berbew | 9911f8b7533b97ebf0349f22a848792ccf7e1484a1fd9065ca80bf6a70793f88

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e2c5432966a64f66f279a8405938a9c8_elex_wannacry.exe
Size 320KB
Sample260720-rd9b8aev5y
SHA256 9911f8b7533b97ebf0349f22a848792ccf7e1484a1fd9065ca80bf6a70793f88
MD5 e2c5432966a64f66f279a8405938a9c8
SHA1 af2539274b2f311f6b801c80f0611b30f214b5dd
SHA512 3258a6d44e2dac2411e76915661289ddabaa05d8c15829d20d5a8f586f6e061823d87b9ef92a67e12e95611da487e8454cc6ec535abe9a741d8d23fe552243b0
SSDEEP 3072:hIYXiqnIFxgUMT5mwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PXiqnj3oV/Ah1G/AcQ///NR5fn
TLSH
T15A644119263009EACEED2FB6AC5249D99142E9F014F1E13E6537DFDCD8E4DA6E804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aifdcgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fabqdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akffjkme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkgpleaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhphfppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khknaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcgackke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkkemble.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhbkccji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbecgned.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgephccp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iibclmkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjciano.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnokeqll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkkndp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhinmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkahba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knbaoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apcemh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpkddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjkacoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhbbmjne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcbfjqkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edcqojqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epndddnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdjjemp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpkddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idbfhiko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfngke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkjocm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgnief32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhdbaihi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghgjlaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npedfjfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iklgkmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkgmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naecieef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddklnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbeinb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbgoik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knbiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmklaaek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnodkjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djhifnho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fllkjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edfdop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idbfhiko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhoomd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noijmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Diafkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clplff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pploli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmpoemef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emniheha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqoijcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijnqld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjlmmbfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nelfnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfnojh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcpieamc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbpoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmabpmjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efepln32.exe

Executes dropped EXE 64 IoCs

pid	Process
4480	Mcklac32.exe
3404	Mpoljg32.exe
4156	Mncmck32.exe
1304	Nglala32.exe
2656	Naaejj32.exe
4592	Njogdldg.exe
5656	Nddkaddm.exe
6024	Njacikbd.exe
5756	Njcpok32.exe
3300	Ojjfpjjj.exe
4240	Occkhp32.exe
5124	Ojmcej32.exe
4920	Pgcpdn32.exe
1132	Pgemimck.exe
4184	Pkcepl32.exe
3584	Papnhbgi.exe
4972	Pbpjbe32.exe
1856	Qgopplkq.exe
4648	Qlmhfj32.exe
5468	Aloekjod.exe
3384	Aalndaml.exe
2348	Ahffqk32.exe
4992	Ahjoljqc.exe
932	Abpcicpi.exe
3356	Bdcmfkde.exe
5892	Bhaeli32.exe
1244	Bbgiibja.exe
3484	Bhdbaihi.exe
5132	Bejoqm32.exe
4104	Chkhbh32.exe
3812	Cbqlpabf.exe
2404	Cbcieqpd.exe
3396	Clknnf32.exe
2512	Chbncg32.exe
1252	Cajblmci.exe
3432	Dkbgeb32.exe
4060	Ddklnh32.exe
4460	Dkedjbgg.exe
2480	Daolgl32.exe
5648	Docmqp32.exe
2904	Dememj32.exe
5700	Dlgmjdlg.exe
5776	Ddbbngjb.exe
4772	Dogfkpih.exe
1596	Deanhj32.exe
1544	Eojcao32.exe
5380	Edgkif32.exe
1044	Ekqcfpmj.exe
4336	Eaklcj32.exe
4396	Ehddpdlc.exe
5492	Edkddeag.exe
2764	Eoaianan.exe
5356	Eleikb32.exe
3304	Eaabci32.exe
4552	Fkjfloeo.exe
2236	Fdbked32.exe
5916	Fdegkdim.exe
4844	Fkopgn32.exe
2540	Fhbpqb32.exe
4888	Fbkdjh32.exe
1184	Flqigq32.exe
3424	Ghgjlaln.exe
124	Gkffhmka.exe
796	Glebbpbd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ojjhfe32.dll	Cckkmg32.exe
File created	C:\Windows\SysWOW64\Ipflcnln.exe	Ikickgnf.exe
File created	C:\Windows\SysWOW64\Mfchehla.exe	Mqfpma32.exe
File opened for modification	C:\Windows\SysWOW64\Bjkacoji.exe	Benijhla.exe
File created	C:\Windows\SysWOW64\Lecnkice.dll	Lbghpinc.exe
File created	C:\Windows\SysWOW64\Hblaqjod.dll	Qhlamhkj.exe
File created	C:\Windows\SysWOW64\Pajidikl.dll	Dklhmlac.exe
File created	C:\Windows\SysWOW64\Lnnidjcg.exe	Liaqlcep.exe
File created	C:\Windows\SysWOW64\Kmpbdj32.dll	Ahonbhig.exe
File created	C:\Windows\SysWOW64\Enigek32.exe	Emhkmcbd.exe
File created	C:\Windows\SysWOW64\Qobhepjf.exe	Qhhphebj.exe
File created	C:\Windows\SysWOW64\Aajggjap.exe	Akpojpic.exe
File created	C:\Windows\SysWOW64\Djhifnho.exe	Dpbdiehi.exe
File created	C:\Windows\SysWOW64\Acanjcbi.dll	Inlibb32.exe
File created	C:\Windows\SysWOW64\Hfhgdc32.exe	Hlbcgj32.exe
File created	C:\Windows\SysWOW64\Ajeami32.exe	Aifdcgcp.exe
File created	C:\Windows\SysWOW64\Geleenbj.dll	Ahdgnj32.exe
File opened for modification	C:\Windows\SysWOW64\Npedfjfo.exe	Nbadmege.exe
File created	C:\Windows\SysWOW64\Aompjamo.exe	Ajqgbjoh.exe
File created	C:\Windows\SysWOW64\Ekhncp32.exe	Efkfkilj.exe
File created	C:\Windows\SysWOW64\Iojbid32.exe	Illfmi32.exe
File opened for modification	C:\Windows\SysWOW64\Knbaoh32.exe	Kflink32.exe
File created	C:\Windows\SysWOW64\Pnkbdqpo.exe	Phajgf32.exe
File opened for modification	C:\Windows\SysWOW64\Dgpgplej.exe	Dacohegc.exe
File created	C:\Windows\SysWOW64\Lmkmilfb.dll	Inbpbnlg.exe
File created	C:\Windows\SysWOW64\Ahakhg32.exe	Acdbpq32.exe
File created	C:\Windows\SysWOW64\Jlhlcnge.exe	Jkgpleaf.exe
File created	C:\Windows\SysWOW64\Mjlhpgfn.exe	Mcbpcm32.exe
File created	C:\Windows\SysWOW64\Ehkhjkkf.dll	Njekfenc.exe
File opened for modification	C:\Windows\SysWOW64\Bhaeli32.exe	Bdcmfkde.exe
File opened for modification	C:\Windows\SysWOW64\Gkjocm32.exe	Gfngke32.exe
File created	C:\Windows\SysWOW64\Fejbhf32.dll	Miofcked.exe
File opened for modification	C:\Windows\SysWOW64\Cmabpmjj.exe	Cbkncd32.exe
File created	C:\Windows\SysWOW64\Bfbjhh32.dll	Ipflcnln.exe
File created	C:\Windows\SysWOW64\Klhglj32.dll	Bdkgckal.exe
File opened for modification	C:\Windows\SysWOW64\Gmlhbo32.exe	Gohhik32.exe
File created	C:\Windows\SysWOW64\Gekckpgl.exe	Goqkne32.exe
File opened for modification	C:\Windows\SysWOW64\Bmomecoi.exe	Bfedhihl.exe
File opened for modification	C:\Windows\SysWOW64\Kcgnkgkl.exe	Jlmfomcp.exe
File created	C:\Windows\SysWOW64\Odhipp32.exe	Omnqcfig.exe
File opened for modification	C:\Windows\SysWOW64\Lqjqab32.exe	Lfeldj32.exe
File opened for modification	C:\Windows\SysWOW64\Pffghc32.exe	Pploli32.exe
File opened for modification	C:\Windows\SysWOW64\Gkdhcqcj.exe	Gpodfh32.exe
File opened for modification	C:\Windows\SysWOW64\Efoiko32.exe	Elienf32.exe
File created	C:\Windows\SysWOW64\Jjlmmbfo.exe	Jcbdph32.exe
File opened for modification	C:\Windows\SysWOW64\Nalpbf32.exe	Mjahfl32.exe
File created	C:\Windows\SysWOW64\Cnahmo32.exe	Clplff32.exe
File created	C:\Windows\SysWOW64\Ompfnoci.exe	Ojajbdde.exe
File created	C:\Windows\SysWOW64\Kdnincal.exe	Kihdqkaf.exe
File created	C:\Windows\SysWOW64\Hnfgci32.dll	Djhpqdlj.exe
File opened for modification	C:\Windows\SysWOW64\Bmliem32.exe	Bfbahcfc.exe
File created	C:\Windows\SysWOW64\Diafkl32.exe	Dcdnce32.exe
File opened for modification	C:\Windows\SysWOW64\Bnkbmp32.exe	Bhnidi32.exe
File created	C:\Windows\SysWOW64\Lqfgfclm.exe	Lgmbmn32.exe
File created	C:\Windows\SysWOW64\Mpoepa32.exe	Mgfqgkib.exe
File created	C:\Windows\SysWOW64\Djaigibm.dll	Qgnief32.exe
File opened for modification	C:\Windows\SysWOW64\Amdddkma.exe	Aclpkffa.exe
File created	C:\Windows\SysWOW64\Iddkqo32.dll	Fdlcehhn.exe
File created	C:\Windows\SysWOW64\Oeccijoh.exe	Noijmp32.exe
File opened for modification	C:\Windows\SysWOW64\Pacfdila.exe	Ooejhn32.exe
File created	C:\Windows\SysWOW64\Bqhioabk.dll	Hfekoc32.exe
File opened for modification	C:\Windows\SysWOW64\Iojbid32.exe	Illfmi32.exe
File opened for modification	C:\Windows\SysWOW64\Hmoehojj.exe	Hcfqoici.exe
File created	C:\Windows\SysWOW64\Aqoijcbo.exe	Ajeami32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13656	13532	WerFault.exe	930

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnahmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enigek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpkddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoagdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohebek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbmjhdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahbjij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhaeli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chhdbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpmlhoil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dclknkfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acfhkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgefae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adanbffk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnlhod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcncjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djhpqdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpcmagpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plndma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akffjkme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmndjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddhhnana.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhpmql32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olgdgibf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcbfjqkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhinmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajdjcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejoogm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijnqld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njcpok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpoepa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eoilfidj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlhkqngo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaliidon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ponfdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdggoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfekoc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfhkop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncggqbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkanmel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gijedm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pahppihl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknocb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbdqpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmpoemef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cokpekpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kglcmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oifekg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbomfokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbpcah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcklac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcgmiiii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpkffa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npedfjfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bciebm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eohcon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddfikaeq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idebniil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbghpinc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgjnpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidaleei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojdd32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	2026-07-20_e2c5432966a64f66f279a8405938a9c8_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flqigq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blcmakcp.dll"	Fneohd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibjanpje.dll"	Adanbffk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gipgea32.dll"	Occkhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejngcgpo.dll"	Mebkbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loqejjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccpdhfmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knbiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hblaqjod.dll"	Qhlamhkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhdhhchf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikndpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nofinm32.dll"	Nifldj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beoqlipd.dll"	Glebbpbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jndmgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iemkjd32.dll"	Jgakkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Colklb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgqqnjea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Noeaaqlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odhipp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldbgealc.dll"	Doanno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkffhmka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lajhfkfo.dll"	Lffhpnhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibcadcgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkffhmka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkchoaif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkbmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehfjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnjhccnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohebek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcqhfmhe.dll"	Acfoep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fipkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdimaigf.dll"	Cnahmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abgmacde.dll"	Mgfqgkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihpinq32.dll"	Lhkghofb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bekdmnio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbpcah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkmaja32.dll"	Pahppihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojjhfe32.dll"	Cckkmg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ejoogm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgbcilhf.dll"	Ohfafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qoboofnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eeelge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpodhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgfnpbgo.dll"	Flqigq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iklgkmop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqhdlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgfpal32.dll"	Fkkemble.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdfoaf32.dll"	Qhigbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lofklp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flqigq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqfjpc32.dll"	Iehfno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlhbja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipgifkfb.dll"	Nhpbpepo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jefbcdik.dll"	Ahbacq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojblpdbb.dll"	Qdjgbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjjlep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efoiko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnahmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkmogbeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmdgbamf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cifhmeli.dll"	Pfanmcao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngmggj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmcmmh32.dll"	Fpjjkh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4480	6112	2026-07-20_e2c5432966a64f66f279a8405938a9c8_elex_wannacry.exe	89
PID 4480 wrote to memory of 3404	4480	Mcklac32.exe	90
PID 3404 wrote to memory of 4156	3404	Mpoljg32.exe	91
PID 4156 wrote to memory of 1304	4156	Mncmck32.exe	92
PID 1304 wrote to memory of 2656	1304	Nglala32.exe	93
PID 2656 wrote to memory of 4592	2656	Naaejj32.exe	94
PID 4592 wrote to memory of 5656	4592	Njogdldg.exe	95
PID 5656 wrote to memory of 6024	5656	Nddkaddm.exe	96
PID 6024 wrote to memory of 5756	6024	Njacikbd.exe	97
PID 5756 wrote to memory of 3300	5756	Njcpok32.exe	98
PID 3300 wrote to memory of 4240	3300	Ojjfpjjj.exe	99
PID 4240 wrote to memory of 5124	4240	Occkhp32.exe	100
PID 5124 wrote to memory of 4920	5124	Ojmcej32.exe	101
PID 4920 wrote to memory of 1132	4920	Pgcpdn32.exe	102
PID 1132 wrote to memory of 4184	1132	Pgemimck.exe	103
PID 4184 wrote to memory of 3584	4184	Pkcepl32.exe	104
PID 3584 wrote to memory of 4972	3584	Papnhbgi.exe	105
PID 4972 wrote to memory of 1856	4972	Pbpjbe32.exe	106
PID 1856 wrote to memory of 4648	1856	Qgopplkq.exe	107
PID 4648 wrote to memory of 5468	4648	Qlmhfj32.exe	108
PID 5468 wrote to memory of 3384	5468	Aloekjod.exe	109
PID 3384 wrote to memory of 2348	3384	Aalndaml.exe	110
PID 2348 wrote to memory of 4992	2348	Ahffqk32.exe	111
PID 4992 wrote to memory of 932	4992	Ahjoljqc.exe	112
PID 932 wrote to memory of 3356	932	Abpcicpi.exe	113
PID 3356 wrote to memory of 5892	3356	Bdcmfkde.exe	114
PID 5892 wrote to memory of 1244	5892	Bhaeli32.exe	115
PID 1244 wrote to memory of 3484	1244	Bbgiibja.exe	116
PID 3484 wrote to memory of 5132	3484	Bhdbaihi.exe	117
PID 5132 wrote to memory of 4104	5132	Bejoqm32.exe	118
PID 4104 wrote to memory of 3812	4104	Chkhbh32.exe	119
PID 3812 wrote to memory of 2404	3812	Cbqlpabf.exe	120
PID 2404 wrote to memory of 3396	2404	Cbcieqpd.exe	121
PID 3396 wrote to memory of 2512	3396	Clknnf32.exe	122
PID 2512 wrote to memory of 1252	2512	Chbncg32.exe	123
PID 1252 wrote to memory of 3432	1252	Cajblmci.exe	124
PID 3432 wrote to memory of 4060	3432	Dkbgeb32.exe	125
PID 4060 wrote to memory of 4460	4060	Ddklnh32.exe	126
PID 4460 wrote to memory of 2480	4460	Dkedjbgg.exe	127
PID 2480 wrote to memory of 5648	2480	Daolgl32.exe	128
PID 5648 wrote to memory of 2904	5648	Docmqp32.exe	129
PID 2904 wrote to memory of 5700	2904	Dememj32.exe	130
PID 5700 wrote to memory of 5776	5700	Dlgmjdlg.exe	131
PID 5776 wrote to memory of 4772	5776	Ddbbngjb.exe	132
PID 4772 wrote to memory of 1596	4772	Dogfkpih.exe	133
PID 1596 wrote to memory of 1544	1596	Deanhj32.exe	134
PID 1544 wrote to memory of 5380	1544	Eojcao32.exe	135
PID 5380 wrote to memory of 1044	5380	Edgkif32.exe	136
PID 1044 wrote to memory of 4336	1044	Ekqcfpmj.exe	137
PID 4336 wrote to memory of 4396	4336	Eaklcj32.exe	138
PID 4396 wrote to memory of 5492	4396	Ehddpdlc.exe	139
PID 5492 wrote to memory of 2764	5492	Edkddeag.exe	140
PID 2764 wrote to memory of 5356	2764	Eoaianan.exe	141
PID 5356 wrote to memory of 3304	5356	Eleikb32.exe	142
PID 3304 wrote to memory of 4552	3304	Eaabci32.exe	143
PID 4552 wrote to memory of 2236	4552	Fkjfloeo.exe	144
PID 2236 wrote to memory of 5916	2236	Fdbked32.exe	145
PID 5916 wrote to memory of 4844	5916	Fdegkdim.exe	146
PID 4844 wrote to memory of 2540	4844	Fkopgn32.exe	147
PID 2540 wrote to memory of 4888	2540	Fhbpqb32.exe	148
PID 4888 wrote to memory of 1184	4888	Fbkdjh32.exe	149
PID 1184 wrote to memory of 3424	1184	Flqigq32.exe	150
PID 3424 wrote to memory of 124	3424	Ghgjlaln.exe	151
PID 124 wrote to memory of 796	124	Gkffhmka.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e2c5432966a64f66f279a8405938a9c8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e2c5432966a64f66f279a8405938a9c8_elex_wannacry.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\SysWOW64\Mcklac32.exe
  C:\Windows\system32\Mcklac32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\Mpoljg32.exe
    C:\Windows\system32\Mpoljg32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\SysWOW64\Mncmck32.exe
      C:\Windows\system32\Mncmck32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1304
      - C:\Windows\SysWOW64\Naaejj32.exe
        
        C:\Windows\system32\Naaejj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Njogdldg.exe
        
        C:\Windows\system32\Njogdldg.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Nddkaddm.exe
        
        C:\Windows\system32\Nddkaddm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5656
        
        C:\Windows\SysWOW64\Njacikbd.exe
        
        C:\Windows\system32\Njacikbd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6024
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\SysWOW64\Ojjfpjjj.exe
        
        C:\Windows\system32\Ojjfpjjj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Occkhp32.exe
        
        C:\Windows\system32\Occkhp32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Windows\SysWOW64\Pgcpdn32.exe
        
        C:\Windows\system32\Pgcpdn32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Pgemimck.exe
        
        C:\Windows\system32\Pgemimck.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Pkcepl32.exe
        
        C:\Windows\system32\Pkcepl32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Papnhbgi.exe
        
        C:\Windows\system32\Papnhbgi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Pbpjbe32.exe
        
        C:\Windows\system32\Pbpjbe32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Qgopplkq.exe
        
        C:\Windows\system32\Qgopplkq.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Qlmhfj32.exe
        
        C:\Windows\system32\Qlmhfj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Aloekjod.exe
        
        C:\Windows\system32\Aloekjod.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5468
        
        C:\Windows\SysWOW64\Aalndaml.exe
        
        C:\Windows\system32\Aalndaml.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Ahffqk32.exe
        
        C:\Windows\system32\Ahffqk32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\Ahjoljqc.exe
        
        C:\Windows\system32\Ahjoljqc.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Abpcicpi.exe
        
        C:\Windows\system32\Abpcicpi.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Bdcmfkde.exe
        
        C:\Windows\system32\Bdcmfkde.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\SysWOW64\Bbgiibja.exe
        
        C:\Windows\system32\Bbgiibja.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Bhdbaihi.exe
        
        C:\Windows\system32\Bhdbaihi.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Bejoqm32.exe
        
        C:\Windows\system32\Bejoqm32.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Windows\SysWOW64\Chkhbh32.exe
        
        C:\Windows\system32\Chkhbh32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Cbqlpabf.exe
        
        C:\Windows\system32\Cbqlpabf.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Cbcieqpd.exe
        
        C:\Windows\system32\Cbcieqpd.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Clknnf32.exe
        
        C:\Windows\system32\Clknnf32.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Chbncg32.exe
        
        C:\Windows\system32\Chbncg32.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\Dkbgeb32.exe
        
        C:\Windows\system32\Dkbgeb32.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Ddklnh32.exe
        
        C:\Windows\system32\Ddklnh32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Docmqp32.exe
        
        C:\Windows\system32\Docmqp32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Windows\SysWOW64\Dememj32.exe
        
        C:\Windows\system32\Dememj32.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\Dlgmjdlg.exe
        
        C:\Windows\system32\Dlgmjdlg.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5700
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5776
        
        C:\Windows\SysWOW64\Dogfkpih.exe
        
        C:\Windows\system32\Dogfkpih.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Deanhj32.exe
        
        C:\Windows\system32\Deanhj32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Edgkif32.exe
        
        C:\Windows\system32\Edgkif32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5380
        
        C:\Windows\SysWOW64\Ekqcfpmj.exe
        
        C:\Windows\system32\Ekqcfpmj.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Eaklcj32.exe
        
        C:\Windows\system32\Eaklcj32.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Ehddpdlc.exe
        
        C:\Windows\system32\Ehddpdlc.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Edkddeag.exe
        
        C:\Windows\system32\Edkddeag.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5492
        
        C:\Windows\SysWOW64\Eoaianan.exe
        
        C:\Windows\system32\Eoaianan.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Eleikb32.exe
        
        C:\Windows\system32\Eleikb32.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Windows\SysWOW64\Eaabci32.exe
        
        C:\Windows\system32\Eaabci32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Fkjfloeo.exe
        
        C:\Windows\system32\Fkjfloeo.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Fdbked32.exe
        
        C:\Windows\system32\Fdbked32.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Fdegkdim.exe
        
        C:\Windows\system32\Fdegkdim.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Windows\SysWOW64\Fkopgn32.exe
        
        C:\Windows\system32\Fkopgn32.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Fhbpqb32.exe
        
        C:\Windows\system32\Fhbpqb32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Fbkdjh32.exe
        
        C:\Windows\system32\Fbkdjh32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\Flqigq32.exe
        
        C:\Windows\system32\Flqigq32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Ghgjlaln.exe
        
        C:\Windows\system32\Ghgjlaln.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Gkffhmka.exe
        
        C:\Windows\system32\Gkffhmka.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:124
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:796
        
        C:\Windows\SysWOW64\Gfngke32.exe
        
        C:\Windows\system32\Gfngke32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Gkjocm32.exe
        
        C:\Windows\system32\Gkjocm32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1532
        
        C:\Windows\SysWOW64\Gbdgpfni.exe
        
        C:\Windows\system32\Gbdgpfni.exe
        68⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Ghnpmqef.exe
        
        C:\Windows\system32\Ghnpmqef.exe
        69⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Gohhik32.exe
        
        C:\Windows\system32\Gohhik32.exe
        70⤵
        Drops file in System32 directory
        
        PID:3912
        
        C:\Windows\SysWOW64\Gmlhbo32.exe
        
        C:\Windows\system32\Gmlhbo32.exe
        71⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Hcfqoici.exe
        
        C:\Windows\system32\Hcfqoici.exe
        72⤵
        Drops file in System32 directory
        
        PID:5116
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        73⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        74⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Hkdbik32.exe
        
        C:\Windows\system32\Hkdbik32.exe
        75⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Helfbqeb.exe
        
        C:\Windows\system32\Helfbqeb.exe
        76⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Hcmgphma.exe
        
        C:\Windows\system32\Hcmgphma.exe
        77⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Hmfkin32.exe
        
        C:\Windows\system32\Hmfkin32.exe
        78⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Hbbdad32.exe
        
        C:\Windows\system32\Hbbdad32.exe
        79⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        80⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Hpfdkiac.exe
        
        C:\Windows\system32\Hpfdkiac.exe
        81⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\Imjddmpl.exe
        
        C:\Windows\system32\Imjddmpl.exe
        82⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Ifcimb32.exe
        
        C:\Windows\system32\Ifcimb32.exe
        83⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Icgjfgef.exe
        
        C:\Windows\system32\Icgjfgef.exe
        84⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Iehfno32.exe
        
        C:\Windows\system32\Iehfno32.exe
        85⤵
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Imakdl32.exe
        
        C:\Windows\system32\Imakdl32.exe
        86⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Ibncmchl.exe
        
        C:\Windows\system32\Ibncmchl.exe
        87⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        88⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        89⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Jbeinb32.exe
        
        C:\Windows\system32\Jbeinb32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1788
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        91⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jmmjpjpg.exe
        
        C:\Windows\system32\Jmmjpjpg.exe
        92⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Jbjciano.exe
        
        C:\Windows\system32\Jbjciano.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4800
        
        C:\Windows\SysWOW64\Jmpgfjmd.exe
        
        C:\Windows\system32\Jmpgfjmd.exe
        94⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Kfhkop32.exe
        
        C:\Windows\system32\Kfhkop32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Kppphe32.exe
        
        C:\Windows\system32\Kppphe32.exe
        96⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Kihdqkaf.exe
        
        C:\Windows\system32\Kihdqkaf.exe
        97⤵
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\Kdnincal.exe
        
        C:\Windows\system32\Kdnincal.exe
        98⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Kpeibdfp.exe
        
        C:\Windows\system32\Kpeibdfp.exe
        99⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Kimnlj32.exe
        
        C:\Windows\system32\Kimnlj32.exe
        100⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Kfanen32.exe
        
        C:\Windows\system32\Kfanen32.exe
        101⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Lpjcnd32.exe
        
        C:\Windows\system32\Lpjcnd32.exe
        102⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Lefkfk32.exe
        
        C:\Windows\system32\Lefkfk32.exe
        103⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        104⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Lffhpnhe.exe
        
        C:\Windows\system32\Lffhpnhe.exe
        105⤵
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Lpnlicne.exe
        
        C:\Windows\system32\Lpnlicne.exe
        106⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Lifqbi32.exe
        
        C:\Windows\system32\Lifqbi32.exe
        107⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Lboeknkf.exe
        
        C:\Windows\system32\Lboeknkf.exe
        108⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Lpcedbjp.exe
        
        C:\Windows\system32\Lpcedbjp.exe
        109⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Mljficpd.exe
        
        C:\Windows\system32\Mljficpd.exe
        110⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Mebkbi32.exe
        
        C:\Windows\system32\Mebkbi32.exe
        111⤵
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Mphoob32.exe
        
        C:\Windows\system32\Mphoob32.exe
        112⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Mlnpdc32.exe
        
        C:\Windows\system32\Mlnpdc32.exe
        113⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Megdmhbp.exe
        
        C:\Windows\system32\Megdmhbp.exe
        114⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Mgfqgkib.exe
        
        C:\Windows\system32\Mgfqgkib.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3296
        
        C:\Windows\SysWOW64\Mpoepa32.exe
        
        C:\Windows\system32\Mpoepa32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Windows\SysWOW64\Nigjifgc.exe
        
        C:\Windows\system32\Nigjifgc.exe
        117⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        118⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Nlhbja32.exe
        
        C:\Windows\system32\Nlhbja32.exe
        119⤵
        Modifies registry class
        
        PID:616
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        120⤵
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        121⤵
        
        PID:716
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:4368
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        124⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        125⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Odhman32.exe
        
        C:\Windows\system32\Odhman32.exe
        126⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        127⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Odkjgm32.exe
        
        C:\Windows\system32\Odkjgm32.exe
        128⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Oflfoepg.exe
        
        C:\Windows\system32\Oflfoepg.exe
        129⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Olfolp32.exe
        
        C:\Windows\system32\Olfolp32.exe
        130⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Ofncde32.exe
        
        C:\Windows\system32\Ofncde32.exe
        131⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Oqdgan32.exe
        
        C:\Windows\system32\Oqdgan32.exe
        132⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        133⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Omjhgoco.exe
        
        C:\Windows\system32\Omjhgoco.exe
        134⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Pgpmdh32.exe
        
        C:\Windows\system32\Pgpmdh32.exe
        135⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Pcgmiiii.exe
        
        C:\Windows\system32\Pcgmiiii.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Pjaefc32.exe
        
        C:\Windows\system32\Pjaefc32.exe
        137⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Pcijoh32.exe
        
        C:\Windows\system32\Pcijoh32.exe
        138⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Pdifhkni.exe
        
        C:\Windows\system32\Pdifhkni.exe
        139⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        140⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Pcncjh32.exe
        
        C:\Windows\system32\Pcncjh32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6164
        
        C:\Windows\SysWOW64\Pncggqbg.exe
        
        C:\Windows\system32\Pncggqbg.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Qgllpf32.exe
        
        C:\Windows\system32\Qgllpf32.exe
        143⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Qmhdhm32.exe
        
        C:\Windows\system32\Qmhdhm32.exe
        144⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Qgnief32.exe
        
        C:\Windows\system32\Qgnief32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Qmkanmel.exe
        
        C:\Windows\system32\Qmkanmel.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
        
        C:\Windows\SysWOW64\Aceijg32.exe
        
        C:\Windows\system32\Aceijg32.exe
        147⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Anjngp32.exe
        
        C:\Windows\system32\Anjngp32.exe
        148⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Agcbqecp.exe
        
        C:\Windows\system32\Agcbqecp.exe
        149⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Anmjmojl.exe
        
        C:\Windows\system32\Anmjmojl.exe
        150⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ajckbp32.exe
        
        C:\Windows\system32\Ajckbp32.exe
        151⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Aclpkffa.exe
        
        C:\Windows\system32\Aclpkffa.exe
        152⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Windows\SysWOW64\Amdddkma.exe
        
        C:\Windows\system32\Amdddkma.exe
        153⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Afmhma32.exe
        
        C:\Windows\system32\Afmhma32.exe
        154⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Benijhla.exe
        
        C:\Windows\system32\Benijhla.exe
        155⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Bjkacoji.exe
        
        C:\Windows\system32\Bjkacoji.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800
        
        C:\Windows\SysWOW64\Bfabhppm.exe
        
        C:\Windows\system32\Bfabhppm.exe
        157⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Bcebadof.exe
        
        C:\Windows\system32\Bcebadof.exe
        158⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Bmngjj32.exe
        
        C:\Windows\system32\Bmngjj32.exe
        159⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Bnmcdm32.exe
        
        C:\Windows\system32\Bnmcdm32.exe
        160⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Beglqgcf.exe
        
        C:\Windows\system32\Beglqgcf.exe
        161⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Bmbpeiaa.exe
        
        C:\Windows\system32\Bmbpeiaa.exe
        162⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Cmdmki32.exe
        
        C:\Windows\system32\Cmdmki32.exe
        164⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Chjaha32.exe
        
        C:\Windows\system32\Chjaha32.exe
        165⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Cabfagee.exe
        
        C:\Windows\system32\Cabfagee.exe
        166⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Cjkjjmlf.exe
        
        C:\Windows\system32\Cjkjjmlf.exe
        167⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Cdcobb32.exe
        
        C:\Windows\system32\Cdcobb32.exe
        168⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Cnicpk32.exe
        
        C:\Windows\system32\Cnicpk32.exe
        169⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Cdfkhb32.exe
        
        C:\Windows\system32\Cdfkhb32.exe
        170⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Cokpekpj.exe
        
        C:\Windows\system32\Cokpekpj.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
        
        C:\Windows\SysWOW64\Ddhhnana.exe
        
        C:\Windows\system32\Ddhhnana.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Windows\SysWOW64\Degdgd32.exe
        
        C:\Windows\system32\Degdgd32.exe
        173⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Dkdmpl32.exe
        
        C:\Windows\system32\Dkdmpl32.exe
        174⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ddmaia32.exe
        
        C:\Windows\system32\Ddmaia32.exe
        175⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Dobffj32.exe
        
        C:\Windows\system32\Dobffj32.exe
        176⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Dhkjooqb.exe
        
        C:\Windows\system32\Dhkjooqb.exe
        177⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Dacohegc.exe
        
        C:\Windows\system32\Dacohegc.exe
        178⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Dgpgplej.exe
        
        C:\Windows\system32\Dgpgplej.exe
        179⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Eeagnc32.exe
        
        C:\Windows\system32\Eeagnc32.exe
        180⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Eoilfidj.exe
        
        C:\Windows\system32\Eoilfidj.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Edfdop32.exe
        
        C:\Windows\system32\Edfdop32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Emniheha.exe
        
        C:\Windows\system32\Emniheha.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Ehdmenhh.exe
        
        C:\Windows\system32\Ehdmenhh.exe
        184⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Emaemefo.exe
        
        C:\Windows\system32\Emaemefo.exe
        185⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Ehfjkn32.exe
        
        C:\Windows\system32\Ehfjkn32.exe
        186⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Edmjpoli.exe
        
        C:\Windows\system32\Edmjpoli.exe
        187⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Fneohd32.exe
        
        C:\Windows\system32\Fneohd32.exe
        188⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Fdpgen32.exe
        
        C:\Windows\system32\Fdpgen32.exe
        189⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Fnhlndqg.exe
        
        C:\Windows\system32\Fnhlndqg.exe
        190⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Fgppgi32.exe
        
        C:\Windows\system32\Fgppgi32.exe
        191⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Fnjhccnd.exe
        
        C:\Windows\system32\Fnjhccnd.exe
        192⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Fhpmql32.exe
        
        C:\Windows\system32\Fhpmql32.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Fojenfeg.exe
        
        C:\Windows\system32\Fojenfeg.exe
        194⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Fdfmfmdo.exe
        
        C:\Windows\system32\Fdfmfmdo.exe
        195⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Folacfcd.exe
        
        C:\Windows\system32\Folacfcd.exe
        196⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Fhdfll32.exe
        
        C:\Windows\system32\Fhdfll32.exe
        197⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ghgbakhb.exe
        
        C:\Windows\system32\Ghgbakhb.exe
        198⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Goqkne32.exe
        
        C:\Windows\system32\Goqkne32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Gekckpgl.exe
        
        C:\Windows\system32\Gekckpgl.exe
        200⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gkglcfec.exe
        
        C:\Windows\system32\Gkglcfec.exe
        201⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Gempqo32.exe
        
        C:\Windows\system32\Gempqo32.exe
        202⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ggnlhgkg.exe
        
        C:\Windows\system32\Ggnlhgkg.exe
        203⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Gadqepkn.exe
        
        C:\Windows\system32\Gadqepkn.exe
        204⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Ghnibj32.exe
        
        C:\Windows\system32\Ghnibj32.exe
        205⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Gnkajapa.exe
        
        C:\Windows\system32\Gnkajapa.exe
        206⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Hgcfcg32.exe
        
        C:\Windows\system32\Hgcfcg32.exe
        207⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Hbhjqp32.exe
        
        C:\Windows\system32\Hbhjqp32.exe
        208⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Hhbbmjne.exe
        
        C:\Windows\system32\Hhbbmjne.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Hnokeqll.exe
        
        C:\Windows\system32\Hnokeqll.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Hdicbkci.exe
        
        C:\Windows\system32\Hdicbkci.exe
        211⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Hoogpcco.exe
        
        C:\Windows\system32\Hoogpcco.exe
        212⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Hdlphjaf.exe
        
        C:\Windows\system32\Hdlphjaf.exe
        213⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hoadecal.exe
        
        C:\Windows\system32\Hoadecal.exe
        214⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Hdnlmj32.exe
        
        C:\Windows\system32\Hdnlmj32.exe
        215⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hbbmgn32.exe
        
        C:\Windows\system32\Hbbmgn32.exe
        216⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Iofmpb32.exe
        
        C:\Windows\system32\Iofmpb32.exe
        217⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7708
        
        C:\Windows\SysWOW64\Iohjebkd.exe
        
        C:\Windows\system32\Iohjebkd.exe
        219⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Idebniil.exe
        
        C:\Windows\system32\Idebniil.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Windows\SysWOW64\Iojgkbib.exe
        
        C:\Windows\system32\Iojgkbib.exe
        221⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Idgocigi.exe
        
        C:\Windows\system32\Idgocigi.exe
        222⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Inpclnnj.exe
        
        C:\Windows\system32\Inpclnnj.exe
        223⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        224⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Inbpbnlg.exe
        
        C:\Windows\system32\Inbpbnlg.exe
        225⤵
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Jigdoglm.exe
        
        C:\Windows\system32\Jigdoglm.exe
        226⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Jndmgn32.exe
        
        C:\Windows\system32\Jndmgn32.exe
        227⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Jgmapcqe.exe
        
        C:\Windows\system32\Jgmapcqe.exe
        228⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Jngjmm32.exe
        
        C:\Windows\system32\Jngjmm32.exe
        229⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Jeqbjgoo.exe
        
        C:\Windows\system32\Jeqbjgoo.exe
        230⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Jkkjfa32.exe
        
        C:\Windows\system32\Jkkjfa32.exe
        231⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Jbdbcl32.exe
        
        C:\Windows\system32\Jbdbcl32.exe
        232⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Jgakkb32.exe
        
        C:\Windows\system32\Jgakkb32.exe
        233⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Jbgoik32.exe
        
        C:\Windows\system32\Jbgoik32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Jgdhab32.exe
        
        C:\Windows\system32\Jgdhab32.exe
        235⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Kfehoj32.exe
        
        C:\Windows\system32\Kfehoj32.exe
        236⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Kpmlhoil.exe
        
        C:\Windows\system32\Kpmlhoil.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Kejepfgd.exe
        
        C:\Windows\system32\Kejepfgd.exe
        238⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Knbiil32.exe
        
        C:\Windows\system32\Knbiil32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Khknaa32.exe
        
        C:\Windows\system32\Khknaa32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7732
        
        C:\Windows\SysWOW64\Kflnpild.exe
        
        C:\Windows\system32\Kflnpild.exe
        241⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Klifhpjk.exe
        
        C:\Windows\system32\Klifhpjk.exe
        242⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Kfnkeh32.exe
        
        C:\Windows\system32\Kfnkeh32.exe
        243⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Knipik32.exe
        
        C:\Windows\system32\Knipik32.exe
        244⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lechfeoi.exe
        
        C:\Windows\system32\Lechfeoi.exe
        245⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Lbghpinc.exe
        
        C:\Windows\system32\Lbghpinc.exe
        246⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8080
        
        C:\Windows\SysWOW64\Liaqlcep.exe
        
        C:\Windows\system32\Liaqlcep.exe
        247⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        248⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Licmbccm.exe
        
        C:\Windows\system32\Licmbccm.exe
        249⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Loqejjad.exe
        
        C:\Windows\system32\Loqejjad.exe
        250⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Lifjgb32.exe
        
        C:\Windows\system32\Lifjgb32.exe
        251⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Locbpi32.exe
        
        C:\Windows\system32\Locbpi32.exe
        252⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Lhkghofb.exe
        
        C:\Windows\system32\Lhkghofb.exe
        253⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Mbqkfhfh.exe
        
        C:\Windows\system32\Mbqkfhfh.exe
        254⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Mhncnodp.exe
        
        C:\Windows\system32\Mhncnodp.exe
        255⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Meadgc32.exe
        
        C:\Windows\system32\Meadgc32.exe
        256⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Mojhphij.exe
        
        C:\Windows\system32\Mojhphij.exe
        257⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Mpiejkql.exe
        
        C:\Windows\system32\Mpiejkql.exe
        258⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Miaica32.exe
        
        C:\Windows\system32\Miaica32.exe
        259⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Mbjnlfnn.exe
        
        C:\Windows\system32\Mbjnlfnn.exe
        260⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Mlbbel32.exe
        
        C:\Windows\system32\Mlbbel32.exe
        261⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Nekgna32.exe
        
        C:\Windows\system32\Nekgna32.exe
        262⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Nleojlbk.exe
        
        C:\Windows\system32\Nleojlbk.exe
        263⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        264⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Nhlpom32.exe
        
        C:\Windows\system32\Nhlpom32.exe
        265⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        266⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Npedfjfo.exe
        
        C:\Windows\system32\Npedfjfo.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8228
        
        C:\Windows\SysWOW64\Nhpijldj.exe
        
        C:\Windows\system32\Nhpijldj.exe
        268⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Ncfmhecp.exe
        
        C:\Windows\system32\Ncfmhecp.exe
        269⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Nipedokm.exe
        
        C:\Windows\system32\Nipedokm.exe
        270⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Oomnmfid.exe
        
        C:\Windows\system32\Oomnmfid.exe
        271⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ohebek32.exe
        
        C:\Windows\system32\Ohebek32.exe
        272⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8388
        
        C:\Windows\SysWOW64\Oookbega.exe
        
        C:\Windows\system32\Oookbega.exe
        273⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Oidopn32.exe
        
        C:\Windows\system32\Oidopn32.exe
        274⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ooaghe32.exe
        
        C:\Windows\system32\Ooaghe32.exe
        275⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Oiglen32.exe
        
        C:\Windows\system32\Oiglen32.exe
        276⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Ocopncke.exe
        
        C:\Windows\system32\Ocopncke.exe
        277⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Olgdgibf.exe
        
        C:\Windows\system32\Olgdgibf.exe
        278⤵
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\Windows\SysWOW64\Ocamcc32.exe
        
        C:\Windows\system32\Ocamcc32.exe
        279⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ohnelj32.exe
        
        C:\Windows\system32\Ohnelj32.exe
        280⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Pcdjic32.exe
        
        C:\Windows\system32\Pcdjic32.exe
        281⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Phqbaj32.exe
        
        C:\Windows\system32\Phqbaj32.exe
        282⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Pcffoben.exe
        
        C:\Windows\system32\Pcffoben.exe
        283⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pomgcc32.exe
        
        C:\Windows\system32\Pomgcc32.exe
        284⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Pfgopnbo.exe
        
        C:\Windows\system32\Pfgopnbo.exe
        285⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        286⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Pjehflie.exe
        
        C:\Windows\system32\Pjehflie.exe
        287⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Pflikm32.exe
        
        C:\Windows\system32\Pflikm32.exe
        288⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Qcpieamc.exe
        
        C:\Windows\system32\Qcpieamc.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8984
        
        C:\Windows\SysWOW64\Qhlamhkj.exe
        
        C:\Windows\system32\Qhlamhkj.exe
        290⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Qcbfjqkp.exe
        
        C:\Windows\system32\Qcbfjqkp.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9052
        
        C:\Windows\SysWOW64\Ahonbhig.exe
        
        C:\Windows\system32\Ahonbhig.exe
        292⤵
        Drops file in System32 directory
        
        PID:9084
        
        C:\Windows\SysWOW64\Acdbpq32.exe
        
        C:\Windows\system32\Acdbpq32.exe
        293⤵
        Drops file in System32 directory
        
        PID:9116
        
        C:\Windows\SysWOW64\Ahakhg32.exe
        
        C:\Windows\system32\Ahakhg32.exe
        294⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Acfoep32.exe
        
        C:\Windows\system32\Acfoep32.exe
        295⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Ajqgbjoh.exe
        
        C:\Windows\system32\Ajqgbjoh.exe
        296⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Aompjamo.exe
        
        C:\Windows\system32\Aompjamo.exe
        297⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Aifdcgcp.exe
        
        C:\Windows\system32\Aifdcgcp.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8416
        
        C:\Windows\SysWOW64\Aqoijcbo.exe
        
        C:\Windows\system32\Aqoijcbo.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8480
        
        C:\Windows\SysWOW64\Bjgncihp.exe
        
        C:\Windows\system32\Bjgncihp.exe
        301⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Bcpblo32.exe
        
        C:\Windows\system32\Bcpblo32.exe
        302⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Bimkde32.exe
        
        C:\Windows\system32\Bimkde32.exe
        303⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Bcboan32.exe
        
        C:\Windows\system32\Bcboan32.exe
        304⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Bmkcjd32.exe
        
        C:\Windows\system32\Bmkcjd32.exe
        305⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        306⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Biadoeib.exe
        
        C:\Windows\system32\Biadoeib.exe
        307⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Bfedhihl.exe
        
        C:\Windows\system32\Bfedhihl.exe
        308⤵
        Drops file in System32 directory
        
        PID:8972
        
        C:\Windows\SysWOW64\Bmomecoi.exe
        
        C:\Windows\system32\Bmomecoi.exe
        309⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bciebm32.exe
        
        C:\Windows\system32\Bciebm32.exe
        310⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
        
        C:\Windows\SysWOW64\Cameka32.exe
        
        C:\Windows\system32\Cameka32.exe
        311⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Cggnhlml.exe
        
        C:\Windows\system32\Cggnhlml.exe
        312⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Cihjpd32.exe
        
        C:\Windows\system32\Cihjpd32.exe
        313⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Ccnnmmbp.exe
        
        C:\Windows\system32\Ccnnmmbp.exe
        314⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Cikgecag.exe
        
        C:\Windows\system32\Cikgecag.exe
        315⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Ccpkblqn.exe
        
        C:\Windows\system32\Ccpkblqn.exe
        316⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Cmipkb32.exe
        
        C:\Windows\system32\Cmipkb32.exe
        317⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Cfaddg32.exe
        
        C:\Windows\system32\Cfaddg32.exe
        318⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Cmklaaek.exe
        
        C:\Windows\system32\Cmklaaek.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        320⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Dibmfb32.exe
        
        C:\Windows\system32\Dibmfb32.exe
        321⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Dcgackke.exe
        
        C:\Windows\system32\Dcgackke.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Didjkbim.exe
        
        C:\Windows\system32\Didjkbim.exe
        323⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Dcjnikhc.exe
        
        C:\Windows\system32\Dcjnikhc.exe
        324⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Dannbogl.exe
        
        C:\Windows\system32\Dannbogl.exe
        325⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Dclknkfp.exe
        
        C:\Windows\system32\Dclknkfp.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Windows\SysWOW64\Dmdogpmq.exe
        
        C:\Windows\system32\Dmdogpmq.exe
        327⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Dpckclld.exe
        
        C:\Windows\system32\Dpckclld.exe
        328⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Djhpqdlj.exe
        
        C:\Windows\system32\Djhpqdlj.exe
        329⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8404
        
        C:\Windows\SysWOW64\Ehlpjikd.exe
        
        C:\Windows\system32\Ehlpjikd.exe
        330⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Emihbp32.exe
        
        C:\Windows\system32\Emihbp32.exe
        331⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Edcqojqh.exe
        
        C:\Windows\system32\Edcqojqh.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9280
        
        C:\Windows\SysWOW64\Emkeho32.exe
        
        C:\Windows\system32\Emkeho32.exe
        333⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ejofacfb.exe
        
        C:\Windows\system32\Ejofacfb.exe
        334⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Edhjji32.exe
        
        C:\Windows\system32\Edhjji32.exe
        335⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Ealkcm32.exe
        
        C:\Windows\system32\Ealkcm32.exe
        336⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ehecpgbi.exe
        
        C:\Windows\system32\Ehecpgbi.exe
        337⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Fdlcehhn.exe
        
        C:\Windows\system32\Fdlcehhn.exe
        338⤵
        Drops file in System32 directory
        
        PID:9472
        
        C:\Windows\SysWOW64\Fkflbb32.exe
        
        C:\Windows\system32\Fkflbb32.exe
        339⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Fapdomgg.exe
        
        C:\Windows\system32\Fapdomgg.exe
        340⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Fkihgb32.exe
        
        C:\Windows\system32\Fkihgb32.exe
        341⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Fabqdl32.exe
        
        C:\Windows\system32\Fabqdl32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9600
        
        C:\Windows\SysWOW64\Fkkemble.exe
        
        C:\Windows\system32\Fkkemble.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Faemjl32.exe
        
        C:\Windows\system32\Faemjl32.exe
        344⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Fkmbbajb.exe
        
        C:\Windows\system32\Fkmbbajb.exe
        345⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Fpjjkh32.exe
        
        C:\Windows\system32\Fpjjkh32.exe
        346⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Fkpoha32.exe
        
        C:\Windows\system32\Fkpoha32.exe
        347⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Fajgekol.exe
        
        C:\Windows\system32\Fajgekol.exe
        348⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ghdoae32.exe
        
        C:\Windows\system32\Ghdoae32.exe
        349⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Gielinlg.exe
        
        C:\Windows\system32\Gielinlg.exe
        350⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Gpodfh32.exe
        
        C:\Windows\system32\Gpodfh32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9892
        
        C:\Windows\SysWOW64\Gkdhcqcj.exe
        
        C:\Windows\system32\Gkdhcqcj.exe
        352⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Gpaqkgba.exe
        
        C:\Windows\system32\Gpaqkgba.exe
        353⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Gijedm32.exe
        
        C:\Windows\system32\Gijedm32.exe
        354⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Windows\SysWOW64\Gpcmagpo.exe
        
        C:\Windows\system32\Gpcmagpo.exe
        355⤵
        System Location Discovery: System Language Discovery
        
        PID:10020
        
        C:\Windows\SysWOW64\Gkianp32.exe
        
        C:\Windows\system32\Gkianp32.exe
        356⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Gacjkjgb.exe
        
        C:\Windows\system32\Gacjkjgb.exe
        357⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Gkkndp32.exe
        
        C:\Windows\system32\Gkkndp32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10120
        
        C:\Windows\SysWOW64\Hhoomd32.exe
        
        C:\Windows\system32\Hhoomd32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10152
        
        C:\Windows\SysWOW64\Hjqkel32.exe
        
        C:\Windows\system32\Hjqkel32.exe
        360⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Hhbkccji.exe
        
        C:\Windows\system32\Hhbkccji.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10216
        
        C:\Windows\SysWOW64\Hnodkjhq.exe
        
        C:\Windows\system32\Hnodkjhq.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Hhdhhchf.exe
        
        C:\Windows\system32\Hhdhhchf.exe
        363⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Hjedpkne.exe
        
        C:\Windows\system32\Hjedpkne.exe
        364⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Hpomme32.exe
        
        C:\Windows\system32\Hpomme32.exe
        365⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Hncmfj32.exe
        
        C:\Windows\system32\Hncmfj32.exe
        366⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        367⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Idpbhc32.exe
        
        C:\Windows\system32\Idpbhc32.exe
        368⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Ikijenab.exe
        
        C:\Windows\system32\Ikijenab.exe
        369⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        370⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Iklgkmop.exe
        
        C:\Windows\system32\Iklgkmop.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Iqipcd32.exe
        
        C:\Windows\system32\Iqipcd32.exe
        372⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ikndpm32.exe
        
        C:\Windows\system32\Ikndpm32.exe
        373⤵
        Modifies registry class
        
        PID:9952
        
        C:\Windows\SysWOW64\Iqklhd32.exe
        
        C:\Windows\system32\Iqklhd32.exe
        374⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        375⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        376⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Ihdaoajd.exe
        
        C:\Windows\system32\Ihdaoajd.exe
        377⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Jbmehf32.exe
        
        C:\Windows\system32\Jbmehf32.exe
        378⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Jgjnpm32.exe
        
        C:\Windows\system32\Jgjnpm32.exe
        379⤵
        System Location Discovery: System Language Discovery
        
        PID:9428
        
        C:\Windows\SysWOW64\Jncfmgfi.exe
        
        C:\Windows\system32\Jncfmgfi.exe
        380⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Jdnnjane.exe
        
        C:\Windows\system32\Jdnnjane.exe
        381⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Jjjgbhlm.exe
        
        C:\Windows\system32\Jjjgbhlm.exe
        382⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Jqdoob32.exe
        
        C:\Windows\system32\Jqdoob32.exe
        383⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Jkjclk32.exe
        
        C:\Windows\system32\Jkjclk32.exe
        384⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jbdliejl.exe
        
        C:\Windows\system32\Jbdliejl.exe
        385⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Jjopmh32.exe
        
        C:\Windows\system32\Jjopmh32.exe
        386⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Jdddjq32.exe
        
        C:\Windows\system32\Jdddjq32.exe
        387⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Kdgapp32.exe
        
        C:\Windows\system32\Kdgapp32.exe
        388⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Kjdjhgdb.exe
        
        C:\Windows\system32\Kjdjhgdb.exe
        389⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Keinepch.exe
        
        C:\Windows\system32\Keinepch.exe
        390⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Kjffngap.exe
        
        C:\Windows\system32\Kjffngap.exe
        391⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Kgjggkqi.exe
        
        C:\Windows\system32\Kgjggkqi.exe
        392⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Kndodehf.exe
        
        C:\Windows\system32\Kndodehf.exe
        393⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Kglcmk32.exe
        
        C:\Windows\system32\Kglcmk32.exe
        394⤵
        System Location Discovery: System Language Discovery
        
        PID:10364
        
        C:\Windows\SysWOW64\Knfliefc.exe
        
        C:\Windows\system32\Knfliefc.exe
        395⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Kilpgnfi.exe
        
        C:\Windows\system32\Kilpgnfi.exe
        396⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Ljmmnf32.exe
        
        C:\Windows\system32\Ljmmnf32.exe
        397⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Linmlm32.exe
        
        C:\Windows\system32\Linmlm32.exe
        398⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Lbgaecjg.exe
        
        C:\Windows\system32\Lbgaecjg.exe
        399⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Lgcjmjho.exe
        
        C:\Windows\system32\Lgcjmjho.exe
        400⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        401⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Lgffci32.exe
        
        C:\Windows\system32\Lgffci32.exe
        402⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Lankloml.exe
        
        C:\Windows\system32\Lankloml.exe
        403⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Lbngfbdo.exe
        
        C:\Windows\system32\Lbngfbdo.exe
        404⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Mhjpnibf.exe
        
        C:\Windows\system32\Mhjpnibf.exe
        405⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Mndhkc32.exe
        
        C:\Windows\system32\Mndhkc32.exe
        406⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Mlhidg32.exe
        
        C:\Windows\system32\Mlhidg32.exe
        407⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Maealn32.exe
        
        C:\Windows\system32\Maealn32.exe
        408⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Mhoiih32.exe
        
        C:\Windows\system32\Mhoiih32.exe
        409⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Mniafbfn.exe
        
        C:\Windows\system32\Mniafbfn.exe
        410⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Miofcked.exe
        
        C:\Windows\system32\Miofcked.exe
        411⤵
        Drops file in System32 directory
        
        PID:10944
        
        C:\Windows\SysWOW64\Mbgjlq32.exe
        
        C:\Windows\system32\Mbgjlq32.exe
        412⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Mhdbdgjl.exe
        
        C:\Windows\system32\Mhdbdgjl.exe
        413⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Mbigapjb.exe
        
        C:\Windows\system32\Mbigapjb.exe
        414⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Niconj32.exe
        
        C:\Windows\system32\Niconj32.exe
        415⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Nophfa32.exe
        
        C:\Windows\system32\Nophfa32.exe
        416⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        417⤵
        Modifies registry class
        
        PID:11136
        
        C:\Windows\SysWOW64\Njghkb32.exe
        
        C:\Windows\system32\Njghkb32.exe
        418⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Nelmik32.exe
        
        C:\Windows\system32\Nelmik32.exe
        419⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Noeaaqlq.exe
        
        C:\Windows\system32\Noeaaqlq.exe
        420⤵
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Nhmejf32.exe
        
        C:\Windows\system32\Nhmejf32.exe
        421⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        422⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Nhpbpepo.exe
        
        C:\Windows\system32\Nhpbpepo.exe
        423⤵
        Modifies registry class
        
        PID:10460
        
        C:\Windows\SysWOW64\Noijmp32.exe
        
        C:\Windows\system32\Noijmp32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10516
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        425⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Olnkfd32.exe
        
        C:\Windows\system32\Olnkfd32.exe
        426⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Oefpoi32.exe
        
        C:\Windows\system32\Oefpoi32.exe
        427⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        428⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Objphn32.exe
        
        C:\Windows\system32\Objphn32.exe
        429⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Oidhehcl.exe
        
        C:\Windows\system32\Oidhehcl.exe
        430⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Okedmp32.exe
        
        C:\Windows\system32\Okedmp32.exe
        431⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Oifekg32.exe
        
        C:\Windows\system32\Oifekg32.exe
        432⤵
        System Location Discovery: System Language Discovery
        
        PID:11068
        
        C:\Windows\SysWOW64\Oocmcn32.exe
        
        C:\Windows\system32\Oocmcn32.exe
        433⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        434⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Ohkbldfa.exe
        
        C:\Windows\system32\Ohkbldfa.exe
        435⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Ooejhn32.exe
        
        C:\Windows\system32\Ooejhn32.exe
        436⤵
        Drops file in System32 directory
        
        PID:11240
        
        C:\Windows\SysWOW64\Pacfdila.exe
        
        C:\Windows\system32\Pacfdila.exe
        437⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Phnoac32.exe
        
        C:\Windows\system32\Phnoac32.exe
        438⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Pcccol32.exe
        
        C:\Windows\system32\Pcccol32.exe
        439⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Pllggbje.exe
        
        C:\Windows\system32\Pllggbje.exe
        440⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Pahppihl.exe
        
        C:\Windows\system32\Pahppihl.exe
        441⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10764
        
        C:\Windows\SysWOW64\Plndma32.exe
        
        C:\Windows\system32\Plndma32.exe
        442⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
        
        C:\Windows\SysWOW64\Pchljlpo.exe
        
        C:\Windows\system32\Pchljlpo.exe
        443⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Pibdff32.exe
        
        C:\Windows\system32\Pibdff32.exe
        444⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Pkcannmj.exe
        
        C:\Windows\system32\Pkcannmj.exe
        445⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Pidaleei.exe
        
        C:\Windows\system32\Pidaleei.exe
        446⤵
        System Location Discovery: System Language Discovery
        
        PID:10424
        
        C:\Windows\SysWOW64\Qhinmb32.exe
        
        C:\Windows\system32\Qhinmb32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3784
        
        C:\Windows\SysWOW64\Qcobjk32.exe
        
        C:\Windows\system32\Qcobjk32.exe
        448⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Qhlkbaho.exe
        
        C:\Windows\system32\Qhlkbaho.exe
        449⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Qoecol32.exe
        
        C:\Windows\system32\Qoecol32.exe
        450⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Ajkgmd32.exe
        
        C:\Windows\system32\Ajkgmd32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3172
        
        C:\Windows\SysWOW64\Acclejeb.exe
        
        C:\Windows\system32\Acclejeb.exe
        452⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Ahpdnaci.exe
        
        C:\Windows\system32\Ahpdnaci.exe
        453⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Acfhkj32.exe
        
        C:\Windows\system32\Acfhkj32.exe
        454⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
        
        C:\Windows\SysWOW64\Ahbacq32.exe
        
        C:\Windows\system32\Ahbacq32.exe
        455⤵
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Acheqi32.exe
        
        C:\Windows\system32\Acheqi32.exe
        456⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Ajbmmcii.exe
        
        C:\Windows\system32\Ajbmmcii.exe
        457⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Akcjel32.exe
        
        C:\Windows\system32\Akcjel32.exe
        458⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Ajdjcc32.exe
        
        C:\Windows\system32\Ajdjcc32.exe
        459⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Windows\SysWOW64\Akffjkme.exe
        
        C:\Windows\system32\Akffjkme.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Bbpoge32.exe
        
        C:\Windows\system32\Bbpoge32.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11164
        
        C:\Windows\SysWOW64\Bjgghc32.exe
        
        C:\Windows\system32\Bjgghc32.exe
        462⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Bocoqj32.exe
        
        C:\Windows\system32\Bocoqj32.exe
        463⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Bhldio32.exe
        
        C:\Windows\system32\Bhldio32.exe
        464⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        465⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Bfbahcfc.exe
        
        C:\Windows\system32\Bfbahcfc.exe
        466⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Bmliem32.exe
        
        C:\Windows\system32\Bmliem32.exe
        467⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Bbiamd32.exe
        
        C:\Windows\system32\Bbiamd32.exe
        468⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Ckaffjbg.exe
        
        C:\Windows\system32\Ckaffjbg.exe
        469⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        470⤵
        Drops file in System32 directory
        
        PID:844
        
        C:\Windows\SysWOW64\Cmabpmjj.exe
        
        C:\Windows\system32\Cmabpmjj.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3416
        
        C:\Windows\SysWOW64\Cckkmg32.exe
        
        C:\Windows\system32\Cckkmg32.exe
        472⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Cjecjahd.exe
        
        C:\Windows\system32\Cjecjahd.exe
        473⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Ckfpai32.exe
        
        C:\Windows\system32\Ckfpai32.exe
        474⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Cfldob32.exe
        
        C:\Windows\system32\Cfldob32.exe
        475⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Ccpdhfmb.exe
        
        C:\Windows\system32\Ccpdhfmb.exe
        476⤵
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Cjjlep32.exe
        
        C:\Windows\system32\Cjjlep32.exe
        477⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Cofemg32.exe
        
        C:\Windows\system32\Cofemg32.exe
        478⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Cfqmjajc.exe
        
        C:\Windows\system32\Cfqmjajc.exe
        479⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Dmjefkap.exe
        
        C:\Windows\system32\Dmjefkap.exe
        480⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Dcdnce32.exe
        
        C:\Windows\system32\Dcdnce32.exe
        481⤵
        Drops file in System32 directory
        
        PID:11356
        
        C:\Windows\SysWOW64\Diafkl32.exe
        
        C:\Windows\system32\Diafkl32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11516
        
        C:\Windows\SysWOW64\Diccal32.exe
        
        C:\Windows\system32\Diccal32.exe
        483⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Dcigneeg.exe
        
        C:\Windows\system32\Dcigneeg.exe
        484⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Djcoko32.exe
        
        C:\Windows\system32\Djcoko32.exe
        485⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        486⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        487⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Dpbdiehi.exe
        
        C:\Windows\system32\Dpbdiehi.exe
        488⤵
        Drops file in System32 directory
        
        PID:11752
        
        C:\Windows\SysWOW64\Djhifnho.exe
        
        C:\Windows\system32\Djhifnho.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11796
        
        C:\Windows\SysWOW64\Elienf32.exe
        
        C:\Windows\system32\Elienf32.exe
        490⤵
        Drops file in System32 directory
        
        PID:11836
        
        C:\Windows\SysWOW64\Efoiko32.exe
        
        C:\Windows\system32\Efoiko32.exe
        491⤵
        Modifies registry class
        
        PID:11876
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        492⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Epgndedc.exe
        
        C:\Windows\system32\Epgndedc.exe
        493⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Ejlban32.exe
        
        C:\Windows\system32\Ejlban32.exe
        494⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Ecefjckj.exe
        
        C:\Windows\system32\Ecefjckj.exe
        495⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Ejoogm32.exe
        
        C:\Windows\system32\Ejoogm32.exe
        496⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12080
        
        C:\Windows\SysWOW64\Elpknehe.exe
        
        C:\Windows\system32\Elpknehe.exe
        497⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Efepln32.exe
        
        C:\Windows\system32\Efepln32.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12160
        
        C:\Windows\SysWOW64\Epndddnk.exe
        
        C:\Windows\system32\Epndddnk.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12200
        
        C:\Windows\SysWOW64\Eblpqono.exe
        
        C:\Windows\system32\Eblpqono.exe
        500⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Fbomfokl.exe
        
        C:\Windows\system32\Fbomfokl.exe
        501⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
        
        C:\Windows\SysWOW64\Fpbmpc32.exe
        
        C:\Windows\system32\Fpbmpc32.exe
        502⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Ffmelmbc.exe
        
        C:\Windows\system32\Ffmelmbc.exe
        503⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Fmfnig32.exe
        
        C:\Windows\system32\Fmfnig32.exe
        504⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Fbcfan32.exe
        
        C:\Windows\system32\Fbcfan32.exe
        505⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Fimonh32.exe
        
        C:\Windows\system32\Fimonh32.exe
        506⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Fllkjd32.exe
        
        C:\Windows\system32\Fllkjd32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11740
        
        C:\Windows\SysWOW64\Fbecgned.exe
        
        C:\Windows\system32\Fbecgned.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11780
        
        C:\Windows\SysWOW64\Fipkch32.exe
        
        C:\Windows\system32\Fipkch32.exe
        509⤵
        Modifies registry class
        
        PID:11828
        
        C:\Windows\SysWOW64\Fpjcpbdn.exe
        
        C:\Windows\system32\Fpjcpbdn.exe
        510⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Gmndjf32.exe
        
        C:\Windows\system32\Gmndjf32.exe
        511⤵
        System Location Discovery: System Language Discovery
        
        PID:11908
        
        C:\Windows\SysWOW64\Gbjlbm32.exe
        
        C:\Windows\system32\Gbjlbm32.exe
        512⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Gideogil.exe
        
        C:\Windows\system32\Gideogil.exe
        513⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Gpnmka32.exe
        
        C:\Windows\system32\Gpnmka32.exe
        514⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        515⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Glenpb32.exe
        
        C:\Windows\system32\Glenpb32.exe
        516⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Gbofmmmj.exe
        
        C:\Windows\system32\Gbofmmmj.exe
        517⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Gmdjjemp.exe
        
        C:\Windows\system32\Gmdjjemp.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12236
        
        C:\Windows\SysWOW64\Gdobgp32.exe
        
        C:\Windows\system32\Gdobgp32.exe
        519⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Gikkof32.exe
        
        C:\Windows\system32\Gikkof32.exe
        520⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Hlldaape.exe
        
        C:\Windows\system32\Hlldaape.exe
        521⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Hgahnjpk.exe
        
        C:\Windows\system32\Hgahnjpk.exe
        522⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        523⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Hchickeo.exe
        
        C:\Windows\system32\Hchickeo.exe
        524⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Hibape32.exe
        
        C:\Windows\system32\Hibape32.exe
        525⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Hlqmla32.exe
        
        C:\Windows\system32\Hlqmla32.exe
        526⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Hkbmjhdo.exe
        
        C:\Windows\system32\Hkbmjhdo.exe
        527⤵
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Windows\SysWOW64\Hlcjaq32.exe
        
        C:\Windows\system32\Hlcjaq32.exe
        528⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        529⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        530⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        531⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Igkkdigp.exe
        
        C:\Windows\system32\Igkkdigp.exe
        532⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Ipcomo32.exe
        
        C:\Windows\system32\Ipcomo32.exe
        533⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Ikickgnf.exe
        
        C:\Windows\system32\Ikickgnf.exe
        534⤵
        Drops file in System32 directory
        
        PID:12280
        
        C:\Windows\SysWOW64\Ipflcnln.exe
        
        C:\Windows\system32\Ipflcnln.exe
        535⤵
        Drops file in System32 directory
        
        PID:1604
        
        C:\Windows\SysWOW64\Ijnqld32.exe
        
        C:\Windows\system32\Ijnqld32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11344
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        537⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Inlibb32.exe
        
        C:\Windows\system32\Inlibb32.exe
        538⤵
        Drops file in System32 directory
        
        PID:3800
        
        C:\Windows\SysWOW64\Iciaji32.exe
        
        C:\Windows\system32\Iciaji32.exe
        539⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Jjeflc32.exe
        
        C:\Windows\system32\Jjeflc32.exe
        540⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        541⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Jkdcffci.exe
        
        C:\Windows\system32\Jkdcffci.exe
        542⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Jlfpnn32.exe
        
        C:\Windows\system32\Jlfpnn32.exe
        543⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Jkgpleaf.exe
        
        C:\Windows\system32\Jkgpleaf.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3476
        
        C:\Windows\SysWOW64\Jlhlcnge.exe
        
        C:\Windows\system32\Jlhlcnge.exe
        545⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Jcbdph32.exe
        
        C:\Windows\system32\Jcbdph32.exe
        546⤵
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\Jjlmmbfo.exe
        
        C:\Windows\system32\Jjlmmbfo.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1180
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        548⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Jlmfomcp.exe
        
        C:\Windows\system32\Jlmfomcp.exe
        549⤵
        Drops file in System32 directory
        
        PID:3600
        
        C:\Windows\SysWOW64\Kcgnkgkl.exe
        
        C:\Windows\system32\Kcgnkgkl.exe
        550⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Kjafha32.exe
        
        C:\Windows\system32\Kjafha32.exe
        551⤵
        
        PID:244
        
        C:\Windows\SysWOW64\Kgefae32.exe
        
        C:\Windows\system32\Kgefae32.exe
        552⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Knoonphp.exe
        
        C:\Windows\system32\Knoonphp.exe
        553⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Kggcgeop.exe
        
        C:\Windows\system32\Kggcgeop.exe
        554⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Knaldo32.exe
        
        C:\Windows\system32\Knaldo32.exe
        555⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Kdkdqinj.exe
        
        C:\Windows\system32\Kdkdqinj.exe
        556⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Kkelmc32.exe
        
        C:\Windows\system32\Kkelmc32.exe
        557⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        558⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Lqdakjak.exe
        
        C:\Windows\system32\Lqdakjak.exe
        559⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Lgnihd32.exe
        
        C:\Windows\system32\Lgnihd32.exe
        560⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Lnhadnpe.exe
        
        C:\Windows\system32\Lnhadnpe.exe
        561⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Lcejmeol.exe
        
        C:\Windows\system32\Lcejmeol.exe
        562⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Lnjnjn32.exe
        
        C:\Windows\system32\Lnjnjn32.exe
        563⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Lddgghfo.exe
        
        C:\Windows\system32\Lddgghfo.exe
        564⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Lknocb32.exe
        
        C:\Windows\system32\Lknocb32.exe
        565⤵
        System Location Discovery: System Language Discovery
        
        PID:4588
        
        C:\Windows\SysWOW64\Lqkgli32.exe
        
        C:\Windows\system32\Lqkgli32.exe
        566⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Lgephccp.exe
        
        C:\Windows\system32\Lgephccp.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4720
        
        C:\Windows\SysWOW64\Ljcldo32.exe
        
        C:\Windows\system32\Ljcldo32.exe
        568⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Lqndahiq.exe
        
        C:\Windows\system32\Lqndahiq.exe
        569⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Lkchoaif.exe
        
        C:\Windows\system32\Lkchoaif.exe
        570⤵
        Modifies registry class
        
        PID:12228
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        571⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Mgjicb32.exe
        
        C:\Windows\system32\Mgjicb32.exe
        572⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Mmfalimb.exe
        
        C:\Windows\system32\Mmfalimb.exe
        573⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        574⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Mjkbemll.exe
        
        C:\Windows\system32\Mjkbemll.exe
        575⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Mgoboake.exe
        
        C:\Windows\system32\Mgoboake.exe
        576⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Mnhkklbb.exe
        
        C:\Windows\system32\Mnhkklbb.exe
        577⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        578⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        579⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        580⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Ngehoqdn.exe
        
        C:\Windows\system32\Ngehoqdn.exe
        581⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        582⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Nanmhf32.exe
        
        C:\Windows\system32\Nanmhf32.exe
        583⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Nhheepbk.exe
        
        C:\Windows\system32\Nhheepbk.exe
        584⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Nnbnaj32.exe
        
        C:\Windows\system32\Nnbnaj32.exe
        585⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Nelfnd32.exe
        
        C:\Windows\system32\Nelfnd32.exe
        586⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12176
        
        C:\Windows\SysWOW64\Njinfk32.exe
        
        C:\Windows\system32\Njinfk32.exe
        587⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Nabfcegi.exe
        
        C:\Windows\system32\Nabfcegi.exe
        588⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Nlhkqngo.exe
        
        C:\Windows\system32\Nlhkqngo.exe
        589⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3524
        
        C:\Windows\SysWOW64\Ojmhaklf.exe
        
        C:\Windows\system32\Ojmhaklf.exe
        591⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        592⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Ohahkojp.exe
        
        C:\Windows\system32\Ohahkojp.exe
        593⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        594⤵
        Drops file in System32 directory
        
        PID:676
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        595⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Oaliidon.exe
        
        C:\Windows\system32\Oaliidon.exe
        596⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
        
        C:\Windows\SysWOW64\Ohfafn32.exe
        
        C:\Windows\system32\Ohfafn32.exe
        597⤵
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Odmbkolo.exe
        
        C:\Windows\system32\Odmbkolo.exe
        598⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Ojgjhicl.exe
        
        C:\Windows\system32\Ojgjhicl.exe
        599⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Oaqbdc32.exe
        
        C:\Windows\system32\Oaqbdc32.exe
        600⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Ohkkanbe.exe
        
        C:\Windows\system32\Ohkkanbe.exe
        601⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Pacojc32.exe
        
        C:\Windows\system32\Pacojc32.exe
        602⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Phmhgmpc.exe
        
        C:\Windows\system32\Phmhgmpc.exe
        603⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Pogpcghp.exe
        
        C:\Windows\system32\Pogpcghp.exe
        604⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Peahpa32.exe
        
        C:\Windows\system32\Peahpa32.exe
        605⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Plkpmlfi.exe
        
        C:\Windows\system32\Plkpmlfi.exe
        606⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        607⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Phaabm32.exe
        
        C:\Windows\system32\Phaabm32.exe
        608⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Poliog32.exe
        
        C:\Windows\system32\Poliog32.exe
        609⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Pdhbgn32.exe
        
        C:\Windows\system32\Pdhbgn32.exe
        610⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ponfdf32.exe
        
        C:\Windows\system32\Ponfdf32.exe
        611⤵
        System Location Discovery: System Language Discovery
        
        PID:696
        
        C:\Windows\SysWOW64\Pehnaqid.exe
        
        C:\Windows\system32\Pehnaqid.exe
        612⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Qkegiggl.exe
        
        C:\Windows\system32\Qkegiggl.exe
        613⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Qaoofaoi.exe
        
        C:\Windows\system32\Qaoofaoi.exe
        614⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Qhigbl32.exe
        
        C:\Windows\system32\Qhigbl32.exe
        615⤵
        Modifies registry class
        
        PID:5084
        
        C:\Windows\SysWOW64\Qoboofnb.exe
        
        C:\Windows\system32\Qoboofnb.exe
        616⤵
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Qdphgmlj.exe
        
        C:\Windows\system32\Qdphgmlj.exe
        617⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Aogije32.exe
        
        C:\Windows\system32\Aogije32.exe
        618⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Addabl32.exe
        
        C:\Windows\system32\Addabl32.exe
        619⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Aojepe32.exe
        
        C:\Windows\system32\Aojepe32.exe
        620⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Ahbjij32.exe
        
        C:\Windows\system32\Ahbjij32.exe
        621⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Anobaa32.exe
        
        C:\Windows\system32\Anobaa32.exe
        622⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Ahdgnj32.exe
        
        C:\Windows\system32\Ahdgnj32.exe
        623⤵
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\Akccje32.exe
        
        C:\Windows\system32\Akccje32.exe
        624⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Bdkgckal.exe
        
        C:\Windows\system32\Bdkgckal.exe
        625⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Boqlqd32.exe
        
        C:\Windows\system32\Boqlqd32.exe
        626⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Bekdmnio.exe
        
        C:\Windows\system32\Bekdmnio.exe
        627⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Bldljh32.exe
        
        C:\Windows\system32\Bldljh32.exe
        628⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        629⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Bhkmoifp.exe
        
        C:\Windows\system32\Bhkmoifp.exe
        630⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        631⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Bhnidi32.exe
        
        C:\Windows\system32\Bhnidi32.exe
        632⤵
        Drops file in System32 directory
        
        PID:12316
        
        C:\Windows\SysWOW64\Bnkbmp32.exe
        
        C:\Windows\system32\Bnkbmp32.exe
        633⤵
        Modifies registry class
        
        PID:12356
        
        C:\Windows\SysWOW64\Bhpfjh32.exe
        
        C:\Windows\system32\Bhpfjh32.exe
        634⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Cdggoi32.exe
        
        C:\Windows\system32\Cdggoi32.exe
        635⤵
        System Location Discovery: System Language Discovery
        
        PID:12596
        
        C:\Windows\SysWOW64\Colklb32.exe
        
        C:\Windows\system32\Colklb32.exe
        636⤵
        Modifies registry class
        
        PID:12632
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        637⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Clplff32.exe
        
        C:\Windows\system32\Clplff32.exe
        638⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12704
        
        C:\Windows\SysWOW64\Cnahmo32.exe
        
        C:\Windows\system32\Cnahmo32.exe
        639⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12744
        
        C:\Windows\SysWOW64\Cdlpjicj.exe
        
        C:\Windows\system32\Cdlpjicj.exe
        640⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Coadgacp.exe
        
        C:\Windows\system32\Coadgacp.exe
        641⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Cbpacmbc.exe
        
        C:\Windows\system32\Cbpacmbc.exe
        642⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Chiipg32.exe
        
        C:\Windows\system32\Chiipg32.exe
        643⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Cnfahn32.exe
        
        C:\Windows\system32\Cnfahn32.exe
        644⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Cdpjeh32.exe
        
        C:\Windows\system32\Cdpjeh32.exe
        645⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        646⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Cninnnfe.exe
        
        C:\Windows\system32\Cninnnfe.exe
        647⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Ddbfkh32.exe
        
        C:\Windows\system32\Ddbfkh32.exe
        648⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Dkmogbeo.exe
        
        C:\Windows\system32\Dkmogbeo.exe
        649⤵
        Modifies registry class
        
        PID:13112
        
        C:\Windows\SysWOW64\Dnkkcmdb.exe
        
        C:\Windows\system32\Dnkkcmdb.exe
        650⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Dhqoaf32.exe
        
        C:\Windows\system32\Dhqoaf32.exe
        651⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Dbicjlji.exe
        
        C:\Windows\system32\Dbicjlji.exe
        652⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Dkahba32.exe
        
        C:\Windows\system32\Dkahba32.exe
        653⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13272
        
        C:\Windows\SysWOW64\Dbkpokhf.exe
        
        C:\Windows\system32\Dbkpokhf.exe
        654⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Dieilepc.exe
        
        C:\Windows\system32\Dieilepc.exe
        655⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Doanno32.exe
        
        C:\Windows\system32\Doanno32.exe
        656⤵
        Modifies registry class
        
        PID:12568
        
        C:\Windows\SysWOW64\Efkfkilj.exe
        
        C:\Windows\system32\Efkfkilj.exe
        657⤵
        Drops file in System32 directory
        
        PID:12584
        
        C:\Windows\SysWOW64\Ekhncp32.exe
        
        C:\Windows\system32\Ekhncp32.exe
        658⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ebbfpjbn.exe
        
        C:\Windows\system32\Ebbfpjbn.exe
        659⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Emhkmcbd.exe
        
        C:\Windows\system32\Emhkmcbd.exe
        660⤵
        Drops file in System32 directory
        
        PID:12732
        
        C:\Windows\SysWOW64\Enigek32.exe
        
        C:\Windows\system32\Enigek32.exe
        661⤵
        System Location Discovery: System Language Discovery
        
        PID:12768
        
        C:\Windows\SysWOW64\Eiokbd32.exe
        
        C:\Windows\system32\Eiokbd32.exe
        662⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Eohcon32.exe
        
        C:\Windows\system32\Eohcon32.exe
        663⤵
        System Location Discovery: System Language Discovery
        
        PID:12868
        
        C:\Windows\SysWOW64\Eeelge32.exe
        
        C:\Windows\system32\Eeelge32.exe
        664⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Epkpdn32.exe
        
        C:\Windows\system32\Epkpdn32.exe
        665⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Efeiahdo.exe
        
        C:\Windows\system32\Efeiahdo.exe
        666⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Eicemccc.exe
        
        C:\Windows\system32\Eicemccc.exe
        667⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Fnpmej32.exe
        
        C:\Windows\system32\Fnpmej32.exe
        668⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Fieacc32.exe
        
        C:\Windows\system32\Fieacc32.exe
        669⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Fnbjkj32.exe
        
        C:\Windows\system32\Fnbjkj32.exe
        670⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Fihnhc32.exe
        
        C:\Windows\system32\Fihnhc32.exe
        671⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Fpbfem32.exe
        
        C:\Windows\system32\Fpbfem32.exe
        672⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Fbpcah32.exe
        
        C:\Windows\system32\Fbpcah32.exe
        673⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        674⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Fngcfikb.exe
        
        C:\Windows\system32\Fngcfikb.exe
        675⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Fealcc32.exe
        
        C:\Windows\system32\Fealcc32.exe
        676⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Fiodib32.exe
        
        C:\Windows\system32\Fiodib32.exe
        677⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Gpimflqb.exe
        
        C:\Windows\system32\Gpimflqb.exe
        678⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Gefencoj.exe
        
        C:\Windows\system32\Gefencoj.exe
        679⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        680⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Gfeahffl.exe
        
        C:\Windows\system32\Gfeahffl.exe
        681⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Glbjpmdd.exe
        
        C:\Windows\system32\Glbjpmdd.exe
        682⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Gfgnnedj.exe
        
        C:\Windows\system32\Gfgnnedj.exe
        683⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Gmafjp32.exe
        
        C:\Windows\system32\Gmafjp32.exe
        684⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Goccbhae.exe
        
        C:\Windows\system32\Goccbhae.exe
        685⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Gihgoq32.exe
        
        C:\Windows\system32\Gihgoq32.exe
        686⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Glgckl32.exe
        
        C:\Windows\system32\Glgckl32.exe
        687⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Gflhie32.exe
        
        C:\Windows\system32\Gflhie32.exe
        688⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Gmfpeoga.exe
        
        C:\Windows\system32\Gmfpeoga.exe
        689⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Hoglmg32.exe
        
        C:\Windows\system32\Hoglmg32.exe
        690⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Headjael.exe
        
        C:\Windows\system32\Headjael.exe
        691⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Hlkmfkli.exe
        
        C:\Windows\system32\Hlkmfkli.exe
        692⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        693⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Hiomppkc.exe
        
        C:\Windows\system32\Hiomppkc.exe
        694⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Hfcnicjl.exe
        
        C:\Windows\system32\Hfcnicjl.exe
        695⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Hfekoc32.exe
        
        C:\Windows\system32\Hfekoc32.exe
        696⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Windows\SysWOW64\Hlbcgj32.exe
        
        C:\Windows\system32\Hlbcgj32.exe
        697⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Hfhgdc32.exe
        
        C:\Windows\system32\Hfhgdc32.exe
        698⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Imbpam32.exe
        
        C:\Windows\system32\Imbpam32.exe
        699⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Ipplmh32.exe
        
        C:\Windows\system32\Ipplmh32.exe
        700⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Iemdep32.exe
        
        C:\Windows\system32\Iemdep32.exe
        701⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Ipbhch32.exe
        
        C:\Windows\system32\Ipbhch32.exe
        702⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Igmqpbab.exe
        
        C:\Windows\system32\Igmqpbab.exe
        703⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Imfill32.exe
        
        C:\Windows\system32\Imfill32.exe
        704⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ibcadcgf.exe
        
        C:\Windows\system32\Ibcadcgf.exe
        705⤵
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Illfmi32.exe
        
        C:\Windows\system32\Illfmi32.exe
        706⤵
        Drops file in System32 directory
        
        PID:7536
        
        C:\Windows\SysWOW64\Iojbid32.exe
        
        C:\Windows\system32\Iojbid32.exe
        707⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Iedjfodg.exe
        
        C:\Windows\system32\Iedjfodg.exe
        708⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Ipjocgdm.exe
        
        C:\Windows\system32\Ipjocgdm.exe
        709⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Ichkpb32.exe
        
        C:\Windows\system32\Ichkpb32.exe
        710⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\Iibclmkn.exe
        
        C:\Windows\system32\Iibclmkn.exe
        711⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6860
        
        C:\Windows\SysWOW64\Jplkig32.exe
        
        C:\Windows\system32\Jplkig32.exe
        712⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Jeidan32.exe
        
        C:\Windows\system32\Jeidan32.exe
        713⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jmplbk32.exe
        
        C:\Windows\system32\Jmplbk32.exe
        714⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Jghpkq32.exe
        
        C:\Windows\system32\Jghpkq32.exe
        715⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jleicg32.exe
        
        C:\Windows\system32\Jleicg32.exe
        716⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Jlgeig32.exe
        
        C:\Windows\system32\Jlgeig32.exe
        717⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jepjbm32.exe
        
        C:\Windows\system32\Jepjbm32.exe
        718⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Jpenoe32.exe
        
        C:\Windows\system32\Jpenoe32.exe
        719⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Jgoflpal.exe
        
        C:\Windows\system32\Jgoflpal.exe
        720⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        721⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Kgacaopj.exe
        
        C:\Windows\system32\Kgacaopj.exe
        722⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Kloljf32.exe
        
        C:\Windows\system32\Kloljf32.exe
        723⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Kgdpgo32.exe
        
        C:\Windows\system32\Kgdpgo32.exe
        724⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        725⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Koodka32.exe
        
        C:\Windows\system32\Koodka32.exe
        726⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        727⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Klceeejl.exe
        
        C:\Windows\system32\Klceeejl.exe
        728⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        729⤵
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Knbaoh32.exe
        
        C:\Windows\system32\Knbaoh32.exe
        730⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Kpankd32.exe
        
        C:\Windows\system32\Kpankd32.exe
        731⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Kgkfhngo.exe
        
        C:\Windows\system32\Kgkfhngo.exe
        732⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Lnendhol.exe
        
        C:\Windows\system32\Lnendhol.exe
        733⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Lofklp32.exe
        
        C:\Windows\system32\Lofklp32.exe
        734⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Lgmbmn32.exe
        
        C:\Windows\system32\Lgmbmn32.exe
        735⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Lqfgfclm.exe
        
        C:\Windows\system32\Lqfgfclm.exe
        736⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Lgpocm32.exe
        
        C:\Windows\system32\Lgpocm32.exe
        737⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Lqhdlc32.exe
        
        C:\Windows\system32\Lqhdlc32.exe
        738⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Lfeldj32.exe
        
        C:\Windows\system32\Lfeldj32.exe
        739⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Lqjqab32.exe
        
        C:\Windows\system32\Lqjqab32.exe
        740⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Lcimmn32.exe
        
        C:\Windows\system32\Lcimmn32.exe
        741⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Lnnakg32.exe
        
        C:\Windows\system32\Lnnakg32.exe
        742⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Lqmmgb32.exe
        
        C:\Windows\system32\Lqmmgb32.exe
        743⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        744⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Mqojlbcb.exe
        
        C:\Windows\system32\Mqojlbcb.exe
        745⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Mgibil32.exe
        
        C:\Windows\system32\Mgibil32.exe
        746⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Mncjffbl.exe
        
        C:\Windows\system32\Mncjffbl.exe
        747⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Modgnn32.exe
        
        C:\Windows\system32\Modgnn32.exe
        748⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Mfnojh32.exe
        
        C:\Windows\system32\Mfnojh32.exe
        749⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6756
        
        C:\Windows\SysWOW64\Mnegkf32.exe
        
        C:\Windows\system32\Mnegkf32.exe
        750⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Mcbpcm32.exe
        
        C:\Windows\system32\Mcbpcm32.exe
        751⤵
        Drops file in System32 directory
        
        PID:12540
        
        C:\Windows\SysWOW64\Mjlhpgfn.exe
        
        C:\Windows\system32\Mjlhpgfn.exe
        752⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Mqfpma32.exe
        
        C:\Windows\system32\Mqfpma32.exe
        753⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Mfchehla.exe
        
        C:\Windows\system32\Mfchehla.exe
        754⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Mnjqfeld.exe
        
        C:\Windows\system32\Mnjqfeld.exe
        755⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Mokmnm32.exe
        
        C:\Windows\system32\Mokmnm32.exe
        756⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Nnmmleja.exe
        
        C:\Windows\system32\Nnmmleja.exe
        757⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Nfhbpghl.exe
        
        C:\Windows\system32\Nfhbpghl.exe
        758⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Nmajmaoi.exe
        
        C:\Windows\system32\Nmajmaoi.exe
        759⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        760⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Njekfenc.exe
        
        C:\Windows\system32\Njekfenc.exe
        761⤵
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Nmdgbamf.exe
        
        C:\Windows\system32\Nmdgbamf.exe
        762⤵
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        763⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Nmfchq32.exe
        
        C:\Windows\system32\Nmfchq32.exe
        764⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        765⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Nfohafad.exe
        
        C:\Windows\system32\Nfohafad.exe
        766⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Nnfpbcbf.exe
        
        C:\Windows\system32\Nnfpbcbf.exe
        767⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ocbhjjqn.exe
        
        C:\Windows\system32\Ocbhjjqn.exe
        768⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ojmqgd32.exe
        
        C:\Windows\system32\Ojmqgd32.exe
        769⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Oafido32.exe
        
        C:\Windows\system32\Oafido32.exe
        770⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ogqaqigd.exe
        
        C:\Windows\system32\Ogqaqigd.exe
        771⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        772⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Oplfekdp.exe
        
        C:\Windows\system32\Oplfekdp.exe
        773⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        774⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Ompfnoci.exe
        
        C:\Windows\system32\Ompfnoci.exe
        775⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Ocjokijf.exe
        
        C:\Windows\system32\Ocjokijf.exe
        776⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ojcghc32.exe
        
        C:\Windows\system32\Ojcghc32.exe
        777⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        778⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Ojfcmc32.exe
        
        C:\Windows\system32\Ojfcmc32.exe
        779⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Pfmdbd32.exe
        
        C:\Windows\system32\Pfmdbd32.exe
        780⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Pmgmonma.exe
        
        C:\Windows\system32\Pmgmonma.exe
        781⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        782⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Pjkmhblk.exe
        
        C:\Windows\system32\Pjkmhblk.exe
        783⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        784⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        785⤵
        Modifies registry class
        
        PID:8580
        
        C:\Windows\SysWOW64\Pmkfjn32.exe
        
        C:\Windows\system32\Pmkfjn32.exe
        786⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Phajgf32.exe
        
        C:\Windows\system32\Phajgf32.exe
        787⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Pnkbdqpo.exe
        
        C:\Windows\system32\Pnkbdqpo.exe
        788⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
        
        C:\Windows\SysWOW64\Pploli32.exe
        
        C:\Windows\system32\Pploli32.exe
        789⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Pffghc32.exe
        
        C:\Windows\system32\Pffghc32.exe
        790⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        791⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8968
        
        C:\Windows\SysWOW64\Qdjgbg32.exe
        
        C:\Windows\system32\Qdjgbg32.exe
        792⤵
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Qfhdnb32.exe
        
        C:\Windows\system32\Qfhdnb32.exe
        793⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\Qmblkmcd.exe
        
        C:\Windows\system32\Qmblkmcd.exe
        794⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\Qhhphebj.exe
        
        C:\Windows\system32\Qhhphebj.exe
        795⤵
        Drops file in System32 directory
        
        PID:13400
        
        C:\Windows\SysWOW64\Qobhepjf.exe
        
        C:\Windows\system32\Qobhepjf.exe
        796⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Apcemh32.exe
        
        C:\Windows\system32\Apcemh32.exe
        797⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13468
        
        C:\Windows\SysWOW64\Akiijq32.exe
        
        C:\Windows\system32\Akiijq32.exe
        798⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        799⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:13672
        
        C:\Windows\SysWOW64\Agbgda32.exe
        
        C:\Windows\system32\Agbgda32.exe
        800⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Amloakki.exe
        
        C:\Windows\system32\Amloakki.exe
        801⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\Adfgne32.exe
        
        C:\Windows\system32\Adfgne32.exe
        802⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\Akpojpic.exe
        
        C:\Windows\system32\Akpojpic.exe
        803⤵
        Drops file in System32 directory
        
        PID:13812
        
        C:\Windows\SysWOW64\Aajggjap.exe
        
        C:\Windows\system32\Aajggjap.exe
        804⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\Akblpo32.exe
        
        C:\Windows\system32\Akblpo32.exe
        805⤵
        
        PID:13884
        
        C:\Windows\SysWOW64\Bpodhf32.exe
        
        C:\Windows\system32\Bpodhf32.exe
        806⤵
        Modifies registry class
        
        PID:13920
        
        C:\Windows\SysWOW64\Bgimepmd.exe
        
        C:\Windows\system32\Bgimepmd.exe
        807⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        808⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        809⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\Bmeagjbo.exe
        
        C:\Windows\system32\Bmeagjbo.exe
        810⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        811⤵
        System Location Discovery: System Language Discovery
        
        PID:14096
        
        C:\Windows\SysWOW64\Boenam32.exe
        
        C:\Windows\system32\Boenam32.exe
        812⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\Bdagidhi.exe
        
        C:\Windows\system32\Bdagidhi.exe
        813⤵
        
        PID:14164
        
        C:\Windows\SysWOW64\Bgpceogl.exe
        
        C:\Windows\system32\Bgpceogl.exe
        814⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Bnjkbi32.exe
        
        C:\Windows\system32\Bnjkbi32.exe
        815⤵
        
        PID:14232
        
        C:\Windows\SysWOW64\Bphgoe32.exe
        
        C:\Windows\system32\Bphgoe32.exe
        816⤵
        System Location Discovery: System Language Discovery
        
        PID:14268
        
        C:\Windows\SysWOW64\Coigllel.exe
        
        C:\Windows\system32\Coigllel.exe
        817⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\Cpkddd32.exe
        
        C:\Windows\system32\Cpkddd32.exe
        818⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13396
        
        C:\Windows\SysWOW64\Cnodmijd.exe
        
        C:\Windows\system32\Cnodmijd.exe
        819⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\Cggifn32.exe
        
        C:\Windows\system32\Cggifn32.exe
        820⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        821⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\Cgiflnoa.exe
        
        C:\Windows\system32\Cgiflnoa.exe
        822⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\Cncnhh32.exe
        
        C:\Windows\system32\Cncnhh32.exe
        823⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\Cpajdc32.exe
        
        C:\Windows\system32\Cpajdc32.exe
        824⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\Cocjbkna.exe
        
        C:\Windows\system32\Cocjbkna.exe
        825⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\Caagofme.exe
        
        C:\Windows\system32\Caagofme.exe
        826⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Chkokq32.exe
        
        C:\Windows\system32\Chkokq32.exe
        827⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Doeghk32.exe
        
        C:\Windows\system32\Doeghk32.exe
        828⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\Dpfcpcam.exe
        
        C:\Windows\system32\Dpfcpcam.exe
        829⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Dklhmlac.exe
        
        C:\Windows\system32\Dklhmlac.exe
        830⤵
        Drops file in System32 directory
        
        PID:13908
        
        C:\Windows\SysWOW64\Dafpjf32.exe
        
        C:\Windows\system32\Dafpjf32.exe
        831⤵
        
        PID:13952
        
        C:\Windows\SysWOW64\Dhphfppl.exe
        
        C:\Windows\system32\Dhphfppl.exe
        832⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14000
        
        C:\Windows\SysWOW64\Dnmaog32.exe
        
        C:\Windows\system32\Dnmaog32.exe
        833⤵
        
        PID:14052
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        834⤵
        System Location Discovery: System Language Discovery
        
        PID:8352
        
        C:\Windows\SysWOW64\Dnondf32.exe
        
        C:\Windows\system32\Dnondf32.exe
        835⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\Ddifaqcn.exe
        
        C:\Windows\system32\Ddifaqcn.exe
        836⤵
        
        PID:14188
        
        C:\Windows\SysWOW64\Dkcnnk32.exe
        
        C:\Windows\system32\Dkcnnk32.exe
        837⤵
        
        PID:14228
        
        C:\Windows\SysWOW64\Dqpffaib.exe
        
        C:\Windows\system32\Dqpffaib.exe
        838⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Eoagdi32.exe
        
        C:\Windows\system32\Eoagdi32.exe
        839⤵
        System Location Discovery: System Language Discovery
        
        PID:8860
        
        C:\Windows\SysWOW64\Ednolp32.exe
        
        C:\Windows\system32\Ednolp32.exe
        840⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        841⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Eqdpaa32.exe
        
        C:\Windows\system32\Eqdpaa32.exe
        842⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13532 -s 448
        843⤵
        Program crash
        
        PID:13656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 13532 -ip 13532
1⤵
PID:13612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aalndaml.exe

Path C:\Windows\SysWOW64\Aalndaml.exe
Size 320KB
SHA256 4dac231205862452852d1fed3ad909454c542becd87b5cfe04688542e5d9fe77
MD5 7114589fb116eefc42217d2a24752b89
SHA1 ac14bd691e32368286d3c3d245880d08fb088ed2
SHA512 25bb68e013172f8a6a40f343b34fd2908bd5d8eff9170bccdb3b8b2abfaabc011a7c4db9a4626b293d23865264e6dee038409dfe141bda72d4e6617c2b6d1933
SSDEEP 3072:6YEMc8ZwRpeUp1N+8XQWGQsswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:APv1gWZssV/Ah1G/AcQ///NR5fn
TLSH
T1CC64DA1A26341DEACEED1BB5AC1259D89141E9F014F1E13EA2239FDCE8F4DB2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Abpcicpi.exe

Path C:\Windows\SysWOW64\Abpcicpi.exe
Size 320KB
SHA256 9028c42d61971fb20d1482f426298952debe387083a32758a58b62ac390aeaec
MD5 feb84936b1c51af3e01405ecc9339de2
SHA1 75459ddd982a98fad09a8ebaa0b4d3d26afbef45
SHA512 6759a82b4c651b1789573c96b0f620faaf712621ecc5a5fcc559aac4254d148602265d3b2ae68ca04e1c8e1d8ee9f71a525cfe86e0d885585ccfba1f6525a993
SSDEEP 3072:GLqIvz4wVv55XRWQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GLqIvzH55XAQV/Ah1G/AcQ///NR5fn
TLSH
T1BA6452591A340DEACEED5FB5AC2249D89141E8F054F1E23EA1A3DFDCD8E4DA6C805F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahffqk32.exe

Path C:\Windows\SysWOW64\Ahffqk32.exe
Size 320KB
SHA256 d42e59706f21a2bd7f5775ed9c914e665d0d9a91fa7a8f7df77b1f7a06b60bb4
MD5 53202c196ee7134cec6d32650df5fade
SHA1 c2df8d48c47be260e4cc6499d5641561945d79c9
SHA512 99a93b125d98902d38f35ab13df3c9cb457620226b77ab2ef6cc8b42ee283e7929c073a375334be685e58fb4af410513512c6acc5b0cabdf18cd7d61b403a6d6
SSDEEP 3072:19ZfeIkuBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vkuBV/Ah1G/AcQ///NR5fn
TLSH
T178640E6A2A3409EACEED1BB9BC124DD86141E9F014F1E23E6163DFDCD8E4D66D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ahjoljqc.exe

Path C:\Windows\SysWOW64\Ahjoljqc.exe
Size 320KB
SHA256 ebccfcf591fb0140492cdbb32885f96cb9e939b6bd35f648adfe33d9f136ecca
MD5 ebc748b97a7d5990532b046070823291
SHA1 0d765aa4842339d278df760f40eeb8e0ac891fcf
SHA512 47fcc64fdfa5e7a8cf829e6ccdc78b618115789b3aea500d5a89a4a50988a33270955d0d374c8f7a3cf8f5922b5844bd797a1ce8390f4b2dbca7cbc5e041231d
SSDEEP 3072:uFiA3W8tjJNZdteBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DAmEtteBV/Ah1G/AcQ///NR5fn
TLSH
T1E6641C29163009EAEEED1BB6EC5249D891D1E9F014F1E13E2123DFDCC9E6DA6C845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aloekjod.exe

Path C:\Windows\SysWOW64\Aloekjod.exe
Size 320KB
SHA256 b488eb4fd530795692f2b8768decfbebf7c8eec25d7acd311ed175d8100b9ce5
MD5 9c802e8f0103dd42d7ed140eb0d560a5
SHA1 fc42e708aea3b4c25d1ed7e1d5a840ec6c99bef6
SHA512 b72387a6a89fbcfa3c0a49fc8e2d97a2b73e8ebfc17d351a65964354ef78aea4e31125cf9cd9873a89b0ada5e33ee3d7e6e7a2001f2dd3d9013e2577db17fa30
SSDEEP 3072:GhvoRRUnbgegpsHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GhA7UM6HV/Ah1G/AcQ///NR5fn
TLSH
T1476430192A3409EACEED1FB6AD0259D89141EAF014F1E13E6523DFDCD8E4DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bbgiibja.exe

Path C:\Windows\SysWOW64\Bbgiibja.exe
Size 320KB
SHA256 0aa1fe084ce7543249ac4d4ac30e22d90fba2faffd69d678e56aee53ff7a9b5a
MD5 d9683b7c9a1b20e0edabab2831a435b0
SHA1 9465b4255d9315855d40c7f4a091f9158340506c
SHA512 049159fb575b69cbb65c5fe5742970712a3c439194924135d0829302019860db16e0fdfc8a74f01405e5af77e84a29be3eb276e0ac014418ac227f3c0f03cee4
SSDEEP 3072:FKvsjk6H/UwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wvsBH/UV/Ah1G/AcQ///NR5fn
TLSH
T1966410192A3409FACDED1FB5AD0249D8A142E5F014F1E23E6923DFDCD8E4DA2D819F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdcmfkde.exe

Path C:\Windows\SysWOW64\Bdcmfkde.exe
Size 320KB
SHA256 2b0bc0ce2298f9c8681c4b49dbc4d5e39779b1795b8598ca72a6efb3baaa220e
MD5 7575cbfd8c1d97c1da628304fb83d1d0
SHA1 21650d60134f47146da8b62b466d476a5b78eb8a
SHA512 c94c8614eb4fc782d45606092f21daf3421ff4b2d3534a1db2f2453d9a2559da1e44732a3b20c8155c475eb65bac72940337f0b8c19abdd743cf6c4ce776f949
SSDEEP 3072:FvD/Ed7u+NSemTQ8t8zwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FvD/UExQ3zV/Ah1G/AcQ///NR5fn
TLSH
T1986460192A3009EACEED1FB5AC2249D89191E8F454F1E17E6123DFDCC9E4DB2D858F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bejoqm32.exe

Path C:\Windows\SysWOW64\Bejoqm32.exe
Size 320KB
SHA256 778f3a2a9ed3b100db694cf631a0e8a1902c83f01ef1f3d3cb47ea12629850eb
MD5 1e0a3795389479a71f3025364925e7d5
SHA1 27f5551ee7318faed633b2d418fb9402e91e8100
SHA512 be64c799d6e82cb89ec921fb82f9263eb8e4a5894bff9321faecc5ab3e13507b6597bf8154b8c07a01aeacaa7424eca60de7b023be8eea60e777f2a2b54eb964
SSDEEP 3072:2Y/txPVR6GlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2i/POGlV/Ah1G/AcQ///NR5fn
TLSH
T1016452192A3049EACEED1FB5AE1259D89145E4F014F1E13E6263DFDCD8E8EA2DC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhaeli32.exe

Path C:\Windows\SysWOW64\Bhaeli32.exe
Size 320KB
SHA256 dd48acbd5fd157171327d54dd84996da3e67d28d237e97ce600966ba493da06f
MD5 551094d1f075820880a77368bb854034
SHA1 56a3931e87dbcc7fb4fb4038fdbd780da09732cc
SHA512 e76d7ee3109d7e4bde29dede358d89a968d90a3f7deddfb1daf783781202fe997c1b3b9e2f104b54faf3d6f49c7e084f5e7cfca65c1a5724481b79e8b6af6e4b
SSDEEP 3072:Y2dzH66AnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rzaRnV/Ah1G/AcQ///NR5fn
TLSH
T1A8641E19263409FADDED2BBAAC124DD85185E8F015F1E23E6127EFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhdbaihi.exe

Path C:\Windows\SysWOW64\Bhdbaihi.exe
Size 320KB
SHA256 bde231fb3a98752d3c73b7516a4dc6785238a4e1ac1ceda6ad9214ac7f2cf53a
MD5 cfb8777fdd6af20503aad25a70ed90aa
SHA1 4a5488251fe88834327239c7a695903c4fd89786
SHA512 aa9a75caad35b8d3a4a5ce84011aff633a65f1995982179285b6ba4fe21b9ef0a980d560857d8b9d0c8082ed7bfc4ee636459d4e8a5151dcb7c552c379e6513c
SSDEEP 3072:sY9bD0hnQCZFAIP0bk069GwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:sY5D2QtR69GV/Ah1G/AcQ///NR5fn
TLSH
T1CA64211926340AEACDED1FB5AC1249D89141F5F124F1E23E6623DFDDD8E4EA6C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbcieqpd.exe

Path C:\Windows\SysWOW64\Cbcieqpd.exe
Size 320KB
SHA256 0f6e2dba93498b3f1ccf95f796c41a9e1162792973402f6627842c28f3c3caef
MD5 4e18edd7788954d33ec610e23c96d60f
SHA1 1460a5623e6416e3dd7bc23231148472771ba03b
SHA512 39a9e90d3ad22f67b8bdb200a2b9d739e21785d4d2b871f45d10baac58355fbcec5559b6e8985d9bf8792930d370d1197cc4b5b0a882d981826cfd68d63d6aeb
SSDEEP 3072:f5cI4avBoEUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fd4aFUV/Ah1G/AcQ///NR5fn
TLSH
T19764FB2A2A3409EADDFD5BB5AC2249DC9151E8F014F1E53E6123DFDCD8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbqlpabf.exe

Path C:\Windows\SysWOW64\Cbqlpabf.exe
Size 320KB
SHA256 547b3b95711ca5296cace645ac1211e7b30e522968d4ce4c2c50003e142e6045
MD5 7ea50a4a3cbef647d66ad70a0f4034c1
SHA1 ac95a297e7dec8d0ec2b3f3757606929b6014a4f
SHA512 284aef4371ff96ce089fcdcde98007259c6c44b6f03caf5295c60130f875f2dcfcbb8ac3f38f0bf6cdd71733d49a2f209b83dc68dbd61990287adb2d450fe50e
SSDEEP 3072:HcrXcgAqRP2JwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:HM7A/JV/Ah1G/AcQ///NR5fn
TLSH
T1716441192A7409EACDED2FB5AC0259D85181E8F018F1E57E2123DFDCD8E4DAACC19F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chkhbh32.exe

Path C:\Windows\SysWOW64\Chkhbh32.exe
Size 320KB
SHA256 e4cb5450ec4537cfcc9f023c698ce09ffde84ae4f29af9a736762f70de4ede99
MD5 1880411cc961a0ec8e9617e6e32b36ef
SHA1 1272f6e7e5b4cfa6dc2accda35ef120acfd87230
SHA512 ce37921a57bdf739afbd9244ee82dd43de16061f9249c7b9422d657ee0c398a8ece5145928422160f969cb4825dd72ef5bf7c1b8c86d0fc0d515d719a7a67aeb
SSDEEP 3072:zJBgwvrRYnwTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zJBNrRlTV/Ah1G/AcQ///NR5fn
TLSH
T19D641F1916350DEACEED1BB6AD1249F89141E9F014F2E23E6123DFDCD8E4DA6E805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mcklac32.exe

Path C:\Windows\SysWOW64\Mcklac32.exe
Size 320KB
SHA256 8386eba5937678c3e1918cd5da20c33de60b5a509f3b35c9150f5d535a758d63
MD5 026152ec83bc7b05642617237ad0452e
SHA1 28253c9b74151a475788a842d775f008cdaa29fd
SHA512 813b757cb3f4bbf0b3e6850a476b9b50c5e2a302703a15d24563eba1b0d4e35704768aa7ca28ce701ebaf187406716272a11c8353a835b496017e29e9ea86699
SSDEEP 3072:Y7e17nieuDTmdUaMWDVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dQeC3zYVV/Ah1G/AcQ///NR5fn
TLSH
T1526440192A3409EADEEE1FB5ED2289D99142E9F014F1E13E5123DFDCD8E4DA2D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mncmck32.exe

Path C:\Windows\SysWOW64\Mncmck32.exe
Size 320KB
SHA256 a685200c2fde6114f51d0f3222554443be387dd2e571b5ea920e7d39efec27be
MD5 ed333194a02641ca6b1be011afb60851
SHA1 34882ab3ae354c2b543d086db2c5e1c8a8d95bf4
SHA512 75c11a0c2309cefa232f33177a4dddbee967db9a4136919cfd49ae367acdd3abaecaafa0639b0f3d910ed2c0fa7555632d7b33c4ebe0712575e89a35e1b5ed48
SSDEEP 3072:zJlt7LZM5kymwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:z7M5jmV/Ah1G/AcQ///NR5fn
TLSH
T1596420292A3409EACDED1BB6AC0249D8A145F9F014F1E13E6923DFDCDCE4DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mpoljg32.exe

Path C:\Windows\SysWOW64\Mpoljg32.exe
Size 320KB
SHA256 24f3815d6db33b6a0003abac1d3adda9f54193ed401496349d79a4b5a7edfcc5
MD5 a5c3dcaa6ca0f2e75041cd5502c41760
SHA1 aae7c4ce37214f0b4f83ef00a36814559ef1a218
SHA512 c9e751cb7f5b6b94ba22a53c1c86aa3efbf8a353a6f667fc88707aa595b0ed0b46996bb831bd9ab8055f96401a6b8c099b15123ebf913d4a1e06601b4c99fe89
SSDEEP 3072:LFMfppbw8buwnmw0BfkwrowS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LFy/wwmwrwroV/Ah1G/AcQ///NR5fn
TLSH
T19D641F1A26340DEACEED1BB9EC1249D85141E9F214F1E13E6123DFDCD8E4DAAD819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Naaejj32.exe

Path C:\Windows\SysWOW64\Naaejj32.exe
Size 320KB
SHA256 d0e7d220a7cc2689a4d6e00d49cd01fab5d348ae9fa19c3827bacd66ef4a264b
MD5 0ae0275808ba767ee64992d597d6353e
SHA1 8995fc1534d74e47e3a7d0a9d0c116dc4bfe68ca
SHA512 c02af37022f765c552d17588bd6da8dd22523c7bbede0818384912b8ebfce670e93fc93d2ff8fad174ce7dfa2e1b9636dd90bb69791ae6e1dff60468ecee1ee3
SSDEEP 3072:q6C8nni4agi8rX6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rC+i4agi8rX6V/Ah1G/AcQ///NR5fn
TLSH
T1EB643019263409EACEED2FB5AC0649D85181EAF014F1E13E6523DFDCD8F4DA2C91AF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nddkaddm.exe

Path C:\Windows\SysWOW64\Nddkaddm.exe
Size 320KB
SHA256 f1c4a210b81c22b40bc4b8942d3d14669b28569afae97d5020f19380f0c2c583
MD5 c3f08e7646526e79c5ec655860910141
SHA1 4d20309342da80f9d515e963e0c9f95fd58c7703
SHA512 371779799d0c592ad5b9585478c61f57b710938c45182a8960afad41b1139f8eca9b6743b449d4da2f017f92c9a8312a053ad71ca1ef59026e80557bf8d305cd
SSDEEP 3072:c5C+DqKGMukAILwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N7gLV/Ah1G/AcQ///NR5fn
TLSH
T1B4641F1A2A7419EBCDEE1BB5AC0249D89141E9F418F1E13E6523DFDCDCE4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nglala32.exe

Path C:\Windows\SysWOW64\Nglala32.exe
Size 320KB
SHA256 8fa457ffb036a6feb92d82b3a86a4fb417b4874c7abd1b45580cda64df1a2da5
MD5 13fadf2c04b0e736754a2d494016f057
SHA1 ecf70824ff8d055e97dafe125acfe6d15f8d3f99
SHA512 d0bff7cb4bfa1b4e642f4fa4b9db21e53ad27efc240afb6be1520195d58148962a1ff45b36593cb9849c68cec8dd6e41963b8f959924d053aa54be0300c10916
SSDEEP 3072:X/yfCejGkoO1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PYVvoO1V/Ah1G/AcQ///NR5fn
TLSH
T134642F1A1A3009EACEED1BB5AD125DD89141E9F014F1E13F6123EFDCD8E4EA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njacikbd.exe

Path C:\Windows\SysWOW64\Njacikbd.exe
Size 320KB
SHA256 d02780fc81239bc6d9fe7bddedbacb183ffaa94eaf9991b3fd6ac9b3ec02b178
MD5 e6749e594e04b7b76d1fa5f8edcf3d9c
SHA1 3942b9c8d018c45aa65bb2fc1704df6777b29078
SHA512 5833263b811515021334eae5323070b667eb7d015f54d37782a6fa4eab2b29954cebf19b85e4130c9f8d69586f2ce5da3265f197026e6db746ee5321a65298e6
SSDEEP 3072:fjBkjn8N1kaD/BGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f1kL8N1kaDpGV/Ah1G/AcQ///NR5fn
TLSH
T1FC641F1A263409EACEEE9BB5AC5249D89141F9F014F1E13E6123DFDCD8E5DA2CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njcpok32.exe

Path C:\Windows\SysWOW64\Njcpok32.exe
Size 320KB
SHA256 24806b6dd43eae24cb70a2bd7a282d3e55edadfe77e320275078bf7853999814
MD5 8ed9dd14dabf33e52a7a9ec0be68e672
SHA1 254b37b88f1bf762a2b90af7163d01ea62a6a13d
SHA512 49847305ee67fc7fc51febdbdd9daf6c329a53bc4790334e66d99d452f0ea37f68bf2bedf12f620a97787a0687a929dd7022609fb601c147e09da3edb4988a6b
SSDEEP 3072:d4EuIOj6+l6/CFl8dUZAcwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:d0jFg+4UZAcV/Ah1G/AcQ///NR5fn
TLSH
T11564E9192A310DEADEED1BB6EC1249D85181E9B014F5E13E6523DFDCE8F8DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njogdldg.exe

Path C:\Windows\SysWOW64\Njogdldg.exe
Size 320KB
SHA256 2f3ed58818d4e00d464334093765b5ae6a4e7a2cf610e6f418e005c89f53fbb0
MD5 6de939ce607b5a68533dd7e70933007d
SHA1 a62f0c2e5b19948f57c5ec5c4c3116c2c0da8ed5
SHA512 b436066aa8389910f36d5e47fc7d237d561407574c6e9d308e3a03feae622dbc6d2c52aeb170ca6d81539729c9666d0e95ec04c0c2b6dcaef045331ebe92a36c
SSDEEP 3072:A7By9eLjlaViDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OyoZaViDV/Ah1G/AcQ///NR5fn
TLSH
T1A3642F19267409EACEFD1BB5BC025AE85182E4F114F1E13E6623DFDCE8E5DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Occkhp32.exe

Path C:\Windows\SysWOW64\Occkhp32.exe
Size 320KB
SHA256 f3e4d2bec3e92df576761f60feb7c3432e90468d6ccf6aa490fad821f9d4a2a2
MD5 31eb03c2e79fe7d013bec9c8ed8ef263
SHA1 a2f7d42051600865620a0dbb8408d903f89b046e
SHA512 cbe27ba34be116b9fc2a79d6ce6b8fd8a6970a2cca269d0f85591a758485d867d31acbeb9747d259d1f1f60999cb42f712c7fc1b791674b0f89c3d9e7e17634d
SSDEEP 3072:pGsipJ+RWWMNm/GQ+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:W8leQ+V/Ah1G/AcQ///NR5fn
TLSH
T1F3642F19263009EADEED1BB5AC2249ED5141E9F018F1E63E5623EFDCD8E4DA2C845FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojjfpjjj.exe

Path C:\Windows\SysWOW64\Ojjfpjjj.exe
Size 320KB
SHA256 a31a9e5f10bc33dfcc365afb9c7fce6e62290998805c4a759993613a5658715e
MD5 e63fe7b257a5b833b6c8d3b09b3a8603
SHA1 7d29a6a2b74f3209dd60679fddef459fcd31e887
SHA512 c42763e9f482dec1dba9d46d1d861ef2ce9339a3c666ede29e4f592403b525e1cc2b6ef291a1b09c6d0c043d6ee91d67c70b0b586bff1cf6bd10f55e6c3dfa11
SSDEEP 3072:eYkoQY/DvQHtDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:iov/DvCDV/Ah1G/AcQ///NR5fn
TLSH
T1296420192A340DEACEED1FB6AC124AD99141E9F014F1E13E6523DFDCD8E4DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojmcej32.exe

Path C:\Windows\SysWOW64\Ojmcej32.exe
Size 320KB
SHA256 7187ae0ec5b893dd6d2e66c5b392c06cd5faa63c7a6695d6a76644961c4c2060
MD5 0e0894e1509b8e884ef36ae6c2ea02f3
SHA1 c5bf67f5c642fe2d70ea852962afb1b06d22ab6e
SHA512 bd8fbc1bcdf9c8263251a75869010cd8202b5d3581dc8b1a6b5828ed24ac2b124f32b4eefba8df155413bfc2b21f8306f141e10ef3d9d9541ec4eebff811aeea
SSDEEP 3072:G04d+CaDg3sppeosrXywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:n4d+CKXejXyV/Ah1G/AcQ///NR5fn
TLSH
T19364FA19AA3449EACEED1FB5AC5249D89585E8B014F1E13E6133DFDCC8F4DA2C818F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Papnhbgi.exe

Path C:\Windows\SysWOW64\Papnhbgi.exe
Size 320KB
SHA256 b44ff86243bd1eb31beba128d2426c03cb7d17856fce2c4bdd6701e79d06988e
MD5 2ecdf70b5a3428217115e53c180ae275
SHA1 074627fb06ba0b6dc52888308a650d4f5adb403a
SHA512 27b0f3c276a8dbe6a571662bec8003c6606e88347b6fa24b4c38c13d8f12cfd9ad2dedd2ed20e958e8e9c8cdb03d4f9eb4835bbb2e1f0fe4a6222e634dcef6f9
SSDEEP 3072:8DBV6oOOCoGLi0N/uP6KwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zoOOW/fKV/Ah1G/AcQ///NR5fn
TLSH
T11E641F19263809EACEED5BB5AC1389D89142E9F015F1E13E6123EFDCD8E4DA6DC15F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pbpjbe32.exe

Path C:\Windows\SysWOW64\Pbpjbe32.exe
Size 320KB
SHA256 831ba347b7068ff9f9312fb09f8473ad6804c3baa6f83e6cc14a7e65f6095f71
MD5 f7dfd496a6930e848fcf3d8623e1b492
SHA1 4f1fc8434f0ba85d8e144ea32fa5c744f59e73df
SHA512 dd1c99b637d2d61549e568b2bf1eb8e3e7c5a09b32f7fae4e724d09c28f68dedaaa7fe13ff6ba6211943a234db9c0cd40f872914bcc7289fbe692de5136cd4a6
SSDEEP 3072:3DGUB156YYxHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:am156YGHV/Ah1G/AcQ///NR5fn
TLSH
T198642F192630C9EACEED1BB6AC1249D85141E5F014F1E53EA133DFDCD8E4DAAE819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pgcpdn32.exe

Path C:\Windows\SysWOW64\Pgcpdn32.exe
Size 320KB
SHA256 12ebed5362291f08435ad62539f5096c75543ada9cee420cf81da556c5626c7d
MD5 d00c950d27f993e1b3596bbd5ff68cc0
SHA1 0e4e26fd61e7a75515985f765e52162477bf395e
SHA512 e082c0413e4d668c3ac277c3f2094d5360f87cd45fafaf1fa0958f6f77fc6c54d19a1f2b319e7456b8c1d85e74c5ae8b83d9235922a031f383caa7b3c41a7fe3
SSDEEP 3072:C484v1rA/brJ4Jqn14zwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Cl4v1rA/J4onyzV/Ah1G/AcQ///NR5fn
TLSH
T1E164FD1A263019EACEED1FB6AC5649DC5242E9F014F1E13E6123DFDCD8E4DA2C816F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pgemimck.exe

Path C:\Windows\SysWOW64\Pgemimck.exe
Size 320KB
SHA256 246f5534bbd18501205fb7e3060869cde3491d627a36decae0c41b87aab39182
MD5 de57924c989c57ba75c7af9fda446078
SHA1 8937ee2259235f18f4a1d2ee3f0cf77daa2a2790
SHA512 3d7eff9a751b9bca3a41fe78260a02e33659d2a4f54104a0c0e12860c0ee9d4b075890fbd3b054e2655a7ab05b8acd5f404a785256780746cdff225a38303025
SSDEEP 3072:kDLhBUT0//Y6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kfhRY6V/Ah1G/AcQ///NR5fn
TLSH
T191640B192A7009EACEED5BB5EE0249D895C1E4B014F1E13E6123DFDDC9E4DAAC814FC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pkcepl32.exe

Path C:\Windows\SysWOW64\Pkcepl32.exe
Size 320KB
SHA256 b7fe6cc7c74ee3e8a979e2d4b37a2d5a05b7bd994abe7f56d31510354bd95400
MD5 7e56f02281efbe76a3a5313502a53135
SHA1 7966d58a383ff227a274ffd4222505a1c4275357
SHA512 1025553d9071db230e01ea57e4b79cb7ab0a3f4f2ea7e7ad817b696268c03e9cecb8f4728a134238cd22538872f4fd5606f3744f7c6e1e6911c53bd6e91d36e3
SSDEEP 3072:8PEbFCv19SoLxzaO0hzayzJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:uZSomzJV/Ah1G/AcQ///NR5fn
TLSH
T100644F592A301DEACEED1BB5AC0249DC9581E9F414F1E13E2123EFDCC8E5DA2C925F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qgopplkq.exe

Path C:\Windows\SysWOW64\Qgopplkq.exe
Size 320KB
SHA256 0ef0093970c7df725e756a350b0a83c2b01bed38e31bc4d5bdc7eebf18cb44c0
MD5 b9a8bac2f3d57b95d914fc88c4bc1b6a
SHA1 2bc249bde760aa5ce1404e4ea8045b3e05bff9e4
SHA512 f590a212211d673a38741c4ad060facfb673d3eee2a3fbea67329cbfef95123aa4104f011dfd2ec704377fd602c0c5b2d572932688fe0b9b094d56ec96361830
SSDEEP 3072:vgKi9t+0racVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XSx5VV/Ah1G/AcQ///NR5fn
TLSH
T1A6642F1A263409EACEEDAFB5AC1249D89141E9F114F5E13E6133DFDCD8E4DA2E805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qlmhfj32.exe

Path C:\Windows\SysWOW64\Qlmhfj32.exe
Size 320KB
SHA256 058e0b9a17d67ceea35742a1caf8e6ef3363b76ce166ea22a35684aeb8b12c29
MD5 170c32eef3e52355a7c064ef66dfdd53
SHA1 7ca33dae6907fe3fa84e704f745fe7e4bb121389
SHA512 91370a23f50b0fc96065a86fc94cb33a0c0a5f19237976590ddeb5b0e42b6e2d5d0b9569a5a91f83ea3e48882119302824ebbe63c8d3cf964d43e5d46434a068
SSDEEP 3072:Y5SMxwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YdxwV/Ah1G/AcQ///NR5fn
TLSH
T18B64EB19163409EACDED1BB9EC0289D89141E9F119F1E13E6623DFDCE8E4DA2D819FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/796-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/932-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/964-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1044-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1072-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1132-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1184-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1220-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1244-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1252-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1304-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1304-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1532-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1544-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1596-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1856-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2236-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2348-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2404-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2480-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2512-237-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2540-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2620-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2656-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2656-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2704-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2764-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2904-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3264-475-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3300-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3304-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3356-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3384-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3396-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3404-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3404-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3424-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3432-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3484-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3584-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3748-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3808-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3812-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3912-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4060-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4104-211-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4156-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4156-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4176-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4184-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4240-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4288-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4336-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4396-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4460-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4480-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4552-342-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4616-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4648-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4692-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4772-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4844-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4872-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4888-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4920-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4972-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4992-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5016-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5056-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5116-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5124-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5132-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5140-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5240-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5356-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5380-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5468-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5492-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5648-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5656-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5656-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5700-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5756-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5776-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5892-186-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5916-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6024-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6112-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/6112-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6112-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads