berbew | 9a0be507d8471efa4a80838bd688377d466daf6b955ced9dd7f7fe2c779d4071

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_13503e9d51e06e6b0701b45e9ffc8776_elex_wannacry.exe
Size 320KB
Sample260717-vyrjpagy2j
SHA256 9a0be507d8471efa4a80838bd688377d466daf6b955ced9dd7f7fe2c779d4071
MD5 13503e9d51e06e6b0701b45e9ffc8776
SHA1 9413dceb321c7a94e521bb357ad9e295e547581a
SHA512 79a72cd7c970eb6bcadc30ce3910a8f979385f1fed9e714c4eedd127dfb11228f9364d58c4637f627d9bdb4ad37872ae2e71045424d72f71e115cda1cc48966d
SSDEEP 3072:vNdbJMA9oxiV88DgswwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vfh5wV/Ah1G/AcQ///NR5fn
TLSH
T1B2643019263549EADEFD1BB5AC1249D85241E8F018F2E13E6123DFDCC8E4DA6E835F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljmmnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkeppeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdhcagnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqikfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmdefi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpopb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhjpnibf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboiaoff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcojoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdgan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnoboc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idbonc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebjckppa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goabhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboldq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Biadoeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdnnjane.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnokhonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeolonem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adbiojfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdlphjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knabne32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nihiiimi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmpqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklfqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkfanqmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mebkbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibkpmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhdhhchf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pedlpgqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icdhojka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mflbdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiahhdee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nekgna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgfcfajg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgcafl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckeigc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goediekj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bemqcngl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekhncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knoonphp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbcieqpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpokm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noijmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjhaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aafefq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdgcmqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofgioah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anbkbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpcdji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlfeeelm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahenip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdiafc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngbpbjoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjkbemll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Canlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfakb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afelal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkcfbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hefneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpodhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hocqkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phqbaj32.exe

Executes dropped EXE 64 IoCs

pid	Process
4776	Kmlmlo32.exe
5108	Lkpnec32.exe
4948	Lmqggncn.exe
3264	Lnccmnak.exe
5004	Ldmlih32.exe
4508	Lpfidh32.exe
5668	Mgggaamn.exe
4136	Maohdj32.exe
5396	Ncpelbap.exe
3120	Nacboi32.exe
2012	Nddkaddm.exe
3196	Ngedbp32.exe
2348	Nbjhph32.exe
4408	Onceji32.exe
3752	Obanqgkl.exe
3096	Oqgkadod.exe
3516	Pqihgcma.exe
5432	Pegqmbch.exe
2784	Peimcaae.exe
5988	Peljha32.exe
5448	Pkebekgo.exe
2176	Pabknbef.exe
5748	Pglcjl32.exe
1788	Qebpipij.exe
4308	Qlmhfj32.exe
3360	Acjjpllp.exe
1072	Abkjnd32.exe
2320	Acmfel32.exe
1580	Anbkbe32.exe
5400	Ahmlaj32.exe
4512	Bhohfj32.exe
3828	Bniacddk.exe
3776	Blonbh32.exe
1560	Blakhgoo.exe
2136	Cldgmgml.exe
5812	Cdolbijg.exe
2744	Ceoillaj.exe
2072	Cliahf32.exe
5028	Cbcieqpd.exe
1684	Cbefkp32.exe
4460	Clmjcfdb.exe
6044	Cbgbpp32.exe
3796	Dbjofp32.exe
5880	Dkedjbgg.exe
2540	Daolgl32.exe
4780	Dboiaoff.exe
5512	Dcaefo32.exe
6076	Ddbbngjb.exe
5156	Deanhj32.exe
3592	Ehpjdepi.exe
5124	Eceoanpo.exe
256	Ekqcfpmj.exe
4296	Edihof32.exe
5276	Ecjhmm32.exe
4664	Ekemap32.exe
468	Ehimkd32.exe
4900	Eocegn32.exe
2152	Femndhgh.exe
2364	Fkjfloeo.exe
900	Ffpjihee.exe
4432	Ffbgog32.exe
4456	Fllplajo.exe
5340	Ffdddg32.exe
5164	Fomhnmgp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Knbmicga.dll	Jfaenqjm.exe
File opened for modification	C:\Windows\SysWOW64\Mbchkg32.exe	Mlipomli.exe
File created	C:\Windows\SysWOW64\Kbpkdd32.exe	Kelkkpae.exe
File created	C:\Windows\SysWOW64\Ekcqji32.dll	Nhokeolc.exe
File created	C:\Windows\SysWOW64\Iecbdhad.dll	Eijbge32.exe
File created	C:\Windows\SysWOW64\Dmgbgf32.exe	Ddonnq32.exe
File created	C:\Windows\SysWOW64\Ggilng32.dll	Iickdgpb.exe
File created	C:\Windows\SysWOW64\Modmkn32.dll	Lalnfooo.exe
File created	C:\Windows\SysWOW64\Blbjdb32.dll	Ddgpfgil.exe
File created	C:\Windows\SysWOW64\Cjkjjmlf.exe	Cdabmcdi.exe
File created	C:\Windows\SysWOW64\Ifolan32.dll	Ahenip32.exe
File created	C:\Windows\SysWOW64\Pmoijcje.exe	Plmmbkdf.exe
File opened for modification	C:\Windows\SysWOW64\Boenam32.exe	Bdojdd32.exe
File opened for modification	C:\Windows\SysWOW64\Edfdop32.exe	Emllbe32.exe
File created	C:\Windows\SysWOW64\Cjiefocn.dll	Knmicfnn.exe
File opened for modification	C:\Windows\SysWOW64\Bcokah32.exe	Bhjgdplo.exe
File created	C:\Windows\SysWOW64\Mmkkgh32.exe	Mkjnop32.exe
File created	C:\Windows\SysWOW64\Pjmjnb32.exe	Pdcaahbk.exe
File created	C:\Windows\SysWOW64\Edihof32.exe	Ekqcfpmj.exe
File created	C:\Windows\SysWOW64\Canlfh32.exe	Bfhhho32.exe
File created	C:\Windows\SysWOW64\Jkhnab32.exe	Jenedhaa.exe
File opened for modification	C:\Windows\SysWOW64\Lblakh32.exe	Lhfmmp32.exe
File created	C:\Windows\SysWOW64\Oibbjoij.exe	Ochjmd32.exe
File opened for modification	C:\Windows\SysWOW64\Ahnghafl.exe	Aadokg32.exe
File opened for modification	C:\Windows\SysWOW64\Afddge32.exe	Aojljkkf.exe
File created	C:\Windows\SysWOW64\Epdaneff.exe	Dbqqeahl.exe
File opened for modification	C:\Windows\SysWOW64\Bfcompnj.exe	Bagfeioc.exe
File created	C:\Windows\SysWOW64\Kilpgnfi.exe	Knfliefc.exe
File created	C:\Windows\SysWOW64\Meepne32.exe	Mjokpm32.exe
File created	C:\Windows\SysWOW64\Dddmmc32.dll	Meepne32.exe
File created	C:\Windows\SysWOW64\Bjminj32.dll	Phdngljk.exe
File opened for modification	C:\Windows\SysWOW64\Ahkdhk32.exe	Qaalkamf.exe
File created	C:\Windows\SysWOW64\Hjbajokj.dll	Adbdml32.exe
File opened for modification	C:\Windows\SysWOW64\Jocepc32.exe	Jiglgl32.exe
File created	C:\Windows\SysWOW64\Hegaapbd.dll	Eainnn32.exe
File created	C:\Windows\SysWOW64\Dpknhfoq.exe	Djnfppqi.exe
File opened for modification	C:\Windows\SysWOW64\Kkgicccd.exe	Kqbdej32.exe
File opened for modification	C:\Windows\SysWOW64\Cglbanmo.exe	Cncnhh32.exe
File created	C:\Windows\SysWOW64\Jpdiag32.dll	Fpeapilo.exe
File opened for modification	C:\Windows\SysWOW64\Gbofmmmj.exe	Glenpb32.exe
File opened for modification	C:\Windows\SysWOW64\Oeehdcij.exe	Onkphi32.exe
File created	C:\Windows\SysWOW64\Bkoooa32.dll	Qkegiggl.exe
File created	C:\Windows\SysWOW64\Ihfecn32.dll	Cofnba32.exe
File created	C:\Windows\SysWOW64\Dkedjbgg.exe	Dbjofp32.exe
File created	C:\Windows\SysWOW64\Hdgfmk32.exe	Hkobdeok.exe
File created	C:\Windows\SysWOW64\Hdlphjaf.exe	Hoogpcco.exe
File opened for modification	C:\Windows\SysWOW64\Ibffbnjh.exe	Ikmnec32.exe
File opened for modification	C:\Windows\SysWOW64\Gngnjk32.exe	Ghkebd32.exe
File opened for modification	C:\Windows\SysWOW64\Aoofej32.exe	Ahenip32.exe
File opened for modification	C:\Windows\SysWOW64\Cofnba32.exe	Cbbnim32.exe
File created	C:\Windows\SysWOW64\Apncei32.dll	Ghgbakhb.exe
File opened for modification	C:\Windows\SysWOW64\Eagahnob.exe	Efamkepl.exe
File opened for modification	C:\Windows\SysWOW64\Hchickeo.exe	Hlnqfanb.exe
File created	C:\Windows\SysWOW64\Igkkdigp.exe	Hdmohnhl.exe
File created	C:\Windows\SysWOW64\Ohahkojp.exe	Oeclockl.exe
File opened for modification	C:\Windows\SysWOW64\Kcmmap32.exe	Knpeii32.exe
File opened for modification	C:\Windows\SysWOW64\Oakbonkb.exe	Ojajbdde.exe
File created	C:\Windows\SysWOW64\Ffbgog32.exe	Ffpjihee.exe
File created	C:\Windows\SysWOW64\Eagahnob.exe	Efamkepl.exe
File created	C:\Windows\SysWOW64\Nogngp32.exe	Nijeoikf.exe
File created	C:\Windows\SysWOW64\Gfgnnedj.exe	Gpnfak32.exe
File opened for modification	C:\Windows\SysWOW64\Hoobnf32.exe	Hefneq32.exe
File opened for modification	C:\Windows\SysWOW64\Igomeb32.exe	Imfill32.exe
File opened for modification	C:\Windows\SysWOW64\Jfnbnk32.exe	Jkhnab32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9984	9936	WerFault.exe	1001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhjpnibf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Badaholq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagidhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncggqbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emniheha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaddcnad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeolonem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdbheajp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlfeeelm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djelqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnjecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgdpgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llhnpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgqqnjea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knmicfnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pefhfgoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epdaneff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhohfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpnbhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjoedfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbfhne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piknfgmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aojljkkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcikagij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fealcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmhmko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoobnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kddnpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfcompnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edfdop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noijmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckkilhjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffobbmpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mokmnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aobieq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehecpgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eimegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpofbobf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjokpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkegiggl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlipal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opongobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aohpek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hefneq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghnpmqef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bqkifb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqphpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlqohhja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajggjap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgapp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llofnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeclockl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icdhojka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgbej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obanqgkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgikip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkobdeok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekdolcbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjhaeklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pedlpgqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkmdoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcplle32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdcbic32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgeihjcb.dll"	Ocpghj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpkiim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbigapjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfdgcmqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdlpjicj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aknhia32.dll"	Kilpgnfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmdefi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oceepj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maohdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjjpllp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dboiaoff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klgqmfpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngkjbkem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfnbnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fifhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpaigg32.dll"	Adbiojfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alnmdojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbofmmmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgaoda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaoao32.dll"	Mjlhpgfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebocpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkpcamfq.dll"	Mbjnlfnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjneec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkcnnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihnci32.dll"	Oiglen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkgeipah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaabkj32.dll"	Hhoomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihbdja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piknfgmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnohemjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdicdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlmhfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hocqkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chcpaide.dll"	Jkimae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmdhmch.dll"	Anmfkane.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhnlilfk.dll"	Ddbfkh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifgbhbbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadokg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkjnop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflkln32.dll"	Aachaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boeelcmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbchkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikqqfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpmknf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdhndlno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldpmlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clmjcfdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmfmfigl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqmgbd32.dll"	Bmkcjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obdmdf32.dll"	Ameipl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomfme32.dll"	Lpqioclc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fecmjq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glodmbga.dll"	Hjhaeklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oimceg32.dll"	Ecbjdcml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpaec32.dll"	Kjhlipla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdqecc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lngkjhmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnifbmfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Majjgmco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkcehaof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbcieqpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cndidlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plnple32.dll"	Dfhjefhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Illiee32.dll"	Jkejalge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6000 wrote to memory of 4776	6000	2026-07-17_13503e9d51e06e6b0701b45e9ffc8776_elex_wannacry.exe	89
PID 4776 wrote to memory of 5108	4776	Kmlmlo32.exe	90
PID 5108 wrote to memory of 4948	5108	Lkpnec32.exe	91
PID 4948 wrote to memory of 3264	4948	Lmqggncn.exe	92
PID 3264 wrote to memory of 5004	3264	Lnccmnak.exe	93
PID 5004 wrote to memory of 4508	5004	Ldmlih32.exe	94
PID 4508 wrote to memory of 5668	4508	Lpfidh32.exe	95
PID 5668 wrote to memory of 4136	5668	Mgggaamn.exe	96
PID 4136 wrote to memory of 5396	4136	Maohdj32.exe	97
PID 5396 wrote to memory of 3120	5396	Ncpelbap.exe	98
PID 3120 wrote to memory of 2012	3120	Nacboi32.exe	99
PID 2012 wrote to memory of 3196	2012	Nddkaddm.exe	100
PID 3196 wrote to memory of 2348	3196	Ngedbp32.exe	101
PID 2348 wrote to memory of 4408	2348	Nbjhph32.exe	102
PID 4408 wrote to memory of 3752	4408	Onceji32.exe	103
PID 3752 wrote to memory of 3096	3752	Obanqgkl.exe	104
PID 3096 wrote to memory of 3516	3096	Oqgkadod.exe	105
PID 3516 wrote to memory of 5432	3516	Pqihgcma.exe	106
PID 5432 wrote to memory of 2784	5432	Pegqmbch.exe	107
PID 2784 wrote to memory of 5988	2784	Peimcaae.exe	108
PID 5988 wrote to memory of 5448	5988	Peljha32.exe	109
PID 5448 wrote to memory of 2176	5448	Pkebekgo.exe	110
PID 2176 wrote to memory of 5748	2176	Pabknbef.exe	111
PID 5748 wrote to memory of 1788	5748	Pglcjl32.exe	112
PID 1788 wrote to memory of 4308	1788	Qebpipij.exe	113
PID 4308 wrote to memory of 3360	4308	Qlmhfj32.exe	114
PID 3360 wrote to memory of 1072	3360	Acjjpllp.exe	115
PID 1072 wrote to memory of 2320	1072	Abkjnd32.exe	116
PID 2320 wrote to memory of 1580	2320	Acmfel32.exe	117
PID 1580 wrote to memory of 5400	1580	Anbkbe32.exe	118
PID 5400 wrote to memory of 4512	5400	Ahmlaj32.exe	119
PID 4512 wrote to memory of 3828	4512	Bhohfj32.exe	120
PID 3828 wrote to memory of 3776	3828	Bniacddk.exe	121
PID 3776 wrote to memory of 1560	3776	Blonbh32.exe	122
PID 1560 wrote to memory of 2136	1560	Blakhgoo.exe	123
PID 2136 wrote to memory of 5812	2136	Cldgmgml.exe	124
PID 5812 wrote to memory of 2744	5812	Cdolbijg.exe	125
PID 2744 wrote to memory of 2072	2744	Ceoillaj.exe	126
PID 2072 wrote to memory of 5028	2072	Cliahf32.exe	127
PID 5028 wrote to memory of 1684	5028	Cbcieqpd.exe	128
PID 1684 wrote to memory of 4460	1684	Cbefkp32.exe	129
PID 4460 wrote to memory of 6044	4460	Clmjcfdb.exe	130
PID 6044 wrote to memory of 3796	6044	Cbgbpp32.exe	131
PID 3796 wrote to memory of 5880	3796	Dbjofp32.exe	132
PID 5880 wrote to memory of 2540	5880	Dkedjbgg.exe	133
PID 2540 wrote to memory of 4780	2540	Daolgl32.exe	134
PID 4780 wrote to memory of 5512	4780	Dboiaoff.exe	135
PID 5512 wrote to memory of 6076	5512	Dcaefo32.exe	136
PID 6076 wrote to memory of 5156	6076	Ddbbngjb.exe	137
PID 5156 wrote to memory of 3592	5156	Deanhj32.exe	138
PID 3592 wrote to memory of 5124	3592	Ehpjdepi.exe	139
PID 5124 wrote to memory of 256	5124	Eceoanpo.exe	140
PID 256 wrote to memory of 4296	256	Ekqcfpmj.exe	141
PID 4296 wrote to memory of 5276	4296	Edihof32.exe	142
PID 5276 wrote to memory of 4664	5276	Ecjhmm32.exe	143
PID 4664 wrote to memory of 468	4664	Ekemap32.exe	144
PID 468 wrote to memory of 4900	468	Ehimkd32.exe	145
PID 4900 wrote to memory of 2152	4900	Eocegn32.exe	146
PID 2152 wrote to memory of 2364	2152	Femndhgh.exe	147
PID 2364 wrote to memory of 900	2364	Fkjfloeo.exe	148
PID 900 wrote to memory of 4432	900	Ffpjihee.exe	149
PID 4432 wrote to memory of 4456	4432	Ffbgog32.exe	150
PID 4456 wrote to memory of 5340	4456	Fllplajo.exe	151
PID 5340 wrote to memory of 5164	5340	Ffdddg32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-07-17_13503e9d51e06e6b0701b45e9ffc8776_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_13503e9d51e06e6b0701b45e9ffc8776_elex_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\SysWOW64\Kmlmlo32.exe
  C:\Windows\system32\Kmlmlo32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\Lkpnec32.exe
    C:\Windows\system32\Lkpnec32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\SysWOW64\Lmqggncn.exe
      C:\Windows\system32\Lmqggncn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\Windows\SysWOW64\Lnccmnak.exe
        
        C:\Windows\system32\Lnccmnak.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3264
      - C:\Windows\SysWOW64\Ldmlih32.exe
        
        C:\Windows\system32\Ldmlih32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Lpfidh32.exe
        
        C:\Windows\system32\Lpfidh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Mgggaamn.exe
        
        C:\Windows\system32\Mgggaamn.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5668
        
        C:\Windows\SysWOW64\Maohdj32.exe
        
        C:\Windows\system32\Maohdj32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Ncpelbap.exe
        
        C:\Windows\system32\Ncpelbap.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5396
        
        C:\Windows\SysWOW64\Nacboi32.exe
        
        C:\Windows\system32\Nacboi32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Nddkaddm.exe
        
        C:\Windows\system32\Nddkaddm.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Ngedbp32.exe
        
        C:\Windows\system32\Ngedbp32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Nbjhph32.exe
        
        C:\Windows\system32\Nbjhph32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\Onceji32.exe
        
        C:\Windows\system32\Onceji32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Obanqgkl.exe
        
        C:\Windows\system32\Obanqgkl.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Windows\SysWOW64\Pqihgcma.exe
        
        C:\Windows\system32\Pqihgcma.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Pegqmbch.exe
        
        C:\Windows\system32\Pegqmbch.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5432
        
        C:\Windows\SysWOW64\Peimcaae.exe
        
        C:\Windows\system32\Peimcaae.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Peljha32.exe
        
        C:\Windows\system32\Peljha32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5988
        
        C:\Windows\SysWOW64\Pkebekgo.exe
        
        C:\Windows\system32\Pkebekgo.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Windows\SysWOW64\Pabknbef.exe
        
        C:\Windows\system32\Pabknbef.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\SysWOW64\Pglcjl32.exe
        
        C:\Windows\system32\Pglcjl32.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5748
        
        C:\Windows\SysWOW64\Qebpipij.exe
        
        C:\Windows\system32\Qebpipij.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Qlmhfj32.exe
        
        C:\Windows\system32\Qlmhfj32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Acjjpllp.exe
        
        C:\Windows\system32\Acjjpllp.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Abkjnd32.exe
        
        C:\Windows\system32\Abkjnd32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Acmfel32.exe
        
        C:\Windows\system32\Acmfel32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Anbkbe32.exe
        
        C:\Windows\system32\Anbkbe32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Ahmlaj32.exe
        
        C:\Windows\system32\Ahmlaj32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5400
        
        C:\Windows\SysWOW64\Bhohfj32.exe
        
        C:\Windows\system32\Bhohfj32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Bniacddk.exe
        
        C:\Windows\system32\Bniacddk.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Blonbh32.exe
        
        C:\Windows\system32\Blonbh32.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Blakhgoo.exe
        
        C:\Windows\system32\Blakhgoo.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Cldgmgml.exe
        
        C:\Windows\system32\Cldgmgml.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Cdolbijg.exe
        
        C:\Windows\system32\Cdolbijg.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Windows\SysWOW64\Ceoillaj.exe
        
        C:\Windows\system32\Ceoillaj.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Cliahf32.exe
        
        C:\Windows\system32\Cliahf32.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Cbcieqpd.exe
        
        C:\Windows\system32\Cbcieqpd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Cbefkp32.exe
        
        C:\Windows\system32\Cbefkp32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Clmjcfdb.exe
        
        C:\Windows\system32\Clmjcfdb.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Cbgbpp32.exe
        
        C:\Windows\system32\Cbgbpp32.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6044
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5880
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Dboiaoff.exe
        
        C:\Windows\system32\Dboiaoff.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5512
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Windows\SysWOW64\Deanhj32.exe
        
        C:\Windows\system32\Deanhj32.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5156
        
        C:\Windows\SysWOW64\Ehpjdepi.exe
        
        C:\Windows\system32\Ehpjdepi.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Eceoanpo.exe
        
        C:\Windows\system32\Eceoanpo.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Windows\SysWOW64\Ekqcfpmj.exe
        
        C:\Windows\system32\Ekqcfpmj.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:256
        
        C:\Windows\SysWOW64\Edihof32.exe
        
        C:\Windows\system32\Edihof32.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Ecjhmm32.exe
        
        C:\Windows\system32\Ecjhmm32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5276
        
        C:\Windows\SysWOW64\Ekemap32.exe
        
        C:\Windows\system32\Ekemap32.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Ehimkd32.exe
        
        C:\Windows\system32\Ehimkd32.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\Eocegn32.exe
        
        C:\Windows\system32\Eocegn32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Femndhgh.exe
        
        C:\Windows\system32\Femndhgh.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Fkjfloeo.exe
        
        C:\Windows\system32\Fkjfloeo.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\SysWOW64\Ffbgog32.exe
        
        C:\Windows\system32\Ffbgog32.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Fllplajo.exe
        
        C:\Windows\system32\Fllplajo.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\SysWOW64\Ffdddg32.exe
        
        C:\Windows\system32\Ffdddg32.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5340
        
        C:\Windows\SysWOW64\Fomhnmgp.exe
        
        C:\Windows\system32\Fomhnmgp.exe
        65⤵
        Executes dropped EXE
        
        PID:5164
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5720
        
        C:\Windows\SysWOW64\Ghgjlaln.exe
        
        C:\Windows\system32\Ghgjlaln.exe
        67⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Goabhl32.exe
        
        C:\Windows\system32\Goabhl32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        69⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Gcojoj32.exe
        
        C:\Windows\system32\Gcojoj32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:844
        
        C:\Windows\SysWOW64\Gcagdj32.exe
        
        C:\Windows\system32\Gcagdj32.exe
        71⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Ghnpmqef.exe
        
        C:\Windows\system32\Ghnpmqef.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:4108
        
        C:\Windows\SysWOW64\Gdeqaa32.exe
        
        C:\Windows\system32\Gdeqaa32.exe
        73⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        74⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Hcimei32.exe
        
        C:\Windows\system32\Hcimei32.exe
        75⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Hmabnnhg.exe
        
        C:\Windows\system32\Hmabnnhg.exe
        76⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Hfiffd32.exe
        
        C:\Windows\system32\Hfiffd32.exe
        77⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Hoakpi32.exe
        
        C:\Windows\system32\Hoakpi32.exe
        78⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        79⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Hfnpacjb.exe
        
        C:\Windows\system32\Hfnpacjb.exe
        80⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Hmhhnmao.exe
        
        C:\Windows\system32\Hmhhnmao.exe
        81⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Icbpkg32.exe
        
        C:\Windows\system32\Icbpkg32.exe
        82⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Ieeihomg.exe
        
        C:\Windows\system32\Ieeihomg.exe
        83⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Ipkneh32.exe
        
        C:\Windows\system32\Ipkneh32.exe
        84⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Ifgbhbbh.exe
        
        C:\Windows\system32\Ifgbhbbh.exe
        85⤵
        Modifies registry class
        
        PID:3132
        
        C:\Windows\SysWOW64\Ildkpiqo.exe
        
        C:\Windows\system32\Ildkpiqo.exe
        86⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        87⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3100
        
        C:\Windows\SysWOW64\Jcplle32.exe
        
        C:\Windows\system32\Jcplle32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        90⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Jfaenqjm.exe
        
        C:\Windows\system32\Jfaenqjm.exe
        91⤵
        Drops file in System32 directory
        
        PID:3656
        
        C:\Windows\SysWOW64\Jmknkk32.exe
        
        C:\Windows\system32\Jmknkk32.exe
        92⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Jianpl32.exe
        
        C:\Windows\system32\Jianpl32.exe
        93⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Jcgbmd32.exe
        
        C:\Windows\system32\Jcgbmd32.exe
        94⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        95⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        96⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Kfhkop32.exe
        
        C:\Windows\system32\Kfhkop32.exe
        97⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Kmbdkj32.exe
        
        C:\Windows\system32\Kmbdkj32.exe
        98⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Kboldq32.exe
        
        C:\Windows\system32\Kboldq32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3892
        
        C:\Windows\SysWOW64\Klgqmfpj.exe
        
        C:\Windows\system32\Klgqmfpj.exe
        100⤵
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Kfmejopp.exe
        
        C:\Windows\system32\Kfmejopp.exe
        101⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kmfmfigl.exe
        
        C:\Windows\system32\Kmfmfigl.exe
        102⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        103⤵
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        104⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Kdcbic32.exe
        
        C:\Windows\system32\Kdcbic32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Llngmeja.exe
        
        C:\Windows\system32\Llngmeja.exe
        106⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Lefkfk32.exe
        
        C:\Windows\system32\Lefkfk32.exe
        107⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Llpcceho.exe
        
        C:\Windows\system32\Llpcceho.exe
        108⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Lbjlpo32.exe
        
        C:\Windows\system32\Lbjlpo32.exe
        109⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        110⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Lbmheomi.exe
        
        C:\Windows\system32\Lbmheomi.exe
        111⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Lpqioclc.exe
        
        C:\Windows\system32\Lpqioclc.exe
        112⤵
        Modifies registry class
        
        PID:300
        
        C:\Windows\SysWOW64\Lemagjjj.exe
        
        C:\Windows\system32\Lemagjjj.exe
        113⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Llgjcd32.exe
        
        C:\Windows\system32\Llgjcd32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        115⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        116⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Mdanjaqf.exe
        
        C:\Windows\system32\Mdanjaqf.exe
        117⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Mebkbi32.exe
        
        C:\Windows\system32\Mebkbi32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1020
        
        C:\Windows\SysWOW64\Mphoob32.exe
        
        C:\Windows\system32\Mphoob32.exe
        119⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Medggidb.exe
        
        C:\Windows\system32\Medggidb.exe
        120⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Mpjleadh.exe
        
        C:\Windows\system32\Mpjleadh.exe
        121⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Megdmhbp.exe
        
        C:\Windows\system32\Megdmhbp.exe
        122⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Mlqljb32.exe
        
        C:\Windows\system32\Mlqljb32.exe
        123⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Meiabh32.exe
        
        C:\Windows\system32\Meiabh32.exe
        124⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Mlciobhj.exe
        
        C:\Windows\system32\Mlciobhj.exe
        125⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Meknhh32.exe
        
        C:\Windows\system32\Meknhh32.exe
        126⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        127⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Ngkjbkem.exe
        
        C:\Windows\system32\Ngkjbkem.exe
        128⤵
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        129⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Ncakglka.exe
        
        C:\Windows\system32\Ncakglka.exe
        130⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Nngoddkg.exe
        
        C:\Windows\system32\Nngoddkg.exe
        131⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Ncdgmkio.exe
        
        C:\Windows\system32\Ncdgmkio.exe
        132⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        133⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Ngbpbjoe.exe
        
        C:\Windows\system32\Ngbpbjoe.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4628
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        135⤵
        
        PID:976
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        136⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        137⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Ofijifbj.exe
        
        C:\Windows\system32\Ofijifbj.exe
        138⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Windows\SysWOW64\Ogifci32.exe
        
        C:\Windows\system32\Ogifci32.exe
        140⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Oncopcqj.exe
        
        C:\Windows\system32\Oncopcqj.exe
        141⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Ocpghj32.exe
        
        C:\Windows\system32\Ocpghj32.exe
        142⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Windows\SysWOW64\Oqdgan32.exe
        
        C:\Windows\system32\Oqdgan32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Ofqpje32.exe
        
        C:\Windows\system32\Ofqpje32.exe
        145⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Oqfdgn32.exe
        
        C:\Windows\system32\Oqfdgn32.exe
        146⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Pfcmpdjp.exe
        
        C:\Windows\system32\Pfcmpdjp.exe
        147⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Pqhammje.exe
        
        C:\Windows\system32\Pqhammje.exe
        148⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        149⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Pdfjcl32.exe
        
        C:\Windows\system32\Pdfjcl32.exe
        150⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Pfgfkd32.exe
        
        C:\Windows\system32\Pfgfkd32.exe
        151⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Pckfdh32.exe
        
        C:\Windows\system32\Pckfdh32.exe
        152⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Pnakaa32.exe
        
        C:\Windows\system32\Pnakaa32.exe
        153⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        154⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Pgiojf32.exe
        
        C:\Windows\system32\Pgiojf32.exe
        155⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Pncggqbg.exe
        
        C:\Windows\system32\Pncggqbg.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Windows\SysWOW64\Qcppogqo.exe
        
        C:\Windows\system32\Qcppogqo.exe
        157⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Qmhdhm32.exe
        
        C:\Windows\system32\Qmhdhm32.exe
        158⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Qcbmegol.exe
        
        C:\Windows\system32\Qcbmegol.exe
        159⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Qjmeaafi.exe
        
        C:\Windows\system32\Qjmeaafi.exe
        160⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Adbiojfo.exe
        
        C:\Windows\system32\Adbiojfo.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Afcffb32.exe
        
        C:\Windows\system32\Afcffb32.exe
        162⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Aedfdjdl.exe
        
        C:\Windows\system32\Aedfdjdl.exe
        163⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ajanmqbc.exe
        
        C:\Windows\system32\Ajanmqbc.exe
        164⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Aqkgikip.exe
        
        C:\Windows\system32\Aqkgikip.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Ageofe32.exe
        
        C:\Windows\system32\Ageofe32.exe
        166⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ambgnl32.exe
        
        C:\Windows\system32\Ambgnl32.exe
        167⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Afjlgafe.exe
        
        C:\Windows\system32\Afjlgafe.exe
        168⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Amdddkma.exe
        
        C:\Windows\system32\Amdddkma.exe
        169⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Acnlqe32.exe
        
        C:\Windows\system32\Acnlqe32.exe
        170⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ajhdmplk.exe
        
        C:\Windows\system32\Ajhdmplk.exe
        171⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Babmjj32.exe
        
        C:\Windows\system32\Babmjj32.exe
        172⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Bjkacoji.exe
        
        C:\Windows\system32\Bjkacoji.exe
        173⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Badipiae.exe
        
        C:\Windows\system32\Badipiae.exe
        174⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Bfabhppm.exe
        
        C:\Windows\system32\Bfabhppm.exe
        175⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Bagfeioc.exe
        
        C:\Windows\system32\Bagfeioc.exe
        176⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Bfcompnj.exe
        
        C:\Windows\system32\Bfcompnj.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Baickimp.exe
        
        C:\Windows\system32\Baickimp.exe
        178⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Bjagcndq.exe
        
        C:\Windows\system32\Bjagcndq.exe
        179⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Beglqgcf.exe
        
        C:\Windows\system32\Beglqgcf.exe
        180⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Bfhhho32.exe
        
        C:\Windows\system32\Bfhhho32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Canlfh32.exe
        
        C:\Windows\system32\Canlfh32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        183⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Cmdmki32.exe
        
        C:\Windows\system32\Cmdmki32.exe
        184⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Cdoegcfl.exe
        
        C:\Windows\system32\Cdoegcfl.exe
        185⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Cndidlfb.exe
        
        C:\Windows\system32\Cndidlfb.exe
        186⤵
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Cdabmcdi.exe
        
        C:\Windows\system32\Cdabmcdi.exe
        187⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Cjkjjmlf.exe
        
        C:\Windows\system32\Cjkjjmlf.exe
        188⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ceqngekl.exe
        
        C:\Windows\system32\Ceqngekl.exe
        189⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Cjmgomjc.exe
        
        C:\Windows\system32\Cjmgomjc.exe
        190⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Cagolf32.exe
        
        C:\Windows\system32\Cagolf32.exe
        191⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Cfdhdn32.exe
        
        C:\Windows\system32\Cfdhdn32.exe
        192⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Dajlafon.exe
        
        C:\Windows\system32\Dajlafon.exe
        193⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Dffdjmme.exe
        
        C:\Windows\system32\Dffdjmme.exe
        194⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Dalhgfmk.exe
        
        C:\Windows\system32\Dalhgfmk.exe
        195⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Dfiaomkb.exe
        
        C:\Windows\system32\Dfiaomkb.exe
        196⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Dejamdca.exe
        
        C:\Windows\system32\Dejamdca.exe
        197⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dfknem32.exe
        
        C:\Windows\system32\Dfknem32.exe
        198⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Dobffj32.exe
        
        C:\Windows\system32\Dobffj32.exe
        199⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ddonnq32.exe
        
        C:\Windows\system32\Ddonnq32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6212
        
        C:\Windows\SysWOW64\Dmgbgf32.exe
        
        C:\Windows\system32\Dmgbgf32.exe
        201⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Dgpgplej.exe
        
        C:\Windows\system32\Dgpgplej.exe
        202⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Eddhipdd.exe
        
        C:\Windows\system32\Eddhipdd.exe
        203⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Emllbe32.exe
        
        C:\Windows\system32\Emllbe32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Edfdop32.exe
        
        C:\Windows\system32\Edfdop32.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Windows\SysWOW64\Emniheha.exe
        
        C:\Windows\system32\Emniheha.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Windows\SysWOW64\Ehdmenhh.exe
        
        C:\Windows\system32\Ehdmenhh.exe
        207⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Eoneah32.exe
        
        C:\Windows\system32\Eoneah32.exe
        208⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Eehnnb32.exe
        
        C:\Windows\system32\Eehnnb32.exe
        209⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ekefgi32.exe
        
        C:\Windows\system32\Ekefgi32.exe
        210⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Eaonccme.exe
        
        C:\Windows\system32\Eaonccme.exe
        211⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Egkgljkm.exe
        
        C:\Windows\system32\Egkgljkm.exe
        212⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Faakickc.exe
        
        C:\Windows\system32\Faakickc.exe
        213⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Fgncaj32.exe
        
        C:\Windows\system32\Fgncaj32.exe
        214⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Fachob32.exe
        
        C:\Windows\system32\Fachob32.exe
        215⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Fgppgi32.exe
        
        C:\Windows\system32\Fgppgi32.exe
        216⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Feapdaof.exe
        
        C:\Windows\system32\Feapdaof.exe
        217⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Fknimh32.exe
        
        C:\Windows\system32\Fknimh32.exe
        218⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Fecmjq32.exe
        
        C:\Windows\system32\Fecmjq32.exe
        219⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Fgeibicb.exe
        
        C:\Windows\system32\Fgeibicb.exe
        220⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Fnoboc32.exe
        
        C:\Windows\system32\Fnoboc32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Fggfghap.exe
        
        C:\Windows\system32\Fggfghap.exe
        222⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Gnaodbhl.exe
        
        C:\Windows\system32\Gnaodbhl.exe
        223⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ghgbakhb.exe
        
        C:\Windows\system32\Ghgbakhb.exe
        224⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Goqkne32.exe
        
        C:\Windows\system32\Goqkne32.exe
        225⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Gdncfl32.exe
        
        C:\Windows\system32\Gdncfl32.exe
        226⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Gkglcfec.exe
        
        C:\Windows\system32\Gkglcfec.exe
        227⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Gdppllld.exe
        
        C:\Windows\system32\Gdppllld.exe
        228⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Goediekj.exe
        
        C:\Windows\system32\Goediekj.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8060
        
        C:\Windows\SysWOW64\Gdbmalja.exe
        
        C:\Windows\system32\Gdbmalja.exe
        230⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Gohaod32.exe
        
        C:\Windows\system32\Gohaod32.exe
        231⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Hkobdeok.exe
        
        C:\Windows\system32\Hkobdeok.exe
        232⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7220
        
        C:\Windows\SysWOW64\Hdgfmk32.exe
        
        C:\Windows\system32\Hdgfmk32.exe
        233⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Hffbfn32.exe
        
        C:\Windows\system32\Hffbfn32.exe
        234⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Hoogpcco.exe
        
        C:\Windows\system32\Hoogpcco.exe
        235⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Hdlphjaf.exe
        
        C:\Windows\system32\Hdlphjaf.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Hgjldfqj.exe
        
        C:\Windows\system32\Hgjldfqj.exe
        237⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Hnddqp32.exe
        
        C:\Windows\system32\Hnddqp32.exe
        238⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Hhihnihm.exe
        
        C:\Windows\system32\Hhihnihm.exe
        239⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Hocqkc32.exe
        
        C:\Windows\system32\Hocqkc32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Hfmigmgf.exe
        
        C:\Windows\system32\Hfmigmgf.exe
        241⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ikjapden.exe
        
        C:\Windows\system32\Ikjapden.exe
        242⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Ibdiln32.exe
        
        C:\Windows\system32\Ibdiln32.exe
        243⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Ikmnec32.exe
        
        C:\Windows\system32\Ikmnec32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Ibffbnjh.exe
        
        C:\Windows\system32\Ibffbnjh.exe
        245⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Igcojdhp.exe
        
        C:\Windows\system32\Igcojdhp.exe
        246⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Inmggo32.exe
        
        C:\Windows\system32\Inmggo32.exe
        247⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Iickdgpb.exe
        
        C:\Windows\system32\Iickdgpb.exe
        248⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Ibkpmm32.exe
        
        C:\Windows\system32\Ibkpmm32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        250⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ioopfa32.exe
        
        C:\Windows\system32\Ioopfa32.exe
        251⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ibnlbm32.exe
        
        C:\Windows\system32\Ibnlbm32.exe
        252⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Jkfakb32.exe
        
        C:\Windows\system32\Jkfakb32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Jenedhaa.exe
        
        C:\Windows\system32\Jenedhaa.exe
        254⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        255⤵
        Drops file in System32 directory
        
        PID:8048
        
        C:\Windows\SysWOW64\Jfnbnk32.exe
        
        C:\Windows\system32\Jfnbnk32.exe
        256⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Jgonfcnb.exe
        
        C:\Windows\system32\Jgonfcnb.exe
        257⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Jnifbmfo.exe
        
        C:\Windows\system32\Jnifbmfo.exe
        258⤵
        Modifies registry class
        
        PID:7640
        
        C:\Windows\SysWOW64\Jecoog32.exe
        
        C:\Windows\system32\Jecoog32.exe
        259⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Jnkchmdl.exe
        
        C:\Windows\system32\Jnkchmdl.exe
        260⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Jeekeg32.exe
        
        C:\Windows\system32\Jeekeg32.exe
        261⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Jlocaabf.exe
        
        C:\Windows\system32\Jlocaabf.exe
        262⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Jnnpnl32.exe
        
        C:\Windows\system32\Jnnpnl32.exe
        263⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Kicdke32.exe
        
        C:\Windows\system32\Kicdke32.exe
        264⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Kfgddi32.exe
        
        C:\Windows\system32\Kfgddi32.exe
        265⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Kldmmp32.exe
        
        C:\Windows\system32\Kldmmp32.exe
        266⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Kfiajinf.exe
        
        C:\Windows\system32\Kfiajinf.exe
        267⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Khknaa32.exe
        
        C:\Windows\system32\Khknaa32.exe
        268⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Kbpboj32.exe
        
        C:\Windows\system32\Kbpboj32.exe
        269⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Kijjldkh.exe
        
        C:\Windows\system32\Kijjldkh.exe
        270⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Kngcdkjo.exe
        
        C:\Windows\system32\Kngcdkjo.exe
        271⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Khpgmqpp.exe
        
        C:\Windows\system32\Khpgmqpp.exe
        272⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Lfqgjh32.exe
        
        C:\Windows\system32\Lfqgjh32.exe
        273⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Lnlloj32.exe
        
        C:\Windows\system32\Lnlloj32.exe
        274⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Lefdld32.exe
        
        C:\Windows\system32\Lefdld32.exe
        275⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Lpkiim32.exe
        
        C:\Windows\system32\Lpkiim32.exe
        276⤵
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Lfeaegdi.exe
        
        C:\Windows\system32\Lfeaegdi.exe
        277⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Lblakh32.exe
        
        C:\Windows\system32\Lblakh32.exe
        279⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Lejngd32.exe
        
        C:\Windows\system32\Lejngd32.exe
        280⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Lppbdmig.exe
        
        C:\Windows\system32\Lppbdmig.exe
        281⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Lfjjqg32.exe
        
        C:\Windows\system32\Lfjjqg32.exe
        282⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Lhkghofb.exe
        
        C:\Windows\system32\Lhkghofb.exe
        283⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Loeoei32.exe
        
        C:\Windows\system32\Loeoei32.exe
        284⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Meogbcel.exe
        
        C:\Windows\system32\Meogbcel.exe
        285⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Mlipomli.exe
        
        C:\Windows\system32\Mlipomli.exe
        286⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Mbchkg32.exe
        
        C:\Windows\system32\Mbchkg32.exe
        287⤵
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Mhppcn32.exe
        
        C:\Windows\system32\Mhppcn32.exe
        288⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        289⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Mlnijmhc.exe
        
        C:\Windows\system32\Mlnijmhc.exe
        290⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Mfcmge32.exe
        
        C:\Windows\system32\Mfcmge32.exe
        291⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Mhdjonng.exe
        
        C:\Windows\system32\Mhdjonng.exe
        292⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Mbjnlfnn.exe
        
        C:\Windows\system32\Mbjnlfnn.exe
        293⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        294⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Nbljaf32.exe
        
        C:\Windows\system32\Nbljaf32.exe
        295⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Nekgna32.exe
        
        C:\Windows\system32\Nekgna32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9208
        
        C:\Windows\SysWOW64\Nockfgao.exe
        
        C:\Windows\system32\Nockfgao.exe
        297⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Nlglpkpi.exe
        
        C:\Windows\system32\Nlglpkpi.exe
        298⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        299⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Nlihek32.exe
        
        C:\Windows\system32\Nlihek32.exe
        300⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Nccqbeec.exe
        
        C:\Windows\system32\Nccqbeec.exe
        301⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Nimioo32.exe
        
        C:\Windows\system32\Nimioo32.exe
        302⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Npgalidl.exe
        
        C:\Windows\system32\Npgalidl.exe
        303⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Nedjdp32.exe
        
        C:\Windows\system32\Nedjdp32.exe
        304⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Nlnbqjjq.exe
        
        C:\Windows\system32\Nlnbqjjq.exe
        305⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Ochjmd32.exe
        
        C:\Windows\system32\Ochjmd32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8876
        
        C:\Windows\SysWOW64\Oibbjoij.exe
        
        C:\Windows\system32\Oibbjoij.exe
        307⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Oplkgi32.exe
        
        C:\Windows\system32\Oplkgi32.exe
        308⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ogfccchd.exe
        
        C:\Windows\system32\Ogfccchd.exe
        309⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Ooaghe32.exe
        
        C:\Windows\system32\Ooaghe32.exe
        310⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Oiglen32.exe
        
        C:\Windows\system32\Oiglen32.exe
        311⤵
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Olehai32.exe
        
        C:\Windows\system32\Olehai32.exe
        312⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Olgdgibf.exe
        
        C:\Windows\system32\Olgdgibf.exe
        313⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Ocamcc32.exe
        
        C:\Windows\system32\Ocamcc32.exe
        314⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ohnelj32.exe
        
        C:\Windows\system32\Ohnelj32.exe
        315⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Pcdjic32.exe
        
        C:\Windows\system32\Pcdjic32.exe
        316⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Phqbaj32.exe
        
        C:\Windows\system32\Phqbaj32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8996
        
        C:\Windows\SysWOW64\Pcffoben.exe
        
        C:\Windows\system32\Pcffoben.exe
        318⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Pjpokm32.exe
        
        C:\Windows\system32\Pjpokm32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Ppjghgdg.exe
        
        C:\Windows\system32\Ppjghgdg.exe
        320⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Pchcdbck.exe
        
        C:\Windows\system32\Pchcdbck.exe
        321⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Phekliab.exe
        
        C:\Windows\system32\Phekliab.exe
        322⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Pckpja32.exe
        
        C:\Windows\system32\Pckpja32.exe
        323⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Pjehflie.exe
        
        C:\Windows\system32\Pjehflie.exe
        324⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        325⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        326⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Qleahgff.exe
        
        C:\Windows\system32\Qleahgff.exe
        327⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Qfneamlf.exe
        
        C:\Windows\system32\Qfneamlf.exe
        328⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Qqcjnell.exe
        
        C:\Windows\system32\Qqcjnell.exe
        329⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Ahonbhig.exe
        
        C:\Windows\system32\Ahonbhig.exe
        330⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Acdbpq32.exe
        
        C:\Windows\system32\Acdbpq32.exe
        331⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        332⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Aqhcid32.exe
        
        C:\Windows\system32\Aqhcid32.exe
        333⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Afelal32.exe
        
        C:\Windows\system32\Afelal32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9464
        
        C:\Windows\SysWOW64\Acilkp32.exe
        
        C:\Windows\system32\Acilkp32.exe
        335⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Amaqde32.exe
        
        C:\Windows\system32\Amaqde32.exe
        336⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Aihaifam.exe
        
        C:\Windows\system32\Aihaifam.exe
        337⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Aobieq32.exe
        
        C:\Windows\system32\Aobieq32.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:9592
        
        C:\Windows\SysWOW64\Aflabj32.exe
        
        C:\Windows\system32\Aflabj32.exe
        339⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Bodfkpfg.exe
        
        C:\Windows\system32\Bodfkpfg.exe
        340⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Bgknlmgi.exe
        
        C:\Windows\system32\Bgknlmgi.exe
        341⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Bimkde32.exe
        
        C:\Windows\system32\Bimkde32.exe
        342⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Bogcqpdd.exe
        
        C:\Windows\system32\Bogcqpdd.exe
        343⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Bfqkmj32.exe
        
        C:\Windows\system32\Bfqkmj32.exe
        344⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Bmkcjd32.exe
        
        C:\Windows\system32\Bmkcjd32.exe
        345⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        346⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        347⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Biadoeib.exe
        
        C:\Windows\system32\Biadoeib.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9964
        
        C:\Windows\SysWOW64\Bpkllo32.exe
        
        C:\Windows\system32\Bpkllo32.exe
        349⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Bfedhihl.exe
        
        C:\Windows\system32\Bfedhihl.exe
        350⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Bqkifb32.exe
        
        C:\Windows\system32\Bqkifb32.exe
        351⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
        
        C:\Windows\SysWOW64\Bgeabloo.exe
        
        C:\Windows\system32\Bgeabloo.exe
        352⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Cppfgnlj.exe
        
        C:\Windows\system32\Cppfgnlj.exe
        353⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Cfjnch32.exe
        
        C:\Windows\system32\Cfjnch32.exe
        354⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Capbaacl.exe
        
        C:\Windows\system32\Capbaacl.exe
        355⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Cjhfjg32.exe
        
        C:\Windows\system32\Cjhfjg32.exe
        356⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Cabofaaj.exe
        
        C:\Windows\system32\Cabofaaj.exe
        357⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Cglgck32.exe
        
        C:\Windows\system32\Cglgck32.exe
        358⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cimckcoe.exe
        
        C:\Windows\system32\Cimckcoe.exe
        359⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Cpglgmfa.exe
        
        C:\Windows\system32\Cpglgmfa.exe
        360⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Cjmpeffh.exe
        
        C:\Windows\system32\Cjmpeffh.exe
        361⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Cafhap32.exe
        
        C:\Windows\system32\Cafhap32.exe
        362⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        363⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
        
        C:\Windows\SysWOW64\Daiegp32.exe
        
        C:\Windows\system32\Daiegp32.exe
        364⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Dcgackke.exe
        
        C:\Windows\system32\Dcgackke.exe
        365⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Djaipe32.exe
        
        C:\Windows\system32\Djaipe32.exe
        366⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Dpnbhl32.exe
        
        C:\Windows\system32\Dpnbhl32.exe
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:9876
        
        C:\Windows\SysWOW64\Dfhjefhf.exe
        
        C:\Windows\system32\Dfhjefhf.exe
        368⤵
        Modifies registry class
        
        PID:9956
        
        C:\Windows\SysWOW64\Diffabgj.exe
        
        C:\Windows\system32\Diffabgj.exe
        369⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Dclknkfp.exe
        
        C:\Windows\system32\Dclknkfp.exe
        370⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Dmdogpmq.exe
        
        C:\Windows\system32\Dmdogpmq.exe
        371⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Dhjcdimf.exe
        
        C:\Windows\system32\Dhjcdimf.exe
        372⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Dikpla32.exe
        
        C:\Windows\system32\Dikpla32.exe
        373⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Dpehikja.exe
        
        C:\Windows\system32\Dpehikja.exe
        374⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ejklfd32.exe
        
        C:\Windows\system32\Ejklfd32.exe
        375⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Eaddcnad.exe
        
        C:\Windows\system32\Eaddcnad.exe
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
        
        C:\Windows\SysWOW64\Efamkepl.exe
        
        C:\Windows\system32\Efamkepl.exe
        377⤵
        Drops file in System32 directory
        
        PID:9808
        
        C:\Windows\SysWOW64\Eagahnob.exe
        
        C:\Windows\system32\Eagahnob.exe
        378⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ejofacfb.exe
        
        C:\Windows\system32\Ejofacfb.exe
        379⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Eainnn32.exe
        
        C:\Windows\system32\Eainnn32.exe
        380⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Edhjji32.exe
        
        C:\Windows\system32\Edhjji32.exe
        381⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Ejabgcdp.exe
        
        C:\Windows\system32\Ejabgcdp.exe
        382⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Ealkcm32.exe
        
        C:\Windows\system32\Ealkcm32.exe
        383⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ehecpgbi.exe
        
        C:\Windows\system32\Ehecpgbi.exe
        384⤵
        System Location Discovery: System Language Discovery
        
        PID:10024
        
        C:\Windows\SysWOW64\Ekdolcbm.exe
        
        C:\Windows\system32\Ekdolcbm.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\Eangimij.exe
        
        C:\Windows\system32\Eangimij.exe
        386⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Fdlcehhn.exe
        
        C:\Windows\system32\Fdlcehhn.exe
        387⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Fiilmofe.exe
        
        C:\Windows\system32\Fiilmofe.exe
        388⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Fpcdji32.exe
        
        C:\Windows\system32\Fpcdji32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3256
        
        C:\Windows\SysWOW64\Ffmmgceo.exe
        
        C:\Windows\system32\Ffmmgceo.exe
        390⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Fpeapilo.exe
        
        C:\Windows\system32\Fpeapilo.exe
        391⤵
        Drops file in System32 directory
        
        PID:10304
        
        C:\Windows\SysWOW64\Fgpilc32.exe
        
        C:\Windows\system32\Fgpilc32.exe
        392⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Fphneijl.exe
        
        C:\Windows\system32\Fphneijl.exe
        393⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Fgbfbc32.exe
        
        C:\Windows\system32\Fgbfbc32.exe
        394⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Fmlnomif.exe
        
        C:\Windows\system32\Fmlnomif.exe
        395⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Fdffkgpc.exe
        
        C:\Windows\system32\Fdffkgpc.exe
        396⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Fibocnnj.exe
        
        C:\Windows\system32\Fibocnnj.exe
        397⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Gdhcagnp.exe
        
        C:\Windows\system32\Gdhcagnp.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10528
        
        C:\Windows\SysWOW64\Gielinlg.exe
        
        C:\Windows\system32\Gielinlg.exe
        399⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Ghflgedf.exe
        
        C:\Windows\system32\Ghflgedf.exe
        400⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Gmcdolbn.exe
        
        C:\Windows\system32\Gmcdolbn.exe
        401⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Ghhhmebd.exe
        
        C:\Windows\system32\Ghhhmebd.exe
        402⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Gkgeipah.exe
        
        C:\Windows\system32\Gkgeipah.exe
        403⤵
        Modifies registry class
        
        PID:10696
        
        C:\Windows\SysWOW64\Ghkebd32.exe
        
        C:\Windows\system32\Ghkebd32.exe
        404⤵
        Drops file in System32 directory
        
        PID:10728
        
        C:\Windows\SysWOW64\Gngnjk32.exe
        
        C:\Windows\system32\Gngnjk32.exe
        405⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Gpfjfg32.exe
        
        C:\Windows\system32\Gpfjfg32.exe
        406⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ggpbcaei.exe
        
        C:\Windows\system32\Ggpbcaei.exe
        407⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Hphglf32.exe
        
        C:\Windows\system32\Hphglf32.exe
        408⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Hhoomd32.exe
        
        C:\Windows\system32\Hhoomd32.exe
        409⤵
        Modifies registry class
        
        PID:10888
        
        C:\Windows\SysWOW64\Hpkcafjg.exe
        
        C:\Windows\system32\Hpkcafjg.exe
        410⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Hgdlnp32.exe
        
        C:\Windows\system32\Hgdlnp32.exe
        411⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Hajpli32.exe
        
        C:\Windows\system32\Hajpli32.exe
        412⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Hhdhhchf.exe
        
        C:\Windows\system32\Hhdhhchf.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11016
        
        C:\Windows\SysWOW64\Hjedpkne.exe
        
        C:\Windows\system32\Hjedpkne.exe
        414⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Hdkimdnk.exe
        
        C:\Windows\system32\Hdkimdnk.exe
        415⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Hjhaeklb.exe
        
        C:\Windows\system32\Hjhaeklb.exe
        416⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11120
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        417⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        418⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Iaaflh32.exe
        
        C:\Windows\system32\Iaaflh32.exe
        419⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Ignndo32.exe
        
        C:\Windows\system32\Ignndo32.exe
        420⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Inhgaipf.exe
        
        C:\Windows\system32\Inhgaipf.exe
        421⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10356
        
        C:\Windows\SysWOW64\Iklgkmop.exe
        
        C:\Windows\system32\Iklgkmop.exe
        423⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Iqipcd32.exe
        
        C:\Windows\system32\Iqipcd32.exe
        424⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Igbhpned.exe
        
        C:\Windows\system32\Igbhpned.exe
        425⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        426⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Ihbdja32.exe
        
        C:\Windows\system32\Ihbdja32.exe
        427⤵
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        428⤵
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        429⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Ihdaoajd.exe
        
        C:\Windows\system32\Ihdaoajd.exe
        430⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Jjfngi32.exe
        
        C:\Windows\system32\Jjfngi32.exe
        431⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Jdkadb32.exe
        
        C:\Windows\system32\Jdkadb32.exe
        432⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        433⤵
        Modifies registry class
        
        PID:11056
        
        C:\Windows\SysWOW64\Jncfmgfi.exe
        
        C:\Windows\system32\Jncfmgfi.exe
        434⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Jdnnjane.exe
        
        C:\Windows\system32\Jdnnjane.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11192
        
        C:\Windows\SysWOW64\Jkggfl32.exe
        
        C:\Windows\system32\Jkggfl32.exe
        436⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Jbaocfmo.exe
        
        C:\Windows\system32\Jbaocfmo.exe
        437⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Jhlgpp32.exe
        
        C:\Windows\system32\Jhlgpp32.exe
        438⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Jnhphg32.exe
        
        C:\Windows\system32\Jnhphg32.exe
        439⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Jdbheajp.exe
        
        C:\Windows\system32\Jdbheajp.exe
        440⤵
        System Location Discovery: System Language Discovery
        
        PID:10748
        
        C:\Windows\SysWOW64\Jklpakam.exe
        
        C:\Windows\system32\Jklpakam.exe
        441⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Jbfhne32.exe
        
        C:\Windows\system32\Jbfhne32.exe
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:11004
        
        C:\Windows\SysWOW64\Jgcafl32.exe
        
        C:\Windows\system32\Jgcafl32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11136
        
        C:\Windows\SysWOW64\Knmicfnn.exe
        
        C:\Windows\system32\Knmicfnn.exe
        444⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10268
        
        C:\Windows\SysWOW64\Kdgapp32.exe
        
        C:\Windows\system32\Kdgapp32.exe
        445⤵
        System Location Discovery: System Language Discovery
        
        PID:10524
        
        C:\Windows\SysWOW64\Kkaimj32.exe
        
        C:\Windows\system32\Kkaimj32.exe
        446⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Kbkaiddd.exe
        
        C:\Windows\system32\Kbkaiddd.exe
        447⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Kkcfbj32.exe
        
        C:\Windows\system32\Kkcfbj32.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4564
        
        C:\Windows\SysWOW64\Knabne32.exe
        
        C:\Windows\system32\Knabne32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10848
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        450⤵
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Kbpkdd32.exe
        
        C:\Windows\system32\Kbpkdd32.exe
        451⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Kkhpmigp.exe
        
        C:\Windows\system32\Kkhpmigp.exe
        452⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Knfliefc.exe
        
        C:\Windows\system32\Knfliefc.exe
        453⤵
        Drops file in System32 directory
        
        PID:10972
        
        C:\Windows\SysWOW64\Kilpgnfi.exe
        
        C:\Windows\system32\Kilpgnfi.exe
        454⤵
        Modifies registry class
        
        PID:10328
        
        C:\Windows\SysWOW64\Ljmmnf32.exe
        
        C:\Windows\system32\Ljmmnf32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11292
        
        C:\Windows\SysWOW64\Lagekp32.exe
        
        C:\Windows\system32\Lagekp32.exe
        456⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Lkmihi32.exe
        
        C:\Windows\system32\Lkmihi32.exe
        457⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Lnkedd32.exe
        
        C:\Windows\system32\Lnkedd32.exe
        458⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Liqibm32.exe
        
        C:\Windows\system32\Liqibm32.exe
        459⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Llofnh32.exe
        
        C:\Windows\system32\Llofnh32.exe
        460⤵
        System Location Discovery: System Language Discovery
        
        PID:11472
        
        C:\Windows\SysWOW64\Lalnfooo.exe
        
        C:\Windows\system32\Lalnfooo.exe
        461⤵
        Drops file in System32 directory
        
        PID:11504
        
        C:\Windows\SysWOW64\Lgffci32.exe
        
        C:\Windows\system32\Lgffci32.exe
        462⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Lnpopcni.exe
        
        C:\Windows\system32\Lnpopcni.exe
        463⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Liecmlno.exe
        
        C:\Windows\system32\Liecmlno.exe
        464⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Ljfodd32.exe
        
        C:\Windows\system32\Ljfodd32.exe
        465⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Lelcbmcc.exe
        
        C:\Windows\system32\Lelcbmcc.exe
        466⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Mhjpnibf.exe
        
        C:\Windows\system32\Mhjpnibf.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11720
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        468⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Mhmmchpd.exe
        
        C:\Windows\system32\Mhmmchpd.exe
        469⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Mngepb32.exe
        
        C:\Windows\system32\Mngepb32.exe
        470⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Meqmmm32.exe
        
        C:\Windows\system32\Meqmmm32.exe
        471⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Mjneec32.exe
        
        C:\Windows\system32\Mjneec32.exe
        472⤵
        Modifies registry class
        
        PID:11900
        
        C:\Windows\SysWOW64\Magnbnea.exe
        
        C:\Windows\system32\Magnbnea.exe
        473⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Mlmbofdh.exe
        
        C:\Windows\system32\Mlmbofdh.exe
        474⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Majjgmco.exe
        
        C:\Windows\system32\Majjgmco.exe
        475⤵
        Modifies registry class
        
        PID:11996
        
        C:\Windows\SysWOW64\Mlooef32.exe
        
        C:\Windows\system32\Mlooef32.exe
        476⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Mbigapjb.exe
        
        C:\Windows\system32\Mbigapjb.exe
        477⤵
        Modifies registry class
        
        PID:12060
        
        C:\Windows\SysWOW64\Mehcnlie.exe
        
        C:\Windows\system32\Mehcnlie.exe
        478⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Nblcgpho.exe
        
        C:\Windows\system32\Nblcgpho.exe
        479⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        480⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Nobdlqnc.exe
        
        C:\Windows\system32\Nobdlqnc.exe
        481⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Nihiiimi.exe
        
        C:\Windows\system32\Nihiiimi.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4132
        
        C:\Windows\SysWOW64\Nlfeeelm.exe
        
        C:\Windows\system32\Nlfeeelm.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11312
        
        C:\Windows\SysWOW64\Nbqmbo32.exe
        
        C:\Windows\system32\Nbqmbo32.exe
        484⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Nijeoikf.exe
        
        C:\Windows\system32\Nijeoikf.exe
        485⤵
        Drops file in System32 directory
        
        PID:11424
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        486⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Naejcl32.exe
        
        C:\Windows\system32\Naejcl32.exe
        487⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Noijmp32.exe
        
        C:\Windows\system32\Noijmp32.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11588
        
        C:\Windows\SysWOW64\Olnkfd32.exe
        
        C:\Windows\system32\Olnkfd32.exe
        489⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        490⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Ohdlke32.exe
        
        C:\Windows\system32\Ohdlke32.exe
        491⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Oondhocf.exe
        
        C:\Windows\system32\Oondhocf.exe
        492⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        493⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Okedmp32.exe
        
        C:\Windows\system32\Okedmp32.exe
        494⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Oejijiip.exe
        
        C:\Windows\system32\Oejijiip.exe
        495⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Oldagc32.exe
        
        C:\Windows\system32\Oldagc32.exe
        496⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        497⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Ooejhn32.exe
        
        C:\Windows\system32\Ooejhn32.exe
        498⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Piknfgmd.exe
        
        C:\Windows\system32\Piknfgmd.exe
        499⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Pklkmo32.exe
        
        C:\Windows\system32\Pklkmo32.exe
        500⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Pimkkfka.exe
        
        C:\Windows\system32\Pimkkfka.exe
        501⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Pkngco32.exe
        
        C:\Windows\system32\Pkngco32.exe
        502⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Pedlpgqe.exe
        
        C:\Windows\system32\Pedlpgqe.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11624
        
        C:\Windows\SysWOW64\Polpim32.exe
        
        C:\Windows\system32\Polpim32.exe
        504⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Pefhfgoc.exe
        
        C:\Windows\system32\Pefhfgoc.exe
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:11792
        
        C:\Windows\SysWOW64\Pkcannmj.exe
        
        C:\Windows\system32\Pkcannmj.exe
        506⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Pamikh32.exe
        
        C:\Windows\system32\Pamikh32.exe
        507⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Pidaleei.exe
        
        C:\Windows\system32\Pidaleei.exe
        508⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Pkencn32.exe
        
        C:\Windows\system32\Pkencn32.exe
        509⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Qaofphbd.exe
        
        C:\Windows\system32\Qaofphbd.exe
        510⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        511⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Qkhjim32.exe
        
        C:\Windows\system32\Qkhjim32.exe
        512⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Qaabfgpa.exe
        
        C:\Windows\system32\Qaabfgpa.exe
        513⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Qhlkbaho.exe
        
        C:\Windows\system32\Qhlkbaho.exe
        514⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Aadokg32.exe
        
        C:\Windows\system32\Aadokg32.exe
        515⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4728
        
        C:\Windows\SysWOW64\Ahnghafl.exe
        
        C:\Windows\system32\Ahnghafl.exe
        516⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Aohpek32.exe
        
        C:\Windows\system32\Aohpek32.exe
        517⤵
        System Location Discovery: System Language Discovery
        
        PID:12120
        
        C:\Windows\SysWOW64\Aojljkkf.exe
        
        C:\Windows\system32\Aojljkkf.exe
        518⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Windows\SysWOW64\Afddge32.exe
        
        C:\Windows\system32\Afddge32.exe
        519⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Alnmdojp.exe
        
        C:\Windows\system32\Alnmdojp.exe
        520⤵
        Modifies registry class
        
        PID:3384
        
        C:\Windows\SysWOW64\Acheqi32.exe
        
        C:\Windows\system32\Acheqi32.exe
        521⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Ahenip32.exe
        
        C:\Windows\system32\Ahenip32.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11812
        
        C:\Windows\SysWOW64\Aoofej32.exe
        
        C:\Windows\system32\Aoofej32.exe
        523⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ajdjcc32.exe
        
        C:\Windows\system32\Ajdjcc32.exe
        524⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Boabkj32.exe
        
        C:\Windows\system32\Boabkj32.exe
        525⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Bhjgdplo.exe
        
        C:\Windows\system32\Bhjgdplo.exe
        526⤵
        Drops file in System32 directory
        
        PID:12164
        
        C:\Windows\SysWOW64\Bcokah32.exe
        
        C:\Windows\system32\Bcokah32.exe
        527⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Bjicnbba.exe
        
        C:\Windows\system32\Bjicnbba.exe
        528⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Bkjpek32.exe
        
        C:\Windows\system32\Bkjpek32.exe
        529⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bfpdcc32.exe
        
        C:\Windows\system32\Bfpdcc32.exe
        530⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Bmjlpnpb.exe
        
        C:\Windows\system32\Bmjlpnpb.exe
        531⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Bcddlhgo.exe
        
        C:\Windows\system32\Bcddlhgo.exe
        532⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Bjnmib32.exe
        
        C:\Windows\system32\Bjnmib32.exe
        533⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Bcfabgel.exe
        
        C:\Windows\system32\Bcfabgel.exe
        534⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Bjpjoa32.exe
        
        C:\Windows\system32\Bjpjoa32.exe
        535⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Combgh32.exe
        
        C:\Windows\system32\Combgh32.exe
        536⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Cjbfdakf.exe
        
        C:\Windows\system32\Cjbfdakf.exe
        537⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Ckdcli32.exe
        
        C:\Windows\system32\Ckdcli32.exe
        538⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Cfigib32.exe
        
        C:\Windows\system32\Cfigib32.exe
        539⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Ckfpai32.exe
        
        C:\Windows\system32\Ckfpai32.exe
        540⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Cfldob32.exe
        
        C:\Windows\system32\Cfldob32.exe
        541⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Cmflkl32.exe
        
        C:\Windows\system32\Cmflkl32.exe
        542⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        543⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Ckkilhjm.exe
        
        C:\Windows\system32\Ckkilhjm.exe
        544⤵
        System Location Discovery: System Language Discovery
        
        PID:12140
        
        C:\Windows\SysWOW64\Cfqmjajc.exe
        
        C:\Windows\system32\Cfqmjajc.exe
        545⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Dmjefkap.exe
        
        C:\Windows\system32\Dmjefkap.exe
        546⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Dcdnce32.exe
        
        C:\Windows\system32\Dcdnce32.exe
        547⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Djnfppqi.exe
        
        C:\Windows\system32\Djnfppqi.exe
        548⤵
        Drops file in System32 directory
        
        PID:12352
        
        C:\Windows\SysWOW64\Dpknhfoq.exe
        
        C:\Windows\system32\Dpknhfoq.exe
        549⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Dfefeq32.exe
        
        C:\Windows\system32\Dfefeq32.exe
        550⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        551⤵
        Modifies registry class
        
        PID:12460
        
        C:\Windows\SysWOW64\Dfgcjpdk.exe
        
        C:\Windows\system32\Dfgcjpdk.exe
        552⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Dmakgj32.exe
        
        C:\Windows\system32\Dmakgj32.exe
        553⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        554⤵
        System Location Discovery: System Language Discovery
        
        PID:12580
        
        C:\Windows\SysWOW64\Dbqqeahl.exe
        
        C:\Windows\system32\Dbqqeahl.exe
        555⤵
        Drops file in System32 directory
        
        PID:12752
        
        C:\Windows\SysWOW64\Epdaneff.exe
        
        C:\Windows\system32\Epdaneff.exe
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:12792
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        557⤵
        System Location Discovery: System Language Discovery
        
        PID:12824
        
        C:\Windows\SysWOW64\Ecbjdcml.exe
        
        C:\Windows\system32\Ecbjdcml.exe
        558⤵
        Modifies registry class
        
        PID:12864
        
        C:\Windows\SysWOW64\Ejlban32.exe
        
        C:\Windows\system32\Ejlban32.exe
        559⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Epikid32.exe
        
        C:\Windows\system32\Epikid32.exe
        560⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Efccfojn.exe
        
        C:\Windows\system32\Efccfojn.exe
        561⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Elpknehe.exe
        
        C:\Windows\system32\Elpknehe.exe
        562⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Ebjckppa.exe
        
        C:\Windows\system32\Ebjckppa.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13048
        
        C:\Windows\SysWOW64\Elbhde32.exe
        
        C:\Windows\system32\Elbhde32.exe
        564⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Eblpqono.exe
        
        C:\Windows\system32\Eblpqono.exe
        565⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Fifhmi32.exe
        
        C:\Windows\system32\Fifhmi32.exe
        566⤵
        Modifies registry class
        
        PID:13168
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        567⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Fjfegl32.exe
        
        C:\Windows\system32\Fjfegl32.exe
        568⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Fdnipbbo.exe
        
        C:\Windows\system32\Fdnipbbo.exe
        569⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Fjhaml32.exe
        
        C:\Windows\system32\Fjhaml32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12292
        
        C:\Windows\SysWOW64\Fpejec32.exe
        
        C:\Windows\system32\Fpejec32.exe
        571⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Ffobbmpp.exe
        
        C:\Windows\system32\Ffobbmpp.exe
        572⤵
        System Location Discovery: System Language Discovery
        
        PID:12372
        
        C:\Windows\SysWOW64\Fmikoggm.exe
        
        C:\Windows\system32\Fmikoggm.exe
        573⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Gjohnkdd.exe
        
        C:\Windows\system32\Gjohnkdd.exe
        574⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Glpdecjb.exe
        
        C:\Windows\system32\Glpdecjb.exe
        575⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Gffhbljh.exe
        
        C:\Windows\system32\Gffhbljh.exe
        576⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Gmpqof32.exe
        
        C:\Windows\system32\Gmpqof32.exe
        577⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12816
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        578⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Glenpb32.exe
        
        C:\Windows\system32\Glenpb32.exe
        579⤵
        Drops file in System32 directory
        
        PID:12904
        
        C:\Windows\SysWOW64\Gbofmmmj.exe
        
        C:\Windows\system32\Gbofmmmj.exe
        580⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Gmdjjemp.exe
        
        C:\Windows\system32\Gmdjjemp.exe
        581⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        582⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Gmggpekm.exe
        
        C:\Windows\system32\Gmggpekm.exe
        583⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Hgokikan.exe
        
        C:\Windows\system32\Hgokikan.exe
        584⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Hmicee32.exe
        
        C:\Windows\system32\Hmicee32.exe
        585⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Hdclbopg.exe
        
        C:\Windows\system32\Hdclbopg.exe
        586⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Hkmdoi32.exe
        
        C:\Windows\system32\Hkmdoi32.exe
        587⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        588⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Hchickeo.exe
        
        C:\Windows\system32\Hchickeo.exe
        589⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Hkpqdifa.exe
        
        C:\Windows\system32\Hkpqdifa.exe
        590⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Hplimpdi.exe
        
        C:\Windows\system32\Hplimpdi.exe
        591⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Hkbmjhdo.exe
        
        C:\Windows\system32\Hkbmjhdo.exe
        592⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        593⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Hkdjph32.exe
        
        C:\Windows\system32\Hkdjph32.exe
        594⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        595⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        596⤵
        Drops file in System32 directory
        
        PID:12800
        
        C:\Windows\SysWOW64\Igkkdigp.exe
        
        C:\Windows\system32\Igkkdigp.exe
        597⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Ilhcmpeg.exe
        
        C:\Windows\system32\Ilhcmpeg.exe
        598⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Icalij32.exe
        
        C:\Windows\system32\Icalij32.exe
        599⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Iildfd32.exe
        
        C:\Windows\system32\Iildfd32.exe
        600⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Iljpbp32.exe
        
        C:\Windows\system32\Iljpbp32.exe
        601⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Icdhojka.exe
        
        C:\Windows\system32\Icdhojka.exe
        602⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:440
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        603⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Icfediio.exe
        
        C:\Windows\system32\Icfediio.exe
        604⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Iloimopp.exe
        
        C:\Windows\system32\Iloimopp.exe
        605⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Igdnkhoe.exe
        
        C:\Windows\system32\Igdnkhoe.exe
        606⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Innfgb32.exe
        
        C:\Windows\system32\Innfgb32.exe
        607⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Jdhndlno.exe
        
        C:\Windows\system32\Jdhndlno.exe
        608⤵
        Modifies registry class
        
        PID:12488
        
        C:\Windows\SysWOW64\Jggjpgmc.exe
        
        C:\Windows\system32\Jggjpgmc.exe
        609⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Jpooimdc.exe
        
        C:\Windows\system32\Jpooimdc.exe
        610⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Jkdcffci.exe
        
        C:\Windows\system32\Jkdcffci.exe
        611⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\Jpalomaq.exe
        
        C:\Windows\system32\Jpalomaq.exe
        612⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Jgkdkg32.exe
        
        C:\Windows\system32\Jgkdkg32.exe
        613⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Jjjpgb32.exe
        
        C:\Windows\system32\Jjjpgb32.exe
        614⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Jkimae32.exe
        
        C:\Windows\system32\Jkimae32.exe
        615⤵
        Modifies registry class
        
        PID:13116
        
        C:\Windows\SysWOW64\Jljiimeb.exe
        
        C:\Windows\system32\Jljiimeb.exe
        616⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Jgpmffeh.exe
        
        C:\Windows\system32\Jgpmffeh.exe
        617⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Jnjecp32.exe
        
        C:\Windows\system32\Jnjecp32.exe
        618⤵
        System Location Discovery: System Language Discovery
        
        PID:12328
        
        C:\Windows\SysWOW64\Kddnpj32.exe
        
        C:\Windows\system32\Kddnpj32.exe
        619⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
        
        C:\Windows\SysWOW64\Kknfmdko.exe
        
        C:\Windows\system32\Kknfmdko.exe
        620⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Kmobdm32.exe
        
        C:\Windows\system32\Kmobdm32.exe
        621⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Kcikagij.exe
        
        C:\Windows\system32\Kcikagij.exe
        622⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
        
        C:\Windows\SysWOW64\Knoonphp.exe
        
        C:\Windows\system32\Knoonphp.exe
        623⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12656
        
        C:\Windows\SysWOW64\Kdigkjpl.exe
        
        C:\Windows\system32\Kdigkjpl.exe
        624⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Kkbohc32.exe
        
        C:\Windows\system32\Kkbohc32.exe
        625⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Kqphpk32.exe
        
        C:\Windows\system32\Kqphpk32.exe
        626⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Kcndlf32.exe
        
        C:\Windows\system32\Kcndlf32.exe
        627⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        628⤵
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        629⤵
        Drops file in System32 directory
        
        PID:13044
        
        C:\Windows\SysWOW64\Kkgicccd.exe
        
        C:\Windows\system32\Kkgicccd.exe
        630⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Knfeoobh.exe
        
        C:\Windows\system32\Knfeoobh.exe
        631⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Ldpmlh32.exe
        
        C:\Windows\system32\Ldpmlh32.exe
        632⤵
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Ljmfdp32.exe
        
        C:\Windows\system32\Ljmfdp32.exe
        633⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Lqfnqjpi.exe
        
        C:\Windows\system32\Lqfnqjpi.exe
        634⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Lcejmeol.exe
        
        C:\Windows\system32\Lcejmeol.exe
        635⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Lqikfi32.exe
        
        C:\Windows\system32\Lqikfi32.exe
        636⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2080
        
        C:\Windows\SysWOW64\Ljaooodf.exe
        
        C:\Windows\system32\Ljaooodf.exe
        637⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Ldgclgcl.exe
        
        C:\Windows\system32\Ldgclgcl.exe
        638⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Lkqliaki.exe
        
        C:\Windows\system32\Lkqliaki.exe
        639⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\Lnohemjm.exe
        
        C:\Windows\system32\Lnohemjm.exe
        640⤵
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        641⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lkchoaif.exe
        
        C:\Windows\system32\Lkchoaif.exe
        642⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        643⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Mjhepnno.exe
        
        C:\Windows\system32\Mjhepnno.exe
        644⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        645⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Mjkbemll.exe
        
        C:\Windows\system32\Mjkbemll.exe
        646⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4264
        
        C:\Windows\SysWOW64\Mepfbflb.exe
        
        C:\Windows\system32\Mepfbflb.exe
        647⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Mkjnop32.exe
        
        C:\Windows\system32\Mkjnop32.exe
        648⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1312
        
        C:\Windows\SysWOW64\Mmkkgh32.exe
        
        C:\Windows\system32\Mmkkgh32.exe
        649⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Mgaoda32.exe
        
        C:\Windows\system32\Mgaoda32.exe
        650⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Mjokpm32.exe
        
        C:\Windows\system32\Mjokpm32.exe
        651⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Windows\SysWOW64\Meepne32.exe
        
        C:\Windows\system32\Meepne32.exe
        652⤵
        Drops file in System32 directory
        
        PID:3276
        
        C:\Windows\SysWOW64\Mlohjpoi.exe
        
        C:\Windows\system32\Mlohjpoi.exe
        653⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        654⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Ngehoqdn.exe
        
        C:\Windows\system32\Ngehoqdn.exe
        655⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        656⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        657⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Nmenmgab.exe
        
        C:\Windows\system32\Nmenmgab.exe
        658⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Nlfnkoia.exe
        
        C:\Windows\system32\Nlfnkoia.exe
        659⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Nmgjbg32.exe
        
        C:\Windows\system32\Nmgjbg32.exe
        660⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Nhmopp32.exe
        
        C:\Windows\system32\Nhmopp32.exe
        661⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Nnfgmjfb.exe
        
        C:\Windows\system32\Nnfgmjfb.exe
        662⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Nhokeolc.exe
        
        C:\Windows\system32\Nhokeolc.exe
        663⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        664⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Oeclockl.exe
        
        C:\Windows\system32\Oeclockl.exe
        665⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\Ohahkojp.exe
        
        C:\Windows\system32\Ohahkojp.exe
        666⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Onkphi32.exe
        
        C:\Windows\system32\Onkphi32.exe
        667⤵
        Drops file in System32 directory
        
        PID:3700
        
        C:\Windows\SysWOW64\Oeehdcij.exe
        
        C:\Windows\system32\Oeehdcij.exe
        668⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Ojbamj32.exe
        
        C:\Windows\system32\Ojbamj32.exe
        669⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Oaliidon.exe
        
        C:\Windows\system32\Oaliidon.exe
        670⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Ohfafn32.exe
        
        C:\Windows\system32\Ohfafn32.exe
        671⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Oopjchnh.exe
        
        C:\Windows\system32\Oopjchnh.exe
        672⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        673⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Oobfhh32.exe
        
        C:\Windows\system32\Oobfhh32.exe
        674⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Oeloebcb.exe
        
        C:\Windows\system32\Oeloebcb.exe
        675⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Olfgbl32.exe
        
        C:\Windows\system32\Olfgbl32.exe
        676⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Pmgcidqm.exe
        
        C:\Windows\system32\Pmgcidqm.exe
        677⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Pdalfo32.exe
        
        C:\Windows\system32\Pdalfo32.exe
        678⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Pmjpod32.exe
        
        C:\Windows\system32\Pmjpod32.exe
        679⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Pahiebeq.exe
        
        C:\Windows\system32\Pahiebeq.exe
        680⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Plmmbkdf.exe
        
        C:\Windows\system32\Plmmbkdf.exe
        681⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Pmoijcje.exe
        
        C:\Windows\system32\Pmoijcje.exe
        682⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Phdngljk.exe
        
        C:\Windows\system32\Phdngljk.exe
        683⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Ponfdf32.exe
        
        C:\Windows\system32\Ponfdf32.exe
        684⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Pehnaqid.exe
        
        C:\Windows\system32\Pehnaqid.exe
        685⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Qkegiggl.exe
        
        C:\Windows\system32\Qkegiggl.exe
        686⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Windows\SysWOW64\Qejkfp32.exe
        
        C:\Windows\system32\Qejkfp32.exe
        687⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        688⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Qaalkamf.exe
        
        C:\Windows\system32\Qaalkamf.exe
        689⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Ahkdhk32.exe
        
        C:\Windows\system32\Ahkdhk32.exe
        690⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        691⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        692⤵
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Adbdml32.exe
        
        C:\Windows\system32\Adbdml32.exe
        693⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Aafefq32.exe
        
        C:\Windows\system32\Aafefq32.exe
        694⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Ahpmckpn.exe
        
        C:\Windows\system32\Ahpmckpn.exe
        695⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Anmfkane.exe
        
        C:\Windows\system32\Anmfkane.exe
        696⤵
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Adfnhlfa.exe
        
        C:\Windows\system32\Adfnhlfa.exe
        697⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Akqfef32.exe
        
        C:\Windows\system32\Akqfef32.exe
        698⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Aefjbo32.exe
        
        C:\Windows\system32\Aefjbo32.exe
        699⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Bkeppeii.exe
        
        C:\Windows\system32\Bkeppeii.exe
        700⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Bncllqhm.exe
        
        C:\Windows\system32\Bncllqhm.exe
        701⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Bldljh32.exe
        
        C:\Windows\system32\Bldljh32.exe
        702⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Bemqcngl.exe
        
        C:\Windows\system32\Bemqcngl.exe
        703⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Blgiphni.exe
        
        C:\Windows\system32\Blgiphni.exe
        704⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        705⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Badaholq.exe
        
        C:\Windows\system32\Badaholq.exe
        706⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Windows\SysWOW64\Bklfqd32.exe
        
        C:\Windows\system32\Bklfqd32.exe
        707⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Bafnmnjn.exe
        
        C:\Windows\system32\Bafnmnjn.exe
        708⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        709⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Bkobfdao.exe
        
        C:\Windows\system32\Bkobfdao.exe
        710⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Cfdgcmqd.exe
        
        C:\Windows\system32\Cfdgcmqd.exe
        711⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Clnopg32.exe
        
        C:\Windows\system32\Clnopg32.exe
        712⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        713⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Cdicdi32.exe
        
        C:\Windows\system32\Cdicdi32.exe
        714⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Clplff32.exe
        
        C:\Windows\system32\Clplff32.exe
        715⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Coohbbeb.exe
        
        C:\Windows\system32\Coohbbeb.exe
        716⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Cdlpjicj.exe
        
        C:\Windows\system32\Cdlpjicj.exe
        717⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Ckeigc32.exe
        
        C:\Windows\system32\Ckeigc32.exe
        718⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13320
        
        C:\Windows\SysWOW64\Cndecn32.exe
        
        C:\Windows\system32\Cndecn32.exe
        719⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Cleeafbi.exe
        
        C:\Windows\system32\Cleeafbi.exe
        720⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\Cbbnim32.exe
        
        C:\Windows\system32\Cbbnim32.exe
        721⤵
        Drops file in System32 directory
        
        PID:13608
        
        C:\Windows\SysWOW64\Cofnba32.exe
        
        C:\Windows\system32\Cofnba32.exe
        722⤵
        Drops file in System32 directory
        
        PID:13716
        
        C:\Windows\SysWOW64\Ddbfkh32.exe
        
        C:\Windows\system32\Ddbfkh32.exe
        723⤵
        Modifies registry class
        
        PID:13756
        
        C:\Windows\SysWOW64\Dkmogbeo.exe
        
        C:\Windows\system32\Dkmogbeo.exe
        724⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Dfbcek32.exe
        
        C:\Windows\system32\Dfbcek32.exe
        725⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        726⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        727⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Ddgpfgil.exe
        
        C:\Windows\system32\Ddgpfgil.exe
        728⤵
        Drops file in System32 directory
        
        PID:13948
        
        C:\Windows\SysWOW64\Dkahba32.exe
        
        C:\Windows\system32\Dkahba32.exe
        729⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\Ddjmkg32.exe
        
        C:\Windows\system32\Ddjmkg32.exe
        730⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\Dkcehaof.exe
        
        C:\Windows\system32\Dkcehaof.exe
        731⤵
        Modifies registry class
        
        PID:14068
        
        C:\Windows\SysWOW64\Dbnmek32.exe
        
        C:\Windows\system32\Dbnmek32.exe
        732⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\Dkfanqmd.exe
        
        C:\Windows\system32\Dkfanqmd.exe
        733⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14148
        
        C:\Windows\SysWOW64\Ebpjjk32.exe
        
        C:\Windows\system32\Ebpjjk32.exe
        734⤵
        
        PID:14188
        
        C:\Windows\SysWOW64\Eijbge32.exe
        
        C:\Windows\system32\Eijbge32.exe
        735⤵
        Drops file in System32 directory
        
        PID:14228
        
        C:\Windows\SysWOW64\Ekhncp32.exe
        
        C:\Windows\system32\Ekhncp32.exe
        736⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14260
        
        C:\Windows\SysWOW64\Ebbfpjbn.exe
        
        C:\Windows\system32\Ebbfpjbn.exe
        737⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\Eilomd32.exe
        
        C:\Windows\system32\Eilomd32.exe
        738⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Eofgioah.exe
        
        C:\Windows\system32\Eofgioah.exe
        739⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Efpofi32.exe
        
        C:\Windows\system32\Efpofi32.exe
        740⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\Emjgcc32.exe
        
        C:\Windows\system32\Emjgcc32.exe
        741⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Ebgpkj32.exe
        
        C:\Windows\system32\Ebgpkj32.exe
        742⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Eiahhdee.exe
        
        C:\Windows\system32\Eiahhdee.exe
        743⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13668
        
        C:\Windows\SysWOW64\Efeiahdo.exe
        
        C:\Windows\system32\Efeiahdo.exe
        744⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\Emoanbll.exe
        
        C:\Windows\system32\Emoanbll.exe
        745⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\Fnpmej32.exe
        
        C:\Windows\system32\Fnpmej32.exe
        746⤵
        
        PID:13824
        
        C:\Windows\SysWOW64\Fejebdig.exe
        
        C:\Windows\system32\Fejebdig.exe
        747⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\Fmancbji.exe
        
        C:\Windows\system32\Fmancbji.exe
        748⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Fbnflihq.exe
        
        C:\Windows\system32\Fbnflihq.exe
        749⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Fihnhc32.exe
        
        C:\Windows\system32\Fihnhc32.exe
        750⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Fbpcah32.exe
        
        C:\Windows\system32\Fbpcah32.exe
        751⤵
        
        PID:14056
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        752⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Fligjnlo.exe
        
        C:\Windows\system32\Fligjnlo.exe
        753⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Fealcc32.exe
        
        C:\Windows\system32\Fealcc32.exe
        754⤵
        System Location Discovery: System Language Discovery
        
        PID:14196
        
        C:\Windows\SysWOW64\Flkdpnjl.exe
        
        C:\Windows\system32\Flkdpnjl.exe
        755⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fiodib32.exe
        
        C:\Windows\system32\Fiodib32.exe
        756⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Gpimflqb.exe
        
        C:\Windows\system32\Gpimflqb.exe
        757⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\Gfcebf32.exe
        
        C:\Windows\system32\Gfcebf32.exe
        758⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        759⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\Gbjegg32.exe
        
        C:\Windows\system32\Gbjegg32.exe
        760⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\Gmojep32.exe
        
        C:\Windows\system32\Gmojep32.exe
        761⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Gpnfak32.exe
        
        C:\Windows\system32\Gpnfak32.exe
        762⤵
        Drops file in System32 directory
        
        PID:13504
        
        C:\Windows\SysWOW64\Gfgnnedj.exe
        
        C:\Windows\system32\Gfgnnedj.exe
        763⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Gppcfk32.exe
        
        C:\Windows\system32\Gppcfk32.exe
        764⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Glgckl32.exe
        
        C:\Windows\system32\Glgckl32.exe
        765⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\Gflhie32.exe
        
        C:\Windows\system32\Gflhie32.exe
        766⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Hlipal32.exe
        
        C:\Windows\system32\Hlipal32.exe
        767⤵
        System Location Discovery: System Language Discovery
        
        PID:7264
        
        C:\Windows\SysWOW64\Hbchnfei.exe
        
        C:\Windows\system32\Hbchnfei.exe
        768⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\Hmhmko32.exe
        
        C:\Windows\system32\Hmhmko32.exe
        769⤵
        System Location Discovery: System Language Discovery
        
        PID:14132
        
        C:\Windows\SysWOW64\Hojibgkm.exe
        
        C:\Windows\system32\Hojibgkm.exe
        770⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Hiomppkc.exe
        
        C:\Windows\system32\Hiomppkc.exe
        771⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Hpiemj32.exe
        
        C:\Windows\system32\Hpiemj32.exe
        772⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\Hefneq32.exe
        
        C:\Windows\system32\Hefneq32.exe
        773⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7204
        
        C:\Windows\SysWOW64\Hoobnf32.exe
        
        C:\Windows\system32\Hoobnf32.exe
        774⤵
        System Location Discovery: System Language Discovery
        
        PID:13352
        
        C:\Windows\SysWOW64\Hehkjpod.exe
        
        C:\Windows\system32\Hehkjpod.exe
        775⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Hoaocf32.exe
        
        C:\Windows\system32\Hoaocf32.exe
        776⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hifcqo32.exe
        
        C:\Windows\system32\Hifcqo32.exe
        777⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\Ibohid32.exe
        
        C:\Windows\system32\Ibohid32.exe
        778⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Ilglbjbl.exe
        
        C:\Windows\system32\Ilglbjbl.exe
        779⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\Ibadoc32.exe
        
        C:\Windows\system32\Ibadoc32.exe
        780⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Imfill32.exe
        
        C:\Windows\system32\Imfill32.exe
        781⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Igomeb32.exe
        
        C:\Windows\system32\Igomeb32.exe
        782⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Ipgbngfp.exe
        
        C:\Windows\system32\Ipgbngfp.exe
        783⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Iedjfodg.exe
        
        C:\Windows\system32\Iedjfodg.exe
        784⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Ilnbch32.exe
        
        C:\Windows\system32\Ilnbch32.exe
        785⤵
        
        PID:14052
        
        C:\Windows\SysWOW64\Ichkpb32.exe
        
        C:\Windows\system32\Ichkpb32.exe
        786⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\Jlqohhja.exe
        
        C:\Windows\system32\Jlqohhja.exe
        787⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\SysWOW64\Jgfcfajg.exe
        
        C:\Windows\system32\Jgfcfajg.exe
        788⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Jlclnhho.exe
        
        C:\Windows\system32\Jlclnhho.exe
        789⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        790⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Jiglgl32.exe
        
        C:\Windows\system32\Jiglgl32.exe
        791⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Jocepc32.exe
        
        C:\Windows\system32\Jocepc32.exe
        792⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Jndenjmo.exe
        
        C:\Windows\system32\Jndenjmo.exe
        793⤵
        
        PID:13460
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        794⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        795⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Jpenoe32.exe
        
        C:\Windows\system32\Jpenoe32.exe
        796⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Jebfgl32.exe
        
        C:\Windows\system32\Jebfgl32.exe
        797⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        798⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\Kcfgaq32.exe
        
        C:\Windows\system32\Kcfgaq32.exe
        799⤵
        
        PID:13712
        
        C:\Windows\SysWOW64\Knlknigf.exe
        
        C:\Windows\system32\Knlknigf.exe
        800⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Kgdpgo32.exe
        
        C:\Windows\system32\Kgdpgo32.exe
        801⤵
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Windows\SysWOW64\Kpldpddh.exe
        
        C:\Windows\system32\Kpldpddh.exe
        802⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kckqlpck.exe
        
        C:\Windows\system32\Kckqlpck.exe
        803⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\Knpeii32.exe
        
        C:\Windows\system32\Knpeii32.exe
        804⤵
        Drops file in System32 directory
        
        PID:14224
        
        C:\Windows\SysWOW64\Kcmmap32.exe
        
        C:\Windows\system32\Kcmmap32.exe
        805⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Kjgenjhe.exe
        
        C:\Windows\system32\Kjgenjhe.exe
        806⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Kpankd32.exe
        
        C:\Windows\system32\Kpankd32.exe
        807⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        808⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        809⤵
        System Location Discovery: System Language Discovery
        
        PID:8188
        
        C:\Windows\SysWOW64\Lcbfmomc.exe
        
        C:\Windows\system32\Lcbfmomc.exe
        810⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Lngkjhmi.exe
        
        C:\Windows\system32\Lngkjhmi.exe
        811⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Lcdcbokq.exe
        
        C:\Windows\system32\Lcdcbokq.exe
        812⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Lfbpnjjd.exe
        
        C:\Windows\system32\Lfbpnjjd.exe
        813⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        814⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ljqhdhpk.exe
        
        C:\Windows\system32\Ljqhdhpk.exe
        815⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Lomqmoob.exe
        
        C:\Windows\system32\Lomqmoob.exe
        816⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Lfgiii32.exe
        
        C:\Windows\system32\Lfgiii32.exe
        817⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\Lqmmgb32.exe
        
        C:\Windows\system32\Lqmmgb32.exe
        818⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Mggecl32.exe
        
        C:\Windows\system32\Mggecl32.exe
        819⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Mnanpfdo.exe
        
        C:\Windows\system32\Mnanpfdo.exe
        820⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Mflbdibj.exe
        
        C:\Windows\system32\Mflbdibj.exe
        821⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Modgnn32.exe
        
        C:\Windows\system32\Modgnn32.exe
        822⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Mgkoolil.exe
        
        C:\Windows\system32\Mgkoolil.exe
        823⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Mjjkkghp.exe
        
        C:\Windows\system32\Mjjkkghp.exe
        824⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Mogccnfg.exe
        
        C:\Windows\system32\Mogccnfg.exe
        825⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Mjlhpgfn.exe
        
        C:\Windows\system32\Mjlhpgfn.exe
        826⤵
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Mmkdlbea.exe
        
        C:\Windows\system32\Mmkdlbea.exe
        827⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Mgphjk32.exe
        
        C:\Windows\system32\Mgphjk32.exe
        828⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Mmmqbb32.exe
        
        C:\Windows\system32\Mmmqbb32.exe
        829⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Mokmnm32.exe
        
        C:\Windows\system32\Mokmnm32.exe
        830⤵
        System Location Discovery: System Language Discovery
        
        PID:8436
        
        C:\Windows\SysWOW64\Ngbeok32.exe
        
        C:\Windows\system32\Ngbeok32.exe
        831⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Nmomga32.exe
        
        C:\Windows\system32\Nmomga32.exe
        832⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Npnjcm32.exe
        
        C:\Windows\system32\Npnjcm32.exe
        833⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Nmajmaoi.exe
        
        C:\Windows\system32\Nmajmaoi.exe
        834⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        835⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Njekfenc.exe
        
        C:\Windows\system32\Njekfenc.exe
        836⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Nqpccp32.exe
        
        C:\Windows\system32\Nqpccp32.exe
        837⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        838⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Nnccmddi.exe
        
        C:\Windows\system32\Nnccmddi.exe
        839⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        840⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Nmipnp32.exe
        
        C:\Windows\system32\Nmipnp32.exe
        841⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Ofaeffpa.exe
        
        C:\Windows\system32\Ofaeffpa.exe
        842⤵
        
        PID:13896
        
        C:\Windows\SysWOW64\Omkmcpgo.exe
        
        C:\Windows\system32\Omkmcpgo.exe
        843⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Oceepj32.exe
        
        C:\Windows\system32\Oceepj32.exe
        844⤵
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Onkimc32.exe
        
        C:\Windows\system32\Onkimc32.exe
        845⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ocgbej32.exe
        
        C:\Windows\system32\Ocgbej32.exe
        846⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        847⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Oakbonkb.exe
        
        C:\Windows\system32\Oakbonkb.exe
        848⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        849⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Onochbjl.exe
        
        C:\Windows\system32\Onochbjl.exe
        850⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Oanodnip.exe
        
        C:\Windows\system32\Oanodnip.exe
        851⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Ohggah32.exe
        
        C:\Windows\system32\Ohggah32.exe
        852⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Ojfcmc32.exe
        
        C:\Windows\system32\Ojfcmc32.exe
        853⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\Ppclej32.exe
        
        C:\Windows\system32\Ppclej32.exe
        854⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Pfmdbd32.exe
        
        C:\Windows\system32\Pfmdbd32.exe
        855⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Pabhpm32.exe
        
        C:\Windows\system32\Pabhpm32.exe
        856⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Phlqlgmg.exe
        
        C:\Windows\system32\Phlqlgmg.exe
        857⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Pnfiia32.exe
        
        C:\Windows\system32\Pnfiia32.exe
        858⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Pdcaahbk.exe
        
        C:\Windows\system32\Pdcaahbk.exe
        859⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Pjmjnb32.exe
        
        C:\Windows\system32\Pjmjnb32.exe
        860⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\Ppjbfi32.exe
        
        C:\Windows\system32\Ppjbfi32.exe
        861⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Pfdjccol.exe
        
        C:\Windows\system32\Pfdjccol.exe
        862⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Qalkfl32.exe
        
        C:\Windows\system32\Qalkfl32.exe
        863⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Qhfcbfdl.exe
        
        C:\Windows\system32\Qhfcbfdl.exe
        864⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        865⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Qfkqcb32.exe
        
        C:\Windows\system32\Qfkqcb32.exe
        866⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ameipl32.exe
        
        C:\Windows\system32\Ameipl32.exe
        867⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Ahjmne32.exe
        
        C:\Windows\system32\Ahjmne32.exe
        868⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Amgefl32.exe
        
        C:\Windows\system32\Amgefl32.exe
        869⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        870⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Aogbpo32.exe
        
        C:\Windows\system32\Aogbpo32.exe
        871⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        872⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Aagkaj32.exe
        
        C:\Windows\system32\Aagkaj32.exe
        873⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Akpojpic.exe
        
        C:\Windows\system32\Akpojpic.exe
        874⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Aajggjap.exe
        
        C:\Windows\system32\Aajggjap.exe
        875⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Windows\SysWOW64\Ahdpdd32.exe
        
        C:\Windows\system32\Ahdpdd32.exe
        876⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Bonhqnpi.exe
        
        C:\Windows\system32\Bonhqnpi.exe
        877⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Bpodhf32.exe
        
        C:\Windows\system32\Bpodhf32.exe
        878⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9136
        
        C:\Windows\SysWOW64\Bgimepmd.exe
        
        C:\Windows\system32\Bgimepmd.exe
        879⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        880⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        881⤵
        Drops file in System32 directory
        
        PID:9132
        
        C:\Windows\SysWOW64\Boenam32.exe
        
        C:\Windows\system32\Boenam32.exe
        882⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Bdagidhi.exe
        
        C:\Windows\system32\Bdagidhi.exe
        883⤵
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Windows\SysWOW64\Bkkofn32.exe
        
        C:\Windows\system32\Bkkofn32.exe
        884⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Baegchgb.exe
        
        C:\Windows\system32\Baegchgb.exe
        885⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Bhpopb32.exe
        
        C:\Windows\system32\Bhpopb32.exe
        886⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Cnlhhi32.exe
        
        C:\Windows\system32\Cnlhhi32.exe
        887⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\Cdfpdc32.exe
        
        C:\Windows\system32\Cdfpdc32.exe
        888⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        889⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Cdhmjc32.exe
        
        C:\Windows\system32\Cdhmjc32.exe
        890⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Cggifn32.exe
        
        C:\Windows\system32\Cggifn32.exe
        891⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Calmcg32.exe
        
        C:\Windows\system32\Calmcg32.exe
        892⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Chfepa32.exe
        
        C:\Windows\system32\Chfepa32.exe
        893⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Cncnhh32.exe
        
        C:\Windows\system32\Cncnhh32.exe
        894⤵
        Drops file in System32 directory
        
        PID:9828
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        895⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Cneknh32.exe
        
        C:\Windows\system32\Cneknh32.exe
        896⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Chkokq32.exe
        
        C:\Windows\system32\Chkokq32.exe
        897⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Dnhgcgbi.exe
        
        C:\Windows\system32\Dnhgcgbi.exe
        898⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Dgpllm32.exe
        
        C:\Windows\system32\Dgpllm32.exe
        899⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Dqipeboj.exe
        
        C:\Windows\system32\Dqipeboj.exe
        900⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Dgbhbm32.exe
        
        C:\Windows\system32\Dgbhbm32.exe
        901⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Dojqcjgi.exe
        
        C:\Windows\system32\Dojqcjgi.exe
        902⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        903⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Dolmijef.exe
        
        C:\Windows\system32\Dolmijef.exe
        904⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Dqmjqb32.exe
        
        C:\Windows\system32\Dqmjqb32.exe
        905⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Dkcnnk32.exe
        
        C:\Windows\system32\Dkcnnk32.exe
        906⤵
        Modifies registry class
        
        PID:10056
        
        C:\Windows\SysWOW64\Dbmfje32.exe
        
        C:\Windows\system32\Dbmfje32.exe
        907⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Ddkbfp32.exe
        
        C:\Windows\system32\Ddkbfp32.exe
        908⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Ekekcjih.exe
        
        C:\Windows\system32\Ekekcjih.exe
        909⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Ebocpd32.exe
        
        C:\Windows\system32\Ebocpd32.exe
        910⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Ehikmohb.exe
        
        C:\Windows\system32\Ehikmohb.exe
        911⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Eoccii32.exe
        
        C:\Windows\system32\Eoccii32.exe
        912⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Eqdpaa32.exe
        
        C:\Windows\system32\Eqdpaa32.exe
        913⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9936 -s 448
        914⤵
        Program crash
        
        PID:9984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 9936 -ip 9936
1⤵
PID:9720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abkjnd32.exe

Path C:\Windows\SysWOW64\Abkjnd32.exe
Size 320KB
SHA256 7c5f44a1597c53599349b45a1387f70e00b1c26e12f21dc9c47308b8438bef89
MD5 91705425c50eb2f07be3ba4edbbf0700
SHA1 513d6e840092dc1be565de9d0f1c86f5ba75ada2
SHA512 997303164870ff22d79c27d8ae7cc969ca27fad5abfa7fd7711e68d88d316a965019c366036fe2aae2821497a8eeac1485d79e511703be5ac4f7e997b72cc652
SSDEEP 3072:THW91g6yI+36wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:THW9C6yR6V/Ah1G/AcQ///NR5fn
TLSH
T119642E1A6A340AEBDDED1FB5AD1249D85181E9F014F2E13E6123DFDCD8E4DA6C908F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acjjpllp.exe

Path C:\Windows\SysWOW64\Acjjpllp.exe
Size 320KB
SHA256 68a9d7865bc632d7c216eeaf3132c76c677182fb8c7c3ac37bfa8b3dea19ca18
MD5 8f5c4f06dd920dc9b7213c98364c6d85
SHA1 1729358f2926d7aa0c80da819ef747c65b5754d8
SHA512 84e0ea263203b6f48910009da11392583ea4759c7298187ee6a0f45e11fe24253fd645650e89d7d6c038d1c1028cb98ecf0beab1c88dc9344b4ec8936eaa2cf0
SSDEEP 3072:qzO5Imz51wFiPlUhPyBbhMKlywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zFzvVBbhMkyV/Ah1G/AcQ///NR5fn
TLSH
T19864EB1926304EEACEED1BB9AD0249DC9181E9F014F1E53E6163DFDCE8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acmfel32.exe

Path C:\Windows\SysWOW64\Acmfel32.exe
Size 320KB
SHA256 54b856a8854970524a003625d6f935689c3a69a80d7c14b03762a97041cef05c
MD5 c6ff2b8657c38a9ec460ec87d13926bc
SHA1 7179ce2520a15073fd5bb50120befae0d2ee95d7
SHA512 391d40d560d284ea54bd10ccf538b1b57d94f64922e5270df10ffb545aa2451e97a86baac396df7e94508424c90e4c943fd60863b573e09ca1bb4f48a6fa8334
SSDEEP 3072:DkdtmGmaDb5f6h0mGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KhdDb85GV/Ah1G/AcQ///NR5fn
TLSH
T1C6643019263889EACEEE5BB5EE026AD85141E4F014F1E13E6133DFDCC8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahmlaj32.exe

Path C:\Windows\SysWOW64\Ahmlaj32.exe
Size 320KB
SHA256 6c09999f66ffe2936588ac06864451c7016b5669a1c62774feb0dda174815518
MD5 486b172147a1c7213cdc9d3f6b0f356a
SHA1 c608e1507a889610d74717cdc46e5df3a1b9cdba
SHA512 2adb61b5c8a0b3a8e96f060e4792348a992b5d72c9f51aff8284826f686fb33891a2c3d42e4bcc521faeb436ac71998fc9d959fd7c491dc8978a9f58141d0793
SSDEEP 3072:ugd5h1BDWohETWtI8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ugd5/BDWgEStI8V/Ah1G/AcQ///NR5fn
TLSH
T191643F1A5A3909EACEED1FB5AC1249D89141F8F014F1E13E6123EFDDE9E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anbkbe32.exe

Path C:\Windows\SysWOW64\Anbkbe32.exe
Size 320KB
SHA256 de417a8a97d8e10dd6e29865ca8b1507e59d53ed4d0f861f13f73a9c09b25ace
MD5 d6fbbd2455a9fb254eff2ca7daf4cdec
SHA1 ddc35d0c9e095e21dd830865dbb443234bb7ab7d
SHA512 eb63f3769ba460aee650f5336bf59598e1fc3d018a02b83ffd76639919be0efbd34e47c2149b4435815f02b375c77d661df59521f7a8ae1a968b9c9d7ebd5c04
SSDEEP 3072:tz9vLWSCr6QR9RjOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pxChRrjOV/Ah1G/AcQ///NR5fn
TLSH
T11E641C1A2A344AEACEED1BB5AC124DD89146E9F014F1F13E6523DFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhohfj32.exe

Path C:\Windows\SysWOW64\Bhohfj32.exe
Size 320KB
SHA256 d02e8d8b4c223badf12663f6e6ad40e6848f72a7eb18165a80ea592cc94bef57
MD5 5fee6f1c9a176c917e4a944a84da1815
SHA1 042a8dccd9b4fd7434d7e32f399634212ea92aeb
SHA512 f0f2c03a2075eec5401fb8058b8a0638600d2088dce6e5ccc35e29811ab63c535a676712515203a43468f44d1b1753b1eeb6fd625ad2d3dbba34e926c531a247
SSDEEP 3072:jRqEom5IcwtMpE2oA+ZYYYYWmiwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jRfFmiV/Ah1G/AcQ///NR5fn
TLSH
T1B46451192A7009EACEED1FB6AC5649D95181E8F014F1E53E6133DFDCC8E4DAAE844F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bniacddk.exe

Path C:\Windows\SysWOW64\Bniacddk.exe
Size 320KB
SHA256 02dcf48ac435f0eeaa38c5faa1d971f8247d11a0f83d038ff079ef70611f07dd
MD5 fda1bb1be67285743c75d92167eed614
SHA1 ce5497f405e8cd712d5cf5cd97ba67e485a9f4b9
SHA512 5d3cdb711eaf0cddc64e09f38e0884f064eede7581cb7b54b3bd555c74b92ff94f8e708f04e34051b82142fb043c540a5f6b6cf36e46d55ef2d41015fedbe8f2
SSDEEP 3072:x+dylTiQoZ4lXCkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x+d2iQdCkV/Ah1G/AcQ///NR5fn
TLSH
T149641E1A2A740AEADDFD5BB5BC0249D85142E9F014F1E53E6123DFECC8E4DA6D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmlmlo32.exe

Path C:\Windows\SysWOW64\Kmlmlo32.exe
Size 320KB
SHA256 b2a8130af7d99481e78117eb6e0b8ad4a9a5cdc14f26fa02d472a24efbb1c18b
MD5 6fa2a8b98f717d93d94f09ff7caa6857
SHA1 013f182286dba0933a77b293a6ddb666392ed719
SHA512 a7aa51788d4809f2413161fd621b551d310ca95dcc97c1ba24c49a10e1b42c0b74b09724383ee0623e7bba2626645deee88e1a934703cb30f1c0800196a425bf
SSDEEP 6144:cnOcA1s44NSav5tV/Ah1G/AcQ///NR5fn:cnOcAGTHC/Nv
TLSH
T14C641D1926345DEACDED2BB6AE124DE85141E8F014F1E23E6123DFDDD8E4DA6C908F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ldmlih32.exe

Path C:\Windows\SysWOW64\Ldmlih32.exe
Size 320KB
SHA256 95f71cb867a96084c2c344e2bcce79304fbbcffa5197a251d1dcc4052c373bc3
MD5 42a55ebaea5d3df28c98ede11ea8d82d
SHA1 712c9539812c2554ad4454392873c34183789b19
SHA512 1e221a1eff96e60152ab7b14d71291d001d832869ce80d15a9615dd15311f8985a0ae811977d0996e2b8d11c30c1b6a9a47ad7ad450c7b660f90a9b1860b0f79
SSDEEP 3072:9fAr8BEUuXVgij5+2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9fOFgi9+2V/Ah1G/AcQ///NR5fn
TLSH
T14264211916300DEACEED1BB5AC428AD99141E8F014F1E57E6223EFDCD9E4DA6C825FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkpnec32.exe

Path C:\Windows\SysWOW64\Lkpnec32.exe
Size 320KB
SHA256 2e46771d31aaca56de048e8df733cdc27216e8907d793470b664ddc1647045fb
MD5 81e62bff326ec438952508c9d1ecb4d9
SHA1 56816fef31782b060233aa80fe6178fc558412b3
SHA512 b6e513f3145e721105366600cdc7d65d4d2ba4f8ade229c3591eaedd4c808bdce6a8348c2f9f5ecf8336ed685c1e1ab1bea90ca166690b2d001d7eecafd12721
SSDEEP 3072:b9e+q2Q8zwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:z7zV/Ah1G/AcQ///NR5fn
TLSH
T1B3641F152A340EEAEEED1BB5AC0249D85541F9F018F1E13E6123EFDCD8E4DA6D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmqggncn.exe

Path C:\Windows\SysWOW64\Lmqggncn.exe
Size 320KB
SHA256 33603a1b8186d6a5049bf1322f80dc4468060f6e5caa36070c19e5005ae8f444
MD5 19959f8324c35801657ce556d82d0c99
SHA1 22192229038cc8591d0892796a535da02d13e7c0
SHA512 a7040e9bb3a7ae99e764baa0cda55eec73324d5fc9e63041fc55f177e9117951115ba8a0e50bed5bb58c0c13efa09b5a9d93f84c404d6b8e11a73f7a394a79eb
SSDEEP 3072:zJB7I7LwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/ELV/Ah1G/AcQ///NR5fn
TLSH
T1BA6440192A3409EACEFD1FB5AD1249D89181E9F014F1E17E6523DFDCD8E4DA6C809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lnccmnak.exe

Path C:\Windows\SysWOW64\Lnccmnak.exe
Size 320KB
SHA256 11851fbda5b6325a3f997c3509ea6dff065d238877ae3cc3d40b92f790e98c6b
MD5 50e4dc34cfd04e673cb36a0df506ef03
SHA1 80f49b2ef4f06c16a09a27c8377505e7bd5d062c
SHA512 449eee7d73ada00d7105dcf5e1324ba4dc7e2912ab6b5e763039e59762ba6612e54f4b9668c095524f060cf67ac785f38085b2ddf4df4c953260e73143fbec7f
SSDEEP 3072:R5+xLCdkmS+suEitrCLIhex3ZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:joIktuLteLI03ZV/Ah1G/AcQ///NR5fn
TLSH
T18264202A3A3809EACDED1BB5AD0289D85141E9F014F1E13E6123DFDED8E4DA2DC15F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lpfidh32.exe

Path C:\Windows\SysWOW64\Lpfidh32.exe
Size 320KB
SHA256 998f4368e3d2af8474151b3d1da88c11f19f31df2642f7364e6f7fcceb5cd80f
MD5 113cc1b4d96f00c48d47a0b5e959e1ef
SHA1 d8460f489c233bd55a2fe82a5236a71756043fb1
SHA512 3050e6969d8fb3bff2d856042bf975a68c6de4e676c469d4210a8769995bec74f11f0a05fd7d8b2e3276616ab8384395b607ce63ff96126bdeb9e99bd1972174
SSDEEP 3072:0Cj4iKYwcAHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0CczYnAHV/Ah1G/AcQ///NR5fn
TLSH
T17C642F192A340DEADDED9BB5AC125ADC6141E8F114F1E13E6123DFDCE8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Maohdj32.exe

Path C:\Windows\SysWOW64\Maohdj32.exe
Size 320KB
SHA256 bd9f7e2f91ac6e890e6dfb2971c82dd24477ee97a815e71ea58a1f48a82576a0
MD5 fd433fb9a4e5d372cb8bbea7f6bf1330
SHA1 e5ae7693e8afba09a92283391ec31e2e9cd225a2
SHA512 90e6c8fa2663d639d350a3b9710c91ef5e25ffb461ed63dc5deada1d6a77536e7a442e429ff6db804ebff01c325d2eaff02cd67bbdff828db369a43cdd6ad7db
SSDEEP 3072:WNpZD79H4djRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WXt7URV/Ah1G/AcQ///NR5fn
TLSH
T16D640B192A3409EADEED1FB5AD0249D85181E9F024F1E13E6123DFDCC9E6DA6DC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgggaamn.exe

Path C:\Windows\SysWOW64\Mgggaamn.exe
Size 320KB
SHA256 9b8b169d59e2a7607e879f9da10c9deac69c06d49ee14cdba7c3a7a054840c5c
MD5 8cd28de30cdb506c429364dac1f67e1f
SHA1 3afca70dd8f54a5a08f5934f3836641b3e213535
SHA512 7b506bb60bd779bccf7ac8023ffdafc613562466e5425adefda96f3faf9756f6e972d52421253b7c27e41a5216927f85432227d2f0a547a8231afa04d1762673
SSDEEP 3072:ERvW2nxQ3Z4mRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ERv1n23Z4mRV/Ah1G/AcQ///NR5fn
TLSH
T12B641F292A3409EACEED1BB6AC128DD85141EAF114F5F13E6123DFDCD8E4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nacboi32.exe

Path C:\Windows\SysWOW64\Nacboi32.exe
Size 320KB
SHA256 ddcc745cd1f4cd6b7ec9e05d60fae59b9a7a13d4a5d4b17ea808a95317006dc0
MD5 40b44f9b91be36f2305644311c22759e
SHA1 5333973e03e88ce5dc1641c55e81ea2d4e6f2ff0
SHA512 26ca8f11e841503b9a90a523aabe1c95f98c8fc84e57258071b2c7f0cce363fad5d056a7b88a60d257bedf61242542e727d51875f9fa4f456f04f2848c38b4e9
SSDEEP 3072:594YFVy3/vfrAZQQiF1hmErgwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:P4YirF1hmErgV/Ah1G/AcQ///NR5fn
TLSH
T1C3644115663049EACDEE1FB5EC124AD9A181E9F454F1E13E2123EFDCD8E4DA2E814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nbjhph32.exe

Path C:\Windows\SysWOW64\Nbjhph32.exe
Size 320KB
SHA256 a16e8a2c5297ef9fdb4314ce8d7b27f0308d20e5336cd1870cfa1c1fa8844a8a
MD5 f2259c55b8236fa86a8e9534f8e67712
SHA1 db52f7f91e966989af3b8b29fb87af0018040711
SHA512 9df047dd81c40fd967ea92038d42f2607e173fd56c125883937e7063f5fbd05921fe93967cea8ad6a848d7d4299da233a25aebe0082a1dfceee4ab249c86b644
SSDEEP 3072:GL4f6k0CnKImPI5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Gg6k0sII5V/Ah1G/AcQ///NR5fn
TLSH
T1E1642119663409EACEEE1BB6AC1249D89141EAF114F1E13F5523DFDCD8EDDA2C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncpelbap.exe

Path C:\Windows\SysWOW64\Ncpelbap.exe
Size 320KB
SHA256 ffabf279f1057210c2265ae5bc16ec143ebc710fe68fe834c4465bdec9b081ca
MD5 2a9c0d3a668a9558653f7c5b32c5ca76
SHA1 f2512893a0b4924b36b058eaa4d3069a05ac83ae
SHA512 86c6cd1871a580bc1fdecaa4ba61125cd02eb00d6a93e414ca78b7ad5e0ba95bf6e10bcb9e62ce6360cfef2366edb2cdafe305abac74f72a04391b47a3c4d505
SSDEEP 3072:GJV+xFJOp8oWn9KdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4V+FJXKdV/Ah1G/AcQ///NR5fn
TLSH
T16F641D192A3009EACEED1BB5AD1249D89541E9F214F1E13E6123DFDEC8E4DA6CC15FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nddkaddm.exe

Path C:\Windows\SysWOW64\Nddkaddm.exe
Size 320KB
SHA256 f1c4a210b81c22b40bc4b8942d3d14669b28569afae97d5020f19380f0c2c583
MD5 c3f08e7646526e79c5ec655860910141
SHA1 4d20309342da80f9d515e963e0c9f95fd58c7703
SHA512 371779799d0c592ad5b9585478c61f57b710938c45182a8960afad41b1139f8eca9b6743b449d4da2f017f92c9a8312a053ad71ca1ef59026e80557bf8d305cd
SSDEEP 3072:c5C+DqKGMukAILwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N7gLV/Ah1G/AcQ///NR5fn
TLSH
T1B4641F1A2A7419EBCDEE1BB5AC0249D89141E9F418F1E13E6523DFDCDCE4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngedbp32.exe

Path C:\Windows\SysWOW64\Ngedbp32.exe
Size 320KB
SHA256 01bb94e7ca56363b641dae414b0beb7c77e7878defea47fecef36581d2c29107
MD5 c362e356f49a05a2ea5331691cd76075
SHA1 628fd23b7c86ff2f8d710dbf384d48206aa30fb7
SHA512 cd5a158fbcb08418df166a890b08f350bcb9f96cf60f67958a4e25befefd2407519b4cc283db4c2930e5408140027cafce4fc52194f713eb835310b8f477f2dd
SSDEEP 3072:mhqInZroY8QwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dInCQV/Ah1G/AcQ///NR5fn
TLSH
T125643F1A2A340AEACDED1FB5AC025DD85141E9F114F5E13E6923DFDED8E4DA2C824F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Obanqgkl.exe

Path C:\Windows\SysWOW64\Obanqgkl.exe
Size 320KB
SHA256 a1e12e048723d9f1d2975f8a4ae2f3248f768198f55932308b7e3ec935ede5cc
MD5 18d72f5c6498cb8b6933a6cc0b375e58
SHA1 7db4080733b4cbd8c99cdd306925ad94c6128a9a
SHA512 2a4b4b2d9d58d528f07ea3bd16cb6aa1aeee94191d45e37d36dd8a765bd8655d033fb9019fae75a7c44d568e87a23c0869890868fe7477a002da84b5e205c88c
SSDEEP 3072:TFdwalrg06W0A7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:TF7g0L7V/Ah1G/AcQ///NR5fn
TLSH
T1A5643E1A2A3409FADEED1BB5AC4259E95181E8F018F1E17E6523DFDCD8F4DA2D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onceji32.exe

Path C:\Windows\SysWOW64\Onceji32.exe
Size 320KB
SHA256 633fe9400500bb811f77c8d32129625574f322338199a9e305afd0fcb8cd132f
MD5 9595d01ed5a4c482c29581354e4e3a67
SHA1 2388fd96eb73c2484b8734598af28765f4aa9043
SHA512 a5692e0b870ecb4735e3c87709288a985511dfcefd9cb3fe70cd79947686d43be3784eb0df8a1c52db5ca986fb2d179fd430154964f5a9c06a57ab578d109ab0
SSDEEP 3072:YcgOa/HrgwiwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YSa/swiV/Ah1G/AcQ///NR5fn
TLSH
T13C644F192A7509EACEEE1BB9EC1249D89145E8F014F1F13E6123EFDDD8E4DA6C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oqgkadod.exe

Path C:\Windows\SysWOW64\Oqgkadod.exe
Size 320KB
SHA256 8ea95933c739ebf5f0d6b39ff0944d70f091576b0e934cd65d3cff582646f380
MD5 7e81f3320686e89fc16451c905f28fc2
SHA1 c34b46b654290784c4a435caf5ac5d7027c226f6
SHA512 b30ae0458a3d76ae00f591eccd0860513a2507e9148a82fed881a96f7402992c1beda7df824036b52135d69806f8e67c17da46cdbbd60f8e4383a9fa5419fa26
SSDEEP 3072:B80yZifIgBLtEzq98nndTYgrdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lJAO9yndTY4dV/Ah1G/AcQ///NR5fn
TLSH
T1026431192A340AEACDED2FB5AC1249D85242E6F014F1E13E6123DFDCD9E4DA6CC19F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pabknbef.exe

Path C:\Windows\SysWOW64\Pabknbef.exe
Size 320KB
SHA256 721d588d65d94bbbf114276ce704acae7d838b3901ed51ad74994adb2b07607f
MD5 eb495527f2bb917c45f9f0bf4fa44560
SHA1 49ce3f98f0cee75374c9cc6d6b35f2739c9678dc
SHA512 e7e5c6943cf77a4eb1b3a41775414c7b105ffdf297d2b02a846e5c6b82187987773c6e21a8bb29bbc7726a5b608f92d128891ff3ee3b0fd996ca73005787233a
SSDEEP 3072:ipKNNzkMzTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fLhTV/Ah1G/AcQ///NR5fn
TLSH
T169641E592A3409EACEED1BB5EC024DD89145E8F018F1E13E6123DFDCD8E4DA6D85AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pegqmbch.exe

Path C:\Windows\SysWOW64\Pegqmbch.exe
Size 320KB
SHA256 53b270a12693dbb98e6df2db0ed1446571cd13571912fa2ba02877d6278400d5
MD5 d41c6ed86981cf352eee30fd393c7664
SHA1 0567eb9212e416195031a9335d5995ce78e33d9b
SHA512 af0267492daf56112471a34d6117406f0a10b0a8decd13851b3fdb19c8f4de69e8dc4fe0c395876e677c940d0c6e8c8852b876b82e9234a230967a42d4290ba4
SSDEEP 3072:TaLcgIiawuoiMb7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:TaLcgIih97V/Ah1G/AcQ///NR5fn
TLSH
T110640D19263409EACEED1BB9AC2249DC5181E9F014F1E13E6523DFECD8E4DA2EC15F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peimcaae.exe

Path C:\Windows\SysWOW64\Peimcaae.exe
Size 320KB
SHA256 3f64982e65258da6a02ac9ab03c06b0b50f8ba0b1d404b8425989d0fa9e918fc
MD5 546958caea78e15821d54898a553e8d3
SHA1 9010990cd333cb74e45d5478de64874f97b3cdb2
SHA512 11271b01e55b3a6b34da6cc8990aca6e7393c6c8561dc47606fce3e71f278b2aa911983ecb1b5ea136d9f9b1368058f3f1ada50030966454e8e14eda611633d4
SSDEEP 3072:9hEgfjlQt2bbZlSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Mgb5nSV/Ah1G/AcQ///NR5fn
TLSH
T19F640C1926300DEACDED5BB5AC1649D85185EAF014F5E13EA123DFDCD8E4DA2CC2AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peljha32.exe

Path C:\Windows\SysWOW64\Peljha32.exe
Size 320KB
SHA256 33b507678df0b10348e56de341f7f06553d1d06ddf281c2b13e92ee330733095
MD5 f48b055b0805ce9192d6788e6c6cb6ab
SHA1 5598f87bb62408b8eac12b6a08afebb593367069
SHA512 0c5e21d53b7e8c45f6261e0d0c0e7e01166d9c5f5f661e898c8f46effe5617fa4a9a8ac38c52b00d6682ccd7f4cfd123c80bc024a36c1797c814f5dca0cc8ab6
SSDEEP 3072:DhmOLs3FQRH5aueXyn4iwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Rs3+R0u8yn4iV/Ah1G/AcQ///NR5fn
TLSH
T1D864FC152A3449EACDED1BB5AC1249E85581EAF01CF1E13E6123DFECC8F4DA6D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pglcjl32.exe

Path C:\Windows\SysWOW64\Pglcjl32.exe
Size 320KB
SHA256 a79f55faf66638697935a42032f91cab68300f4a1169954871e7ebb19e1b1d03
MD5 4fd3c32c24183357f3eff2fd37db0f2d
SHA1 cd09cabd5251beb3194c09609bf51c25e278d703
SHA512 a790c3a0e6cb5b25bc0355e4baeb49967a54811996dfb8c28b9fc3e2a173892cd1e499b759053ec9d2c1b3a45e99a4258f77da7a13386b65bb50269469f26d09
SSDEEP 3072:hZJy8cFD+X82DvMNCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jJyhDFivMCV/Ah1G/AcQ///NR5fn
TLSH
T16A642E19263809EACEED1BB5AC0259F85151E9F014F1E23E6123DFDED9E4DA6C809FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pkebekgo.exe

Path C:\Windows\SysWOW64\Pkebekgo.exe
Size 320KB
SHA256 28914c985c7869872806d5d6a838b50ec8b2b6f288e06a6bfb118872ac1fc3bc
MD5 4c7d6d5bfd51c89cc5a036d5c165dadc
SHA1 c266625b498d157fd95fb3c0987906ea574b03cc
SHA512 bc4c04a8b6f151aec90d5096daa5accc3245e22b5f347a3e726bf28d494a3dfd1c05388974923f6bfd03a1ea92945a9fba536d32c392883cb60d31e38e6aac5c
SSDEEP 3072:X2JZYOummWABwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GHzuWABV/Ah1G/AcQ///NR5fn
TLSH
T1C4640C192A3049EACEED1BB6AD1249D89185E8F014F1E13E6523DFDCCCE4DA6DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pqihgcma.exe

Path C:\Windows\SysWOW64\Pqihgcma.exe
Size 320KB
SHA256 1690e10b2ea803c3df00372f2e602cc64bdf5a991a171e2519386fc16b14e226
MD5 b81b2b991b6ebf4358aea6b1af384c98
SHA1 ff86dd180b250e56bc6fa3cff0ee18f1d6c1b299
SHA512 0199a9045c2772843de888500e4f9e50952cbdede2cd9939a76041f4ee19f95426949d394ffb30d53a51f573b080163e19dd77092f3793ecf75b7428985bda7c
SSDEEP 3072:Q5CuCBbWN/+DBwh4CU17Au7wjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:53g/+DBxJhsjV/Ah1G/AcQ///NR5fn
TLSH
T14F6430192A7049EACEED1FB6AC1259D89145E9F018F1E13E6123DFDCD8F4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qebpipij.exe

Path C:\Windows\SysWOW64\Qebpipij.exe
Size 320KB
SHA256 79ffd8ce4bb6a50235ae0fc2a4e6691e8942be4a98d5e267b762ef0420e558e7
MD5 2abe31a4379e8b912b3452c64178b404
SHA1 141a424d44d0f07d003521c59286069081c0e9ab
SHA512 fb29d30369c4f61fd474a2fa6cad0713c2d6283126fde698ac9038ed4a64ff920661352a7b327046d88ae32d0d42a3a6138484bc902482068e175c85cce02d1c
SSDEEP 3072:DYFahdPDYXHvsmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0CtkvsmV/Ah1G/AcQ///NR5fn
TLSH
T1C1641D1A2A340AEACEED2FB5AC8249D95141E5F014F1E13E6167DFDCD8E4DA2D806FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qlmhfj32.exe

Path C:\Windows\SysWOW64\Qlmhfj32.exe
Size 320KB
SHA256 ae5a729023afe0a50741a438c4d0fa0f84944a71bae9fe5d69b5dededcdf0ad7
MD5 b044a4ffb5b90c4e0ae94c553e4c363f
SHA1 bd31f5e5826ad6d5457e306de0de7d8ae9f9313e
SHA512 4cc6f789876589a32cc4a9148c32ee11189ae162ae28743e2ad847b0cb0d650eca1f2b9c6d88edf98c97b710121eff2871d756b21ec59d8fd8c0c4f0841009c3
SSDEEP 3072:Y5SMxzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YdxzV/Ah1G/AcQ///NR5fn
TLSH
T1FB64EB19263409EACDED1BB9EC0289D85141E9F119F1E13E6623DFDCE8E4DA2D819FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/468-348-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/624-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/776-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/816-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/844-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/900-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1072-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1132-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1140-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1328-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1544-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1560-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1580-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1684-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1788-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1896-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2012-78-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2024-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2072-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2136-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2152-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2176-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2320-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2348-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2364-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2540-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2544-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2744-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2784-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3028-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3096-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3120-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3132-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3176-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-85-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3264-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3264-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3360-183-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3516-120-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3592-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3752-106-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3768-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3776-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3784-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3796-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3828-225-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4108-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4136-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4288-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4296-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4308-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4408-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4432-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4456-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4460-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4508-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4508-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4512-218-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4664-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4776-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4776-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4780-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4884-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4900-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5004-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5004-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5028-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5108-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5108-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5124-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5156-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5164-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5276-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5340-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5396-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5400-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5432-127-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5440-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5448-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5512-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5668-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5668-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5720-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5748-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5812-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5880-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5948-403-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-141-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6000-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6000-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/6000-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6044-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6076-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads