TLSH
T16E64305A263009EACEED2FB5AC0249D89141E9F014F1E13E6127DFDDD9F6DA2C825F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbifobho.exe

Path C:\Windows\SysWOW64\Bbifobho.exe
Size 320KB
SHA256 4bc63211fb8f909472a1619379e6f3ffc2c3785a6c7de350442e89587e424057
MD5 306026a80dbea63ef38f13301e573517
SHA1 40355b6f9c79a2a97e42547108ff35937c7282f7
SHA512 59dd19f306ba03daa826a78211be8935ef0ce89a615782d2be71f52806727b905f86a270eedf6991b1ddb20633fe66ed0b1b044f061fdbf89d1e412bf886e301
SSDEEP 3072:2d0Pu/tpRuwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2dLpRuV/Ah1G/AcQ///NR5fn
TLSH
T1D064D91A2A380DEAEDED5BB5AC124DDC9141E9B114F1E13E6123EFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bblcda32.exe

Path C:\Windows\SysWOW64\Bblcda32.exe
Size 320KB
SHA256 cbd64a340e950587395cf81bf201ade7aed1e8e9573ff9fe6b1ecd6b0ca693ed
MD5 19e841eeb17704576e735dfb8682e18a
SHA1 ea85aa97525c94092a5761b185b9f6ea5a2b8644
SHA512 0fbac13748ced254c011d104cd7ae7cf0b9b572ca76f75c3848798f528144cee6933e0cda6c730aad6d7f8127aa680414fb58626c01f21adb4668d9d55cd66a1
SSDEEP 3072:p2uLxC6wOP5G89Vm4Jc0hxtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:p24xCenJc0hxtV/Ah1G/AcQ///NR5fn
TLSH
T131643119263009EACEED1FB5AC5749D85981E8F014F1E13E5123DFEEE9E8D62C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdcmfkde.exe

Path C:\Windows\SysWOW64\Bdcmfkde.exe
Size 320KB
SHA256 a51704a6875a620913c2b9f22de082cd53182bc8c9fbfc0e17f1e7b1e671a962
MD5 62151812a06cbf0878fa530cc8ef0b00
SHA1 4c194318ffbc4c6b48baa1fbff983c6a374ca782
SHA512 f6091f3839d596a79b9bf61be7b0170bece754bc3f19191374c356c21f89354273ba6a85663b994241e219fe21fd9446248b2e3f750a4bd1efb510e8f7bbd3ed
SSDEEP 3072:FvD/Ed7u+NSemTQ8t8VwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FvD/UExQ3VV/Ah1G/AcQ///NR5fn
TLSH
T1406460192A3009EACEED1FB5AC2249D89191E8F454F1E17E6123DFDCC9E4DB2D858F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdkbgj32.exe

Path C:\Windows\SysWOW64\Bdkbgj32.exe
Size 320KB
SHA256 7b627dbd83e98f77975963afa039b7b0ad56f8a66cc896ff12ba2a2f6d58602b
MD5 aa6301b856972566e137c44f6e156a8f
SHA1 38b244d7f213d28e6e9f750facadedd20d530d1f
SHA512 5608595abb489d95b4633d0fb69eadbdbaa58d665b1c67a9a3323251123e0a962c3cee21c438931a2bbf96447afbfa25353c6cd776389c358cdc216cc4d37bcd
SSDEEP 3072:kaQ3SEXyB6CC/vuDHUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kfSEXyB6CzDHUV/Ah1G/AcQ///NR5fn
TLSH
T13564421A263409EACDED1FB5AC1299D89141EAF024F1E23E6123DFDCD8E4DA7D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhaeli32.exe

Path C:\Windows\SysWOW64\Bhaeli32.exe
Size 320KB
SHA256 31b497d22582622b70ad21a153cb6cbf72b609bc89a3d9e80956519b2c7d166f
MD5 45477d0f8c694d23708ce9f8dfc60813
SHA1 33058da31b00a81a59b54c829f3b3d45641824e6
SHA512 90133a6ef1194b78925f9f0c61a41d57087197f2ad43af3f5be38868b110ba1a0001ae8619f0c504327ee3745e8b4b0db96669be23fc3db5aced9fafd1a0edaa
SSDEEP 3072:Y2dzH66AFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rzaRFV/Ah1G/AcQ///NR5fn
TLSH
T198641E19263409FADDED2BBAAC124DD85185E8F015F1E23E6127EFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhdbaihi.exe

Path C:\Windows\SysWOW64\Bhdbaihi.exe
Size 320KB
SHA256 28133398d116df2585130acbbee7f70f5760c463d03875e710f626565322328f
MD5 25934f5c5c1635e803083fa19b35f686
SHA1 481ac82502c5d0d87e42808b9fd15117c8b0939a
SHA512 f4c882859f72f3c0719de1dbc2cfbcb39d1aac99419cead08986dcce7b0e8b346aacada077b00d8da1da83427662defe711125d58a2f6dcbe87f5d1c9d0a7df9
SSDEEP 3072:sY9bD0hnQCZFAIP0bk069nwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:sY5D2QtR69nV/Ah1G/AcQ///NR5fn
TLSH
T1C464211926340AEACDED1FB5AC1249D89141F5F124F1E23E6623DFDDD8E4EA6C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjdkcd32.exe

Path C:\Windows\SysWOW64\Bjdkcd32.exe
Size 320KB
SHA256 1a8bf9ce1343babeaf6686673a413d0ecb05ed52dac08ee6477333f241e69c14
MD5 2abccc215550938a6c43fbc7db096277
SHA1 2e0b49a61e9c0e5917a9bd648d713d7c38a69344
SHA512 1d5861f99b5c52a922179815202c9b76b6d3e9896b01c00b8f6b58bf25e41398fb6c3c3fd93bd513b9bb84b3acad9bfb61e274228922d8a9a9d57440243692cf
SSDEEP 3072:lz2/5gXZ9HFswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lq/5y7FsV/Ah1G/AcQ///NR5fn
TLSH
T12864D9192A3809EACEFD1BB5BC124AD89181E9B414F1E13E6533DFDCD8E4DA2C915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjnece32.exe

Path C:\Windows\SysWOW64\Bjnece32.exe
Size 320KB
SHA256 745f8e15fd162ab17e7b2d9289c1d581a78658f3f46506abafda21557e43acfa
MD5 07f53af623e87763e55c9b87ebf27806
SHA1 3223d3c3ec6e17ea3fd644381dae62a123e69b85
SHA512 643c21cfac11e98e64396f1969fe109c05c27c6a2c727ef465d6e568d743aaff16868ecf4a596168b1ae6534ece59cceec2f888d5350c3e348f3188349cafadb
SSDEEP 3072:UHuODdf+iDzmkRXMBIwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ubHmPIV/Ah1G/AcQ///NR5fn
TLSH
T1B5641019263009FACDED1BB5AC1289D89141E9F014F1F17E6123DFECD8E6DA6D819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjpaheio.exe

Path C:\Windows\SysWOW64\Bjpaheio.exe
Size 320KB
SHA256 79b52eaf02f7c9a4898a8f7c1d2c46dab779b013905a41b1d0d9087a348454c5
MD5 01d4a9511048057fcb5869f0c457e48c
SHA1 61c924ef9d33a746ca672b604945b9f6464cdcd9
SHA512 e55f97f6ebd8368070e9b096b87d8440d813134771765be95b4c421e7fb7e669b78793ad71701b4b675bf34d532caf7a5545ccac8bd2bc5d2f3b4fdceb385660
SSDEEP 3072:xkMGA2BhhTasAm4SwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:aMGtevSwV/Ah1G/AcQ///NR5fn
TLSH
T16A640C1A2A7449EACEED5BB9BC1249D85145E8F024F1E13E6133DFDCD8E4DA2C806F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Blhhaigj.exe

Path C:\Windows\SysWOW64\Blhhaigj.exe
Size 320KB
SHA256 4c3b7cc53e8f527fe604cdd457252cf53b04a25147d6477e9137b71bc8fbe320
MD5 0724b9ce18b3e29a21497158a5a9fa1b
SHA1 fb277cbd86b32d244623a6c9f60a0cb237effd1a
SHA512 e9900ab803c3d06a1c71761fba80f5a33eb5ab5b2c6a25a55f9308841163d519fda6bf3460bf1ce487d20414dbc9a8f212b7aa783af9d0bda9f0f2d4ff7fbaf2
SSDEEP 3072:MOSdYxDDOPWmB3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MOCwXOPF3V/Ah1G/AcQ///NR5fn
TLSH
T17064202966340AEACEED1FB6AC0349D85241EAF114F1E13E6163DFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cahffmel.exe

Path C:\Windows\SysWOW64\Cahffmel.exe
Size 320KB
SHA256 ccb334968e8192f8d0a472e836afc1bbd7923500e0a34081a59636743098b036
MD5 e44ecf732214b6022f18004fe4dd1b82
SHA1 8cc87e7659b5df2d73bf3710cb79305f72a126cd
SHA512 07a754fd9cacf7ba7d18e0a17f4ed1b3e8a55e2b068658d431ba03af6e771aa1c83cf1bb5aca2ce32b80c55d100afeb099cc905a6857976eb1c7ffce98de4f86
SSDEEP 6144:pQWoSEAjnfWPfx4++kw/+siWYwGV/Ah1G/AcQ///NR5fn:pQWiAjnfWPfx4++k2YM/Nv
TLSH
T1326452292A3409EACDED1FB5AE1259D86191E9F014F1E13E6123DFDCE8E4DA2DD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbcieqpd.exe

Path C:\Windows\SysWOW64\Cbcieqpd.exe
Size 320KB
SHA256 ecb2de04b7ef7042093420159baf3d605e1df190d4f42f20f9368645ca5cefc7
MD5 538355526215b845b60ba57b8d283ef3
SHA1 40f69911df9bea5e8b3d6ccb5e11536a752b23f8
SHA512 ffd1bf104743ab3677c3bf9344fe808031cb5794f80a2d5513eb7a1cf24db6f6af8e6c1acef46d8bef605f1a93176df847b30b963a39cce9cfa7ee8c1671844d
SSDEEP 3072:f5cI4avBoECwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fd4aFCV/Ah1G/AcQ///NR5fn
TLSH
T1A064FB2A2A3409EADDFD5BB5AC2249DC9151E8F014F1E53E6123DFDCD8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbqlpabf.exe

Path C:\Windows\SysWOW64\Cbqlpabf.exe
Size 320KB
SHA256 bc1dfbb994e021a415b0fc7fc35b8758fda5528f72e746ae994cfa0946e1f4a2
MD5 0b043ee02796aff75b9b7c718e81eb64
SHA1 6a338abe50c47d1dbe1c6d382424187ad9498ec2
SHA512 f22a37d6ff95ef895952b0a6de69d056d089fb95f2b81744aec42623d1467fd19d309d08558502e9a1418977be524b2b807ae53e1717e3b63f057a4c1a3e071b
SSDEEP 3072:HcrXcgAqRP2cwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HM7A/cV/Ah1G/AcQ///NR5fn
TLSH
T1926441192A7409EACDED2FB5AC0259D85181E8F018F1E57E2123DFDCD8E4DAACC19F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cdaigi32.exe

Path C:\Windows\SysWOW64\Cdaigi32.exe
Size 320KB
SHA256 303564bd90feaa2f532c847cd7b3c4085cd248c12cddb3f8a4cdb14984139c08
MD5 753ba12d190f9a0bf77121fb3d018f68
SHA1 665abb201d6a476d41e104ada72b335fc922066f
SHA512 bc8899f4cf79e2f97afda78e3216606ddfe173e6016898bedc02f4d07bebe40d0114c5712a89bb90a32e9187de51dcf905fffc5128f6eb60d80570e2a8863807
SSDEEP 3072:tSnZkOtay3uSlNGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tgZkOtay3uSlNGV/Ah1G/AcQ///NR5fn
TLSH
T197643F1A1A3149FACEED1BB5AC0649D89142E8F014F2E13FA523DFDCD8E4DA6C945F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cddemi32.exe

Path C:\Windows\SysWOW64\Cddemi32.exe
Size 320KB
SHA256 92ca9030711ce7f331345fe1bf80870fb03cf3144afaacec127f77322feb9703
MD5 c173c7c1e450920462a3970d03d4b4a0
SHA1 5d1499dc9302f03c81d0d4c7d182c11e11b4d000
SHA512 36a6b53dd45b7ee043391f47fd7f2fc9797bd107f79617d1d8ee8385f0e25d967c9294fae798877ec3bae20190edff4cf2a27ff1f237de9508e96513e1fb1a5d
SSDEEP 3072:9sY3GPcu2ZzDzplOY0cKSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9locuoAcKSV/Ah1G/AcQ///NR5fn
TLSH
T1456410192A3409EACDED2BBAAC1249DC5145E8F024F5E13E5127DFDCE8E4DA2EC14F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cellfm32.exe

Path C:\Windows\SysWOW64\Cellfm32.exe
Size 320KB
SHA256 453daeead0dff51469ae30eec9479f20c9751dc77911f68bec21208717b9095e
MD5 575e511fb67a0d32e22c53e833309dde
SHA1 95231649867a30346056055dccda0c4c3b7b257a
SHA512 0007967b1723430dc25b748aed4b16f29706b278052a76178e96c94873497bfed57cebf5119a60a7c16b2dc2bd43f8c0b502ce48242afde2f3b6e56a4c7d5911
SSDEEP 3072:Leajsz5QwSvaExwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Lrjszew61xV/Ah1G/AcQ///NR5fn
TLSH
T14A64EC157A3009EACEFE1BB5AD1249D89141E8F014F1E13EA123DFDCD8E4DA6D919F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chhkmh32.exe

Path C:\Windows\SysWOW64\Chhkmh32.exe
Size 320KB
SHA256 6ec824df9ed1b4b2034a392dd90f0baf1ba273caadd0b534d314b48ac0bf2447
MD5 aed72c5b94a6f9602295f2efb5b1645d
SHA1 920c7a60c208401d78c4692b4df37f44a9af0ebc
SHA512 2e7d2c244858a27b6638b2c7da9ca5b310d69f5dced572898d6cc32b21d13e8a24527372ab772d4c31e403e2ca8db6c0caa814be1b8336c870dac093e323b63f
SSDEEP 3072:hcfNvXT/GK7Lba8dSQDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hY/GiXRoQDV/Ah1G/AcQ///NR5fn
TLSH
T18F64B7192A3809EACDED1FB6BC1249D89141E9F054F1E23E6123DFDCD8E4DAADC15B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckghid32.exe

Path C:\Windows\SysWOW64\Ckghid32.exe
Size 320KB
SHA256 2bff3347a543dd97c612d8ec503f5087df15069f3786afb08844b94cf7294abc
MD5 8f613af164080d795f80e22df8bf6821
SHA1 20f8cddb09d0bb5894953a6f04a4bb06f7a526ed
SHA512 4f0021731c0db3fb1bc4549f41359c77fdb11cbf8ae9b92c55bddf867e432181db0096b6a7f84aad68075e47bb6b9ea0e8d787499cdf397cf6d491aa0de10a66
SSDEEP 3072:IwwPwgB6PBC/qsTkwSPnCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:I5MypkwSfCV/Ah1G/AcQ///NR5fn
TLSH
T11864401916300AEADEED1BB5AC429DD89151E9F414F1E13EA223DFDCCDE4DA6C818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckladcoa.exe

Path C:\Windows\SysWOW64\Ckladcoa.exe
Size 320KB
SHA256 e5a644cb5988ada86d557ee87ccf658b6fb014a1510eefc51018c564f1281ff9
MD5 1d845eb20967daea3cf9a747a64dd729
SHA1 10c28d695061d9c4f1eabfb75425f2a19a41a5cf
SHA512 9d8267764b49838440740ea57f72f2c71be0a44b5d6d758710013ba24365a520dce8a9051e08792c50832f863d089bd597fc33c24357eda032e2443a607d79d4
SSDEEP 3072:axw+QeoPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:aCNPV/Ah1G/AcQ///NR5fn
TLSH
T1E464511D2A3019EACEED5FB5AC1249D85281EAF024F1E13E2167DFDCD8E4DA2C815F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cknnjcmo.exe

Path C:\Windows\SysWOW64\Cknnjcmo.exe
Size 320KB
SHA256 e0216dc494685cd4ef5df4f947073373df77ae0d1611659804c1a177185135e4
MD5 ca22f0316e8f3c791758d6f8bff1e367
SHA1 e0c3db05fbd3bb1b3ec9c3ea48c14027a9e1dd6c
SHA512 a59bdfba95f54ddc41103844c3ffafdbdca2c9e70e822ba06f552ed64661c3fa18cffcd15208730e5c9815e0dc4f6cd897553a55cdfe072fda59c35791dfa0b2
SSDEEP 3072:q6KQNiw5ncuZ3JlrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qhQV5ncuZPrV/Ah1G/AcQ///NR5fn
TLSH
T18964DD191A3409EADEED2FB5AC1259EC5141E8F014F1E13E6123DFECD8E8DA2E855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clfdcgkj.exe

Path C:\Windows\SysWOW64\Clfdcgkj.exe
Size 320KB
SHA256 d7c51b2a45f242e6d48ff3c2601b05a23c815212c255d0092d86d4e7aff50292
MD5 e4d7289e857a623c5943f44bae59e300
SHA1 547e08ff858a037e184f88df278b1b67b5021fa9
SHA512 48475e5e27d506220c9301efe6754f1e568ca96ca83d1e3af1fd75c936df2ae797290390314403433ff5197b989ea8aff8c1295194dc9ac32339dcbbaceaf895
SSDEEP 3072:5vr5OJAWGUZ6hzzM02M8ywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5YJAMHXyV/Ah1G/AcQ///NR5fn
TLSH
T12564311926340AEACDED1FB6AC1269D8A541E9F014F1E53E6133DFDCD8E4DA6C824F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qkjlpk32.exe

Path C:\Windows\SysWOW64\Qkjlpk32.exe
Size 320KB
SHA256 b21e80b95b914e837fe682e1af7ec76c568e788c72a3eaeb45b78d8d9cf44f0c
MD5 1235a0e2f3d44e5eb706fd4aea8c952f
SHA1 359a355693cd3cc47ffc4b7ae848556fa44ce05f
SHA512 0302b50b98e6ac93235f41ffddb87f626c38f11b546eaea883955ab82ad542047ea58bbf2004f04629ef582702395257778f339aa22b65a9f1d8d180c934599b
SSDEEP 3072:m/yapfm5x1kpawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9apfKKpaV/Ah1G/AcQ///NR5fn
TLSH
T12C6441196A3019EACEED1FB5AE024ADC5281E4F114F1E23E6123DFDCD8E4DA6D814F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qnfkgfdp.exe

Path C:\Windows\SysWOW64\Qnfkgfdp.exe
Size 320KB
SHA256 945014109cce7074d23d5330561f990a86bc19ac926d85052f6ac0693ca6ea4f
MD5 9183d19ef9dda8ea04721434abd4d66b
SHA1 95cc9dc68c840bf2adf50c2b2d87d88ba69ba43e
SHA512 4004f46d8942f546bf5be34c161f1d86f27713840c99a23c9432fd2685606e7daaec3cc8e3c97ba6997531db34602cc3de98a9344c0245ee7612bd8e16be7cfa
SSDEEP 3072:ad28lC7u7Nk/MVotbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QNO/MVotbV/Ah1G/AcQ///NR5fn
TLSH
T135642D1A2A3409EACDED1BB5AC1249D89149E8F118F1E13E6133DFDDD8E5DA6CC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/636-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/716-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/944-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/944-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1032-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1096-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1100-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1116-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1216-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1384-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1388-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1404-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1476-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1620-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1648-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1696-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1696-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1724-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1840-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1912-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2000-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2060-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2280-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2280-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2300-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2444-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2508-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2520-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2620-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2624-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2680-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2808-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2944-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3060-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3068-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3788-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3812-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3888-403-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3900-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3952-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3952-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3980-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4092-453-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4132-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4180-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4232-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4248-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4260-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4260-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4300-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4308-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4324-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4376-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4376-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4376-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4472-397-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4484-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4516-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4544-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4556-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4628-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4684-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4820-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4832-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4844-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4844-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4904-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4908-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4968-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4984-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4992-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5084-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5116-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5132-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5132-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5156-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5160-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5164-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5176-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5200-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5344-418-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5456-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5500-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5508-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5516-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5664-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5712-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5732-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5764-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5956-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6032-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads