berbew | d1b8606fd93c35c4e7b70dc3282a2fd33b3287e71bae9bdc6a0f5760c016c496

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_3227e2a6e63be45a5435aca66891de89_elex_wannacry.exe
Size 320KB
Sample260728-2873rayeld
SHA256 d1b8606fd93c35c4e7b70dc3282a2fd33b3287e71bae9bdc6a0f5760c016c496
MD5 3227e2a6e63be45a5435aca66891de89
SHA1 41067180d5e23d68c61758fd1a561fb11116ba7e
SHA512 b135a1c3bab84ab6ff46784f8ab44d806c4f450fcc2ea32e35620122c3634168c7806f65de8cfaa1d034609c22ab12d5bec070f84065237c596997eb3ac7375f
SSDEEP 3072:ai6tHVK1s6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ai6Rms6V/Ah1G/AcQ///NR5fn
TLSH
T1A0642D1A6A3409EACEFE1BB5AD1249DA9141E9F054F1E13E6123DFDCC8E4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpllbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egmjpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afkipi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diopep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imfmgcdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jabiie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnebmgjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Donecfao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijgakgej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkdlkope.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdofpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dicbfhni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fncbha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdddhlbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pklamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eekjep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glchjedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfcdaehf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkqdnkge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anjpeelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqbohocd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mejnlpai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjpld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpmifkgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Donecfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcembe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfdaigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Malnklgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkcackeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khhaanop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meljappg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkjegb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jobfdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deejpjgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imfdaigj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogqmee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opmcod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eljchpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jakchf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oamgcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pocdba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pojjcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebcdjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljffccjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okkalnjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcgqag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oolnabal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foonjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcmpgpkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hodqlq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgaiffii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfanlpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfpidk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akfdcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnblm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clgmkbna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edlann32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flcfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmjcdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mackfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmckbjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afqifo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmlgcf32.exe

Executes dropped EXE 64 IoCs

pid	Process
1968	Qmckbjdl.exe
1120	Apddce32.exe
2808	Abemep32.exe
2032	Afqifo32.exe
620	Afeban32.exe
464	Bldgoeog.exe
2856	Bmddihfj.exe
4452	Bcnleb32.exe
4104	Beaecjab.exe
3748	Bmimdg32.exe
3580	Blknpdho.exe
1856	Cmmgof32.exe
456	Cekhihig.exe
2660	Ciiaogon.exe
3504	Clgmkbna.exe
3520	Cpcila32.exe
4112	Cbaehl32.exe
4844	Cmgjee32.exe
4616	Dpefaq32.exe
2584	Dbcbnlcl.exe
1032	Debnjgcp.exe
3588	Dinjjf32.exe
3940	Dllffa32.exe
100	Ddcogo32.exe
3000	Dbfoclai.exe
4268	Dfakcj32.exe
2100	Dipgpf32.exe
4180	Dlncla32.exe
2148	Dpjompqc.exe
1264	Dbhlikpf.exe
2432	Dgdgijhp.exe
2280	Dibdeegc.exe
4568	Dmnpfd32.exe
2536	Dpllbp32.exe
2388	Ddhhbngi.exe
4756	Dgfdojfm.exe
1136	Didqkeeq.exe
3492	Dlcmgqdd.exe
3928	Ddjehneg.exe
2592	Dghadidj.exe
4208	Digmqe32.exe
5108	Eleimp32.exe
4728	Edlann32.exe
4752	Egknji32.exe
1576	Eiijfd32.exe
3632	Elhfbp32.exe
3252	Edoncm32.exe
4332	Egmjpi32.exe
1816	Eilfldoi.exe
4076	Eljchpnl.exe
1588	Edakimoo.exe
2532	Egpgehnb.exe
1168	Eincadmf.exe
4072	Ellpmolj.exe
1568	Edcgnmml.exe
5008	Egbdjhlp.exe
3796	Eippgckc.exe
3752	Elolco32.exe
116	Edfddl32.exe
3384	Egdqph32.exe
2456	Eibmlc32.exe
4764	Fpmeimpn.exe
4932	Fckaeioa.exe
3540	Fjeibc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gphddlfp.exe	Gnjhhpgl.exe
File opened for modification	C:\Windows\SysWOW64\Dipgpf32.exe	Dfakcj32.exe
File created	C:\Windows\SysWOW64\Efpcfibk.dll	Edlann32.exe
File created	C:\Windows\SysWOW64\Ocooahdo.dll	Edcgnmml.exe
File created	C:\Windows\SysWOW64\Dppgmlhk.dll	Cbdhgaid.exe
File opened for modification	C:\Windows\SysWOW64\Pocdba32.exe	Pgllad32.exe
File opened for modification	C:\Windows\SysWOW64\Ebcdjc32.exe	Epehnhbj.exe
File created	C:\Windows\SysWOW64\Fibfbm32.exe	Fbhnec32.exe
File opened for modification	C:\Windows\SysWOW64\Phpbffnp.exe	Pbfjjlgc.exe
File created	C:\Windows\SysWOW64\Ignnjk32.exe	Imhjlb32.exe
File created	C:\Windows\SysWOW64\Bhamin32.dll	Lhopgg32.exe
File opened for modification	C:\Windows\SysWOW64\Bdgehobe.exe	Bbhhlccb.exe
File created	C:\Windows\SysWOW64\Gpngef32.dll	Dbcbnlcl.exe
File created	C:\Windows\SysWOW64\Ofigcd32.dll	Imhjlb32.exe
File opened for modification	C:\Windows\SysWOW64\Nockkcjg.exe	Nkgoke32.exe
File opened for modification	C:\Windows\SysWOW64\Kmkpipaf.exe	Kiodha32.exe
File created	C:\Windows\SysWOW64\Ojicgi32.dll	Qkcackeb.exe
File opened for modification	C:\Windows\SysWOW64\Ciqmjkno.exe	Cqiehnml.exe
File created	C:\Windows\SysWOW64\Icqmncof.exe	Ienlbf32.exe
File created	C:\Windows\SysWOW64\Infqklol.exe	Icqmncof.exe
File created	C:\Windows\SysWOW64\Jndmlj32.exe	Jfmekm32.exe
File created	C:\Windows\SysWOW64\Mndlcglp.dll	Lhjnfn32.exe
File created	C:\Windows\SysWOW64\Qomghp32.exe	Pgeogb32.exe
File created	C:\Windows\SysWOW64\Fllfihmi.dll	Jqklnp32.exe
File opened for modification	C:\Windows\SysWOW64\Egbdjhlp.exe	Edcgnmml.exe
File opened for modification	C:\Windows\SysWOW64\Ffpcbchm.exe	Fcbgfhii.exe
File created	C:\Windows\SysWOW64\Phlikg32.exe	Pbapom32.exe
File created	C:\Windows\SysWOW64\Gmjlak32.dll	Kmpido32.exe
File created	C:\Windows\SysWOW64\Dfjood32.dll	Npcaie32.exe
File created	C:\Windows\SysWOW64\Bdgdii32.dll	Oggllnkl.exe
File created	C:\Windows\SysWOW64\Ocikabbg.dll	Qajlje32.exe
File created	C:\Windows\SysWOW64\Igpgak32.dll	Deqqek32.exe
File created	C:\Windows\SysWOW64\Fidbgm32.exe	Fgffka32.exe
File created	C:\Windows\SysWOW64\Mkofokch.dll	Kjfmminc.exe
File opened for modification	C:\Windows\SysWOW64\Jcnbekok.exe	Jobfdl32.exe
File created	C:\Windows\SysWOW64\Oajccgmd.exe	Onngci32.exe
File created	C:\Windows\SysWOW64\Ahpdcn32.exe	Aqilaplo.exe
File created	C:\Windows\SysWOW64\Dlhmea32.dll	Imcqacfq.exe
File created	C:\Windows\SysWOW64\Chknpnap.dll	Bqdlmo32.exe
File created	C:\Windows\SysWOW64\Dicbfhni.exe	Dnnoip32.exe
File created	C:\Windows\SysWOW64\Hnhjcpmd.dll	Inhmqlmj.exe
File opened for modification	C:\Windows\SysWOW64\Ljncnhhk.exe	Lhogamih.exe
File created	C:\Windows\SysWOW64\Cmjninol.dll	Mdmngm32.exe
File created	C:\Windows\SysWOW64\Ngnppfgb.exe	Nhkpdi32.exe
File opened for modification	C:\Windows\SysWOW64\Ajhndgjj.exe	Agiahlkf.exe
File created	C:\Windows\SysWOW64\Phbcfe32.dll	Cgejkh32.exe
File opened for modification	C:\Windows\SysWOW64\Egpgehnb.exe	Edakimoo.exe
File created	C:\Windows\SysWOW64\Cidlgjgm.dll	Inagpm32.exe
File opened for modification	C:\Windows\SysWOW64\Khhaanop.exe	Kejeebpl.exe
File created	C:\Windows\SysWOW64\Aeglbeea.exe	Anncek32.exe
File opened for modification	C:\Windows\SysWOW64\Kjopbd32.exe	Kfcdaehf.exe
File opened for modification	C:\Windows\SysWOW64\Pjahchpb.exe	Pgbkgmao.exe
File created	C:\Windows\SysWOW64\Fbmqcp32.dll	Logbigbg.exe
File opened for modification	C:\Windows\SysWOW64\Pdklebje.exe	Oalpigkb.exe
File created	C:\Windows\SysWOW64\Bgmnooom.exe	Bndjfjhl.exe
File created	C:\Windows\SysWOW64\Eejcki32.exe	Ejdonq32.exe
File created	C:\Windows\SysWOW64\Cbjeeion.dll	Eejcki32.exe
File created	C:\Windows\SysWOW64\Odmqgd32.dll	Fcpkph32.exe
File created	C:\Windows\SysWOW64\Keghocao.exe	Kmppneal.exe
File created	C:\Windows\SysWOW64\Nojeqbeo.dll	Bkdqdokk.exe
File opened for modification	C:\Windows\SysWOW64\Doqbifpl.exe	Dehnpp32.exe
File opened for modification	C:\Windows\SysWOW64\Ppffec32.exe	Pnhjig32.exe
File created	C:\Windows\SysWOW64\Dnnoip32.exe	Dlobmd32.exe
File created	C:\Windows\SysWOW64\Lilphejh.dll	Elhfbp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14716	14632	WerFault.exe	744

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Moglpedd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllffa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnmglk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Najjmjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacmchcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opfnne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eleimp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgebnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logbigbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbhnec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijngkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eilfldoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcbgfhii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfkhfmdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kagbdenk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjemle32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmmmnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfhnme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmijnfgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anncek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmfodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onngci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjahchpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahkkhnpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmmgof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Elolco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmhofbma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiodha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmejp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcjodbgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Namnmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flekihpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfeoijbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kciaqi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Labkempb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iqgjmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjdqhjpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpnkdfko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaihonhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okkalnjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omlkmign.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfoclai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nonbqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hljnkdnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afqifo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjcojo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mobbdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogjpld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfpidk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjnbg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnhjig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpcila32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kanbjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkqdnkge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqdbfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjjldpdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qoocnpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggoiap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gllajf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkefphem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glabolja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfpkhjae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hodqlq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjfclcpg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdmdjkpo.dll"	Gnjhhpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfgjbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Moglpedd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oojalb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boepfh32.dll"	Aamipe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eleimp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Biljib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmdggnj.dll"	Odcfdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahpdcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhmgfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eeaqfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkjkdck.dll"	Jihngboe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhddgofo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnoiqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckcbaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpandm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igghffab.dll"	Mhfmbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Diamko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlkiaece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fegndm32.dll"	Fcmnkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gglpgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Japmcfcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeglbeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Femdjbab.dll"	Ijgakgej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kejeebpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkdqdokk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgmnooom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Diopep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqbohocd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjfclcpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daeddlco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmijnfgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fibfbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abemep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnapgjdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlhlck32.dll"	Fikihlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcofdpfp.dll"	Pdmikb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqbfaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggdbmoho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imfmgcdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onngci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgaljo32.dll"	Hgnlmdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdmpk32.dll"	Hnjaonij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iqfcbahb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkboeobh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjabdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmijnfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfhnme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkpjeba.dll"	Clgmkbna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgpplf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpcila32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Leqkeajd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbehienn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emdplb32.dll"	Lgjglg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gggfme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodqpf32.dll"	Fpnkdfko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhaope32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpiinc32.dll"	Ppamjcpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cqiehnml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eincadmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kaqejcep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckfmq32.dll"	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igdnnggp.dll"	Gqkajk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1968	5028	2026-07-28_3227e2a6e63be45a5435aca66891de89_elex_wannacry.exe	83
PID 1968 wrote to memory of 1120	1968	Qmckbjdl.exe	84
PID 1120 wrote to memory of 2808	1120	Apddce32.exe	85
PID 2808 wrote to memory of 2032	2808	Abemep32.exe	86
PID 2032 wrote to memory of 620	2032	Afqifo32.exe	87
PID 620 wrote to memory of 464	620	Afeban32.exe	88
PID 464 wrote to memory of 2856	464	Bldgoeog.exe	89
PID 2856 wrote to memory of 4452	2856	Bmddihfj.exe	90
PID 4452 wrote to memory of 4104	4452	Bcnleb32.exe	91
PID 4104 wrote to memory of 3748	4104	Beaecjab.exe	92
PID 3748 wrote to memory of 3580	3748	Bmimdg32.exe	93
PID 3580 wrote to memory of 1856	3580	Blknpdho.exe	94
PID 1856 wrote to memory of 456	1856	Cmmgof32.exe	95
PID 456 wrote to memory of 2660	456	Cekhihig.exe	96
PID 2660 wrote to memory of 3504	2660	Ciiaogon.exe	97
PID 3504 wrote to memory of 3520	3504	Clgmkbna.exe	98
PID 3520 wrote to memory of 4112	3520	Cpcila32.exe	99
PID 4112 wrote to memory of 4844	4112	Cbaehl32.exe	100
PID 4844 wrote to memory of 4616	4844	Cmgjee32.exe	101
PID 4616 wrote to memory of 2584	4616	Dpefaq32.exe	102
PID 2584 wrote to memory of 1032	2584	Dbcbnlcl.exe	103
PID 1032 wrote to memory of 3588	1032	Debnjgcp.exe	104
PID 3588 wrote to memory of 3940	3588	Dinjjf32.exe	105
PID 3940 wrote to memory of 100	3940	Dllffa32.exe	106
PID 100 wrote to memory of 3000	100	Ddcogo32.exe	107
PID 3000 wrote to memory of 4268	3000	Dbfoclai.exe	108
PID 4268 wrote to memory of 2100	4268	Dfakcj32.exe	109
PID 2100 wrote to memory of 4180	2100	Dipgpf32.exe	110
PID 4180 wrote to memory of 2148	4180	Dlncla32.exe	111
PID 2148 wrote to memory of 1264	2148	Dpjompqc.exe	112
PID 1264 wrote to memory of 2432	1264	Dbhlikpf.exe	113
PID 2432 wrote to memory of 2280	2432	Dgdgijhp.exe	114
PID 2280 wrote to memory of 4568	2280	Dibdeegc.exe	115
PID 4568 wrote to memory of 2536	4568	Dmnpfd32.exe	116
PID 2536 wrote to memory of 2388	2536	Dpllbp32.exe	117
PID 2388 wrote to memory of 4756	2388	Ddhhbngi.exe	118
PID 4756 wrote to memory of 1136	4756	Dgfdojfm.exe	119
PID 1136 wrote to memory of 3492	1136	Didqkeeq.exe	120
PID 3492 wrote to memory of 3928	3492	Dlcmgqdd.exe	121
PID 3928 wrote to memory of 2592	3928	Ddjehneg.exe	122
PID 2592 wrote to memory of 4208	2592	Dghadidj.exe	123
PID 4208 wrote to memory of 5108	4208	Digmqe32.exe	124
PID 5108 wrote to memory of 4728	5108	Eleimp32.exe	125
PID 4728 wrote to memory of 4752	4728	Edlann32.exe	126
PID 4752 wrote to memory of 1576	4752	Egknji32.exe	127
PID 1576 wrote to memory of 3632	1576	Eiijfd32.exe	128
PID 3632 wrote to memory of 3252	3632	Elhfbp32.exe	129
PID 3252 wrote to memory of 4332	3252	Edoncm32.exe	130
PID 4332 wrote to memory of 1816	4332	Egmjpi32.exe	131
PID 1816 wrote to memory of 4076	1816	Eilfldoi.exe	132
PID 4076 wrote to memory of 1588	4076	Eljchpnl.exe	133
PID 1588 wrote to memory of 2532	1588	Edakimoo.exe	134
PID 2532 wrote to memory of 1168	2532	Egpgehnb.exe	135
PID 1168 wrote to memory of 4072	1168	Eincadmf.exe	136
PID 4072 wrote to memory of 1568	4072	Ellpmolj.exe	137
PID 1568 wrote to memory of 5008	1568	Edcgnmml.exe	138
PID 5008 wrote to memory of 3796	5008	Egbdjhlp.exe	139
PID 3796 wrote to memory of 3752	3796	Eippgckc.exe	140
PID 3752 wrote to memory of 116	3752	Elolco32.exe	141
PID 116 wrote to memory of 3384	116	Edfddl32.exe	142
PID 3384 wrote to memory of 2456	3384	Egdqph32.exe	143
PID 2456 wrote to memory of 4764	2456	Eibmlc32.exe	144
PID 4764 wrote to memory of 4932	4764	Fpmeimpn.exe	145
PID 4932 wrote to memory of 3540	4932	Fckaeioa.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-07-28_3227e2a6e63be45a5435aca66891de89_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_3227e2a6e63be45a5435aca66891de89_elex_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\Qmckbjdl.exe
  C:\Windows\system32\Qmckbjdl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\Apddce32.exe
    C:\Windows\system32\Apddce32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\Abemep32.exe
      C:\Windows\system32\Abemep32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2032
      - C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Beaecjab.exe
        
        C:\Windows\system32\Beaecjab.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:100
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Dgfdojfm.exe
        
        C:\Windows\system32\Dgfdojfm.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Didqkeeq.exe
        
        C:\Windows\system32\Didqkeeq.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Dlcmgqdd.exe
        
        C:\Windows\system32\Dlcmgqdd.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Ddjehneg.exe
        
        C:\Windows\system32\Ddjehneg.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Digmqe32.exe
        
        C:\Windows\system32\Digmqe32.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Edlann32.exe
        
        C:\Windows\system32\Edlann32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Egknji32.exe
        
        C:\Windows\system32\Egknji32.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Eiijfd32.exe
        
        C:\Windows\system32\Eiijfd32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\SysWOW64\Egmjpi32.exe
        
        C:\Windows\system32\Egmjpi32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Eilfldoi.exe
        
        C:\Windows\system32\Eilfldoi.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Edakimoo.exe
        
        C:\Windows\system32\Edakimoo.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Ellpmolj.exe
        
        C:\Windows\system32\Ellpmolj.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Edcgnmml.exe
        
        C:\Windows\system32\Edcgnmml.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Egbdjhlp.exe
        
        C:\Windows\system32\Egbdjhlp.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\SysWOW64\Egdqph32.exe
        
        C:\Windows\system32\Egdqph32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Eibmlc32.exe
        
        C:\Windows\system32\Eibmlc32.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Fckaeioa.exe
        
        C:\Windows\system32\Fckaeioa.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Fjeibc32.exe
        
        C:\Windows\system32\Fjeibc32.exe
        65⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Fcmnkh32.exe
        
        C:\Windows\system32\Fcmnkh32.exe
        67⤵
        Modifies registry class
        
        PID:2840
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        68⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3476
        
        C:\Windows\SysWOW64\Fpandm32.exe
        
        C:\Windows\system32\Fpandm32.exe
        70⤵
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        71⤵
        Drops file in System32 directory
        
        PID:1420
        
        C:\Windows\SysWOW64\Ffnglc32.exe
        
        C:\Windows\system32\Ffnglc32.exe
        72⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Fneoma32.exe
        
        C:\Windows\system32\Fneoma32.exe
        73⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        74⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Windows\SysWOW64\Ffpcbchm.exe
        
        C:\Windows\system32\Ffpcbchm.exe
        76⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Fnglcqio.exe
        
        C:\Windows\system32\Fnglcqio.exe
        77⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Fpfholhc.exe
        
        C:\Windows\system32\Fpfholhc.exe
        78⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Fgpplf32.exe
        
        C:\Windows\system32\Fgpplf32.exe
        79⤵
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        80⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Gnjhhpgl.exe
        
        C:\Windows\system32\Gnjhhpgl.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        82⤵
        
        PID:364
        
        C:\Windows\SysWOW64\Gcgqag32.exe
        
        C:\Windows\system32\Gcgqag32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        84⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Gnlenp32.exe
        
        C:\Windows\system32\Gnlenp32.exe
        85⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        86⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        87⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        88⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Glabolja.exe
        
        C:\Windows\system32\Glabolja.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        90⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        91⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Gjebiq32.exe
        
        C:\Windows\system32\Gjebiq32.exe
        92⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        93⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Gdkffi32.exe
        
        C:\Windows\system32\Gdkffi32.exe
        94⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ggicbe32.exe
        
        C:\Windows\system32\Ggicbe32.exe
        95⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        96⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Gmfkjl32.exe
        
        C:\Windows\system32\Gmfkjl32.exe
        97⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        98⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        99⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Hjjldpdf.exe
        
        C:\Windows\system32\Hjjldpdf.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\Hmhhpkcj.exe
        
        C:\Windows\system32\Hmhhpkcj.exe
        101⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        102⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        103⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        104⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        105⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Hcembe32.exe
        
        C:\Windows\system32\Hcembe32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Hgpibdam.exe
        
        C:\Windows\system32\Hgpibdam.exe
        107⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        108⤵
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Hqimlihn.exe
        
        C:\Windows\system32\Hqimlihn.exe
        109⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Hgbfhc32.exe
        
        C:\Windows\system32\Hgbfhc32.exe
        110⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        111⤵
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\Hmpnqj32.exe
        
        C:\Windows\system32\Hmpnqj32.exe
        112⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        113⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        116⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Hclccd32.exe
        
        C:\Windows\system32\Hclccd32.exe
        117⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Ifjoop32.exe
        
        C:\Windows\system32\Ifjoop32.exe
        118⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Iqpclh32.exe
        
        C:\Windows\system32\Iqpclh32.exe
        120⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Icnphd32.exe
        
        C:\Windows\system32\Icnphd32.exe
        121⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        122⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Ienlbf32.exe
        
        C:\Windows\system32\Ienlbf32.exe
        124⤵
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        125⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Infqklol.exe
        
        C:\Windows\system32\Infqklol.exe
        126⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Imiagi32.exe
        
        C:\Windows\system32\Imiagi32.exe
        127⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Icciccmd.exe
        
        C:\Windows\system32\Icciccmd.exe
        128⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Ifaepolg.exe
        
        C:\Windows\system32\Ifaepolg.exe
        129⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Inhmqlmj.exe
        
        C:\Windows\system32\Inhmqlmj.exe
        130⤵
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Iqgjmg32.exe
        
        C:\Windows\system32\Iqgjmg32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        132⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        133⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        134⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Iaifbg32.exe
        
        C:\Windows\system32\Iaifbg32.exe
        135⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        136⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Jffokn32.exe
        
        C:\Windows\system32\Jffokn32.exe
        137⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Windows\SysWOW64\Jfhlpnfp.exe
        
        C:\Windows\system32\Jfhlpnfp.exe
        141⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        142⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        143⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        144⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Jfkhfmdm.exe
        
        C:\Windows\system32\Jfkhfmdm.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
        
        C:\Windows\SysWOW64\Jnapgjdo.exe
        
        C:\Windows\system32\Jnapgjdo.exe
        146⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        147⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        148⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Jfmekm32.exe
        
        C:\Windows\system32\Jfmekm32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Jndmlj32.exe
        
        C:\Windows\system32\Jndmlj32.exe
        150⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Jabiie32.exe
        
        C:\Windows\system32\Jabiie32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        152⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Jfoaam32.exe
        
        C:\Windows\system32\Jfoaam32.exe
        153⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        154⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jmijnfgd.exe
        
        C:\Windows\system32\Jmijnfgd.exe
        155⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        156⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        157⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Kfanflne.exe
        
        C:\Windows\system32\Kfanflne.exe
        158⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6976
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        161⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        162⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        163⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Kaioidkh.exe
        
        C:\Windows\system32\Kaioidkh.exe
        164⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Kdhlepkl.exe
        
        C:\Windows\system32\Kdhlepkl.exe
        165⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        166⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Knmpbi32.exe
        
        C:\Windows\system32\Knmpbi32.exe
        167⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        168⤵
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Keghocao.exe
        
        C:\Windows\system32\Keghocao.exe
        169⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Khfdlnab.exe
        
        C:\Windows\system32\Khfdlnab.exe
        170⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        172⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Khhaanop.exe
        
        C:\Windows\system32\Khhaanop.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4176
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        175⤵
        Drops file in System32 directory
        
        PID:4148
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        176⤵
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Lhjnfn32.exe
        
        C:\Windows\system32\Lhjnfn32.exe
        177⤵
        Drops file in System32 directory
        
        PID:32
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        178⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Lmgfod32.exe
        
        C:\Windows\system32\Lmgfod32.exe
        179⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Lennpb32.exe
        
        C:\Windows\system32\Lennpb32.exe
        180⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Lfpkhjae.exe
        
        C:\Windows\system32\Lfpkhjae.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
        
        C:\Windows\SysWOW64\Logbigbg.exe
        
        C:\Windows\system32\Logbigbg.exe
        182⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Leqkeajd.exe
        
        C:\Windows\system32\Leqkeajd.exe
        184⤵
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Lhogamih.exe
        
        C:\Windows\system32\Lhogamih.exe
        185⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Ljncnhhk.exe
        
        C:\Windows\system32\Ljncnhhk.exe
        186⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Lmlpjdgo.exe
        
        C:\Windows\system32\Lmlpjdgo.exe
        187⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Malefbkc.exe
        
        C:\Windows\system32\Malefbkc.exe
        188⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Mhfmbl32.exe
        
        C:\Windows\system32\Mhfmbl32.exe
        189⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        190⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Mmcfkc32.exe
        
        C:\Windows\system32\Mmcfkc32.exe
        191⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Mejnlpai.exe
        
        C:\Windows\system32\Mejnlpai.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        193⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Mgkjch32.exe
        
        C:\Windows\system32\Mgkjch32.exe
        194⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        195⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Mobbdf32.exe
        
        C:\Windows\system32\Mobbdf32.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        197⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Meljappg.exe
        
        C:\Windows\system32\Meljappg.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        199⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Mgngih32.exe
        
        C:\Windows\system32\Mgngih32.exe
        200⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Mkicjgnn.exe
        
        C:\Windows\system32\Mkicjgnn.exe
        201⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Mmhofbma.exe
        
        C:\Windows\system32\Mmhofbma.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Windows\SysWOW64\Mackfa32.exe
        
        C:\Windows\system32\Mackfa32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1792
        
        C:\Windows\SysWOW64\Meoggpmd.exe
        
        C:\Windows\system32\Meoggpmd.exe
        204⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Mgpcohcb.exe
        
        C:\Windows\system32\Mgpcohcb.exe
        205⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        206⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Maehlqch.exe
        
        C:\Windows\system32\Maehlqch.exe
        207⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:932
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        209⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Moiheebb.exe
        
        C:\Windows\system32\Moiheebb.exe
        210⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Nahdapae.exe
        
        C:\Windows\system32\Nahdapae.exe
        211⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        213⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Nolekd32.exe
        
        C:\Windows\system32\Nolekd32.exe
        214⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Nnoefagj.exe
        
        C:\Windows\system32\Nnoefagj.exe
        215⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        216⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        217⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        218⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Nkbfpeec.exe
        
        C:\Windows\system32\Nkbfpeec.exe
        219⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Nonbqd32.exe
        
        C:\Windows\system32\Nonbqd32.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        222⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Ngifef32.exe
        
        C:\Windows\system32\Ngifef32.exe
        223⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        224⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Nejgbn32.exe
        
        C:\Windows\system32\Nejgbn32.exe
        225⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ndmgnkja.exe
        
        C:\Windows\system32\Ndmgnkja.exe
        226⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        227⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Nockkcjg.exe
        
        C:\Windows\system32\Nockkcjg.exe
        228⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        229⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Nemchn32.exe
        
        C:\Windows\system32\Nemchn32.exe
        230⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Nhkpdi32.exe
        
        C:\Windows\system32\Nhkpdi32.exe
        231⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Ngnppfgb.exe
        
        C:\Windows\system32\Ngnppfgb.exe
        232⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Nkjlqd32.exe
        
        C:\Windows\system32\Nkjlqd32.exe
        233⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Oacdmo32.exe
        
        C:\Windows\system32\Oacdmo32.exe
        234⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Oeopnmoa.exe
        
        C:\Windows\system32\Oeopnmoa.exe
        235⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        236⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Ogqmee32.exe
        
        C:\Windows\system32\Ogqmee32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        238⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Oddmoj32.exe
        
        C:\Windows\system32\Oddmoj32.exe
        239⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        240⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Oojalb32.exe
        
        C:\Windows\system32\Oojalb32.exe
        241⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Oahnhncc.exe
        
        C:\Windows\system32\Oahnhncc.exe
        242⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        243⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        244⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ogefqeaj.exe
        
        C:\Windows\system32\Ogefqeaj.exe
        245⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7452
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        247⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Oeffnl32.exe
        
        C:\Windows\system32\Oeffnl32.exe
        248⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Oookgbpj.exe
        
        C:\Windows\system32\Oookgbpj.exe
        249⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7644
        
        C:\Windows\SysWOW64\Ogjpld32.exe
        
        C:\Windows\system32\Ogjpld32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        252⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        253⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7812
        
        C:\Windows\SysWOW64\Pocdba32.exe
        
        C:\Windows\system32\Pocdba32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Pbapom32.exe
        
        C:\Windows\system32\Pbapom32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Phlikg32.exe
        
        C:\Windows\system32\Phlikg32.exe
        257⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Pkjegb32.exe
        
        C:\Windows\system32\Pkjegb32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        259⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Pfpidk32.exe
        
        C:\Windows\system32\Pfpidk32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Pgaelcgm.exe
        
        C:\Windows\system32\Pgaelcgm.exe
        261⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Pklamb32.exe
        
        C:\Windows\system32\Pklamb32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        263⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Pbfjjlgc.exe
        
        C:\Windows\system32\Pbfjjlgc.exe
        264⤵
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Phpbffnp.exe
        
        C:\Windows\system32\Phpbffnp.exe
        265⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        266⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Pojjcp32.exe
        
        C:\Windows\system32\Pojjcp32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Pnmjomlg.exe
        
        C:\Windows\system32\Pnmjomlg.exe
        268⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Pfdbpjmi.exe
        
        C:\Windows\system32\Pfdbpjmi.exe
        269⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Phbolflm.exe
        
        C:\Windows\system32\Phbolflm.exe
        270⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        271⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Qomghp32.exe
        
        C:\Windows\system32\Qomghp32.exe
        272⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Qbkcek32.exe
        
        C:\Windows\system32\Qbkcek32.exe
        273⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        274⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Qghlmbae.exe
        
        C:\Windows\system32\Qghlmbae.exe
        275⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Qoocnpag.exe
        
        C:\Windows\system32\Qoocnpag.exe
        276⤵
        System Location Discovery: System Language Discovery
        
        PID:8160
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        277⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Qhghge32.exe
        
        C:\Windows\system32\Qhghge32.exe
        278⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Akfdcq32.exe
        
        C:\Windows\system32\Akfdcq32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        280⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Afkipi32.exe
        
        C:\Windows\system32\Afkipi32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        282⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Agmehamp.exe
        
        C:\Windows\system32\Agmehamp.exe
        283⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Anfmeldl.exe
        
        C:\Windows\system32\Anfmeldl.exe
        284⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        285⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        286⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        287⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        288⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        289⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        290⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Ankgpk32.exe
        
        C:\Windows\system32\Ankgpk32.exe
        291⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        292⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Aiqkmd32.exe
        
        C:\Windows\system32\Aiqkmd32.exe
        293⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        294⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Windows\SysWOW64\Aeglbeea.exe
        
        C:\Windows\system32\Aeglbeea.exe
        295⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        296⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Bomppneg.exe
        
        C:\Windows\system32\Bomppneg.exe
        297⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        298⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Biedhclh.exe
        
        C:\Windows\system32\Biedhclh.exe
        299⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Bkdqdokk.exe
        
        C:\Windows\system32\Bkdqdokk.exe
        300⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        301⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        302⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        303⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Bndjfjhl.exe
        
        C:\Windows\system32\Bndjfjhl.exe
        304⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Bgmnooom.exe
        
        C:\Windows\system32\Bgmnooom.exe
        305⤵
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Bngfli32.exe
        
        C:\Windows\system32\Bngfli32.exe
        306⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Biljib32.exe
        
        C:\Windows\system32\Biljib32.exe
        307⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        308⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Bbeobhlp.exe
        
        C:\Windows\system32\Bbeobhlp.exe
        309⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        310⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Cpipkl32.exe
        
        C:\Windows\system32\Cpipkl32.exe
        311⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        312⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        313⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9156
        
        C:\Windows\SysWOW64\Cfgace32.exe
        
        C:\Windows\system32\Cfgace32.exe
        315⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Chinkndp.exe
        
        C:\Windows\system32\Chinkndp.exe
        316⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Cnbfgh32.exe
        
        C:\Windows\system32\Cnbfgh32.exe
        317⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Cemndbci.exe
        
        C:\Windows\system32\Cemndbci.exe
        318⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        320⤵
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        321⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        322⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        323⤵
        Modifies registry class
        
        PID:8728
        
        C:\Windows\SysWOW64\Diopep32.exe
        
        C:\Windows\system32\Diopep32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        325⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Dolinf32.exe
        
        C:\Windows\system32\Dolinf32.exe
        326⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        327⤵
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9180
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        330⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        332⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ebokodfc.exe
        
        C:\Windows\system32\Ebokodfc.exe
        333⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ehkcgkdj.exe
        
        C:\Windows\system32\Ehkcgkdj.exe
        334⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        335⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        336⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        337⤵
        Drops file in System32 directory
        
        PID:9012
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8224
        
        C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        339⤵
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        340⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Eedmlo32.exe
        
        C:\Windows\system32\Eedmlo32.exe
        341⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ehbihj32.exe
        
        C:\Windows\system32\Ehbihj32.exe
        342⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        343⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8412
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        344⤵
        Modifies registry class
        
        PID:9164
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        345⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8696
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        348⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        349⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        350⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        351⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\Fgjpfqpi.exe
        
        C:\Windows\system32\Fgjpfqpi.exe
        352⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Fhllni32.exe
        
        C:\Windows\system32\Fhllni32.exe
        353⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        354⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        355⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        356⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        357⤵
        System Location Discovery: System Language Discovery
        
        PID:9344
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        358⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        359⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        360⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        361⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        362⤵
        Modifies registry class
        
        PID:9524
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        363⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Gplged32.exe
        
        C:\Windows\system32\Gplged32.exe
        364⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Glchjedc.exe
        
        C:\Windows\system32\Glchjedc.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9636
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Gjghdj32.exe
        
        C:\Windows\system32\Gjghdj32.exe
        367⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Hodqlq32.exe
        
        C:\Windows\system32\Hodqlq32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9744
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        369⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        370⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        371⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:9888
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        373⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        374⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Hcfcmnce.exe
        
        C:\Windows\system32\Hcfcmnce.exe
        375⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:10032
        
        C:\Windows\SysWOW64\Hqjcgbbo.exe
        
        C:\Windows\system32\Hqjcgbbo.exe
        377⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        378⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        379⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        380⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        381⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        382⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Iobmmoed.exe
        
        C:\Windows\system32\Iobmmoed.exe
        383⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        384⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9432
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        387⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        388⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        389⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        390⤵
        Drops file in System32 directory
        
        PID:9680
        
        C:\Windows\SysWOW64\Ignnjk32.exe
        
        C:\Windows\system32\Ignnjk32.exe
        391⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Iiokacgp.exe
        
        C:\Windows\system32\Iiokacgp.exe
        392⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        393⤵
        Modifies registry class
        
        PID:9884
        
        C:\Windows\SysWOW64\Igpkok32.exe
        
        C:\Windows\system32\Igpkok32.exe
        394⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        395⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        396⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Jcgldl32.exe
        
        C:\Windows\system32\Jcgldl32.exe
        397⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        398⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Jicdlc32.exe
        
        C:\Windows\system32\Jicdlc32.exe
        399⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        400⤵
        Drops file in System32 directory
        
        PID:9372
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        401⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        402⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        403⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Jjemle32.exe
        
        C:\Windows\system32\Jjemle32.exe
        404⤵
        System Location Discovery: System Language Discovery
        
        PID:9876
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        405⤵
        Modifies registry class
        
        PID:10060
        
        C:\Windows\SysWOW64\Jobfdl32.exe
        
        C:\Windows\system32\Jobfdl32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10200
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        407⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        408⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        409⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Jglkkiea.exe
        
        C:\Windows\system32\Jglkkiea.exe
        410⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Kimgba32.exe
        
        C:\Windows\system32\Kimgba32.exe
        411⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Kgngqico.exe
        
        C:\Windows\system32\Kgngqico.exe
        412⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        413⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9844
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        414⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Kpilekqj.exe
        
        C:\Windows\system32\Kpilekqj.exe
        415⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Kgqdfi32.exe
        
        C:\Windows\system32\Kgqdfi32.exe
        416⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10256
        
        C:\Windows\SysWOW64\Kjopbd32.exe
        
        C:\Windows\system32\Kjopbd32.exe
        418⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        419⤵
        System Location Discovery: System Language Discovery
        
        PID:10328
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        420⤵
        System Location Discovery: System Language Discovery
        
        PID:10368
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        421⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        422⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Kjamhd32.exe
        
        C:\Windows\system32\Kjamhd32.exe
        423⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        424⤵
        Drops file in System32 directory
        
        PID:10516
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        425⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        426⤵
        System Location Discovery: System Language Discovery
        
        PID:10588
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        427⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        428⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Kifjip32.exe
        
        C:\Windows\system32\Kifjip32.exe
        429⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        430⤵
        System Location Discovery: System Language Discovery
        
        PID:10732
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        431⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        432⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10840
        
        C:\Windows\SysWOW64\Lapopm32.exe
        
        C:\Windows\system32\Lapopm32.exe
        434⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        435⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        436⤵
        Modifies registry class
        
        PID:10964
        
        C:\Windows\SysWOW64\Ljhchc32.exe
        
        C:\Windows\system32\Ljhchc32.exe
        437⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Lmfodn32.exe
        
        C:\Windows\system32\Lmfodn32.exe
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:11060
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        439⤵
        System Location Discovery: System Language Discovery
        
        PID:11100
        
        C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        440⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Limpiomm.exe
        
        C:\Windows\system32\Limpiomm.exe
        441⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        442⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        443⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Lhopgg32.exe
        
        C:\Windows\system32\Lhopgg32.exe
        444⤵
        Drops file in System32 directory
        
        PID:10360
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        445⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Lmkipncc.exe
        
        C:\Windows\system32\Lmkipncc.exe
        446⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        447⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Lcealh32.exe
        
        C:\Windows\system32\Lcealh32.exe
        448⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        449⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        450⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        451⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Laiafl32.exe
        
        C:\Windows\system32\Laiafl32.exe
        452⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        453⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        454⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        455⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        456⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        458⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        459⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        460⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        461⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Mankaked.exe
        
        C:\Windows\system32\Mankaked.exe
        462⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        463⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        464⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Miipencp.exe
        
        C:\Windows\system32\Miipencp.exe
        465⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Mapgfk32.exe
        
        C:\Windows\system32\Mapgfk32.exe
        466⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        467⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        468⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        469⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        470⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        471⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        472⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Mmiealgc.exe
        
        C:\Windows\system32\Mmiealgc.exe
        473⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        474⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        475⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:11596
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        477⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11676
        
        C:\Windows\SysWOW64\Ndejcemn.exe
        
        C:\Windows\system32\Ndejcemn.exe
        479⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        480⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Najjmjkg.exe
        
        C:\Windows\system32\Najjmjkg.exe
        481⤵
        System Location Discovery: System Language Discovery
        
        PID:11792
        
        C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        482⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        483⤵
        Modifies registry class
        
        PID:11864
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        484⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Ndjcne32.exe
        
        C:\Windows\system32\Ndjcne32.exe
        485⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Nkdlkope.exe
        
        C:\Windows\system32\Nkdlkope.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11972
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        487⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        488⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        489⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Ngklppei.exe
        
        C:\Windows\system32\Ngklppei.exe
        490⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Niihlkdm.exe
        
        C:\Windows\system32\Niihlkdm.exe
        491⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        492⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        493⤵
        Drops file in System32 directory
        
        PID:12232
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        494⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        495⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Oileakbj.exe
        
        C:\Windows\system32\Oileakbj.exe
        496⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        497⤵
        System Location Discovery: System Language Discovery
        
        PID:11448
        
        C:\Windows\SysWOW64\Opfnne32.exe
        
        C:\Windows\system32\Opfnne32.exe
        498⤵
        System Location Discovery: System Language Discovery
        
        PID:11516
        
        C:\Windows\SysWOW64\Ohmepbki.exe
        
        C:\Windows\system32\Ohmepbki.exe
        499⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        500⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11704
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        502⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Oaejhh32.exe
        
        C:\Windows\system32\Oaejhh32.exe
        503⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        504⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        505⤵
        Modifies registry class
        
        PID:12000
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        506⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        507⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        508⤵
        System Location Discovery: System Language Discovery
        
        PID:12216
        
        C:\Windows\SysWOW64\Oahgnh32.exe
        
        C:\Windows\system32\Oahgnh32.exe
        509⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        510⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        511⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        512⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        513⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11764
        
        C:\Windows\SysWOW64\Oajccgmd.exe
        
        C:\Windows\system32\Oajccgmd.exe
        514⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11980
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        516⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        517⤵
        Drops file in System32 directory
        
        PID:12204
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        518⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        519⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Oalpigkb.exe
        
        C:\Windows\system32\Oalpigkb.exe
        520⤵
        Drops file in System32 directory
        
        PID:11848
        
        C:\Windows\SysWOW64\Pdklebje.exe
        
        C:\Windows\system32\Pdklebje.exe
        521⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Phfhfa32.exe
        
        C:\Windows\system32\Phfhfa32.exe
        522⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        523⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Pjgemi32.exe
        
        C:\Windows\system32\Pjgemi32.exe
        524⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        525⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        526⤵
        Modifies registry class
        
        PID:11836
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        527⤵
        Modifies registry class
        
        PID:11756
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        528⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        529⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        530⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        531⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Pdofpb32.exe
        
        C:\Windows\system32\Pdofpb32.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12468
        
        C:\Windows\SysWOW64\Pgnblm32.exe
        
        C:\Windows\system32\Pgnblm32.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12512
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        534⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        535⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12584
        
        C:\Windows\SysWOW64\Ppffec32.exe
        
        C:\Windows\system32\Ppffec32.exe
        536⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Phmnfp32.exe
        
        C:\Windows\system32\Phmnfp32.exe
        537⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        538⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        539⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\Pafcofcg.exe
        
        C:\Windows\system32\Pafcofcg.exe
        540⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        541⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Phpklp32.exe
        
        C:\Windows\system32\Phpklp32.exe
        542⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        543⤵
        Drops file in System32 directory
        
        PID:12872
        
        C:\Windows\SysWOW64\Pjahchpb.exe
        
        C:\Windows\system32\Pjahchpb.exe
        544⤵
        System Location Discovery: System Language Discovery
        
        PID:12908
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        545⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Qpkppbho.exe
        
        C:\Windows\system32\Qpkppbho.exe
        546⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        547⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Qgehml32.exe
        
        C:\Windows\system32\Qgehml32.exe
        548⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Qkqdnkge.exe
        
        C:\Windows\system32\Qkqdnkge.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13092
        
        C:\Windows\SysWOW64\Qnopjfgi.exe
        
        C:\Windows\system32\Qnopjfgi.exe
        550⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Qajlje32.exe
        
        C:\Windows\system32\Qajlje32.exe
        551⤵
        Drops file in System32 directory
        
        PID:13176
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        552⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        553⤵
        Modifies registry class
        
        PID:13276
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11432
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        555⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        556⤵
        Modifies registry class
        
        PID:12392
        
        C:\Windows\SysWOW64\Aqpika32.exe
        
        C:\Windows\system32\Aqpika32.exe
        557⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        558⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Agiahlkf.exe
        
        C:\Windows\system32\Agiahlkf.exe
        559⤵
        Drops file in System32 directory
        
        PID:12600
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        560⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Ancjef32.exe
        
        C:\Windows\system32\Ancjef32.exe
        561⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        562⤵
        Modifies registry class
        
        PID:12808
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        563⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        564⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        565⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        566⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        567⤵
        System Location Discovery: System Language Discovery
        
        PID:13140
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        568⤵
        System Location Discovery: System Language Discovery
        
        PID:13220
        
        C:\Windows\SysWOW64\Agnkck32.exe
        
        C:\Windows\system32\Agnkck32.exe
        569⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        570⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        571⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        572⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Adbkmo32.exe
        
        C:\Windows\system32\Adbkmo32.exe
        573⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        574⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        575⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13040
        
        C:\Windows\SysWOW64\Aqilaplo.exe
        
        C:\Windows\system32\Aqilaplo.exe
        577⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Ahpdcn32.exe
        
        C:\Windows\system32\Ahpdcn32.exe
        578⤵
        Modifies registry class
        
        PID:13228
        
        C:\Windows\SysWOW64\Akopoi32.exe
        
        C:\Windows\system32\Akopoi32.exe
        579⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Anmmkd32.exe
        
        C:\Windows\system32\Anmmkd32.exe
        580⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        581⤵
        Drops file in System32 directory
        
        PID:13156
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        582⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        583⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        584⤵
        
        PID:13348
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        585⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        586⤵
        Modifies registry class
        
        PID:13428
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        587⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\Bdiamnpc.exe
        
        C:\Windows\system32\Bdiamnpc.exe
        588⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        589⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Bjfjee32.exe
        
        C:\Windows\system32\Bjfjee32.exe
        590⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        591⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        592⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Bdlncn32.exe
        
        C:\Windows\system32\Bdlncn32.exe
        593⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        594⤵
        System Location Discovery: System Language Discovery
        
        PID:13724
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        595⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\Bbpolb32.exe
        
        C:\Windows\system32\Bbpolb32.exe
        596⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        597⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13868
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        598⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Bglgdi32.exe
        
        C:\Windows\system32\Bglgdi32.exe
        599⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        600⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        601⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        602⤵
        Drops file in System32 directory
        
        PID:14100
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        603⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\Bilcol32.exe
        
        C:\Windows\system32\Bilcol32.exe
        604⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        605⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        606⤵
        
        PID:14244
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        607⤵
        Drops file in System32 directory
        
        PID:14284
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        608⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\Cinpdl32.exe
        
        C:\Windows\system32\Cinpdl32.exe
        609⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        610⤵
        
        PID:13384
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        611⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        612⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        613⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13584
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        614⤵
        
        PID:13636
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        615⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        616⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        617⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        618⤵
        
        PID:13900
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        619⤵
        Drops file in System32 directory
        
        PID:13996
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        620⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        621⤵
        
        PID:14136
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        622⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        623⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        624⤵
        Modifies registry class
        
        PID:13100
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        625⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:13424
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        626⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        627⤵
        
        PID:13684
        
        C:\Windows\SysWOW64\Djipbbne.exe
        
        C:\Windows\system32\Djipbbne.exe
        628⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        629⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        630⤵
        
        PID:14032
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        631⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\Dlhlleeh.exe
        
        C:\Windows\system32\Dlhlleeh.exe
        632⤵
        
        PID:14276
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        633⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\Daeddlco.exe
        
        C:\Windows\system32\Daeddlco.exe
        634⤵
        Modifies registry class
        
        PID:14056
        
        C:\Windows\SysWOW64\Deqqek32.exe
        
        C:\Windows\system32\Deqqek32.exe
        635⤵
        Drops file in System32 directory
        
        PID:14316
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        636⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\Dlkiaece.exe
        
        C:\Windows\system32\Dlkiaece.exe
        637⤵
        Modifies registry class
        
        PID:13704
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        638⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        639⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13360
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        640⤵
        
        PID:14092
        
        C:\Windows\SysWOW64\Dbgndoho.exe
        
        C:\Windows\system32\Dbgndoho.exe
        641⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Deejpjgc.exe
        
        C:\Windows\system32\Deejpjgc.exe
        642⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14228
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        643⤵
        Drops file in System32 directory
        
        PID:14368
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        644⤵
        Drops file in System32 directory
        
        PID:14412
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        645⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14448
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        646⤵
        
        PID:14484
        
        C:\Windows\SysWOW64\Ejdonq32.exe
        
        C:\Windows\system32\Ejdonq32.exe
        647⤵
        Drops file in System32 directory
        
        PID:14520
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        648⤵
        Drops file in System32 directory
        
        PID:14556
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        649⤵
        
        PID:14592
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        650⤵
        
        PID:14632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14632 -s 404
        651⤵
        Program crash
        
        PID:14716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 14632 -ip 14632
1⤵
PID:14692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Abdoqd32.exe

Path C:\Windows\SysWOW64\Abdoqd32.exe
Size 320KB
SHA256 eb0ae29da757e3bf14f6a6db55a3459650951bcab10ec8580e425f8196f9b0e2
MD5 c7e0148842dd66e44a06aad107bb6bc3
SHA1 fb08486da02e21a8e4cd9f944ade96ff6a35fc2c
SHA512 d8e91d3f95208ee8bc0e0303ad32b31c78165d36d47b9a5fd040d2fb622b3689574a7108e00cccee643348e2b4ebfa1208bf57907abef544c61b77a90b033535
SSDEEP 3072:VbPGouRgaoqCSwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:VbPGhg8CSV/Ah1G/AcQ///NR5fn
TLSH
T1A364FA19663449EACEED1BB5AD024DD85191FAB018F1E13E25239FDDD8F4DB2C80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Abemep32.exe

Path C:\Windows\SysWOW64\Abemep32.exe
Size 320KB
SHA256 192d3cb7ac8bdec219fa19701542776ae14bf6067d6259b954f47945933028cf
MD5 4e74e0183712c9608a2022939fe2bda1
SHA1 ced666d44243db9b2362fd5efaded5039595fa67
SHA512 275125f4612a38d7e02afe95be1710c9bea9b953be755d95b2a11c620ebb9011ba8cb495a9232bd87110a41f020cd11b079f97de9967dfd3bc2de352c39e4153
SSDEEP 3072:GdBASnNU9tigPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GdBASNU9ttPV/Ah1G/AcQ///NR5fn
TLSH
T184642F59263419EACEED5BF6AC2249D99141E5F014F1E23E6133DFDCC8E4DA2C826F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afeban32.exe

Path C:\Windows\SysWOW64\Afeban32.exe
Size 320KB
SHA256 f5f44e1df9135595aa96b946a243d2d5233449b832b47457e005495d513fca9d
MD5 2fbad8767a84c58cabd43b17541e8e84
SHA1 aa5260b13bb415b402c7d705fef1290acdd42ea7
SHA512 feb24e83e02bb13e3273f8f7e7817d874e6e266275624228d04ed131512f0acdedae0067a269ba25b7567a1732232af408e4989503d6476bbbe6a8f6f9c9e6c4
SSDEEP 3072:fc64zjEcxawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:k64zYsaV/Ah1G/AcQ///NR5fn
TLSH
T15D6452192AB409EACDED1FB5AD1289DC9141EAF014F1E13E6923DFDDD8E4DA2C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Afqifo32.exe

Path C:\Windows\SysWOW64\Afqifo32.exe
Size 320KB
SHA256 29f16fecf6286a870eddd5c47872e22674ec27c805e4c84275efb204a08fe7ee
MD5 f8f3d6f1820e0b435d98139b103aaf16
SHA1 6c339d7a5034f25616bfe71e97aaecae1a0534cd
SHA512 21e18e9d5a82f42100887582ab27afcaad1761c6d59db67ab46862dd645ec81626078cdf758014aed7403eb30fddcee35a803381f88c75286dd07483ce2c67bf
SSDEEP 3072:sVUUkE3llWH1kCwz/kwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:sJk8q1ikV/Ah1G/AcQ///NR5fn
TLSH
T1BD644219267409EACEED1FB5BC0649D85146E4F015F1E13E6123DFDCD8E9DA2E818F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aiqkmd32.exe

Path C:\Windows\SysWOW64\Aiqkmd32.exe
Size 320KB
SHA256 de1d6b3a35d3a2bf804330670d6eee956e6f09c184fd80c2b7395c9f2f6c3c63
MD5 6dd5f1422f2408a54356a1698b54c06b
SHA1 8dd698c29c224d538700163137dd32167fe2c719
SHA512 76195826be47fdc14a72b4b81cbccab419f3ff2124a412b072ed0cd81110e19a510092c83d377312122d9ae11a284476ad17a59f9eca90929ded32ce88cde59a
SSDEEP 3072:lQYRdIfXHssdkaz47ZUtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NRdIfHssJc7ZUtV/Ah1G/AcQ///NR5fn
TLSH
T114640D192A7409EADEED1BB5AC0249E89141E9F014F1F13E6163DFDCDDE4DA2C819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aofjoo32.exe

Path C:\Windows\SysWOW64\Aofjoo32.exe
Size 320KB
SHA256 f85666c1ec1128d29b08def2dada7cf677841bdcb91616754b3dc067d69aedb5
MD5 780eab390d48b75dec72bec7b6dc1296
SHA1 039942716b0cf365eaf6f0c6f795f2e6ada686e4
SHA512 9ee5f18dcc2b975a410ebcef684ca683ea5c477cbbbae017828029b7e7a9a675807c748577d9e9228f35894ad71fcc7a02702c3d77042edca0dc344f2d6b1998
SSDEEP 3072:6fK02Oftp57ZCfBUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+t2KfBZCZUV/Ah1G/AcQ///NR5fn
TLSH
T10464511A663909EADDED1BB9EC0249D85141F9F014F1E27E6123DFDCC9E8DA6C819F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Apddce32.exe

Path C:\Windows\SysWOW64\Apddce32.exe
Size 320KB
SHA256 5eb1ca7f89bc024a1059f53eb6e8af1dc796517452ec5673a6ff8751852970d1
MD5 f2a7cb398bb9b1d6cb91cc0c696b3826
SHA1 9b8550b62d67b7886ee93f176887f2b41b6a8dfe
SHA512 5ad01af974ecf549b784ee1c1637c0f0fbc6338d110c9ff945f6ec26818500179ca59382256dc36b7b9cb16851817a43f4e75e1647202ebf3cad77a950146a12
SSDEEP 3072:dQ7Noxl7uNJga1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:6BRNJga1V/Ah1G/AcQ///NR5fn
TLSH
T16E641F1A2A3419EACDED1BB5BC0249D85181E5F014F1E23E6123DFDDD8E4DB6E819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aqilaplo.exe

Path C:\Windows\SysWOW64\Aqilaplo.exe
Size 320KB
SHA256 e637f4f8a85bca845ae83d6ad21f62592330e11ddbefe68667383b6d98496119
MD5 a13dee51bef9a9cdc0094afd8be09ec6
SHA1 b96dc6bba01d9afe51c91abe92d9d072e4621a01
SHA512 d0b7516fc33c825ccdd51a8b839f777025c03458685b5585e4cea12d8c1bed6aeb500d5f1dca4eda7ac00e9071ee65bd05c9241aabef1ea94e7e75b50814b43d
SSDEEP 3072:v5pVSxrinzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:v5L3nzV/Ah1G/AcQ///NR5fn
TLSH
T10E642E19263409EADEED1BB5AC124DD89181EAF115F5E13E6133EFDCC8E4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bcnleb32.exe

Path C:\Windows\SysWOW64\Bcnleb32.exe
Size 320KB
SHA256 b2d375afaf61298d7c0118bc4e80bae0d33fe73c3e23226b1655e5464ea9e8b7
MD5 2dfe4b08a01dba4b59008f69f88409ae
SHA1 38f945c64920333cda2e570ccaf4aa6ed62c3e37
SHA512 1b19ce6b52fc6e7abb3a42dc8cc6c1bc0ccfeb88153bbcfc16a39fdb93dfdfe7eb596c1327c606a70a427fc0c06d9fa4526fbf52f8a70710d2462130d9956c3d
SSDEEP 3072:xjF+UpEj+fe2E3063wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xJ+UoWe2qh3V/Ah1G/AcQ///NR5fn
TLSH
T127643019263449EACDED1FB6AC1249D89541E8F014F1E13E6223DFEDDCE5DA2D814F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdiamnpc.exe

Path C:\Windows\SysWOW64\Bdiamnpc.exe
Size 320KB
SHA256 63f10bf1ba6f0d5d9c16c05038bdd36de07e0312fc6fb55300862d2b391916ea
MD5 62919930301b6e8d5b0d2941faa2b0ba
SHA1 5e0b4535b13eea26e9124420ca6366dfe1e561cd
SHA512 478cf77955af1d1ca817f3712d45e6ffb245d5c25356d0481618e43c84b7a5679412e08fd811bdb251240e51213e6febe5d0549b99f22f86028080cc4f1e8a75
SSDEEP 3072:Iu8eZhotZsm2rL5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:v8eXotZsNf5V/Ah1G/AcQ///NR5fn
TLSH
T1AF643F1A663419EACDED1BB5AC024AD8A581E9F054F1E17E6523DFDCC8F4DA6CC08F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bdlncn32.exe

Path C:\Windows\SysWOW64\Bdlncn32.exe
Size 320KB
SHA256 979ff483c02fdb421b9b085a4b56210752f78ac6cbaa9347d03f42e01e18e906
MD5 111c0ac80b6c8cca485d61fd74197a03
SHA1 6305db8086d3a372f3954ec45dfe6742d9b8c58d
SHA512 a5abebb004986ad459aece7fb77202358567008da5e47f377648d0e3a4dcbf56a4dfe5fd9ee6e66361be8366279687a7f05550d93227d75f20c6b11f00f59b77
SSDEEP 3072:7FrgGe4s3C3Lf09zwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7FrA4syg9zV/Ah1G/AcQ///NR5fn
TLSH
T12C642F5A2A3009EACDED1FB5AC124ED89241E9F018F1E13E6123DFDDD8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Beaecjab.exe

Path C:\Windows\SysWOW64\Beaecjab.exe
Size 320KB
SHA256 4c88b4562773a4ee4f25e615165fa473ac769b6e23cc51c3b38410b93a6684cc
MD5 7b52e0b221b90b626d729642d3ba1fee
SHA1 18a1c3327212da1bf4dbaf1aa64b8fa8836aaed5
SHA512 6997fdfffa788340056153b9658612db9877f4e34ca64a221672efed66e46e66f40d86a23a6e9245031f7c1569966ddf291644766ed1dbc82d3b963d8bcb2eb8
SSDEEP 3072:8sKxiL2XTtv97WtQaCK2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8Ti0Tt9Tk2V/Ah1G/AcQ///NR5fn
TLSH
T1AE640E1A2A3409EACEED1BB5EC1249DC5181E8F214F5E13E6163DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Biljib32.exe

Path C:\Windows\SysWOW64\Biljib32.exe
Size 320KB
SHA256 dfc86ee7f97906c9a840db31263f8c386abba8fb88263567be2353050b66bb12
MD5 f5af62025be6e7595ea25f0a47a83209
SHA1 79f828b31a068b884708481734279a67f96d8413
SHA512 0a17c102dd222b6cab20e7a1d8cc582e5fdc594f5705c68f1d5aa8707fb9c16424d5974acd76ab0f854a55cb3a7fca77b8c2270d266d2776a0c7fd806e8d2b63
SSDEEP 3072:ObB7fkoMo3QwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OblkXo3QV/Ah1G/AcQ///NR5fn
TLSH
T1A4641F1A1A3009EACDED1BB6EC1259D89181E9F014F1E13F6123EFDCD8E5DA6E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bldgoeog.exe

Path C:\Windows\SysWOW64\Bldgoeog.exe
Size 320KB
SHA256 a761e01d6ba612d9cef21c5d8507bf95a13beb86b60f532d70551d5aca5a926a
MD5 0e2842415a349a34a227c95e37c2cd21
SHA1 e472de62c72b9c0b6ac8f27fe0c17cf6a94e08e7
SHA512 9065f9e6ecde992882397f875052e02f5ed53142c4e081de2d306b8ada64f835c2ed957c36c5e1bfe7ea7b45ceee0f920305cc554a4c3d528a1eb9c5b92e122b
SSDEEP 3072:74AvVVfmZWHywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9ttmZWHyV/Ah1G/AcQ///NR5fn
TLSH
T1D8642F1A163009EADFFD1BB5AC1259D85182E8F015F1E13E6227DFDCD8E4DA6C819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Blknpdho.exe

Path C:\Windows\SysWOW64\Blknpdho.exe
Size 320KB
SHA256 2e90a7a876b31ebdb8274506989885a59346bec21c1a3e8ea77b934b8659f0b4
MD5 3e1f5611c286554e3801abd8b4e1eecf
SHA1 691e9e12d13d31ba12f3206196f1a7d743bd01c3
SHA512 cfa4cf13a0b51dacd8476b2c920c86ed08ff77aa41157a86796f80934ae65337c7e81d007d17bfc892514ce60dec39d19edb67a98f4501ecc92fe17845307774
SSDEEP 3072:9yo5yzXhxMtdouwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4o5yFIdouV/Ah1G/AcQ///NR5fn
TLSH
T17D641E192A3419EECEED1BB5AC1349D89141E9F014F1E23E6523DFDCE8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmddihfj.exe

Path C:\Windows\SysWOW64\Bmddihfj.exe
Size 320KB
SHA256 eb82f49498d0cbc39bf019783863245452cb4e5bfa885e0b8842876729815563
MD5 ed45460ebd38eb0ae317c61c6b81a3ee
SHA1 5400e6d748572f2bc17642c8d83eefda4e7b14a5
SHA512 f8266f01dfe8e5086731ef3014bfadf4c622e05b30f7308b42bf2c5111098c0623ff090447100e1655b7240d12aa0c7fb656fd87e4078c98227923450277928b
SSDEEP 3072:2m0snVch3+1ZY4eILwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2m0EO3+PBeILV/Ah1G/AcQ///NR5fn
TLSH
T14F64DA1916340AEACEED2BBAFC1249D85141F9B014F1E13E6523DFEDD8E4DA2E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bmimdg32.exe

Path C:\Windows\SysWOW64\Bmimdg32.exe
Size 320KB
SHA256 21c56fdfe636b90f543adff381d609a3f6ea96a4509720df39fd969fa608e37c
MD5 30d9296dda225c544716e09485bc2614
SHA1 b10b4b46871633531042df79cd94f6a0c3dd5ef1
SHA512 3379b3030e0d4ed60d86d544bad2fbef578ce8a0caad40c8c56e3cb48652f839ac33582ada11d8ccbf4beaee8a288f5faf4dc01a17ab8a7207504cbc6900b5cf
SSDEEP 3072:NDATHyNzllfEDw1pwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1XzlCD2pV/Ah1G/AcQ///NR5fn
TLSH
T10E64DA1A2A3009EACDED1BB5AD124DD89185F5B054F1E13E6123EFDDE8F4DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cbaehl32.exe

Path C:\Windows\SysWOW64\Cbaehl32.exe
Size 320KB
SHA256 2aedba2890d11548dcd3d44fc3d299d3500aada7dd00fd4f72145095ea9b80fe
MD5 071248c01baed0a93b2524c7b2cfe42f
SHA1 27a46575e9d3ee86db6ec330b8817422ce09a9d0
SHA512 9106d62f0bf6039d75f2e460fefe412d1ab8c139a5f045cdce4dafaf1d23b2a328cd7a80ea537f54b1fa1dbdcd882b3fa89529170ba141493aa6ccb205912248
SSDEEP 3072:mwJYNN4VwdDP86wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GNN4Vw+6V/Ah1G/AcQ///NR5fn
TLSH
T13964FA192A7409EACEED5BB6AC1249DC9185E9F114F1E13E6123DFDCD8E4DB6C808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cekhihig.exe

Path C:\Windows\SysWOW64\Cekhihig.exe
Size 320KB
SHA256 d4974d903ef14cedb2a1bbbfacae85b7e6f04f07be630deeb7fea41de205ed4b
MD5 03245b0977f3519fb93d6fa14fbc1eed
SHA1 bac2690728938ad0f066b13f27e2889f07fb7b8e
SHA512 d4da6bd8791a6667eb8f51a1d60fc7c21508de0a48c8820188cd7c0648335010f10bc12acd42d0ee87a7750169128ede4c7e5dc354fcd909111e910fdaa6fe4e
SSDEEP 3072:MkXQ/4sZqdE0/8qHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MkXQAsZqd39HV/Ah1G/AcQ///NR5fn
TLSH
T125641E1A2A3409EACDED1BF5AC1259DC9181E8F114F1E13E6123DFDCD8E4DA6D819F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cfbhhfbg.exe

Path C:\Windows\SysWOW64\Cfbhhfbg.exe
Size 320KB
SHA256 9427e033e6f14593a7dae38666e563bb68160dec85a4cecc0d36ecc0a9e4ad46
MD5 62b8902bddbe6e83748031f1c4883742
SHA1 2d10b2a2e9938a580eb84a1d2fd2bfe4522d1519
SHA512 9391b09c8a9905591e9e968bd182c0f68bc1cdcbe405eb148e8db4e9ed80746e45a8a58f834782b74281d92d4219170a75aaa27081bc695389942e8605a83672
SSDEEP 3072:r2LcHipPh/7CLb9lHZ2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2pPh/Kb9NZ2V/Ah1G/AcQ///NR5fn
TLSH
T149644F192A3049EACEED5FB5AC0259E99189E8F414F1F13E6123DFDCD8E5DA2C814F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ciiaogon.exe

Path C:\Windows\SysWOW64\Ciiaogon.exe
Size 320KB
SHA256 09371e74b0c87d201a766752716ff44ef63cf7704d3f0130355385428483bdda
MD5 82eccaf170d5511e035e964de1130040
SHA1 029407d184bb355018be3414a60c39137f8b7bda
SHA512 07a28af8c9bd6035d4a0cb2709841da0bf64e06e62cd835a1be207db85c5a035f1c40181ab69ea5cc46fa16d3cf856f7aacba482e484b8eac66aa46bfb650e7f
SSDEEP 3072:A4DA/nGGhn570Ir3fKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pUGuzfKV/Ah1G/AcQ///NR5fn
TLSH
T1D4642F1926300DEACDED1BB6AC1249D8A141E9F014F1E13E6127DFEED9E4DAAC815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cjaiac32.exe

Path C:\Windows\SysWOW64\Cjaiac32.exe
Size 320KB
SHA256 f7fbc55136e87c5a24a0b59dab490e5af4ec1b88e3516a92a0f4f71b9021384f
MD5 6e29b40a02dad2b39c43c15d5d04a981
SHA1 c17a086c79d1da5134e8c7d59a5d00e1ec0a4d05
SHA512 f4523e75c1654ea73fc290a1b49c5385b782a5be066037d2878c18732a3be7277d9b02cda87560ca4de764fc935c511aa6825aade2d8804e77ae2c4a0f32b59f
SSDEEP 3072:3hlk+Cr5knWlgF/kwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/k+CrRukV/Ah1G/AcQ///NR5fn
TLSH
T1F36430192A3049EACEEE1FB5AC0249D96541F9F115F1E13E6123DFDCD8E4DA2D80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cjfclcpg.exe

Path C:\Windows\SysWOW64\Cjfclcpg.exe
Size 320KB
SHA256 7002d061f4f44f8ccd89fc86bd7fb07d30d98071735d732926c31062eacf7e37
MD5 e1371584c7c726d166c430d7a19ff57d
SHA1 fb069dd0ddb50a4086c3a2290778ba69ea5ddcf3
SHA512 5ece6bbd3b03d6f7453ee5cb4bf45c3010e986233fdd76e76ecd12a6bf92a382fff0f7f0fe50fb580039c6ce2752895715cb339770fbed6f411e9d28a9b1b28c
SSDEEP 3072:2udcPHNJtkoA/CQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2uW/XA6QV/Ah1G/AcQ///NR5fn
TLSH
T108643F1926385AEACEED5BB5AD0249D85141E9F024F5E13E6133DFDCE8E4DA2DC08F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clgmkbna.exe

Path C:\Windows\SysWOW64\Clgmkbna.exe
Size 320KB
SHA256 1311e1185f53d7b2e50752ded0bebfbefc28c7bc95a1e2b4e4b92f397d0273b1
MD5 5a6f41888e7319bb7ceca614d134073d
SHA1 80ba9c73071c5daeb12fc8a0a6e8be0c7370f779
SHA512 c4cddb890971137963715ed46e118f20816e7ba2f1e8a36e85c7fba315b6998928b4b3ea0b05879306b9c15c859642fc330d6f40bb3e712f8c42bb7249b48d3a
SSDEEP 3072:XUyfh/TqWFQyH/4LDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Xph5f4LDV/Ah1G/AcQ///NR5fn
TLSH
T139642F19263049EACEED5BB5AC124ADC9241E9F014F5E23E6163DFDCD8E4EA7C804F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmgjee32.exe

Path C:\Windows\SysWOW64\Cmgjee32.exe
Size 320KB
SHA256 a8455779fed6726d659925015af137b961a9f5782479d98f5adef1682296f2f6
MD5 4e1c88b16acd0fb334e0462c21621825
SHA1 73912b0dd40e214105be3dcad5eb53fdd3f0bce8
SHA512 1fad24a57b353d692649b1a2a2c91040b3664f250b264f38f1b7168dcb13fc113e277e40f9a7e4eb2257ca234ad71004ce2d6345455da78117f6ff1706a243d8
SSDEEP 3072:5NDNEepUbunu01cWDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JkuutWDV/Ah1G/AcQ///NR5fn
TLSH
T1D7643D192A3009EACEED5FB5AD0259D89181EAF015F1E13E6163DFECD8F4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cmmgof32.exe

Path C:\Windows\SysWOW64\Cmmgof32.exe
Size 320KB
SHA256 d3c74b8296a4a3604945eb941e24e2cfbbf8370c49c072b12b525e5f5ade857f
MD5 650112176fe2b9333e4fb28d610de7a9
SHA1 89592204acecf0a6e11f80340c3ba5d5445645e0
SHA512 694c74830a723d2ca5a386bcc7669c160b8af93392dfb85c71326c5200eb9a3dd4afb39c53523b754d5fdda856f6ff1575c54ec88eb6696df7627b8f0381e88c
SSDEEP 3072:MsRB0P9Mw+z0mnJ1w1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5RB0FA1w1V/Ah1G/AcQ///NR5fn
TLSH
T13B6430292A3409EACEED1BF5AC4349D85181E9F215F1E13E6523DFDCC8E4DA2C919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cnebmgjj.exe

Path C:\Windows\SysWOW64\Cnebmgjj.exe
Size 320KB
SHA256 924717e9132dd80d10af83fae99472cebf701490be5c84ccd1949186e0a8f7d6
MD5 23164a63f291f00a0fec2333e35542a1
SHA1 e1717e2d8955e05ed9ac2bc88ae41c51d76a5326
SHA512 1c2863ba36006ff66b36c7a60b92c77b677ba5c74b989ae8eb276a8a0d855f792740784b8b11a5ad2f01f2a99baebba65b3fd5a6367b31a2488fb50dfd1ffec4
SSDEEP 3072:QhLNnbI+qtice2z5lIlFY3ahwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SxZA3ahV/Ah1G/AcQ///NR5fn
TLSH
T11D644F596A3009EACDED2BB9AE1249DC9141E9F414F1E53E2533DFDCC8E4DA2C806F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cpcila32.exe

Path C:\Windows\SysWOW64\Cpcila32.exe
Size 320KB
SHA256 648301499cbddfd52ac56b88e2e17019e7a2b359bdffa9fed2474f0b075743b8
MD5 d136dc5460d01f35f6a0f67f89a5a303
SHA1 07eb0b547b315fb79327e957515bee992b7fc0ee
SHA512 a67affb564df072248c2565fffaa054962dee4bd4ede8b151e24c716ff572adf4139bc1a32e2aa54d47f4c6dca5d2bce935716658032d972881aadc2de118528
SSDEEP 3072:Q29bsiCjwBqhaG3rC0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DsiCjwUE0V/Ah1G/AcQ///NR5fn
TLSH
T18364301A2A3419EADDED1FB6EC1259D85181E8F014F2E13E6123DFDCE8E4DA6C845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbcbnlcl.exe

Path C:\Windows\SysWOW64\Dbcbnlcl.exe
Size 320KB
SHA256 a887ae2d15285b31037136c681db1c9a172fadbbaf438906dc80c726b08fcb1b
MD5 5ecd1fa2bc28293244f05503a5b1f302
SHA1 57aba4f6dd75650033aa90639f7ecf25361d4361
SHA512 978fa693e5d29ec1a6936ca74f2b53530abc3f4aaa7f10ade19e01399ce4ed5392242c509ad3ff8214666fb9f3242c5e3a2497d12e719d0b86c5a3729e251e67
SSDEEP 3072:CBFN2f3T5jqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N/T5jqV/Ah1G/AcQ///NR5fn
TLSH
T17F64521A2A3009EACEED1FB5AC1249D85199E8F015F1E23E6523DFDCD8E4DA2CC05F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbfoclai.exe

Path C:\Windows\SysWOW64\Dbfoclai.exe
Size 320KB
SHA256 2326b3a29e0c33f94ea4382dbda9fd0e2becdd3c011ae4c8b991d1a269e875fb
MD5 d271088a75529fa307abc35ac89e0057
SHA1 8cf03e667ef3100e2e3fc679fc981216b1e6d101
SHA512 52d94cf8ef30db2d9d8179c88c512b20af22a32059fd6d1690068df2aa376c6287ab45f33411b822417b4e929b62f97c9b8b5408411cf891aba11fa89b87c836
SSDEEP 3072:4OgCJWPLpMUb4nkQ5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xgCJapMUb4kQ5V/Ah1G/AcQ///NR5fn
TLSH
T19564EA1A66340AEACEED1BB5EC0249D89181ECF114F1E13F6527AFDCD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbhlikpf.exe

Path C:\Windows\SysWOW64\Dbhlikpf.exe
Size 320KB
SHA256 e06788dc7e12b1d9ab75938d488026f17dff980e5d2a955e29097dc87a4a9470
MD5 f766a890e0eb7bedb3b320fe48245422
SHA1 86318bbcc0cacb6b23ed439db77795047fa4692a
SHA512 4cd26fa0cd5454ac8b786a6aec75c5b711a28364ef8edacab9a09ecbe2d2056c870eb7583bf6f6900e2254c13718bd8fcba31fdebee7a3f9476464373f0909d2
SSDEEP 3072:wHySqr/ZI4SpAgUNE/awS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wyD+4S3UNE/aV/Ah1G/AcQ///NR5fn
TLSH
T1956431192A7909EACDED2BB5AC5249D86141EAF114F1E13E9933DFDCD9E4DA2CC04F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddcogo32.exe

Path C:\Windows\SysWOW64\Ddcogo32.exe
Size 320KB
SHA256 69f5e8a1569248548bec751878aab0f9f0d5728031d4481b2922e99027551c21
MD5 8e24a1e407c9af8354e95a0888c168f7
SHA1 0a53851652e5d95c68632c7bc4d4a46633e26bed
SHA512 e803cc41f85c334f8c3de86f265ecfba0a36e2fa0c6aca79fe37e9b8b64f07198287f4ce0f9acea2fe1871d5ebb5def90334c00c79d1ea3e4ed8801eb7be1423
SSDEEP 3072:UD9aFAgsY9so6w/AwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UONpsY/AV/Ah1G/AcQ///NR5fn
TLSH
T14F642F1A2A3409EADDED1BB5AC1259D89141E8F01CF1E23E6133DFDCD8E4DA2E855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Debnjgcp.exe

Path C:\Windows\SysWOW64\Debnjgcp.exe
Size 320KB
SHA256 671732f3b40d6d9e9ae14a3d9b664db5ee60b482fee8153b6e0121bf0564a114
MD5 4fbab6fbca2bfe78cd4729c6966e145c
SHA1 0955f2548551eceedecb19ac485f80070c8a7265
SHA512 e4936ed18bf23aecfefe2635276ef1dbf65801a2f6a94f3de72a5ef27a57e1f9c267d8b213e815a08d8200a72bbb4b79f42e596988936cfc3d8182373b2b8a32
SSDEEP 3072:wbxS1zLxBGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:wbxGNBGV/Ah1G/AcQ///NR5fn
TLSH
T1956431196A3409EACDFD5BB9AC1249D89241E8F015F2E13F6523DFDDE8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dehnpp32.exe

Path C:\Windows\SysWOW64\Dehnpp32.exe
Size 320KB
SHA256 52a9c9971fedc52b382df228c082c0bc94e3987c1404e52e2af90d9d4c649fa1
MD5 ab51614c2fbb1f0d55b61225ee9ec646
SHA1 5137a7cae949663e8c7fc4c5ec2ef3970ab8af90
SHA512 fbb1d891d55a32b8334a9500c0064f4282449cba2c63b143555da9bac5ee049f8206debc51a6a38c74438bb4699f932fac65bb5d5b60987e10b2095d27b99e9b
SSDEEP 3072:1UK5UjMI+9I1zUmNMwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XCjMIUI1zriV/Ah1G/AcQ///NR5fn
TLSH
T19E643F192A7009EACDED1FB5AC0249D89245E9F414F1E67E6123DFDCE8E4DB2C846F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dfakcj32.exe

Path C:\Windows\SysWOW64\Dfakcj32.exe
Size 320KB
SHA256 81f35d9d2f64ef709a0bc275f5890f1c9c4f6da6582d0ca931d6d82354ac0cc4
MD5 c0016b208f54015214f8e9fabcd6e022
SHA1 7fbe6639914fea361ba45bbcc73fcccbd7673726
SHA512 1d4400f9a38ccf6f906cb879fdfeaf8eafda291824a999713cdb645a86356417d4ccacc83f8bbd3de866d00e1ecd2fc8f80eb280db3c2b5243e456db313c35af
SSDEEP 3072:56sEkE3+LEgRjhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:f7EOLEg1hV/Ah1G/AcQ///NR5fn
TLSH
T11A642F1966341DEACEEE1BB5AC0249D85241E4F054F1E13E61A3DFDCE8E4DA6CC29F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dgdgijhp.exe

Path C:\Windows\SysWOW64\Dgdgijhp.exe
Size 320KB
SHA256 2c2398e46d23460965bbe675377835215fcc4a29fa00ca348841721fb4d40589
MD5 17068f2f0620bcf7beb1a925d1b3af7d
SHA1 154f52a37b0c424955053835c6ea955f0fc74d4c
SHA512 d526750a4f031a8ced37003c8ef272d39dcb8d310ca4681b99526a2bcc99665b6c2c31dc53aec35effe7ca92522068a6a6645c8f3b128b2327d438a0f05394f5
SSDEEP 3072:Q5FdeJwswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QbdxsV/Ah1G/AcQ///NR5fn
TLSH
T1D0642F5A6A3409EACEED1BB6AC0289D85145E8F014F1E13E6923DFDCD8E4DA6DC14FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhpdkm32.exe

Path C:\Windows\SysWOW64\Dhpdkm32.exe
Size 320KB
SHA256 48bd9b4a10cc3b6deadbfacb9df4d7b0861ca795c399929b51ac1e35c04dc20c
MD5 fb7a8a6a70045d8fb79a7e427e8a80a1
SHA1 b7b5cc74e1c9bb805aa817e1805e87eca78c903f
SHA512 838032aa88a26b1aad980bc313dde9d0932bb541c4990f1d2e3ba1f65bfb25905cdf47a24e899811965074860e3079d4a99bb6e77c04cb9b9ece739bc8e24029
SSDEEP 3072:QvNNxFMFM7ws7wg3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QdwPgwg3V/Ah1G/AcQ///NR5fn
TLSH
T182644F192A3809EACDED2FB5EC024AD89141E9F114F1E23E6127DFDCD9E5DA2C905F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dibdeegc.exe

Path C:\Windows\SysWOW64\Dibdeegc.exe
Size 320KB
SHA256 9aaa2885eff5c00c37b9da01842d2fa1912c6f9109e32ad9cf4e22eacd6bc767
MD5 baedc56e61894c5d1d764816baaccc29
SHA1 629457f65295e77f063f6061bd15343736b26aa2
SHA512 5b64fec15640eb625218aaddef0a622bf0bf4210a5b25a7ec798e59170dbf960d4eeedbbb834fc9aec8619968bd9e1657ac108262e3dcccd9857bdf5bd0b235d
SSDEEP 3072:flWhOB7kiJbwAwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:flWMBdMAV/Ah1G/AcQ///NR5fn
TLSH
T18E64505A2A3009EACDED1FB6AC0259D89181E9F055F1E17E6123DFDCD8E4DA2DC09F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dinjjf32.exe

Path C:\Windows\SysWOW64\Dinjjf32.exe
Size 320KB
SHA256 faf40a34d695665e61f52e926e23e689f778bb4c5d1953e3edbfefe779a171d5
MD5 79fef8168248f7801371adc61d2a27a6
SHA1 7469612e5f5ad11c1d076ce0fc83e53aa95d7538
SHA512 6257f1044f6f8e5f47d9ce4061570795975921347026388a109daf0ccb74029d1b5e3624345e69dfa1c760dd1470078b0d9ff920c2c05533df42984bd9a51ba9
SSDEEP 3072:cHdNwItvQusZa/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:cH1tYba/V/Ah1G/AcQ///NR5fn
TLSH
T1FB642F19263409EACDED5FB5AC0289D89182E5F419F2E13E6123DFDDD8F4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dipgpf32.exe

Path C:\Windows\SysWOW64\Dipgpf32.exe
Size 320KB
SHA256 82700fbfaf344a238f1d453da6f32c0ddb54842ad9148349e3433f6aa4044d8c
MD5 d19411bf07a5b249e554709cc5c11b57
SHA1 dc99b6ef87f463f8b3fe966be60ccf068a76b859
SHA512 016edcbba5fcedaa5491e1a67edf8c225d931106b088d8d039612b2329ee5067d5596c5ac6a0b32a406ea225f37887185c27e8e321c20bad80b428636580d541
SSDEEP 3072:H4SjNXPVZx6LXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zjb6LXV/Ah1G/AcQ///NR5fn
TLSH
T1FB642E192A340AFACDED1BB5AC0249D89145E9F024F1E23E6933DFDCD8E4DA6D845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dllffa32.exe

Path C:\Windows\SysWOW64\Dllffa32.exe
Size 320KB
SHA256 5e2d8319b8068f58a76b62f74dcd1da5faba3657de6d0e3409a4f04e78e5981d
MD5 5b8a918ae1d6e1e2fccfdf19e0c9b9e7
SHA1 eb7ca26305fca4b664d0d752a88b21ad7b1f67f6
SHA512 8857e477c2178d50d57878c8b4de147ba5db5c0a60d14667fcd0e104bc641a5274fd824303bf3c62afa8b2916ec967683c4a90bda6c7e0283895eb4657736549
SSDEEP 3072:FmC5nG0S/lWU2HGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FV2gU2HGV/Ah1G/AcQ///NR5fn
TLSH
T18F6420192A3809EACEED6BB5AC5249D85191E9F014F1E13EA123DFDCD8F4DA2DD04F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dlncla32.exe

Path C:\Windows\SysWOW64\Dlncla32.exe
Size 320KB
SHA256 c96fd055f8b447cff351b2b5eee4db434d716136e7bc431daac489705d09492d
MD5 57c18ab313a0fc9a8107ba98c2b40ee3
SHA1 f25becb83c533593f12b5c02a3c75f272e9f1bd7
SHA512 401d200f763f05bfd1f748d0648257efa6c6bb247d0abfd9072132a927fc4fb7f8856d03584d4bc80ae605d4af5f5fe9ef254b26613381b1b13493f1151a327b
SSDEEP 3072:UnLOqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:COqV/Ah1G/AcQ///NR5fn
TLSH
T130643E192A7009EACEED1BB5AC0259D89181F9F014F5E13E6123DFDCD9E4DA2CD09F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnienqbi.exe

Path C:\Windows\SysWOW64\Dnienqbi.exe
Size 320KB
SHA256 7d13be3f5847350fe484bee65283c2994f9d9e5d6b2ce7e49dc246c5dfbe19ae
MD5 8ca1a1ef973908387b8aaf3d2abda801
SHA1 63e42e02690ca2584bca30f9a7d34b3f61044a5a
SHA512 794a426fd6bd7669aee7cae18c6a2a810b766bf655c68d7be16023045f5af6616969bb7fabc38a2bb0659cb18782102a730f14be6560c8c3e780a9929e37fc16
SSDEEP 3072:xjghLFcwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5McV/Ah1G/AcQ///NR5fn
TLSH
T1C564FC29263009EACEED1BB5FC1249D95285E9F014F5E13E6523DFDCD8E4DA2C826F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dnnoip32.exe

Path C:\Windows\SysWOW64\Dnnoip32.exe
Size 320KB
SHA256 3d850f85caf8e05734f5a78bf87772009e6ef345c606efca0cdbdc60502b4de2
MD5 c6f5a88b83f04cae8ad866300a8475ea
SHA1 ba82f0668d423243a6f32b773a7d7c544561a55f
SHA512 a8903ebe6c496eaa7daa86af787e19434ff117d2e24c2e9171fce0fcee36adff09a2e5976c34f03db80cc5a07a6afb3514b3682792d5b9333511f3d2aa9c55f5
SSDEEP 3072:Fy/cKHNNgSjh9YaqrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Fy/ltNPYaqrV/Ah1G/AcQ///NR5fn
TLSH
T15A64CA19163809EACDED1BB5AC124DD89141E9F018F1E23EA5339FDDD8E8DA6CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpefaq32.exe

Path C:\Windows\SysWOW64\Dpefaq32.exe
Size 320KB
SHA256 bcb8d3f344f741e7a9dd806b2117e5464300e5915c46dcae9ef7d543e2ba68f9
MD5 705f34586de2cccc1379546e5c583fa8
SHA1 5ab89db991b9dc0930f60c7f9389f59f20488672
SHA512 ea6346f29c08d854231166e384a7150d49b1909fc55b157cf82ff4813703380238588d2281a7e52ded34652515c3df3cbd1ea4cf221c253cdb97e09fd7310800
SSDEEP 3072:dDLoQq4nafi27kLeJVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:WQUkLEVV/Ah1G/AcQ///NR5fn
TLSH
T17064EB192A3009EACEED1BB5BC1259D99181E9F214F1E13E6123DFDCD8E4DA6DC06F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dpjompqc.exe

Path C:\Windows\SysWOW64\Dpjompqc.exe
Size 320KB
SHA256 fff363c798822df49162371d74f203193ab21f45441c3bbc2bf029b3b2a2bccc
MD5 bdb861249ee4ca1b28460048582bba85
SHA1 ca98d8802ad2743a85222869d0f5c332e4905332
SHA512 1b3d02bac630df7eb35f54a62e2d16dbfb2049972e79de8d00293c8ad2a0d1a9975ad45095646cc5bd7726d0f9be105d3c99ae1487d9a30e674e440596a7a284
SSDEEP 3072:iU7gtVavQ34yK8o8bKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V7gtVOQW8/KV/Ah1G/AcQ///NR5fn
TLSH
T1C764DB1A2A3409EACEFD1FB6AC1249D89181E9F014F1E13E6523DFDDD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ehbihj32.exe

Path C:\Windows\SysWOW64\Ehbihj32.exe
Size 320KB
SHA256 115173367326a90640f785306795ee4785496c4ed3a7b12147374ef190c3a0d7
MD5 65112e6aecd9ca150e745bb760e25b6e
SHA1 d0d18a635dcb4b5d58e14f324c72395f768fd5a8
SHA512 badecea70e540e06f83aded4b02e35053e27bd0f17570cbda932157032a36b67a24deb9703b5a4115b9952e06f98f0a22e5ec7aea803bb524ef03826bd53ca08
SSDEEP 6144:tPO3l2YNV8pj/w6cV/Ah1G/AcQ///NR5fn:tml2YNV8pj/wo/Nv
TLSH
T1DB64FB192A3809EADFED1BB5AD0249D99141F8F014F1E53E5127DFDCD8E4EA2C81AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ejdonq32.exe

Path C:\Windows\SysWOW64\Ejdonq32.exe
Size 320KB
SHA256 db256b5c7f2a3ea322d34c06722c4fb684dacac489991984599d621b9924d128
MD5 98fcc00efe5b0ab0b200d962b7fb081a
SHA1 cd7c56c871689afe923e223f715cc819501ae0f5
SHA512 ca4da4c9befec39318ce6165dc4f4bb5201be336ad21373b7cfb290413bf931fc65790d8b3043123be75b8733d0720c757b48737ce13aaa7b0d5ef748c26015a
SSDEEP 3072:IQKrNfLDiwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qrNniV/Ah1G/AcQ///NR5fn
TLSH
T18D642019A63409FACDED1BB5EC1249D89181E8F425F1E13E6223DFDCD8E4DA2D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fcmgpbjc.exe

Path C:\Windows\SysWOW64\Fcmgpbjc.exe
Size 320KB
SHA256 780c6753e5a5a374c0d00b58ed1d466dbe2a59578709d32e68cc206909ebcb02
MD5 0cadfa79d4dde938fb78fe001af980d3
SHA1 294b9cded5588556ed85a883b5ebb580b9f2574a
SHA512 61b7cfb69357b91a6e1c2a8b5c3dd082aa9cc8bfb3a3b3f80c0fab03410d2c2904d45d07b1272f7b2b2a8dc283184f526ebfbaf718d26a531c466223bc2085bf
SSDEEP 3072:1hO1Q1WNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1hzCV/Ah1G/AcQ///NR5fn
TLSH
T149642F1A263009EBDDED1BB5AD2249D89151E8F424F1E23E6123DFDCD8E4DA6C819FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fgjpfqpi.exe

Path C:\Windows\SysWOW64\Fgjpfqpi.exe
Size 320KB
SHA256 a58bfe81404deffacaab648c81bfe3066a238d6bb5916dc6a0a0e218d3cb5ca3
MD5 bff30a12f0586e8a4572bd7e6790826b
SHA1 188da5d174555033b2bbcdd6e151cbc38d647ac0
SHA512 42ec490db9a1f275650ae85ea8f641e2d892b6dedde340816c2ae7fe91fa2c73a304d23b513ba56569e323cfea760db88ca4a47eeab9a136d8aef2e3f7954ba8
SSDEEP 3072:/q0yPPbf5gEabWAwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SfPb5geAV/Ah1G/AcQ///NR5fn
TLSH
T10464311A663809EACDED1FB5BC2249D85281E9F014F1E17E6123DFDCC8E4DAAD815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fgmllpng.exe

Path C:\Windows\SysWOW64\Fgmllpng.exe
Size 320KB
SHA256 55e33d36e014a8d735f92944747b36c8af1c64dc978f7b2878ed136c16d97c32
MD5 b2124c47ae61c86e816a0f3893e3452b
SHA1 59898459326dc58deb2957dc5dc27dd69f6eadcb
SHA512 1beb9b8d39a2e7644ca649d896acbd76e8430389e09495ab091fd889e29f333126e4e3ecfe1c1c1a2de122eecf1a56a7ef85ea11f9fe85d6bcaa53843246060d
SSDEEP 3072:7GEP5O/6kos4ubjWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZOlPWV/Ah1G/AcQ///NR5fn
TLSH
T1626431192A3809EACEED1FB6AD0249D89142E9F414F5E53F6123DFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fidbgm32.exe

Path C:\Windows\SysWOW64\Fidbgm32.exe
Size 320KB
SHA256 137346c2f6d714243c49bc35c28607c983d817e27ecddd1a24b366faebdd3933
MD5 01182762f2db34f71bb8a7b845cc5b63
SHA1 8747bc400987d56a5e2a70b544482c4188c5375d
SHA512 d2a14d884ee70b00c0508873655bad4ace48eb083e1e29937fba244eeb3ad7ba34b298de76ae0427ea82b8dbd5fe19856e63365e3ad534ef5193be09f9608dbf
SSDEEP 3072:YWE+6kPlD0H9tKk4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YhktSjN4V/Ah1G/AcQ///NR5fn
TLSH
T1B0643F19263849EACEED1BB5BD1249D89141E8F014F1E13E6533DFDCC8E9DA6C90AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gjghdj32.exe

Path C:\Windows\SysWOW64\Gjghdj32.exe
Size 320KB
SHA256 f4d096deae4280a2ece74aa6bed00b4f1f82d05ddf610543e64ecb4a8135d37f
MD5 005edfeaddf751981200371f1080508d
SHA1 a2edec6eaee2ab856b19f75f3777770364eced52
SHA512 6e515c4325e12c8d780f0f4b5608eb13092732cf0c6791e0205c3bf051c9ef4ca8fe58466aaf386e60189611b50efb2a26ddf49aa6ba1b77364972c4e7707590
SSDEEP 3072:Ltu1hv9mrVx3DvTXjbfL3DvbHT/rXjP7nzfL3DvbHT/rXjP7nzfLLDDvbHT/rX7Y:puZmrVJbV/Ah1G/AcQ///NR5fn
TLSH
T115642F19263409EACEED1FB6AC0249D89585E9F414F1E13E2223DFDCD9E4DABD814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gllajf32.exe

Path C:\Windows\SysWOW64\Gllajf32.exe
Size 320KB
SHA256 e76b6ae33c9883c0f9678c89ffcb66dde276e63011c9b689b82875b2176875a1
MD5 c4c272d308b47fb2a9164a538560478b
SHA1 375c1ffdf257e5179b58303ba144c6ab9f138789
SHA512 bf77c1ca7e64c402b504acf35c3a9a62381134afb8a7781f0fa3e9d02d0f55d6912ad659f3e6a28d719e2057003b9e044f5084f0d03dd962d2cf4fe081d18f7c
SSDEEP 3072:6k/USVX11TUg5YT7sb3WwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/jVjTUEmaWV/Ah1G/AcQ///NR5fn
TLSH
T1AB643F1A2A3049EACEED1FB5AC0249DC9141E8F014F1E17E6163DFDCD9E4DAAE805F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gplged32.exe

Path C:\Windows\SysWOW64\Gplged32.exe
Size 320KB
SHA256 fa2a5b028cf9b75fddee27075b9ff95f749f0a6a160491adef234ed049e4d26e
MD5 f40c0167b9c7a93abdd3464f9ec7b45d
SHA1 2a69124b4c723a13aaea83c2b807221076b3ac5a
SHA512 f2330bf5ba01ea0eb907f033fd845f377652e73af99825eec410c727d02cc57eaa654dc8ffe016eea16e167a331ecbaa3c662caec45c9a53f23de81b47d94919
SSDEEP 3072:64LpQCD4kz5yA59ulwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:64Lpp4Q5y8ulV/Ah1G/AcQ///NR5fn
TLSH
T19064FD1A2A3409EACDED1BB6AE1249D85241E8F015F1E13EA123DFDCD8F4DA2DC15F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhaope32.exe

Path C:\Windows\SysWOW64\Hhaope32.exe
Size 320KB
SHA256 03e76f725a1d87b8354f0549b73a2284bc43c6306981cc784836bfe5504a4401
MD5 125d30c4aeafc643a37a7d2b8955b705
SHA1 6e46935b9fcb6c9b2ecfb85bcab91f4341b6e3f1
SHA512 5464a901d5791d6a54bcec073c8a5b7dd7c7412d43df9faf2e8b9e3bb140398dfa1a737776604c32b66b07e8543b6eed84b3263271d3f4808561bcf33d3e81cd
SSDEEP 3072:mnjGuVER40RZ9BzVkAwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:jLmIRVlV/Ah1G/AcQ///NR5fn
TLSH
T17D6420592A3809EACDEE1BB5AD1249D85141E9F014F1F53E6927DFDCC8F4DA2C818F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhleefhe.exe

Path C:\Windows\SysWOW64\Hhleefhe.exe
Size 320KB
SHA256 9a8eba0d035488627d8764b0518192fd4f07acad4472b53fd2c4d82019b474cf
MD5 a920a0516efa7824fedbd6c47a98667c
SHA1 d450f6d96e8388320f7eafcdd0bed0ed4784c4f0
SHA512 6077747b63538c0e681fb3b74184b6819437d9390793d3db45a2a901098ce193e02c1ae76b9fafe4e1967e96a00c7a2ed68b77116530142ae275bf11e4fcd010
SSDEEP 3072:j8LbyBRcpzoowwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:j8LAGzoowV/Ah1G/AcQ///NR5fn
TLSH
T106642019263809EACDFD1FB9AC1249D89181E9F016F1E17E6123DFDCC8E4DAAC805F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Homcbo32.exe

Path C:\Windows\SysWOW64\Homcbo32.exe
Size 320KB
SHA256 39bb5ebfdad54e6bae5589eedd17f6b4762dd5d87621b5f623b3fde31ec2f5fe
MD5 748b34dcad290bc15bf48d11a8088029
SHA1 6c1dab0fe8620326b0a99d4e507485a809ebac4b
SHA512 02207aa84e1b4d65e34a8c9e7054c59fcdd2a4d40386e7b629450c2af97ea70bfaea5fabc0d34a8dacb36ed75835c0138885a676218a3240d73fca551a925079
SSDEEP 3072:MeiU7olgzGXA1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Me3jzGQ1V/Ah1G/AcQ///NR5fn
TLSH
T1A864411A6A3009EACDED1FB5BE028AD85141E5F418F1E13E6163DFDCD9E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iiokacgp.exe

Path C:\Windows\SysWOW64\Iiokacgp.exe
Size 320KB
SHA256 eb87ba353e405004717be929a08348eb8a51632c5fe0f2e5f64d17a7c554248f
MD5 aee2ee8a56547596da826afc3d69790d
SHA1 7a71309589d233294f876ceef0df13d8a97d0cd5
SHA512 9ae4a8a8dd546468fb1b0226060d32f92c35a2b335b918a43f3642d2f4f9aa9f403d89ab8c69c32004b69d4c72c62f8c7391dce5f74ee327d55f57e452b75a58
SSDEEP 3072:3+zk8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OA8V/Ah1G/AcQ///NR5fn
TLSH
T119641019263809EACDED1FB5AC1249D89181F9F124F2E13E6123DFDCD8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Imhjlb32.exe

Path C:\Windows\SysWOW64\Imhjlb32.exe
Size 320KB
SHA256 e26b67c3b1ca09b913bb4e711b7a1a8c695569ed7a9fa68889f69da23d6b64e7
MD5 6e5caa0b1b5117a4cb070f40d6b57bac
SHA1 227ab739b197bbfb8017278595324190b60a71cb
SHA512 573d7297a797cf31510f043c1c7b94ffe8d5ba0eb22122419e6ceafe7c27133700a9359eeb6f278e215d66bac24188cf7b8a01d626ec140f6e3a3a7bd2e31965
SSDEEP 3072:V76+n4BPfZ5+cizNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Vx4ENV/Ah1G/AcQ///NR5fn
TLSH
T148642F192A3409EACEED5BB9EC124DD85181EAF014F1E13E6123DFDCD8E4DA6CA15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ioppho32.exe

Path C:\Windows\SysWOW64\Ioppho32.exe
Size 320KB
SHA256 fa7a40d21bfa44c01114ae35f72fabeca5e5e666446a481856f9b04b307617e5
MD5 5f459c4dfe0074abdda585374ae57964
SHA1 d738b7b7586dfb1b31c12d78684f95886f01ca0f
SHA512 85b5c238cb8e7feffd2b6cda18a5cbb50593e14dd52376594f09ff1748b4b6ea4f3dd6387873a5b10aaf0c64e9969e9bcd920e5c8950deed0923c1fcc87cb771
SSDEEP 3072:vWVhPeBUlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vUxeGlV/Ah1G/AcQ///NR5fn
TLSH
T19764401A1A740AEACEED1BB5EC1259D85181E8F014F1E93E6523DFDED8F4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jmamba32.exe

Path C:\Windows\SysWOW64\Jmamba32.exe
Size 320KB
SHA256 fc529e242617827351c024cd4043593e06ab6dce89ce67db04a0025e30d96a6f
MD5 1e76f11831cdb8c9a8315f783f1dbe8e
SHA1 710762df5dc4d463c32d74bfc6ec9ad418301ae4
SHA512 7e8777355cf5d86c1f902230384f47a6fbb0bd2399ae5e466b98e8b5a2b7edf9066712a78215e2e53918b08ac587cc327f2ae48e48bd95c4c988f49bcab1cd0e
SSDEEP 3072:ETrT2WFuwwG3LO+YJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ETH2twZiPJV/Ah1G/AcQ///NR5fn
TLSH
T1EE642E19263009EACEED5BF6AC124AD85181E8F054F6F23E6123DFDCD8E4DA6D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jqklnp32.exe

Path C:\Windows\SysWOW64\Jqklnp32.exe
Size 320KB
SHA256 22695a53ca8c900097ac16301d5d65af8712bd221e835592a96234a6e0679a39
MD5 30b0ade5104c81a6c0bce6e0a16e31cc
SHA1 5a414ed15839ad9c3ec7720bc938ac7a894e2869
SHA512 5373c93eea11286c39d6e93b9ab3bc5fc7d055b1fc8fbf36aa5e9f03cfd57f56c83b05584eba6e2de06452bbbfbc96055c30864fe519456e3f52ee257ea2f027
SSDEEP 3072:3mGbw26jGGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2GL6jGGV/Ah1G/AcQ///NR5fn
TLSH
T1366431192A3409EACEED5FB5AD1249D89141E9F024F1E13E6123EFDCD8E4DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lhopgg32.exe

Path C:\Windows\SysWOW64\Lhopgg32.exe
Size 320KB
SHA256 4c9a1a1ab3806e615596c0dbb62159a2250cceedfca7d1b0287799f4ed893537
MD5 a8d3a4ae8dad4527b6e3c9c8b55a9365
SHA1 b6b7954c92928e3aefbdeaf5b1f114669aa62a7b
SHA512 e86ab4d7ed9cd1ebe6c687ec23b774609e448dc3cbf224772dba224d675077b91e198f0f664d56ec0d39e75fc2bdf9f553bbedfe315375f3ef327218190f39e0
SSDEEP 3072:oeygrBf1/+cC8LlwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:U83/+YLlV/Ah1G/AcQ///NR5fn
TLSH
T1AA642E192A301AEACEED1BB5EC0249D89155E5F014F1E23E6523DFDCC9E4DB2D806FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malefbkc.exe

Path C:\Windows\SysWOW64\Malefbkc.exe
Size 320KB
SHA256 baa5754d20869b41b2e4a61bbb7ed0d1a9e7fe5ad34d0498cf54d3a802d8d8b2
MD5 31181c36b207c9cc577650e593321d42
SHA1 7e262ab7b51d6f439e70d99fc3b03a76fa7d89c8
SHA512 2a5eb1b461dff3869451b569b6972cb6ebc8810bdb52043cfe9ff2b42aaea30040970c335bf0d22c3090be7c9cc55b151eeff495f1c614d61c19181dc6693d10
SSDEEP 3072:A/ii9SfSQasTFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:A/vSfJamFV/Ah1G/AcQ///NR5fn
TLSH
T1F1642E19263449EACDEE2BB5ED024AD89141E9F018F1E53E6127DFDCC8F5DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Meoggpmd.exe

Path C:\Windows\SysWOW64\Meoggpmd.exe
Size 320KB
SHA256 8d9acc6b7327cdbadb73193d6fb6194cac74830109583ec817ce9786bad398ea
MD5 6703f34ab8a1d5da3324c0057da89c6d
SHA1 b6723e73554af8e4fd4b1d4377e0ef111ad801f0
SHA512 0e9a9b6a715b4eb19eda3dc5f7ea35b90ee78a9f49eeea5924a906fe6ec0281c96898d5d72ebeadd1934a7470cffbbe62281d68efac11eec4d150415d35638d4
SSDEEP 3072:kqhsFQd0C5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kosFQCC5V/Ah1G/AcQ///NR5fn
TLSH
T14C644019273809EACEED1FB5AC0259D89552E8F018F1E13E2127DFEDD8E4DA2D855F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfomda32.exe

Path C:\Windows\SysWOW64\Mfomda32.exe
Size 320KB
SHA256 19e8cf5ced9ca063951f827c19112fc91f1cc6734d1000091287abe295580a4f
MD5 e7fa1a73f4f53a9ccd368e4681e45cbe
SHA1 b7cda5f47225ebec85023f80efae11ae75b3deac
SHA512 7c5b0eeea31b75801224edce6bebdac06ea15b4fa7cef03372977172e957e71bf74fabe0d0355d81962040a4e627295ba3c3d4ef74004d358975e7b347c6c365
SSDEEP 3072:yFSJqecYx/7wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7qst7V/Ah1G/AcQ///NR5fn
TLSH
T1CB642F192A3809EACEED5BB5ED0289D85181E9F014F1E13E6523DFDCD8E4DA6CC19F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgbpdgap.exe

Path C:\Windows\SysWOW64\Mgbpdgap.exe
Size 320KB
SHA256 649e9379ae72f2254efb33547ec490faff2b046185df666f48dc3421ce1faa1f
MD5 d752711d47c0e7274a9a3a42453d22ab
SHA1 13571f928eeef5688739c648322b7786f1491baf
SHA512 7b4c9de23ecc6409aa05a61d6be2dbd120e5d5e3b3bfdec3fb9282e059eedd3d58d153fc7813c847d61c7813102810aaf474f03af754bbbcc246fa717112dc14
SSDEEP 3072:Ma02q4Wg5952iE9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Ma02q4WZr9V/Ah1G/AcQ///NR5fn
TLSH
T142642F192E3409EACDED9BB5AC1249D89181E9F014F1E13E6123DFDCD8E5DBAC819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mhhcne32.exe

Path C:\Windows\SysWOW64\Mhhcne32.exe
Size 320KB
SHA256 69fc1ab7408ce5d6198857e70b4f2fb17dd77cf18306f5f51e0dc0c56abe2afb
MD5 ab97be8ec33076dfadf1b2d02bce11ce
SHA1 d63de162e81599111a97109df7c8e9a6c811444f
SHA512 9809e037d89eb05ff3e21a65f51a4095d339045764dcc6a95f6d4b34085489856a357a157fe5f985633a347ed4e72af986751e64c3c18b646aee9304dd3e9cf3
SSDEEP 3072:Lf3MirtJXKrWT7V4MDu9f9STVhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:r5JDT7HcUphV/Ah1G/AcQ///NR5fn
TLSH
T1196430196A3409EACDED1FB6AC1249D89241F9F414F1E17E6523DFDCC8E4DA2D80AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mmghklif.exe

Path C:\Windows\SysWOW64\Mmghklif.exe
Size 320KB
SHA256 7beedc655c998e68552d10a050a2e422d17d54c4d24397eca496ec019f0c9a42
MD5 ed3ddaff90d4740e7ebc06589bc20fa3
SHA1 9447f2776246c979443ca508283f4a23400df5f9
SHA512 695b97461c5d759caffc24a1695d8024d257e867095c4141a413921a3f4b240011164017474ffae53a60600d9055ca7546e015c0cc56fc734b6c1e01bc3056b4
SSDEEP 3072:4nYqbQcNJmIKZZIvF3uMZds0KwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JsQcluMDs0KV/Ah1G/AcQ///NR5fn
TLSH
T133642D1A6A3409EACEED1BB5EC2249D85141E9F014F1E13E6523DFDCD9E4DA2CC19F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mpchbhjl.exe

Path C:\Windows\SysWOW64\Mpchbhjl.exe
Size 320KB
SHA256 2d29991e62b2a148aed9c6bbca31bd40c20b742d37db184ce186eac6ee3d0537
MD5 46608bfb3b94e29ac4b3e283a89a97d3
SHA1 e627cfdafda4086a9b7ca348af192115207ae794
SHA512 83af4ab04a9ad23d18c9ca906ddb5b621017dc49c9ee52f91d0227fdf580a4dba695736b44c08175d3f37160e1e7306c1f22b0acb88de981ae89ff570dddc563
SSDEEP 3072:gpHyD2+/cflwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gyIlwV/Ah1G/AcQ///NR5fn
TLSH
T131643F192A3049EADEED1FB6BC2249D85181E9F014F1E13E6123DFDCD8E5DA6C818F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndhgie32.exe

Path C:\Windows\SysWOW64\Ndhgie32.exe
Size 320KB
SHA256 97b5517d2315a87062f89b9312fb61a9795b652c552a37d62905f9e898cfc87e
MD5 72d17f15b701bf93db71b7bad56384ea
SHA1 f3a96650571d20190991d60657cb4186bc82b8f1
SHA512 e2ae30092c07d15c2aa58f06e6937c3679ef2753b09a91f2f13a2422f99b4748b78cfae5bee901a78f2c27a9cfedb30398c8d964d4ef8f4fc3c0a84e58156f0e
SSDEEP 3072:nkURuH57EaX5sWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nvRByaWV/Ah1G/AcQ///NR5fn
TLSH
T1E864305A1A3409EACEED1FB5AC1249D89151E9F014F2E23E6533DFDCD8E4DA2C809F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndjcne32.exe

Path C:\Windows\SysWOW64\Ndjcne32.exe
Size 320KB
SHA256 74cfdc4ba754d15fc88b5df7fc9e6ee860c2a337958699ddb7133b45629dbe13
MD5 87cdcbcdad68cd505d19653e91f49b26
SHA1 753a0cf3ee63ae253ea59107b0b8dac0b5c0e3f5
SHA512 5a6e06352db7f3f03c3a63a10a6597403de1e00b17be1f8c30321e05c318f0aa28413cf923a595c2f423728a34a5a28d1fd1e21669a110c204a56068b8c12f4a
SSDEEP 3072:s9fvuBiebmUFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s9fmceblFV/Ah1G/AcQ///NR5fn
TLSH
T18B641F19263809EACEED1BB6AD5289D89141E9F014F1E13E6133DFDCD8E4DABC845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ndmgnkja.exe

Path C:\Windows\SysWOW64\Ndmgnkja.exe
Size 320KB
SHA256 d36615650af2b919ad969718e33e52459bfe6826fc318a38942320be0e743d15
MD5 5857894d2982fefc114d7b0db048959a
SHA1 6d1e0543980d245e7d43481b611355c3ad5b7e9f
SHA512 7a51eeafa076b2a82572f4b163e1cd795120fd20e942fb51caeb1bc809c9158a68f7817b27cf956621241238e74393167a457aa7830386b902c620f6a5f69da6
SSDEEP 3072:V6trz9kN/dszL4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Vu6q4V/Ah1G/AcQ///NR5fn
TLSH
T12D64211A263409EACDED1FB6AC124AE85541E9F018F1E13E6523DFDCD8F4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nkpbpp32.exe

Path C:\Windows\SysWOW64\Nkpbpp32.exe
Size 320KB
SHA256 edbfd0d6e5f4d2f57898530a1e28674a6666f4d24e82496bffff3697ac75695f
MD5 86e53d5b4a85047591df503ce5507363
SHA1 640bb2eb7fc4bb28574083b091702c3cbf5ea356
SHA512 d0ae62425c93f4a2f6d18b5c2a679a6e3aa73406dfab2c4ec22e6109dc693a211b907917f2ac3ad5ca93df811eed111224bdc2865d13674e68c59c4dd38f7525
SSDEEP 3072:USn1z6wA+A39+oUj1KL3/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:US6/V/Ah1G/AcQ///NR5fn
TLSH
T17A643019263449EBCEEE1BB5AC1249E85151E9F014F1E13E6623DFDCC8E4DA2DC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nolekd32.exe

Path C:\Windows\SysWOW64\Nolekd32.exe
Size 320KB
SHA256 df938906bc2702d90f75b5afec866be02ccb24fad108f4878dc3b0e7bc2680d1
MD5 44f1a7f3577def3542308541e506df9a
SHA1 6e4d7eb87bf2597fb7f887cc9c4978fae6b4f6ef
SHA512 6f35ad1716a269e59019da12b7bf2032b30c2833e2bc8378029abf2e5b02ef4d92017e7aa4c4cb333083156f36d56caa90009c77a6486b435109203b5c32d821
SSDEEP 3072:sql1rzgWL5p9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3zgWn9V/Ah1G/AcQ///NR5fn
TLSH
T1766433192AB409EACDEE1FF6AC1259E89181E5F054F2E13E5123DFECD8E4D66C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oahnhncc.exe

Path C:\Windows\SysWOW64\Oahnhncc.exe
Size 320KB
SHA256 83d93c8dd778167f9ace8b071332f151489dc3f17691d703c52ac8821018dae9
MD5 68b92d586d4d85e59c0aee9bc24d5645
SHA1 e89d9616d252b0d5e9fd15b237b3abcbedacb7b6
SHA512 f9aed4bf236bcc0dfff6245b6dd84bf5d225dd2eba494289c83505f26eb037a9f34f3db9ceeddd085354ae6fcd02fff7ad2f4adcee7b60ba8bcb56a82ff18a4f
SSDEEP 3072:PeUyIuPG/MDmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:dyIunmV/Ah1G/AcQ///NR5fn
TLSH
T1F96420191A7509EADEED1FB5AC0259D89142E5F024F1E13E6223DFDCD8F8DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oamgcm32.exe

Path C:\Windows\SysWOW64\Oamgcm32.exe
Size 320KB
SHA256 626bbe6bf38217ffd0ec474838e3b2734ea1ac8b5881c0aa4e6cd3293a619cc4
MD5 dfd720b557c29425489ce8f33b6bc67f
SHA1 6162ba1fa37830684cdf32738eb2473f4f532af5
SHA512 cf9bb8df30e100984c70ffe5f9ff81fe4496a53d5d83593b9c76a6b0c5cee27c5dee765d2f52f87ad4e85d2171d0d69d407482b14d5139bed9dfb25efd19779a
SSDEEP 3072:Hz3y4ec6Bcvw5zvtZfVrwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:56BcvwpvvfRV/Ah1G/AcQ///NR5fn
TLSH
T1FB640D19263419EACEFD1BB5BE1249D85A41E9F014F1E13E6223DFDCD8E8DA2C854F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oeffnl32.exe

Path C:\Windows\SysWOW64\Oeffnl32.exe
Size 320KB
SHA256 00770260a4546212f589ee6b43b4c70282f992eba7834d6cf9ad04bef8994e21
MD5 8f2176d501ba38a7d711431b6a5b1596
SHA1 a9401a80fd783dafb5c0661738dd573f46ec7d77
SHA512 bf1d08bd28649c7300368bf405e733c68933f38321b52f445c7f06e8e55394641729304c6ca3c3819bc1e3484ab85ea45116e451200d9850a283aebcb6725cfb
SSDEEP 3072:DbR5VyuwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZCuV/Ah1G/AcQ///NR5fn
TLSH
T135641F192A3409EACEED5FB5AC1249D85181F9F114F1E13E6223DFDCE8E8DA6C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oogdfc32.exe

Path C:\Windows\SysWOW64\Oogdfc32.exe
Size 320KB
SHA256 cdda2e97108c5bf618ff5aadd14a8600279e0b93136795035d57523d27655f56
MD5 6c6b1d1a089d8e886219c9e7d63f13d8
SHA1 2c0400d2b1282e519ecbfc30baf28a45926afdae
SHA512 40f2ebe9451258a315a2f9568ff72fdabd0dc800a4da0254235538e81bea6c5f269c41384a0bd9d32d1f7a058e7623fafd1505ceb2a1d8c0a2f6ae3e285ff899
SSDEEP 3072:9tUny/rABMjNeHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1zABMjYHV/Ah1G/AcQ///NR5fn
TLSH
T10E64201916348AEACEFD5FB6AC0249D89546E9F014F1E23E6123DFDCD8E4DA2D814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pdmikb32.exe

Path C:\Windows\SysWOW64\Pdmikb32.exe
Size 320KB
SHA256 2506ecd2c388d3f449b7bdc2bfcb397f7fb03826e43a8907ac62340d9ebd9061
MD5 b9bb54710a038597f7af2bef07f952e0
SHA1 d5c21dc4f6b96ba415833dcca06b08c9bf9209cd
SHA512 9c78f79dfe05ccb168c37c5aca96e8a283c0564c4a22ffdaf700c6a9017f6409bfcf205d4c947d4eb4855cfd8877e7394f76988d55aadab272c7c482286cbcdd
SSDEEP 3072:zI6GkjAq5WwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zIdq5WV/Ah1G/AcQ///NR5fn
TLSH
T12564201926340AEACEEE5FB5EC1249D89281E9F014F1E13E6123DFDCD9E4DA6D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pfpidk32.exe

Path C:\Windows\SysWOW64\Pfpidk32.exe
Size 320KB
SHA256 020f8da0a49dfad117e00515002560c749e763e0d20925f1632e7cc301a1b77a
MD5 bbede3b01d89d7dd2021279bb4cc5238
SHA1 82826764279f27fc9cbf1cc36c60a1f65f2a58ce
SHA512 7432e4309e3ca81ce64e4ae50582075ae344f86f7e23200674a0201072227d73d639789fb0191198544d35d520870b1f9ebe9c1753745bff88779e00411b2e46
SSDEEP 3072:hB0dfioUcy07XXrc1EXQ6MwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DF07XXrlMV/Ah1G/AcQ///NR5fn
TLSH
T16364EB192A340AEACEED1BB5BC1249D89142F9F114F1E13E6127DFDCD8E4DAAD805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pndhhnda.exe

Path C:\Windows\SysWOW64\Pndhhnda.exe
Size 320KB
SHA256 be9fa4a8739761584a5d15a36f308255d6407ab7baa12ee70f5c9a29e9089765
MD5 3242a20f4ddeadd25fcb39ecb08cadd0
SHA1 74a0f839037af652445e31891f7cda1d6a49b874
SHA512 542e80ccef9c68e5cbf03c040246a26fa85c3dae8dee8e2d582a00e3b00fcaf74b607ca2f8178288db4c6526523bd9db1495788964f8fcef8fb018100602cd2a
SSDEEP 3072:ZDg2e20lmbGDE5JwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:eNlGEGJV/Ah1G/AcQ///NR5fn
TLSH
T1596420192A340AEACDED1BB5EC1259D95142E9F214F1F13E6123DFECD8E4E62C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qmckbjdl.exe

Path C:\Windows\SysWOW64\Qmckbjdl.exe
Size 320KB
SHA256 6ff51022073cd04faf4475d343b629e38426f1c08ff875fd6b77969a701e6a3f
MD5 4372b930b4ba23fb3bd0143cdcc47e96
SHA1 2520f3f881e98181bd17eb951377c776070f1fa1
SHA512 d059df55a6e21f01babd86844c33f48dcb5cc258adb9a71e3923dd84e8e0eca712255978898bd39e1eabcd0e0107ac56672cf30944ec4b087099d9b280c8f711
SSDEEP 3072:CfvKGN3LwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CfLV/Ah1G/AcQ///NR5fn
TLSH
T1AE643F19263149EACDED1FB6AC1249D99142EAF014F1F13E6127DFDCD8E4DAAC824F84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/100-198-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/116-424-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/456-104-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/456-629-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/464-48-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/464-591-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/620-41-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/620-585-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/856-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1032-174-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1120-565-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1120-16-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1136-292-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1168-388-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1264-246-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1420-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1568-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1576-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1588-376-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1816-364-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1856-628-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1856-96-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1968-559-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1968-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2032-579-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2032-33-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2100-222-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2136-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2148-238-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2280-262-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2388-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2432-254-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2456-436-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2492-512-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2532-382-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2536-274-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2584-166-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2592-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2660-113-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2808-572-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2808-30-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2840-465-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2856-60-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2856-598-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2944-529-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3000-206-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3252-352-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3384-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3476-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3492-298-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3504-142-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3520-149-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3540-454-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3544-518-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3580-94-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3588-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3632-346-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3748-81-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3748-617-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3752-418-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3796-412-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3928-304-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3940-190-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4072-394-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4076-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4104-611-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4104-78-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4112-150-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4156-541-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4180-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4208-316-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4268-214-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4332-358-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-605-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4452-65-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4460-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4528-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4568-268-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4616-158-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4692-535-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4728-328-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4752-334-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4756-286-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4764-442-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4844-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4932-448-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5008-406-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5028-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5028-547-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5028-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/5108-327-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5144-553-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5224-566-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5264-578-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5392-592-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5432-599-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads