berbew | 118ac541f1c31b33beedf1ba83a9f551da78c1f01784439a6c8ce4d47f3249e9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_dd8b8046e21042bf74724a10e4fb8217_elex_wannacry.exe
Size 320KB
Sample260801-xvk9lseq51
SHA256 118ac541f1c31b33beedf1ba83a9f551da78c1f01784439a6c8ce4d47f3249e9
MD5 dd8b8046e21042bf74724a10e4fb8217
SHA1 455aaa9ada045026669a6fc4c3e0d5c5926e21c6
SHA512 d89477e9ec8e342019a3047a02cdde0f358335e4e6a3b18c1e54e26a2025ff0d00f4ee60235640e7c1f44eb5bd24b7be8ece1644e5ba987627bd83fc40e6bc8b
SSDEEP 3072:LYGNMzXYEQfx5mwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LYjkxfvmV/Ah1G/AcQ///NR5fn
TLSH
T18D64201A2A340DEACEED1BB5AC1249D86541E8F054F1E13E6123DFDDD8E4DA2EC25F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amdddkma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnnidjcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdepaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmaojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahdgnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbanfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjffkhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejofacfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eidbbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncnook32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbifobho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Celelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nelmik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkieab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaajoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikpjkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aachaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hekgppma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkhkdjli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipjocgdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnlapbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceoillaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dalhgfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dclknkfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebjckppa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpopb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlpgiebo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifihckmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgqdal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neiiiecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdllhdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gglpbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccmgbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peddhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflfoepg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eolhlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhjcdimf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Engjol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidkek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkejalge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojommdfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgeegled.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caeiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebjckppa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjmkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fldnoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjffkhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbifobho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igmgji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbhch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blonbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glebbpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpniaool.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nblcgpho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgigfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mceccbpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekkkip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhhkoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjmeaafi.exe

Executes dropped EXE 64 IoCs

pid	Process
5428	Hfhqkk32.exe
1592	Hfjmajbc.exe
4184	Hbanfk32.exe
3104	Ijmobhdd.exe
5060	Immhdc32.exe
2940	Ipnaen32.exe
472	Iiffoc32.exe
2868	Ibojgikg.exe
2964	Ibagmiie.exe
4656	Jfopcgpk.exe
1588	Jfdinf32.exe
2840	Jplmglbf.exe
1772	Jfffcf32.exe
5272	Jaljaoii.exe
3244	Kkdnjd32.exe
1956	Kkkdjcjb.exe
2648	Kmlmlo32.exe
5956	Lkbkkbdj.exe
5148	Lanpml32.exe
5836	Lkgdfb32.exe
4168	Mgpaqbcf.exe
3132	Mjqjbn32.exe
4488	Mpmodg32.exe
3552	Mnapnl32.exe
3608	Nglala32.exe
480	Naaejj32.exe
6060	Nnjbdj32.exe
704	Ncgkma32.exe
5740	Ncihbaie.exe
5516	Oqmhlego.exe
1044	Ogjmnomi.exe
1492	Oboakhmo.exe
4132	Ojopki32.exe
2952	Peddhb32.exe
4216	Pbkagfba.exe
5936	Pjffkhpl.exe
4748	Pengna32.exe
1824	Qgopplkq.exe
3624	Qgalelin.exe
3376	Aeemop32.exe
2692	Acjjpllp.exe
3872	Anpnmele.exe
5540	Ahhbfkbf.exe
1332	Aaqgop32.exe
1328	Andghd32.exe
5076	Ahmlaj32.exe
1912	Blkdgheg.exe
2896	Bhaeli32.exe
5404	Bajjeo32.exe
2972	Blonbh32.exe
3328	Bbifobho.exe
3120	Bejoqm32.exe
3740	Caapfnkd.exe
3660	Ckidoc32.exe
5364	Ceoillaj.exe
4752	Caeiam32.exe
5448	Coijja32.exe
2564	Colfpace.exe
2956	Dlpgiebo.exe
4224	Dkedjbgg.exe
2880	Ddmhcg32.exe
1352	Dememj32.exe
2608	Dkjmea32.exe
3016	Dhnnoe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fchpnh32.dll	Eplnijdj.exe
File opened for modification	C:\Windows\SysWOW64\Qifnaecf.exe	Pcmeek32.exe
File created	C:\Windows\SysWOW64\Eaedbq32.dll	Fdccka32.exe
File created	C:\Windows\SysWOW64\Hoglmg32.exe	Gikdep32.exe
File created	C:\Windows\SysWOW64\Koaaaaip.exe	Kjeiij32.exe
File created	C:\Windows\SysWOW64\Fkalmn32.exe	Fojlhmic.exe
File opened for modification	C:\Windows\SysWOW64\Fggfghap.exe	Folacfcd.exe
File opened for modification	C:\Windows\SysWOW64\Acfoep32.exe	Afboll32.exe
File created	C:\Windows\SysWOW64\Mmildo32.dll	Eidbbp32.exe
File created	C:\Windows\SysWOW64\Kpbjfeil.dll	Jcoapami.exe
File created	C:\Windows\SysWOW64\Pqfjpc32.dll	Iciflfcd.exe
File opened for modification	C:\Windows\SysWOW64\Emkeho32.exe	Efamkepl.exe
File opened for modification	C:\Windows\SysWOW64\Afgame32.exe	Aomipkic.exe
File created	C:\Windows\SysWOW64\Cmelgi32.dll	Alcfoo32.exe
File created	C:\Windows\SysWOW64\Fbipejob.dll	Giinjg32.exe
File opened for modification	C:\Windows\SysWOW64\Kgefae32.exe	Kdfjej32.exe
File created	C:\Windows\SysWOW64\Mllqpaej.dll	Ckaolcol.exe
File created	C:\Windows\SysWOW64\Coldbl32.exe	Cdfpdc32.exe
File created	C:\Windows\SysWOW64\Eddhipdd.exe	Emjomf32.exe
File created	C:\Windows\SysWOW64\Dcckal32.dll	Fknimh32.exe
File opened for modification	C:\Windows\SysWOW64\Olbdacbp.exe	Objphn32.exe
File created	C:\Windows\SysWOW64\Hgfaij32.exe	Hmnmqdee.exe
File created	C:\Windows\SysWOW64\Bdojdd32.exe	Bkgekock.exe
File created	C:\Windows\SysWOW64\Dkbomgde.exe	Dcgjie32.exe
File opened for modification	C:\Windows\SysWOW64\Ecipeb32.exe	Emphhhoh.exe
File created	C:\Windows\SysWOW64\Akkfop32.exe	Adanbffk.exe
File opened for modification	C:\Windows\SysWOW64\Edknjonl.exe	Ehdmenhh.exe
File created	C:\Windows\SysWOW64\Blhcia32.dll	Jfpocjfa.exe
File created	C:\Windows\SysWOW64\Oobknhji.dll	Plagmh32.exe
File created	C:\Windows\SysWOW64\Dqhicdkm.dll	Lagekp32.exe
File opened for modification	C:\Windows\SysWOW64\Baohmo32.exe	Aehghn32.exe
File created	C:\Windows\SysWOW64\Jqllaedc.dll	Ipjocgdm.exe
File created	C:\Windows\SysWOW64\Cbdijhno.dll	2026-08-01_dd8b8046e21042bf74724a10e4fb8217_elex_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\Mpmodg32.exe	Mjqjbn32.exe
File created	C:\Windows\SysWOW64\Hnkkaaai.dll	Ndagao32.exe
File created	C:\Windows\SysWOW64\Bddcep32.dll	Oflfoepg.exe
File created	C:\Windows\SysWOW64\Fkihgb32.exe	Fapdomgg.exe
File opened for modification	C:\Windows\SysWOW64\Jgngkmkf.exe	Jnfcbg32.exe
File opened for modification	C:\Windows\SysWOW64\Mglfibmh.exe	Mabnlh32.exe
File opened for modification	C:\Windows\SysWOW64\Ahdgnj32.exe	Aajoapdk.exe
File created	C:\Windows\SysWOW64\Baomkono.dll	Feapdaof.exe
File opened for modification	C:\Windows\SysWOW64\Efkfkilj.exe	Dkfanqmd.exe
File created	C:\Windows\SysWOW64\Polbgh32.dll	Dkmogbeo.exe
File opened for modification	C:\Windows\SysWOW64\Mplhjabe.exe	Megdmhbp.exe
File created	C:\Windows\SysWOW64\Jgcanm32.dll	Fdepaa32.exe
File created	C:\Windows\SysWOW64\Hlldaape.exe	Hkkgii32.exe
File opened for modification	C:\Windows\SysWOW64\Phcgmffo.exe	Pmnbpm32.exe
File created	C:\Windows\SysWOW64\Cboema32.dll	Bogkgmho.exe
File created	C:\Windows\SysWOW64\Pjffkhpl.exe	Pbkagfba.exe
File created	C:\Windows\SysWOW64\Ocgbej32.exe	Ojommdfh.exe
File created	C:\Windows\SysWOW64\Aopmpq32.exe	Agdhln32.exe
File created	C:\Windows\SysWOW64\Epfmalli.dll	Hlldaape.exe
File created	C:\Windows\SysWOW64\Conkhh32.dll	Chdikajj.exe
File created	C:\Windows\SysWOW64\Lnbcfp32.dll	Olnkfd32.exe
File created	C:\Windows\SysWOW64\Dlegjk32.dll	Dememj32.exe
File created	C:\Windows\SysWOW64\Nfhfbedd.exe	Mehjhbma.exe
File created	C:\Windows\SysWOW64\Qfneamlf.exe	Qhjegh32.exe
File opened for modification	C:\Windows\SysWOW64\Gdafgefe.exe	Ggnenagl.exe
File created	C:\Windows\SysWOW64\Olheak32.dll	Milinkgf.exe
File opened for modification	C:\Windows\SysWOW64\Bkoiqjdj.exe	Bjnmib32.exe
File opened for modification	C:\Windows\SysWOW64\Caojigoh.exe	Cgiflnoa.exe
File opened for modification	C:\Windows\SysWOW64\Pjeoablq.exe	Pqmjhm32.exe
File opened for modification	C:\Windows\SysWOW64\Hhbbmjne.exe	Hgcfcg32.exe
File opened for modification	C:\Windows\SysWOW64\Hoglmg32.exe	Gikdep32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8716	13288	WerFault.exe	849

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lclpmdhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfqlph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncifdlii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blonbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eolhlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghdoae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaiiffjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfigib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfohafad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfpocjfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahdgnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekoddodi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phjdggoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpahghbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fknimh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfehoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idbonc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdkadb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miabik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmdefi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiiiml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkbkkbdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkoiqjdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmmoekem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkcehaof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoglmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmomga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaklcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgcgje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipjocgdm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpomme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgopbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkkgii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mceccbpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncofjaho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bojogb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdlphjaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkihgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pedlpgqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baadbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfgiii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmipnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jecejm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eddhipdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fggfghap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnnidjcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cggnhlml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbeece32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mebkbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adbiojfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emjomf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlglpkpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgoejapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpmpgfhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afinbdon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdndik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oboakhmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbaiip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddligi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibkpmm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komhfa32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hoebhpfd.dll"	Neppiagi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfhecfj.dll"	Ddmaia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpmlhoil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnlloj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhbogb32.dll"	Kgopbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caaikieh.dll"	Gefencoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiihkncb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioeqqnmg.dll"	Pllnbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcdnce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbnobf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngbeok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgeegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dceplm32.dll"	Caeiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjadjm32.dll"	Jilnjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbbhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmnbpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banabi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcclm32.dll"	Jfffcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baomkono.dll"	Feapdaof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbhcjpnl.dll"	Inmggo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfjjqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhbfpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoofej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cffcilob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbdckd32.dll"	Fpbfem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Naaejj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Feapdaof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljbfiegb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hplbbipm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoaocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pflfmdog.dll"	Lomqmoob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofhkgeij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnlhhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pllnbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afoqbkld.dll"	Fppqjcli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjfegl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cllfcdpd.dll"	Igmgji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmgijc32.dll"	Baadbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipbhch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkgekock.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eddodfhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbmoodbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ineilini.dll"	Qpahghbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmnlklmf.dll"	Gdkgam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbhhlbgb.dll"	Pgoejapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kohhopdk.dll"	Aaiiffjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmaojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmpdbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgdhab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchpnh32.dll"	Eplnijdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlgpgbf.dll"	Emmkci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffobbmpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogjpn32.dll"	Mkeeda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjeoablq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pappijpj.dll"	Gkhkdjli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplmglbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnppim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfkeej32.dll"	Bgknlmgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Illiakok.dll"	Qejkfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blonbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghnibj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfqafh32.dll"	Jkejalge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caojigoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blhcia32.dll"	Jfpocjfa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 5428	3260	2026-08-01_dd8b8046e21042bf74724a10e4fb8217_elex_wannacry.exe	89
PID 5428 wrote to memory of 1592	5428	Hfhqkk32.exe	90
PID 1592 wrote to memory of 4184	1592	Hfjmajbc.exe	91
PID 4184 wrote to memory of 3104	4184	Hbanfk32.exe	92
PID 3104 wrote to memory of 5060	3104	Ijmobhdd.exe	93
PID 5060 wrote to memory of 2940	5060	Immhdc32.exe	94
PID 2940 wrote to memory of 472	2940	Ipnaen32.exe	95
PID 472 wrote to memory of 2868	472	Iiffoc32.exe	96
PID 2868 wrote to memory of 2964	2868	Ibojgikg.exe	97
PID 2964 wrote to memory of 4656	2964	Ibagmiie.exe	98
PID 4656 wrote to memory of 1588	4656	Jfopcgpk.exe	99
PID 1588 wrote to memory of 2840	1588	Jfdinf32.exe	100
PID 2840 wrote to memory of 1772	2840	Jplmglbf.exe	101
PID 1772 wrote to memory of 5272	1772	Jfffcf32.exe	102
PID 5272 wrote to memory of 3244	5272	Jaljaoii.exe	103
PID 3244 wrote to memory of 1956	3244	Kkdnjd32.exe	104
PID 1956 wrote to memory of 2648	1956	Kkkdjcjb.exe	105
PID 2648 wrote to memory of 5956	2648	Kmlmlo32.exe	106
PID 5956 wrote to memory of 5148	5956	Lkbkkbdj.exe	107
PID 5148 wrote to memory of 5836	5148	Lanpml32.exe	108
PID 5836 wrote to memory of 4168	5836	Lkgdfb32.exe	109
PID 4168 wrote to memory of 3132	4168	Mgpaqbcf.exe	110
PID 3132 wrote to memory of 4488	3132	Mjqjbn32.exe	111
PID 4488 wrote to memory of 3552	4488	Mpmodg32.exe	112
PID 3552 wrote to memory of 3608	3552	Mnapnl32.exe	113
PID 3608 wrote to memory of 480	3608	Nglala32.exe	114
PID 480 wrote to memory of 6060	480	Naaejj32.exe	115
PID 6060 wrote to memory of 704	6060	Nnjbdj32.exe	116
PID 704 wrote to memory of 5740	704	Ncgkma32.exe	117
PID 5740 wrote to memory of 5516	5740	Ncihbaie.exe	118
PID 5516 wrote to memory of 1044	5516	Oqmhlego.exe	119
PID 1044 wrote to memory of 1492	1044	Ogjmnomi.exe	120
PID 1492 wrote to memory of 4132	1492	Oboakhmo.exe	121
PID 4132 wrote to memory of 2952	4132	Ojopki32.exe	122
PID 2952 wrote to memory of 4216	2952	Peddhb32.exe	123
PID 4216 wrote to memory of 5936	4216	Pbkagfba.exe	124
PID 5936 wrote to memory of 4748	5936	Pjffkhpl.exe	125
PID 4748 wrote to memory of 1824	4748	Pengna32.exe	126
PID 1824 wrote to memory of 3624	1824	Qgopplkq.exe	127
PID 3624 wrote to memory of 3376	3624	Qgalelin.exe	128
PID 3376 wrote to memory of 2692	3376	Aeemop32.exe	129
PID 2692 wrote to memory of 3872	2692	Acjjpllp.exe	130
PID 3872 wrote to memory of 5540	3872	Anpnmele.exe	131
PID 5540 wrote to memory of 1332	5540	Ahhbfkbf.exe	132
PID 1332 wrote to memory of 1328	1332	Aaqgop32.exe	133
PID 1328 wrote to memory of 5076	1328	Andghd32.exe	134
PID 5076 wrote to memory of 1912	5076	Ahmlaj32.exe	135
PID 1912 wrote to memory of 2896	1912	Blkdgheg.exe	136
PID 2896 wrote to memory of 5404	2896	Bhaeli32.exe	137
PID 5404 wrote to memory of 2972	5404	Bajjeo32.exe	138
PID 2972 wrote to memory of 3328	2972	Blonbh32.exe	139
PID 3328 wrote to memory of 3120	3328	Bbifobho.exe	140
PID 3120 wrote to memory of 3740	3120	Bejoqm32.exe	141
PID 3740 wrote to memory of 3660	3740	Caapfnkd.exe	142
PID 3660 wrote to memory of 5364	3660	Ckidoc32.exe	143
PID 5364 wrote to memory of 4752	5364	Ceoillaj.exe	144
PID 4752 wrote to memory of 5448	4752	Caeiam32.exe	145
PID 5448 wrote to memory of 2564	5448	Coijja32.exe	146
PID 2564 wrote to memory of 2956	2564	Colfpace.exe	147
PID 2956 wrote to memory of 4224	2956	Dlpgiebo.exe	148
PID 4224 wrote to memory of 2880	4224	Dkedjbgg.exe	149
PID 2880 wrote to memory of 1352	2880	Ddmhcg32.exe	150
PID 1352 wrote to memory of 2608	1352	Dememj32.exe	151
PID 2608 wrote to memory of 3016	2608	Dkjmea32.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-08-01_dd8b8046e21042bf74724a10e4fb8217_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_dd8b8046e21042bf74724a10e4fb8217_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\Hfhqkk32.exe
  C:\Windows\system32\Hfhqkk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\SysWOW64\Hfjmajbc.exe
    C:\Windows\system32\Hfjmajbc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\SysWOW64\Hbanfk32.exe
      C:\Windows\system32\Hbanfk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Windows\SysWOW64\Ijmobhdd.exe
        
        C:\Windows\system32\Ijmobhdd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3104
      - C:\Windows\SysWOW64\Immhdc32.exe
        
        C:\Windows\system32\Immhdc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Ipnaen32.exe
        
        C:\Windows\system32\Ipnaen32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Iiffoc32.exe
        
        C:\Windows\system32\Iiffoc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Ibagmiie.exe
        
        C:\Windows\system32\Ibagmiie.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Jfopcgpk.exe
        
        C:\Windows\system32\Jfopcgpk.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Jfdinf32.exe
        
        C:\Windows\system32\Jfdinf32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Jplmglbf.exe
        
        C:\Windows\system32\Jplmglbf.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Jfffcf32.exe
        
        C:\Windows\system32\Jfffcf32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5272
        
        C:\Windows\SysWOW64\Kkdnjd32.exe
        
        C:\Windows\system32\Kkdnjd32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Kkkdjcjb.exe
        
        C:\Windows\system32\Kkkdjcjb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Kmlmlo32.exe
        
        C:\Windows\system32\Kmlmlo32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Lkbkkbdj.exe
        
        C:\Windows\system32\Lkbkkbdj.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5956
        
        C:\Windows\SysWOW64\Lanpml32.exe
        
        C:\Windows\system32\Lanpml32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5148
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5836
        
        C:\Windows\SysWOW64\Mgpaqbcf.exe
        
        C:\Windows\system32\Mgpaqbcf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\Mjqjbn32.exe
        
        C:\Windows\system32\Mjqjbn32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Mpmodg32.exe
        
        C:\Windows\system32\Mpmodg32.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Mnapnl32.exe
        
        C:\Windows\system32\Mnapnl32.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Naaejj32.exe
        
        C:\Windows\system32\Naaejj32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:480
        
        C:\Windows\SysWOW64\Nnjbdj32.exe
        
        C:\Windows\system32\Nnjbdj32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6060
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:704
        
        C:\Windows\SysWOW64\Ncihbaie.exe
        
        C:\Windows\system32\Ncihbaie.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5740
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5516
        
        C:\Windows\SysWOW64\Ogjmnomi.exe
        
        C:\Windows\system32\Ogjmnomi.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Oboakhmo.exe
        
        C:\Windows\system32\Oboakhmo.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Peddhb32.exe
        
        C:\Windows\system32\Peddhb32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Pbkagfba.exe
        
        C:\Windows\system32\Pbkagfba.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Pjffkhpl.exe
        
        C:\Windows\system32\Pjffkhpl.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5936
        
        C:\Windows\SysWOW64\Pengna32.exe
        
        C:\Windows\system32\Pengna32.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Qgopplkq.exe
        
        C:\Windows\system32\Qgopplkq.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Qgalelin.exe
        
        C:\Windows\system32\Qgalelin.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\Aeemop32.exe
        
        C:\Windows\system32\Aeemop32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Acjjpllp.exe
        
        C:\Windows\system32\Acjjpllp.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Anpnmele.exe
        
        C:\Windows\system32\Anpnmele.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Ahhbfkbf.exe
        
        C:\Windows\system32\Ahhbfkbf.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5540
        
        C:\Windows\SysWOW64\Aaqgop32.exe
        
        C:\Windows\system32\Aaqgop32.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Andghd32.exe
        
        C:\Windows\system32\Andghd32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Ahmlaj32.exe
        
        C:\Windows\system32\Ahmlaj32.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Blkdgheg.exe
        
        C:\Windows\system32\Blkdgheg.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Bajjeo32.exe
        
        C:\Windows\system32\Bajjeo32.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Windows\SysWOW64\Blonbh32.exe
        
        C:\Windows\system32\Blonbh32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Bbifobho.exe
        
        C:\Windows\system32\Bbifobho.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Bejoqm32.exe
        
        C:\Windows\system32\Bejoqm32.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Caapfnkd.exe
        
        C:\Windows\system32\Caapfnkd.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Ckidoc32.exe
        
        C:\Windows\system32\Ckidoc32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Windows\SysWOW64\Ceoillaj.exe
        
        C:\Windows\system32\Ceoillaj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5364
        
        C:\Windows\SysWOW64\Caeiam32.exe
        
        C:\Windows\system32\Caeiam32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Coijja32.exe
        
        C:\Windows\system32\Coijja32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Windows\SysWOW64\Colfpace.exe
        
        C:\Windows\system32\Colfpace.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Dlpgiebo.exe
        
        C:\Windows\system32\Dlpgiebo.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Dkedjbgg.exe
        
        C:\Windows\system32\Dkedjbgg.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Ddmhcg32.exe
        
        C:\Windows\system32\Ddmhcg32.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Dememj32.exe
        
        C:\Windows\system32\Dememj32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Dkjmea32.exe
        
        C:\Windows\system32\Dkjmea32.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\Dhnnoe32.exe
        
        C:\Windows\system32\Dhnnoe32.exe
        65⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Windows\SysWOW64\Eddodfhp.exe
        
        C:\Windows\system32\Eddodfhp.exe
        66⤵
        Modifies registry class
        
        PID:1108
        
        C:\Windows\SysWOW64\Eedkniob.exe
        
        C:\Windows\system32\Eedkniob.exe
        67⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Eaklcj32.exe
        
        C:\Windows\system32\Eaklcj32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Ekcplp32.exe
        
        C:\Windows\system32\Ekcplp32.exe
        69⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Eehdii32.exe
        
        C:\Windows\system32\Eehdii32.exe
        70⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Eleikb32.exe
        
        C:\Windows\system32\Eleikb32.exe
        71⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Flgfqb32.exe
        
        C:\Windows\system32\Flgfqb32.exe
        72⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Fklcbocl.exe
        
        C:\Windows\system32\Fklcbocl.exe
        73⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Fdegkdim.exe
        
        C:\Windows\system32\Fdegkdim.exe
        74⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Fojlhmic.exe
        
        C:\Windows\system32\Fojlhmic.exe
        75⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Fkalmn32.exe
        
        C:\Windows\system32\Fkalmn32.exe
        76⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Fdiafc32.exe
        
        C:\Windows\system32\Fdiafc32.exe
        77⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Gfimpfmj.exe
        
        C:\Windows\system32\Gfimpfmj.exe
        78⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Gcmnijkd.exe
        
        C:\Windows\system32\Gcmnijkd.exe
        79⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4368
        
        C:\Windows\SysWOW64\Gmhogppb.exe
        
        C:\Windows\system32\Gmhogppb.exe
        81⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Gfbpfedp.exe
        
        C:\Windows\system32\Gfbpfedp.exe
        82⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        83⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Hiefmp32.exe
        
        C:\Windows\system32\Hiefmp32.exe
        84⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Hkfookmo.exe
        
        C:\Windows\system32\Hkfookmo.exe
        85⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Hillnoif.exe
        
        C:\Windows\system32\Hillnoif.exe
        86⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Ipiaphop.exe
        
        C:\Windows\system32\Ipiaphop.exe
        87⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Ifefbbdj.exe
        
        C:\Windows\system32\Ifefbbdj.exe
        88⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        89⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Imakdl32.exe
        
        C:\Windows\system32\Imakdl32.exe
        90⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Ibncmchl.exe
        
        C:\Windows\system32\Ibncmchl.exe
        91⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Jpbdfgge.exe
        
        C:\Windows\system32\Jpbdfgge.exe
        92⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Jijhom32.exe
        
        C:\Windows\system32\Jijhom32.exe
        93⤵
        
        PID:268
        
        C:\Windows\SysWOW64\Jfoihalp.exe
        
        C:\Windows\system32\Jfoihalp.exe
        94⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Jlkaahjg.exe
        
        C:\Windows\system32\Jlkaahjg.exe
        95⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Jecejm32.exe
        
        C:\Windows\system32\Jecejm32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\Jlnnfghd.exe
        
        C:\Windows\system32\Jlnnfghd.exe
        97⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Jefbomoe.exe
        
        C:\Windows\system32\Jefbomoe.exe
        98⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Jpkfmfok.exe
        
        C:\Windows\system32\Jpkfmfok.exe
        99⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Kdiobd32.exe
        
        C:\Windows\system32\Kdiobd32.exe
        101⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Kifhkkci.exe
        
        C:\Windows\system32\Kifhkkci.exe
        102⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Kdllhdco.exe
        
        C:\Windows\system32\Kdllhdco.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4912
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        104⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Kbaiip32.exe
        
        C:\Windows\system32\Kbaiip32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Windows\SysWOW64\Kmfmfigl.exe
        
        C:\Windows\system32\Kmfmfigl.exe
        106⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Kfoapo32.exe
        
        C:\Windows\system32\Kfoapo32.exe
        107⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Klljhe32.exe
        
        C:\Windows\system32\Klljhe32.exe
        108⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Lbhojo32.exe
        
        C:\Windows\system32\Lbhojo32.exe
        109⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Llpcceho.exe
        
        C:\Windows\system32\Llpcceho.exe
        110⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Liddligi.exe
        
        C:\Windows\system32\Liddligi.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\Mikjmhaq.exe
        
        C:\Windows\system32\Mikjmhaq.exe
        112⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Mebkbi32.exe
        
        C:\Windows\system32\Mebkbi32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
        
        C:\Windows\SysWOW64\Mdckpqod.exe
        
        C:\Windows\system32\Mdckpqod.exe
        114⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Mipchg32.exe
        
        C:\Windows\system32\Mipchg32.exe
        115⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Megdmhbp.exe
        
        C:\Windows\system32\Megdmhbp.exe
        116⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Mplhjabe.exe
        
        C:\Windows\system32\Mplhjabe.exe
        117⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Meiabh32.exe
        
        C:\Windows\system32\Meiabh32.exe
        118⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Mcmall32.exe
        
        C:\Windows\system32\Mcmall32.exe
        119⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Nlefebfg.exe
        
        C:\Windows\system32\Nlefebfg.exe
        120⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        121⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Nepgcgje.exe
        
        C:\Windows\system32\Nepgcgje.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Windows\SysWOW64\Ndagao32.exe
        
        C:\Windows\system32\Ndagao32.exe
        123⤵
        Drops file in System32 directory
        
        PID:4948
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        124⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Nfeqnf32.exe
        
        C:\Windows\system32\Nfeqnf32.exe
        125⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Ofgmdf32.exe
        
        C:\Windows\system32\Ofgmdf32.exe
        126⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Oggjni32.exe
        
        C:\Windows\system32\Oggjni32.exe
        127⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        128⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Oflfoepg.exe
        
        C:\Windows\system32\Oflfoepg.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4716
        
        C:\Windows\SysWOW64\Odmgmmhf.exe
        
        C:\Windows\system32\Odmgmmhf.exe
        130⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        131⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        132⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Odaphl32.exe
        
        C:\Windows\system32\Odaphl32.exe
        133⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        134⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Pnlafaio.exe
        
        C:\Windows\system32\Pnlafaio.exe
        135⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        136⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        138⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Pcncjh32.exe
        
        C:\Windows\system32\Pcncjh32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4768
        
        C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        140⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Qjjhla32.exe
        
        C:\Windows\system32\Qjjhla32.exe
        141⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Qjmeaafi.exe
        
        C:\Windows\system32\Qjmeaafi.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3388
        
        C:\Windows\SysWOW64\Adbiojfo.exe
        
        C:\Windows\system32\Adbiojfo.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
        
        C:\Windows\SysWOW64\Aqijdk32.exe
        
        C:\Windows\system32\Aqijdk32.exe
        144⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ampkil32.exe
        
        C:\Windows\system32\Ampkil32.exe
        145⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ajckbp32.exe
        
        C:\Windows\system32\Ajckbp32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Windows\SysWOW64\Aclpkffa.exe
        
        C:\Windows\system32\Aclpkffa.exe
        147⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Amdddkma.exe
        
        C:\Windows\system32\Amdddkma.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Afmhma32.exe
        
        C:\Windows\system32\Afmhma32.exe
        149⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Benijhla.exe
        
        C:\Windows\system32\Benijhla.exe
        150⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Bminokil.exe
        
        C:\Windows\system32\Bminokil.exe
        151⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Bjmnho32.exe
        
        C:\Windows\system32\Bjmnho32.exe
        152⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Bjokno32.exe
        
        C:\Windows\system32\Bjokno32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        154⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Bcjlld32.exe
        
        C:\Windows\system32\Bcjlld32.exe
        155⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Bnppim32.exe
        
        C:\Windows\system32\Bnppim32.exe
        156⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        157⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Celelf32.exe
        
        C:\Windows\system32\Celelf32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6728
        
        C:\Windows\SysWOW64\Cjindm32.exe
        
        C:\Windows\system32\Cjindm32.exe
        159⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Cnffjl32.exe
        
        C:\Windows\system32\Cnffjl32.exe
        160⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Cnicpk32.exe
        
        C:\Windows\system32\Cnicpk32.exe
        161⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Cfdhdn32.exe
        
        C:\Windows\system32\Cfdhdn32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6936
        
        C:\Windows\SysWOW64\Dmnpah32.exe
        
        C:\Windows\system32\Dmnpah32.exe
        163⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        164⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Dalhgfmk.exe
        
        C:\Windows\system32\Dalhgfmk.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Dopiqj32.exe
        
        C:\Windows\system32\Dopiqj32.exe
        166⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ddmaia32.exe
        
        C:\Windows\system32\Ddmaia32.exe
        167⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Ddonnq32.exe
        
        C:\Windows\system32\Ddonnq32.exe
        168⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Dacohegc.exe
        
        C:\Windows\system32\Dacohegc.exe
        169⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Emjomf32.exe
        
        C:\Windows\system32\Emjomf32.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Windows\SysWOW64\Eddhipdd.exe
        
        C:\Windows\system32\Eddhipdd.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\Eecdcckf.exe
        
        C:\Windows\system32\Eecdcckf.exe
        172⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Eolhlh32.exe
        
        C:\Windows\system32\Eolhlh32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Ehdmenhh.exe
        
        C:\Windows\system32\Ehdmenhh.exe
        174⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Edknjonl.exe
        
        C:\Windows\system32\Edknjonl.exe
        175⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Eaonccme.exe
        
        C:\Windows\system32\Eaonccme.exe
        176⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Fkgbli32.exe
        
        C:\Windows\system32\Fkgbli32.exe
        177⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Fhkcfmbp.exe
        
        C:\Windows\system32\Fhkcfmbp.exe
        178⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Fachob32.exe
        
        C:\Windows\system32\Fachob32.exe
        179⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Fgppgi32.exe
        
        C:\Windows\system32\Fgppgi32.exe
        180⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Feapdaof.exe
        
        C:\Windows\system32\Feapdaof.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Fknimh32.exe
        
        C:\Windows\system32\Fknimh32.exe
        182⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Windows\SysWOW64\Fecmjq32.exe
        
        C:\Windows\system32\Fecmjq32.exe
        183⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Folacfcd.exe
        
        C:\Windows\system32\Folacfcd.exe
        184⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Fggfghap.exe
        
        C:\Windows\system32\Fggfghap.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Gdkgam32.exe
        
        C:\Windows\system32\Gdkgam32.exe
        186⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Gnckjbfj.exe
        
        C:\Windows\system32\Gnckjbfj.exe
        187⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Gglpbh32.exe
        
        C:\Windows\system32\Gglpbh32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Gaadpqmp.exe
        
        C:\Windows\system32\Gaadpqmp.exe
        189⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Goediekj.exe
        
        C:\Windows\system32\Goediekj.exe
        190⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ghnibj32.exe
        
        C:\Windows\system32\Ghnibj32.exe
        191⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Gafmkp32.exe
        
        C:\Windows\system32\Gafmkp32.exe
        192⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Hgcfcg32.exe
        
        C:\Windows\system32\Hgcfcg32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Hhbbmjne.exe
        
        C:\Windows\system32\Hhbbmjne.exe
        194⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Hnokeqll.exe
        
        C:\Windows\system32\Hnokeqll.exe
        195⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Hheoci32.exe
        
        C:\Windows\system32\Hheoci32.exe
        196⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Hnagkp32.exe
        
        C:\Windows\system32\Hnagkp32.exe
        197⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Hdlphjaf.exe
        
        C:\Windows\system32\Hdlphjaf.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Hnddqp32.exe
        
        C:\Windows\system32\Hnddqp32.exe
        199⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Hhihnihm.exe
        
        C:\Windows\system32\Hhihnihm.exe
        200⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Hbbmgn32.exe
        
        C:\Windows\system32\Hbbmgn32.exe
        201⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ihlechfj.exe
        
        C:\Windows\system32\Ihlechfj.exe
        202⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Ininloda.exe
        
        C:\Windows\system32\Ininloda.exe
        203⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Ihnbih32.exe
        
        C:\Windows\system32\Ihnbih32.exe
        204⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        205⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Inmggo32.exe
        
        C:\Windows\system32\Inmggo32.exe
        206⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Iickdgpb.exe
        
        C:\Windows\system32\Iickdgpb.exe
        207⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ibkpmm32.exe
        
        C:\Windows\system32\Ibkpmm32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\Ighhed32.exe
        
        C:\Windows\system32\Ighhed32.exe
        209⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ifihckmi.exe
        
        C:\Windows\system32\Ifihckmi.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Joamlacj.exe
        
        C:\Windows\system32\Joamlacj.exe
        211⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Jijaef32.exe
        
        C:\Windows\system32\Jijaef32.exe
        212⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Jngjmm32.exe
        
        C:\Windows\system32\Jngjmm32.exe
        213⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Jilnjf32.exe
        
        C:\Windows\system32\Jilnjf32.exe
        214⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Jfpocjfa.exe
        
        C:\Windows\system32\Jfpocjfa.exe
        215⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Jnkchmdl.exe
        
        C:\Windows\system32\Jnkchmdl.exe
        216⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Jgdhab32.exe
        
        C:\Windows\system32\Jgdhab32.exe
        217⤵
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Kfehoj32.exe
        
        C:\Windows\system32\Kfehoj32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
        
        C:\Windows\SysWOW64\Kpmlhoil.exe
        
        C:\Windows\system32\Kpmlhoil.exe
        219⤵
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Kejepfgd.exe
        
        C:\Windows\system32\Kejepfgd.exe
        220⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Knbiil32.exe
        
        C:\Windows\system32\Knbiil32.exe
        221⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Kihnfdmj.exe
        
        C:\Windows\system32\Kihnfdmj.exe
        222⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Khmjga32.exe
        
        C:\Windows\system32\Khmjga32.exe
        223⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Kbbodj32.exe
        
        C:\Windows\system32\Kbbodj32.exe
        224⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Klkcmo32.exe
        
        C:\Windows\system32\Klkcmo32.exe
        225⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Lechfeoi.exe
        
        C:\Windows\system32\Lechfeoi.exe
        226⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Lnlloj32.exe
        
        C:\Windows\system32\Lnlloj32.exe
        227⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Liaqlcep.exe
        
        C:\Windows\system32\Liaqlcep.exe
        228⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7200
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        230⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Lblakh32.exe
        
        C:\Windows\system32\Lblakh32.exe
        231⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Lhijcohe.exe
        
        C:\Windows\system32\Lhijcohe.exe
        232⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Lfjjqg32.exe
        
        C:\Windows\system32\Lfjjqg32.exe
        233⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        234⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Meogbcel.exe
        
        C:\Windows\system32\Meogbcel.exe
        235⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Moglkikl.exe
        
        C:\Windows\system32\Moglkikl.exe
        236⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Mimphakb.exe
        
        C:\Windows\system32\Mimphakb.exe
        237⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Mfaqafjl.exe
        
        C:\Windows\system32\Mfaqafjl.exe
        238⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Mlnijmhc.exe
        
        C:\Windows\system32\Mlnijmhc.exe
        239⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Mhdjonng.exe
        
        C:\Windows\system32\Mhdjonng.exe
        240⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Mehjhbma.exe
        
        C:\Windows\system32\Mehjhbma.exe
        241⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Nfhfbedd.exe
        
        C:\Windows\system32\Nfhfbedd.exe
        242⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Nleojlbk.exe
        
        C:\Windows\system32\Nleojlbk.exe
        243⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ngjcgdba.exe
        
        C:\Windows\system32\Ngjcgdba.exe
        244⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Nlglpkpi.exe
        
        C:\Windows\system32\Nlglpkpi.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
        
        C:\Windows\SysWOW64\Neppiagi.exe
        
        C:\Windows\system32\Neppiagi.exe
        246⤵
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Npedfjfo.exe
        
        C:\Windows\system32\Npedfjfo.exe
        247⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Nimioo32.exe
        
        C:\Windows\system32\Nimioo32.exe
        248⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Nojagf32.exe
        
        C:\Windows\system32\Nojagf32.exe
        249⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Nhbfpl32.exe
        
        C:\Windows\system32\Nhbfpl32.exe
        250⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Ochjmd32.exe
        
        C:\Windows\system32\Ochjmd32.exe
        251⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ogfccchd.exe
        
        C:\Windows\system32\Ogfccchd.exe
        252⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ohgokknb.exe
        
        C:\Windows\system32\Ohgokknb.exe
        253⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Oiglen32.exe
        
        C:\Windows\system32\Oiglen32.exe
        254⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        255⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Oiihkncb.exe
        
        C:\Windows\system32\Oiihkncb.exe
        256⤵
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Oofacdaj.exe
        
        C:\Windows\system32\Oofacdaj.exe
        257⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ohnelj32.exe
        
        C:\Windows\system32\Ohnelj32.exe
        258⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Pgoejapi.exe
        
        C:\Windows\system32\Pgoejapi.exe
        259⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Pllnbh32.exe
        
        C:\Windows\system32\Pllnbh32.exe
        260⤵
        Modifies registry class
        
        PID:1372
        
        C:\Windows\SysWOW64\Pgaboa32.exe
        
        C:\Windows\system32\Pgaboa32.exe
        261⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Pgdodq32.exe
        
        C:\Windows\system32\Pgdodq32.exe
        262⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Pgfljqia.exe
        
        C:\Windows\system32\Pgfljqia.exe
        264⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        265⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Qhjegh32.exe
        
        C:\Windows\system32\Qhjegh32.exe
        266⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Qfneamlf.exe
        
        C:\Windows\system32\Qfneamlf.exe
        267⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Qqcjnell.exe
        
        C:\Windows\system32\Qqcjnell.exe
        268⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        269⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Aoifoa32.exe
        
        C:\Windows\system32\Aoifoa32.exe
        270⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Afboll32.exe
        
        C:\Windows\system32\Afboll32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Acfoep32.exe
        
        C:\Windows\system32\Acfoep32.exe
        272⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Amodnenk.exe
        
        C:\Windows\system32\Amodnenk.exe
        273⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8640
        
        C:\Windows\SysWOW64\Aopmpq32.exe
        
        C:\Windows\system32\Aopmpq32.exe
        275⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Aihaifam.exe
        
        C:\Windows\system32\Aihaifam.exe
        276⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Bijnnf32.exe
        
        C:\Windows\system32\Bijnnf32.exe
        277⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Bgknlmgi.exe
        
        C:\Windows\system32\Bgknlmgi.exe
        278⤵
        Modifies registry class
        
        PID:8768
        
        C:\Windows\SysWOW64\Bogcqpdd.exe
        
        C:\Windows\system32\Bogcqpdd.exe
        279⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Biogieke.exe
        
        C:\Windows\system32\Biogieke.exe
        280⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bjodch32.exe
        
        C:\Windows\system32\Bjodch32.exe
        281⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Bpniaool.exe
        
        C:\Windows\system32\Bpniaool.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8896
        
        C:\Windows\SysWOW64\Cifmjd32.exe
        
        C:\Windows\system32\Cifmjd32.exe
        283⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Cggnhlml.exe
        
        C:\Windows\system32\Cggnhlml.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:8960
        
        C:\Windows\SysWOW64\Cpbbln32.exe
        
        C:\Windows\system32\Cpbbln32.exe
        285⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Cikgecag.exe
        
        C:\Windows\system32\Cikgecag.exe
        286⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Ccpkblqn.exe
        
        C:\Windows\system32\Ccpkblqn.exe
        287⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Cadllq32.exe
        
        C:\Windows\system32\Cadllq32.exe
        288⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Cjmpeffh.exe
        
        C:\Windows\system32\Cjmpeffh.exe
        289⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Djomjfde.exe
        
        C:\Windows\system32\Djomjfde.exe
        290⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Dgcmdj32.exe
        
        C:\Windows\system32\Dgcmdj32.exe
        291⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Dmpfla32.exe
        
        C:\Windows\system32\Dmpfla32.exe
        292⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Djcfee32.exe
        
        C:\Windows\system32\Djcfee32.exe
        293⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Dclknkfp.exe
        
        C:\Windows\system32\Dclknkfp.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8352
        
        C:\Windows\SysWOW64\Diicfa32.exe
        
        C:\Windows\system32\Diicfa32.exe
        295⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Dhjcdimf.exe
        
        C:\Windows\system32\Dhjcdimf.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Edqdij32.exe
        
        C:\Windows\system32\Edqdij32.exe
        297⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Einmaaqb.exe
        
        C:\Windows\system32\Einmaaqb.exe
        298⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Efamkepl.exe
        
        C:\Windows\system32\Efamkepl.exe
        299⤵
        Drops file in System32 directory
        
        PID:8660
        
        C:\Windows\SysWOW64\Emkeho32.exe
        
        C:\Windows\system32\Emkeho32.exe
        300⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ejofacfb.exe
        
        C:\Windows\system32\Ejofacfb.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Eplnijdj.exe
        
        C:\Windows\system32\Eplnijdj.exe
        302⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Eidbbp32.exe
        
        C:\Windows\system32\Eidbbp32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Eangimij.exe
        
        C:\Windows\system32\Eangimij.exe
        304⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Fapdomgg.exe
        
        C:\Windows\system32\Fapdomgg.exe
        305⤵
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Fkihgb32.exe
        
        C:\Windows\system32\Fkihgb32.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
        
        C:\Windows\SysWOW64\Fhmiqfma.exe
        
        C:\Windows\system32\Fhmiqfma.exe
        307⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Fmiaimki.exe
        
        C:\Windows\system32\Fmiaimki.exe
        308⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Fgbfbc32.exe
        
        C:\Windows\system32\Fgbfbc32.exe
        309⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Fagjolao.exe
        
        C:\Windows\system32\Fagjolao.exe
        310⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Fkpoha32.exe
        
        C:\Windows\system32\Fkpoha32.exe
        311⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ghdoae32.exe
        
        C:\Windows\system32\Ghdoae32.exe
        312⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\Gmqgjl32.exe
        
        C:\Windows\system32\Gmqgjl32.exe
        313⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Gighom32.exe
        
        C:\Windows\system32\Gighom32.exe
        314⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Ghhhmebd.exe
        
        C:\Windows\system32\Ghhhmebd.exe
        315⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Gneaelqk.exe
        
        C:\Windows\system32\Gneaelqk.exe
        316⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        317⤵
        Drops file in System32 directory
        
        PID:8712
        
        C:\Windows\SysWOW64\Gdafgefe.exe
        
        C:\Windows\system32\Gdafgefe.exe
        318⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Hphglf32.exe
        
        C:\Windows\system32\Hphglf32.exe
        319⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Hjqkel32.exe
        
        C:\Windows\system32\Hjqkel32.exe
        320⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Hgdlnp32.exe
        
        C:\Windows\system32\Hgdlnp32.exe
        321⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Hpmpgfhd.exe
        
        C:\Windows\system32\Hpmpgfhd.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Windows\SysWOW64\Hkbddo32.exe
        
        C:\Windows\system32\Hkbddo32.exe
        323⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Hpomme32.exe
        
        C:\Windows\system32\Hpomme32.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:8968
        
        C:\Windows\SysWOW64\Hkeajn32.exe
        
        C:\Windows\system32\Hkeajn32.exe
        325⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Hpaibe32.exe
        
        C:\Windows\system32\Hpaibe32.exe
        326⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Hjjnkkjp.exe
        
        C:\Windows\system32\Hjjnkkjp.exe
        327⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Idpbhc32.exe
        
        C:\Windows\system32\Idpbhc32.exe
        328⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ijlkqj32.exe
        
        C:\Windows\system32\Ijlkqj32.exe
        329⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Idbonc32.exe
        
        C:\Windows\system32\Idbonc32.exe
        330⤵
        System Location Discovery: System Language Discovery
        
        PID:9384
        
        C:\Windows\SysWOW64\Iklgkmop.exe
        
        C:\Windows\system32\Iklgkmop.exe
        331⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Iqipcd32.exe
        
        C:\Windows\system32\Iqipcd32.exe
        332⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        333⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Igedenca.exe
        
        C:\Windows\system32\Igedenca.exe
        334⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        335⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Ihdaoajd.exe
        
        C:\Windows\system32\Ihdaoajd.exe
        336⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Jnaighhk.exe
        
        C:\Windows\system32\Jnaighhk.exe
        337⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Jdkadb32.exe
        
        C:\Windows\system32\Jdkadb32.exe
        338⤵
        System Location Discovery: System Language Discovery
        
        PID:9668
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        340⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Jhijjp32.exe
        
        C:\Windows\system32\Jhijjp32.exe
        341⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Jnfcbg32.exe
        
        C:\Windows\system32\Jnfcbg32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Jgngkmkf.exe
        
        C:\Windows\system32\Jgngkmkf.exe
        343⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Jgqdal32.exe
        
        C:\Windows\system32\Jgqdal32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9988
        
        C:\Windows\SysWOW64\Jqihjbod.exe
        
        C:\Windows\system32\Jqihjbod.exe
        345⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Kkomgkoj.exe
        
        C:\Windows\system32\Kkomgkoj.exe
        346⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Kibmqond.exe
        
        C:\Windows\system32\Kibmqond.exe
        347⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Kbkaiddd.exe
        
        C:\Windows\system32\Kbkaiddd.exe
        348⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Kkcfbj32.exe
        
        C:\Windows\system32\Kkcfbj32.exe
        349⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Kbmoodbb.exe
        
        C:\Windows\system32\Kbmoodbb.exe
        350⤵
        Modifies registry class
        
        PID:10212
        
        C:\Windows\SysWOW64\Kkechjib.exe
        
        C:\Windows\system32\Kkechjib.exe
        351⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Kabkpqgj.exe
        
        C:\Windows\system32\Kabkpqgj.exe
        352⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Kglcmk32.exe
        
        C:\Windows\system32\Kglcmk32.exe
        353⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Kbbhjc32.exe
        
        C:\Windows\system32\Kbbhjc32.exe
        354⤵
        Modifies registry class
        
        PID:9376
        
        C:\Windows\SysWOW64\Kgopbj32.exe
        
        C:\Windows\system32\Kgopbj32.exe
        355⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Lagekp32.exe
        
        C:\Windows\system32\Lagekp32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9464
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        357⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Laiaqp32.exe
        
        C:\Windows\system32\Laiaqp32.exe
        358⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ljbfiegb.exe
        
        C:\Windows\system32\Ljbfiegb.exe
        359⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Lbkkpb32.exe
        
        C:\Windows\system32\Lbkkpb32.exe
        360⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Llcoihmb.exe
        
        C:\Windows\system32\Llcoihmb.exe
        361⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Laqhao32.exe
        
        C:\Windows\system32\Laqhao32.exe
        362⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Mlflog32.exe
        
        C:\Windows\system32\Mlflog32.exe
        363⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Macdgn32.exe
        
        C:\Windows\system32\Macdgn32.exe
        364⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Mjkipdpg.exe
        
        C:\Windows\system32\Mjkipdpg.exe
        365⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Milinkgf.exe
        
        C:\Windows\system32\Milinkgf.exe
        366⤵
        Drops file in System32 directory
        
        PID:10016
        
        C:\Windows\SysWOW64\Mbenfq32.exe
        
        C:\Windows\system32\Mbenfq32.exe
        367⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Miofcked.exe
        
        C:\Windows\system32\Miofcked.exe
        368⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Mjpbkc32.exe
        
        C:\Windows\system32\Mjpbkc32.exe
        369⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Miabik32.exe
        
        C:\Windows\system32\Miabik32.exe
        370⤵
        System Location Discovery: System Language Discovery
        
        PID:10208
        
        C:\Windows\SysWOW64\Mnnkaa32.exe
        
        C:\Windows\system32\Mnnkaa32.exe
        371⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Nhfpjghi.exe
        
        C:\Windows\system32\Nhfpjghi.exe
        372⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Nblcgpho.exe
        
        C:\Windows\system32\Nblcgpho.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Nldhpeop.exe
        
        C:\Windows\system32\Nldhpeop.exe
        374⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Nelmik32.exe
        
        C:\Windows\system32\Nelmik32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9692
        
        C:\Windows\SysWOW64\Nkieab32.exe
        
        C:\Windows\system32\Nkieab32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9712
        
        C:\Windows\SysWOW64\Nijeoikf.exe
        
        C:\Windows\system32\Nijeoikf.exe
        377⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        378⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Neafdjak.exe
        
        C:\Windows\system32\Neafdjak.exe
        379⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Noijmp32.exe
        
        C:\Windows\system32\Noijmp32.exe
        380⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Olnkfd32.exe
        
        C:\Windows\system32\Olnkfd32.exe
        381⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Oajcnkdl.exe
        
        C:\Windows\system32\Oajcnkdl.exe
        382⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Olphlcdb.exe
        
        C:\Windows\system32\Olphlcdb.exe
        383⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Objphn32.exe
        
        C:\Windows\system32\Objphn32.exe
        384⤵
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\Olbdacbp.exe
        
        C:\Windows\system32\Olbdacbp.exe
        385⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Oejijiip.exe
        
        C:\Windows\system32\Oejijiip.exe
        386⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Okgabpgg.exe
        
        C:\Windows\system32\Okgabpgg.exe
        387⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9620
        
        C:\Windows\SysWOW64\Ohkbldfa.exe
        
        C:\Windows\system32\Ohkbldfa.exe
        389⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Obafim32.exe
        
        C:\Windows\system32\Obafim32.exe
        390⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Peaokh32.exe
        
        C:\Windows\system32\Peaokh32.exe
        391⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Pojccmii.exe
        
        C:\Windows\system32\Pojccmii.exe
        392⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Pedlpgqe.exe
        
        C:\Windows\system32\Pedlpgqe.exe
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
        
        C:\Windows\SysWOW64\Pkqdhnom.exe
        
        C:\Windows\system32\Pkqdhnom.exe
        394⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Phddbbnf.exe
        
        C:\Windows\system32\Phddbbnf.exe
        395⤵
        
        PID:800
        
        C:\Windows\SysWOW64\Pcjioknl.exe
        
        C:\Windows\system32\Pcjioknl.exe
        396⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Plbmhadm.exe
        
        C:\Windows\system32\Plbmhadm.exe
        397⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Pcmeek32.exe
        
        C:\Windows\system32\Pcmeek32.exe
        398⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        399⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Qocfjlan.exe
        
        C:\Windows\system32\Qocfjlan.exe
        400⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Qjijgead.exe
        
        C:\Windows\system32\Qjijgead.exe
        401⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Qkjgomgb.exe
        
        C:\Windows\system32\Qkjgomgb.exe
        402⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Aepklffh.exe
        
        C:\Windows\system32\Aepklffh.exe
        403⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        404⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Aaflag32.exe
        
        C:\Windows\system32\Aaflag32.exe
        405⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Ahpdnaci.exe
        
        C:\Windows\system32\Ahpdnaci.exe
        406⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Aaiiffjj.exe
        
        C:\Windows\system32\Aaiiffjj.exe
        407⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Aomipkic.exe
        
        C:\Windows\system32\Aomipkic.exe
        408⤵
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Afgame32.exe
        
        C:\Windows\system32\Afgame32.exe
        409⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Aoofej32.exe
        
        C:\Windows\system32\Aoofej32.exe
        410⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Afinbdon.exe
        
        C:\Windows\system32\Afinbdon.exe
        411⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\Alcfoo32.exe
        
        C:\Windows\system32\Alcfoo32.exe
        412⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Boabkj32.exe
        
        C:\Windows\system32\Boabkj32.exe
        413⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Bfkkhdlk.exe
        
        C:\Windows\system32\Bfkkhdlk.exe
        414⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Bocoqj32.exe
        
        C:\Windows\system32\Bocoqj32.exe
        415⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Bjicnbba.exe
        
        C:\Windows\system32\Bjicnbba.exe
        416⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Bkjpek32.exe
        
        C:\Windows\system32\Bkjpek32.exe
        417⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Bfpdcc32.exe
        
        C:\Windows\system32\Bfpdcc32.exe
        418⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        419⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Bjnmib32.exe
        
        C:\Windows\system32\Bjnmib32.exe
        420⤵
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Bkoiqjdj.exe
        
        C:\Windows\system32\Bkoiqjdj.exe
        421⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\Bicjjncd.exe
        
        C:\Windows\system32\Bicjjncd.exe
        422⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Combgh32.exe
        
        C:\Windows\system32\Combgh32.exe
        423⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Cmabpmjj.exe
        
        C:\Windows\system32\Cmabpmjj.exe
        424⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Cfigib32.exe
        
        C:\Windows\system32\Cfigib32.exe
        425⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
        
        C:\Windows\SysWOW64\Ccmgbf32.exe
        
        C:\Windows\system32\Ccmgbf32.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10364
        
        C:\Windows\SysWOW64\Ckhlgilp.exe
        
        C:\Windows\system32\Ckhlgilp.exe
        427⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        428⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Cmhial32.exe
        
        C:\Windows\system32\Cmhial32.exe
        429⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Cbeaib32.exe
        
        C:\Windows\system32\Cbeaib32.exe
        430⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Cioifm32.exe
        
        C:\Windows\system32\Cioifm32.exe
        431⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Dcdnce32.exe
        
        C:\Windows\system32\Dcdnce32.exe
        432⤵
        Modifies registry class
        
        PID:10580
        
        C:\Windows\SysWOW64\Dmmblkpm.exe
        
        C:\Windows\system32\Dmmblkpm.exe
        433⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Dcgjie32.exe
        
        C:\Windows\system32\Dcgjie32.exe
        434⤵
        Drops file in System32 directory
        
        PID:10660
        
        C:\Windows\SysWOW64\Dkbomgde.exe
        
        C:\Windows\system32\Dkbomgde.exe
        435⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Difpflco.exe
        
        C:\Windows\system32\Difpflco.exe
        436⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Dckdddcd.exe
        
        C:\Windows\system32\Dckdddcd.exe
        437⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        438⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Dpbdiehi.exe
        
        C:\Windows\system32\Dpbdiehi.exe
        439⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Dflmep32.exe
        
        C:\Windows\system32\Dflmep32.exe
        440⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Emfebjgb.exe
        
        C:\Windows\system32\Emfebjgb.exe
        441⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Emhahiep.exe
        
        C:\Windows\system32\Emhahiep.exe
        442⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        443⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Emknmi32.exe
        
        C:\Windows\system32\Emknmi32.exe
        444⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Ebggep32.exe
        
        C:\Windows\system32\Ebggep32.exe
        445⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Emmkci32.exe
        
        C:\Windows\system32\Emmkci32.exe
        446⤵
        Modifies registry class
        
        PID:11240
        
        C:\Windows\SysWOW64\Ebjckppa.exe
        
        C:\Windows\system32\Ebjckppa.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Emphhhoh.exe
        
        C:\Windows\system32\Emphhhoh.exe
        448⤵
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        449⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Fifhmi32.exe
        
        C:\Windows\system32\Fifhmi32.exe
        450⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        451⤵
        Modifies registry class
        
        PID:252
        
        C:\Windows\SysWOW64\Fjfegl32.exe
        
        C:\Windows\system32\Fjfegl32.exe
        452⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Fpbmpc32.exe
        
        C:\Windows\system32\Fpbmpc32.exe
        453⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Ffmelmbc.exe
        
        C:\Windows\system32\Ffmelmbc.exe
        454⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Flinddpj.exe
        
        C:\Windows\system32\Flinddpj.exe
        455⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Ffobbmpp.exe
        
        C:\Windows\system32\Ffobbmpp.exe
        456⤵
        Modifies registry class
        
        PID:10588
        
        C:\Windows\SysWOW64\Fmikoggm.exe
        
        C:\Windows\system32\Fmikoggm.exe
        457⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Fdccka32.exe
        
        C:\Windows\system32\Fdccka32.exe
        458⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Fipkch32.exe
        
        C:\Windows\system32\Fipkch32.exe
        459⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Fdepaa32.exe
        
        C:\Windows\system32\Fdepaa32.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10940
        
        C:\Windows\SysWOW64\Gbjlbm32.exe
        
        C:\Windows\system32\Gbjlbm32.exe
        461⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Gmpqof32.exe
        
        C:\Windows\system32\Gmpqof32.exe
        462⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Gbmigm32.exe
        
        C:\Windows\system32\Gbmigm32.exe
        463⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Gifadggi.exe
        
        C:\Windows\system32\Gifadggi.exe
        464⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Gpqjaanf.exe
        
        C:\Windows\system32\Gpqjaanf.exe
        465⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Giinjg32.exe
        
        C:\Windows\system32\Giinjg32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11180
        
        C:\Windows\SysWOW64\Gpcffalc.exe
        
        C:\Windows\system32\Gpcffalc.exe
        467⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Gkhkdjli.exe
        
        C:\Windows\system32\Gkhkdjli.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Gdaomobj.exe
        
        C:\Windows\system32\Gdaomobj.exe
        469⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Hkkgii32.exe
        
        C:\Windows\system32\Hkkgii32.exe
        470⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10300
        
        C:\Windows\SysWOW64\Hlldaape.exe
        
        C:\Windows\system32\Hlldaape.exe
        471⤵
        Drops file in System32 directory
        
        PID:10356
        
        C:\Windows\SysWOW64\Hbflnl32.exe
        
        C:\Windows\system32\Hbflnl32.exe
        472⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Hmlpkd32.exe
        
        C:\Windows\system32\Hmlpkd32.exe
        473⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Hgdedj32.exe
        
        C:\Windows\system32\Hgdedj32.exe
        474⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Hmnmqdee.exe
        
        C:\Windows\system32\Hmnmqdee.exe
        475⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Hgfaij32.exe
        
        C:\Windows\system32\Hgfaij32.exe
        476⤵
        
        PID:604
        
        C:\Windows\SysWOW64\Hmpjfdcb.exe
        
        C:\Windows\system32\Hmpjfdcb.exe
        477⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        478⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        479⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Ikfgeh32.exe
        
        C:\Windows\system32\Ikfgeh32.exe
        480⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ilhcmpeg.exe
        
        C:\Windows\system32\Ilhcmpeg.exe
        481⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Iljpbp32.exe
        
        C:\Windows\system32\Iljpbp32.exe
        483⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Igpdph32.exe
        
        C:\Windows\system32\Igpdph32.exe
        484⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Iphihnjk.exe
        
        C:\Windows\system32\Iphihnjk.exe
        485⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Icfediio.exe
        
        C:\Windows\system32\Icfediio.exe
        486⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Ijqmacpl.exe
        
        C:\Windows\system32\Ijqmacpl.exe
        487⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Idfaolpb.exe
        
        C:\Windows\system32\Idfaolpb.exe
        488⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ikpjkf32.exe
        
        C:\Windows\system32\Ikpjkf32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2492
        
        C:\Windows\SysWOW64\Ilafcomm.exe
        
        C:\Windows\system32\Ilafcomm.exe
        490⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Jcknpi32.exe
        
        C:\Windows\system32\Jcknpi32.exe
        491⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Jnqbmadp.exe
        
        C:\Windows\system32\Jnqbmadp.exe
        492⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Jgigfg32.exe
        
        C:\Windows\system32\Jgigfg32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10792
        
        C:\Windows\SysWOW64\Jncobabm.exe
        
        C:\Windows\system32\Jncobabm.exe
        494⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Jcphkhad.exe
        
        C:\Windows\system32\Jcphkhad.exe
        495⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Jnelha32.exe
        
        C:\Windows\system32\Jnelha32.exe
        496⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jcbdph32.exe
        
        C:\Windows\system32\Jcbdph32.exe
        497⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Jljiimeb.exe
        
        C:\Windows\system32\Jljiimeb.exe
        498⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Jcdafg32.exe
        
        C:\Windows\system32\Jcdafg32.exe
        499⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        500⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Kknfmdko.exe
        
        C:\Windows\system32\Kknfmdko.exe
        501⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Kdfjej32.exe
        
        C:\Windows\system32\Kdfjej32.exe
        502⤵
        Drops file in System32 directory
        
        PID:10796
        
        C:\Windows\SysWOW64\Kgefae32.exe
        
        C:\Windows\system32\Kgefae32.exe
        503⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Kmaojl32.exe
        
        C:\Windows\system32\Kmaojl32.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Kdigkjpl.exe
        
        C:\Windows\system32\Kdigkjpl.exe
        505⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Kkbohc32.exe
        
        C:\Windows\system32\Kkbohc32.exe
        506⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Kmdlolmg.exe
        
        C:\Windows\system32\Kmdlolmg.exe
        507⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Kcndlf32.exe
        
        C:\Windows\system32\Kcndlf32.exe
        508⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Knchio32.exe
        
        C:\Windows\system32\Knchio32.exe
        509⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Kdmqfi32.exe
        
        C:\Windows\system32\Kdmqfi32.exe
        510⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kkgicccd.exe
        
        C:\Windows\system32\Kkgicccd.exe
        511⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Ldpmlh32.exe
        
        C:\Windows\system32\Ldpmlh32.exe
        512⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Ljmfdp32.exe
        
        C:\Windows\system32\Ljmfdp32.exe
        513⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Lqfnqjpi.exe
        
        C:\Windows\system32\Lqfnqjpi.exe
        514⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Lklbnb32.exe
        
        C:\Windows\system32\Lklbnb32.exe
        515⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\Lmmoekem.exe
        
        C:\Windows\system32\Lmmoekem.exe
        516⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Windows\SysWOW64\Lgephccp.exe
        
        C:\Windows\system32\Lgephccp.exe
        517⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        518⤵
        System Location Discovery: System Language Discovery
        
        PID:11044
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        519⤵
        System Location Discovery: System Language Discovery
        
        PID:11164
        
        C:\Windows\SysWOW64\Mkeeda32.exe
        
        C:\Windows\system32\Mkeeda32.exe
        520⤵
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Mabnlh32.exe
        
        C:\Windows\system32\Mabnlh32.exe
        521⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Mglfibmh.exe
        
        C:\Windows\system32\Mglfibmh.exe
        522⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Mminaikp.exe
        
        C:\Windows\system32\Mminaikp.exe
        523⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Mccfnc32.exe
        
        C:\Windows\system32\Mccfnc32.exe
        524⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Mnhkklbb.exe
        
        C:\Windows\system32\Mnhkklbb.exe
        525⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Mceccbpj.exe
        
        C:\Windows\system32\Mceccbpj.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Windows\SysWOW64\Mnkgakpp.exe
        
        C:\Windows\system32\Mnkgakpp.exe
        527⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        528⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Nmpdbh32.exe
        
        C:\Windows\system32\Nmpdbh32.exe
        529⤵
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Ncjmob32.exe
        
        C:\Windows\system32\Ncjmob32.exe
        530⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        531⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Neiiiecg.exe
        
        C:\Windows\system32\Neiiiecg.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5036
        
        C:\Windows\SysWOW64\Njfaalao.exe
        
        C:\Windows\system32\Njfaalao.exe
        533⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Ncofjaho.exe
        
        C:\Windows\system32\Ncofjaho.exe
        534⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Windows\SysWOW64\Nndjgjhe.exe
        
        C:\Windows\system32\Nndjgjhe.exe
        535⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Nhmopp32.exe
        
        C:\Windows\system32\Nhmopp32.exe
        536⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Naecieef.exe
        
        C:\Windows\system32\Naecieef.exe
        537⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        538⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Oeclockl.exe
        
        C:\Windows\system32\Oeclockl.exe
        539⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Olmdln32.exe
        
        C:\Windows\system32\Olmdln32.exe
        540⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        541⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        542⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Ojbamj32.exe
        
        C:\Windows\system32\Ojbamj32.exe
        543⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Oegejc32.exe
        
        C:\Windows\system32\Oegejc32.exe
        544⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Olangmod.exe
        
        C:\Windows\system32\Olangmod.exe
        545⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        546⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Oldjlm32.exe
        
        C:\Windows\system32\Oldjlm32.exe
        547⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Omegdebp.exe
        
        C:\Windows\system32\Omegdebp.exe
        548⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ohkkanbe.exe
        
        C:\Windows\system32\Ohkkanbe.exe
        549⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Podcnh32.exe
        
        C:\Windows\system32\Podcnh32.exe
        550⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Plkpmlfi.exe
        
        C:\Windows\system32\Plkpmlfi.exe
        551⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        552⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        553⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Poliog32.exe
        
        C:\Windows\system32\Poliog32.exe
        554⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Pdhbgn32.exe
        
        C:\Windows\system32\Pdhbgn32.exe
        555⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Pkbjchio.exe
        
        C:\Windows\system32\Pkbjchio.exe
        556⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        557⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Phfjmlhh.exe
        
        C:\Windows\system32\Phfjmlhh.exe
        558⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Qopbjf32.exe
        
        C:\Windows\system32\Qopbjf32.exe
        559⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Qejkfp32.exe
        
        C:\Windows\system32\Qejkfp32.exe
        560⤵
        Modifies registry class
        
        PID:11836
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        561⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Qemhlp32.exe
        
        C:\Windows\system32\Qemhlp32.exe
        562⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        563⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        564⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11988
        
        C:\Windows\SysWOW64\Alimnj32.exe
        
        C:\Windows\system32\Alimnj32.exe
        565⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Anjifbpg.exe
        
        C:\Windows\system32\Anjifbpg.exe
        566⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Addabl32.exe
        
        C:\Windows\system32\Addabl32.exe
        567⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Akniofoa.exe
        
        C:\Windows\system32\Akniofoa.exe
        568⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Aahblp32.exe
        
        C:\Windows\system32\Aahblp32.exe
        569⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Alnfiifd.exe
        
        C:\Windows\system32\Alnfiifd.exe
        570⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Aajoapdk.exe
        
        C:\Windows\system32\Aajoapdk.exe
        571⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Ahdgnj32.exe
        
        C:\Windows\system32\Ahdgnj32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Aonokdce.exe
        
        C:\Windows\system32\Aonokdce.exe
        573⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Aehghn32.exe
        
        C:\Windows\system32\Aehghn32.exe
        574⤵
        Drops file in System32 directory
        
        PID:11472
        
        C:\Windows\SysWOW64\Baohmo32.exe
        
        C:\Windows\system32\Baohmo32.exe
        575⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Bdndik32.exe
        
        C:\Windows\system32\Bdndik32.exe
        576⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Bkgleegf.exe
        
        C:\Windows\system32\Bkgleegf.exe
        577⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        578⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Bkjikd32.exe
        
        C:\Windows\system32\Bkjikd32.exe
        579⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Badaholq.exe
        
        C:\Windows\system32\Badaholq.exe
        580⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Blieeglf.exe
        
        C:\Windows\system32\Blieeglf.exe
        581⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Bnkbmp32.exe
        
        C:\Windows\system32\Bnkbmp32.exe
        582⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Bhpfjh32.exe
        
        C:\Windows\system32\Bhpfjh32.exe
        583⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Bojogb32.exe
        
        C:\Windows\system32\Bojogb32.exe
        584⤵
        System Location Discovery: System Language Discovery
        
        PID:11916
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        585⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Ckaolcol.exe
        
        C:\Windows\system32\Ckaolcol.exe
        586⤵
        Drops file in System32 directory
        
        PID:12020
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        587⤵
        Modifies registry class
        
        PID:1272
        
        C:\Windows\SysWOW64\Ckclacmi.exe
        
        C:\Windows\system32\Ckclacmi.exe
        588⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Cbmdnmdf.exe
        
        C:\Windows\system32\Cbmdnmdf.exe
        589⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ckhelb32.exe
        
        C:\Windows\system32\Ckhelb32.exe
        590⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Cfmijkhj.exe
        
        C:\Windows\system32\Cfmijkhj.exe
        591⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        592⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Dfpfokfg.exe
        
        C:\Windows\system32\Dfpfokfg.exe
        593⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Dkmogbeo.exe
        
        C:\Windows\system32\Dkmogbeo.exe
        594⤵
        Drops file in System32 directory
        
        PID:11532
        
        C:\Windows\SysWOW64\Dfbcek32.exe
        
        C:\Windows\system32\Dfbcek32.exe
        595⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        596⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        597⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Diclff32.exe
        
        C:\Windows\system32\Diclff32.exe
        598⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Domdcpib.exe
        
        C:\Windows\system32\Domdcpib.exe
        599⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ddjmkg32.exe
        
        C:\Windows\system32\Ddjmkg32.exe
        600⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11900
        
        C:\Windows\SysWOW64\Dkcehaof.exe
        
        C:\Windows\system32\Dkcehaof.exe
        601⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\Dfiiejnl.exe
        
        C:\Windows\system32\Dfiiejnl.exe
        602⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Dkfanqmd.exe
        
        C:\Windows\system32\Dkfanqmd.exe
        603⤵
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Efkfkilj.exe
        
        C:\Windows\system32\Efkfkilj.exe
        604⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        605⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Engjol32.exe
        
        C:\Windows\system32\Engjol32.exe
        606⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12284
        
        C:\Windows\SysWOW64\Ekkkip32.exe
        
        C:\Windows\system32\Ekkkip32.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Eohcon32.exe
        
        C:\Windows\system32\Eohcon32.exe
        608⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Eeelge32.exe
        
        C:\Windows\system32\Eeelge32.exe
        609⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ekoddodi.exe
        
        C:\Windows\system32\Ekoddodi.exe
        610⤵
        System Location Discovery: System Language Discovery
        
        PID:11672
        
        C:\Windows\SysWOW64\Eehime32.exe
        
        C:\Windows\system32\Eehime32.exe
        611⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Ekaaio32.exe
        
        C:\Windows\system32\Ekaaio32.exe
        612⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Ffgegh32.exe
        
        C:\Windows\system32\Ffgegh32.exe
        613⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Fldnoo32.exe
        
        C:\Windows\system32\Fldnoo32.exe
        614⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Fbnflihq.exe
        
        C:\Windows\system32\Fbnflihq.exe
        615⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Fihnhc32.exe
        
        C:\Windows\system32\Fihnhc32.exe
        616⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Fpbfem32.exe
        
        C:\Windows\system32\Fpbfem32.exe
        617⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Fflobgng.exe
        
        C:\Windows\system32\Fflobgng.exe
        618⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Fligjnlo.exe
        
        C:\Windows\system32\Fligjnlo.exe
        619⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Fbbpgh32.exe
        
        C:\Windows\system32\Fbbpgh32.exe
        620⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Fmhcda32.exe
        
        C:\Windows\system32\Fmhcda32.exe
        621⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Fnipliip.exe
        
        C:\Windows\system32\Fnipliip.exe
        622⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Fechhcal.exe
        
        C:\Windows\system32\Fechhcal.exe
        623⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Gpimflqb.exe
        
        C:\Windows\system32\Gpimflqb.exe
        624⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Gefencoj.exe
        
        C:\Windows\system32\Gefencoj.exe
        625⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        626⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Gehbcb32.exe
        
        C:\Windows\system32\Gehbcb32.exe
        627⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Gejoib32.exe
        
        C:\Windows\system32\Gejoib32.exe
        628⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Gldgflba.exe
        
        C:\Windows\system32\Gldgflba.exe
        629⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Gbnobf32.exe
        
        C:\Windows\system32\Gbnobf32.exe
        630⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Gihgoq32.exe
        
        C:\Windows\system32\Gihgoq32.exe
        631⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gbqlhfgk.exe
        
        C:\Windows\system32\Gbqlhfgk.exe
        632⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Gikdep32.exe
        
        C:\Windows\system32\Gikdep32.exe
        633⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Hoglmg32.exe
        
        C:\Windows\system32\Hoglmg32.exe
        634⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\Headjael.exe
        
        C:\Windows\system32\Headjael.exe
        635⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Hlkmfkli.exe
        
        C:\Windows\system32\Hlkmfkli.exe
        636⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        637⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Windows\SysWOW64\Hiomppkc.exe
        
        C:\Windows\system32\Hiomppkc.exe
        638⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Hpiemj32.exe
        
        C:\Windows\system32\Hpiemj32.exe
        639⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Hefneq32.exe
        
        C:\Windows\system32\Hefneq32.exe
        640⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Hplbbipm.exe
        
        C:\Windows\system32\Hplbbipm.exe
        641⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Hehkjpod.exe
        
        C:\Windows\system32\Hehkjpod.exe
        642⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Hoaocf32.exe
        
        C:\Windows\system32\Hoaocf32.exe
        643⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Hekgppma.exe
        
        C:\Windows\system32\Hekgppma.exe
        644⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6720
        
        C:\Windows\SysWOW64\Ipplmh32.exe
        
        C:\Windows\system32\Ipplmh32.exe
        645⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Ipbhch32.exe
        
        C:\Windows\system32\Ipbhch32.exe
        646⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Iliihipi.exe
        
        C:\Windows\system32\Iliihipi.exe
        647⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Iebnqofj.exe
        
        C:\Windows\system32\Iebnqofj.exe
        648⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Iojbid32.exe
        
        C:\Windows\system32\Iojbid32.exe
        649⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Igajka32.exe
        
        C:\Windows\system32\Igajka32.exe
        650⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ipjocgdm.exe
        
        C:\Windows\system32\Ipjocgdm.exe
        651⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6568
        
        C:\Windows\SysWOW64\Igcgpalj.exe
        
        C:\Windows\system32\Igcgpalj.exe
        652⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Jlqohhja.exe
        
        C:\Windows\system32\Jlqohhja.exe
        653⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Jgfcfajg.exe
        
        C:\Windows\system32\Jgfcfajg.exe
        654⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Jpnhof32.exe
        
        C:\Windows\system32\Jpnhof32.exe
        655⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Jghpkq32.exe
        
        C:\Windows\system32\Jghpkq32.exe
        656⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Jmbhhkoa.exe
        
        C:\Windows\system32\Jmbhhkoa.exe
        657⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Jcoapami.exe
        
        C:\Windows\system32\Jcoapami.exe
        658⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Jiiiml32.exe
        
        C:\Windows\system32\Jiiiml32.exe
        659⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        660⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Jepjbm32.exe
        
        C:\Windows\system32\Jepjbm32.exe
        661⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Jljbogaf.exe
        
        C:\Windows\system32\Jljbogaf.exe
        662⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Jebfgl32.exe
        
        C:\Windows\system32\Jebfgl32.exe
        663⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        664⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
        
        C:\Windows\SysWOW64\Kjblcj32.exe
        
        C:\Windows\system32\Kjblcj32.exe
        665⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Koodka32.exe
        
        C:\Windows\system32\Koodka32.exe
        666⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Kjeiij32.exe
        
        C:\Windows\system32\Kjeiij32.exe
        667⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Koaaaaip.exe
        
        C:\Windows\system32\Koaaaaip.exe
        668⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        669⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Kleajegi.exe
        
        C:\Windows\system32\Kleajegi.exe
        670⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Kodnfqgm.exe
        
        C:\Windows\system32\Kodnfqgm.exe
        671⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        672⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        673⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Lfpcijlg.exe
        
        C:\Windows\system32\Lfpcijlg.exe
        674⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Lqfgfclm.exe
        
        C:\Windows\system32\Lqfgfclm.exe
        675⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Lfbpnjjd.exe
        
        C:\Windows\system32\Lfbpnjjd.exe
        676⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Llmhkd32.exe
        
        C:\Windows\system32\Llmhkd32.exe
        677⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Lgblhmag.exe
        
        C:\Windows\system32\Lgblhmag.exe
        678⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Lnldeg32.exe
        
        C:\Windows\system32\Lnldeg32.exe
        679⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Lomqmoob.exe
        
        C:\Windows\system32\Lomqmoob.exe
        680⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Lfgiii32.exe
        
        C:\Windows\system32\Lfgiii32.exe
        681⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
        
        C:\Windows\SysWOW64\Lmaafcml.exe
        
        C:\Windows\system32\Lmaafcml.exe
        682⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Mmcnlc32.exe
        
        C:\Windows\system32\Mmcnlc32.exe
        683⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Mjgneg32.exe
        
        C:\Windows\system32\Mjgneg32.exe
        684⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Modgnn32.exe
        
        C:\Windows\system32\Modgnn32.exe
        685⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Mjjkkghp.exe
        
        C:\Windows\system32\Mjjkkghp.exe
        686⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Mqdcga32.exe
        
        C:\Windows\system32\Mqdcga32.exe
        687⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Mfqlph32.exe
        
        C:\Windows\system32\Mfqlph32.exe
        688⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\Mnhdae32.exe
        
        C:\Windows\system32\Mnhdae32.exe
        689⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Moiphnde.exe
        
        C:\Windows\system32\Moiphnde.exe
        690⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Mjodff32.exe
        
        C:\Windows\system32\Mjodff32.exe
        691⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Mokmnm32.exe
        
        C:\Windows\system32\Mokmnm32.exe
        692⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ngbeok32.exe
        
        C:\Windows\system32\Ngbeok32.exe
        693⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Nmomga32.exe
        
        C:\Windows\system32\Nmomga32.exe
        694⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
        
        C:\Windows\SysWOW64\Ncifdlii.exe
        
        C:\Windows\system32\Ncifdlii.exe
        695⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
        
        C:\Windows\SysWOW64\Nfhbpghl.exe
        
        C:\Windows\system32\Nfhbpghl.exe
        696⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Nmajmaoi.exe
        
        C:\Windows\system32\Nmajmaoi.exe
        697⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Nggnjjoo.exe
        
        C:\Windows\system32\Nggnjjoo.exe
        698⤵
        
        PID:864
        
        C:\Windows\SysWOW64\Nnafgd32.exe
        
        C:\Windows\system32\Nnafgd32.exe
        699⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ncnook32.exe
        
        C:\Windows\system32\Ncnook32.exe
        700⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Nnccmddi.exe
        
        C:\Windows\system32\Nnccmddi.exe
        701⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Nfohafad.exe
        
        C:\Windows\system32\Nfohafad.exe
        702⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
        
        C:\Windows\SysWOW64\Nmipnp32.exe
        
        C:\Windows\system32\Nmipnp32.exe
        703⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
        
        C:\Windows\SysWOW64\Ocbhjjqn.exe
        
        C:\Windows\system32\Ocbhjjqn.exe
        704⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Ojmqgd32.exe
        
        C:\Windows\system32\Ojmqgd32.exe
        705⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Opiipkfb.exe
        
        C:\Windows\system32\Opiipkfb.exe
        706⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Ojommdfh.exe
        
        C:\Windows\system32\Ojommdfh.exe
        707⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12612
        
        C:\Windows\SysWOW64\Ocgbej32.exe
        
        C:\Windows\system32\Ocgbej32.exe
        708⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Onmfcb32.exe
        
        C:\Windows\system32\Onmfcb32.exe
        709⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Ofhkgeij.exe
        
        C:\Windows\system32\Ofhkgeij.exe
        710⤵
        Modifies registry class
        
        PID:12724
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        711⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Ojfcmc32.exe
        
        C:\Windows\system32\Ojfcmc32.exe
        712⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Phjdggoj.exe
        
        C:\Windows\system32\Phjdggoj.exe
        713⤵
        System Location Discovery: System Language Discovery
        
        PID:12840
        
        C:\Windows\SysWOW64\Pabhpm32.exe
        
        C:\Windows\system32\Pabhpm32.exe
        714⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Pfoahd32.exe
        
        C:\Windows\system32\Pfoahd32.exe
        715⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Padeem32.exe
        
        C:\Windows\system32\Padeem32.exe
        716⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        717⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Ppjbfi32.exe
        
        C:\Windows\system32\Ppjbfi32.exe
        718⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Pmnbpm32.exe
        
        C:\Windows\system32\Pmnbpm32.exe
        719⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13184
        
        C:\Windows\SysWOW64\Phcgmffo.exe
        
        C:\Windows\system32\Phcgmffo.exe
        720⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        721⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Qdjgbg32.exe
        
        C:\Windows\system32\Qdjgbg32.exe
        722⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Qoplop32.exe
        
        C:\Windows\system32\Qoplop32.exe
        723⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        724⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12332
        
        C:\Windows\SysWOW64\Qobhepjf.exe
        
        C:\Windows\system32\Qobhepjf.exe
        725⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Adoamfhn.exe
        
        C:\Windows\system32\Adoamfhn.exe
        726⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Aodejohd.exe
        
        C:\Windows\system32\Aodejohd.exe
        727⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Adanbffk.exe
        
        C:\Windows\system32\Adanbffk.exe
        728⤵
        Drops file in System32 directory
        
        PID:12500
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        729⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        730⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Akmbepke.exe
        
        C:\Windows\system32\Akmbepke.exe
        731⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Ahacndjo.exe
        
        C:\Windows\system32\Ahacndjo.exe
        732⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Amnlfk32.exe
        
        C:\Windows\system32\Amnlfk32.exe
        733⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        734⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Bgimepmd.exe
        
        C:\Windows\system32\Bgimepmd.exe
        735⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        736⤵
        Modifies registry class
        
        PID:12996
        
        C:\Windows\SysWOW64\Bkgekock.exe
        
        C:\Windows\system32\Bkgekock.exe
        737⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13012
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        738⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13080
        
        C:\Windows\SysWOW64\Boenam32.exe
        
        C:\Windows\system32\Boenam32.exe
        739⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Bpfkiepp.exe
        
        C:\Windows\system32\Bpfkiepp.exe
        740⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Bogkgmho.exe
        
        C:\Windows\system32\Bogkgmho.exe
        741⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Bhpopb32.exe
        
        C:\Windows\system32\Bhpopb32.exe
        742⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4900
        
        C:\Windows\SysWOW64\Cnlhhi32.exe
        
        C:\Windows\system32\Cnlhhi32.exe
        743⤵
        Modifies registry class
        
        PID:13252
        
        C:\Windows\SysWOW64\Cdfpdc32.exe
        
        C:\Windows\system32\Cdfpdc32.exe
        744⤵
        Drops file in System32 directory
        
        PID:13300
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        745⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Chdikajj.exe
        
        C:\Windows\system32\Chdikajj.exe
        746⤵
        Drops file in System32 directory
        
        PID:12348
        
        C:\Windows\SysWOW64\Cnaachha.exe
        
        C:\Windows\system32\Cnaachha.exe
        747⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\Cgiflnoa.exe
        
        C:\Windows\system32\Cgiflnoa.exe
        748⤵
        Drops file in System32 directory
        
        PID:12452
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        749⤵
        Modifies registry class
        
        PID:12524
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        750⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        751⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Dhnlapbo.exe
        
        C:\Windows\system32\Dhnlapbo.exe
        752⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4432
        
        C:\Windows\SysWOW64\Dafpjf32.exe
        
        C:\Windows\system32\Dafpjf32.exe
        753⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Dnmaog32.exe
        
        C:\Windows\system32\Dnmaog32.exe
        754⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Dgeegled.exe
        
        C:\Windows\system32\Dgeegled.exe
        755⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Ddifaqcn.exe
        
        C:\Windows\system32\Ddifaqcn.exe
        756⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Doojni32.exe
        
        C:\Windows\system32\Doojni32.exe
        757⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Dhgogojd.exe
        
        C:\Windows\system32\Dhgogojd.exe
        758⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Encgofhl.exe
        
        C:\Windows\system32\Encgofhl.exe
        759⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        760⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Eqdpaa32.exe
        
        C:\Windows\system32\Eqdpaa32.exe
        761⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13288 -s 448
        762⤵
        Program crash
        
        PID:8716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 13288 -ip 13288
1⤵
PID:8528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hbanfk32.exe

Path C:\Windows\SysWOW64\Hbanfk32.exe
Size 320KB
SHA256 18d3e19dd58b3dfa436c5bab1dcee30c267407f3d767cf2ed9bcfe852b858582
MD5 2886736249c8ace9d67b96593e37c0c4
SHA1 eb430691e53efaf1f4e2666ba8834dc68e63e2f7
SHA512 1efb693d36f2df14f085c84bd8c3b3d65f83062e4bfe23d7106d816f8118fb39ee47fa555a5f78ee09072051b531fd2292753f72796e307e5f1a29e12e6e49f3
SSDEEP 3072:GBrMYdvLqnOBUOOn1wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:G/YkDOn1V/Ah1G/AcQ///NR5fn
TLSH
T15A643F292A3409EACEED2BB5EC1249D89141E9F414F1E23E6163DFDCDCE5DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfhqkk32.exe

Path C:\Windows\SysWOW64\Hfhqkk32.exe
Size 320KB
SHA256 3d38434ae277bd0bed89875745832c63dbea4e07fe23666c0aa59407a0a8ab3a
MD5 8c7a63cd8ae1cbc5fee65c451a2a504e
SHA1 70ad82b8bbdbf6012cd36c918f1a06a0010bb9b0
SHA512 14df40344c627d113175f967bda4b84ec9363d33e6c0d33013a7188c946f25107ce9cd89d596ca751959f22b40277dda5296aed18c86f564dd6d5d65ce525f54
SSDEEP 3072:7DvTf9X/O1M/ZK4h+PanwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7DvTf9Xygfh9nV/Ah1G/AcQ///NR5fn
TLSH
T16564401A263509EADEED3FB5AC1249D85145E9F014F1E23E6127DFDCC8E4DA2C84AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfjmajbc.exe

Path C:\Windows\SysWOW64\Hfjmajbc.exe
Size 320KB
SHA256 6632f22a0b56f558b1d6dfd718ee88b8dbea81f9069907ba49871ac3f3950094
MD5 d09762802a0b878d94146039d7b0c28d
SHA1 9e54b2b2c8520285f0cf60ab9635ffad84eeb946
SHA512 520fe0f803a95e0773658477388e10d44a82bb4b3856d361a1fbbb8bef2343a1eeef318c451112b45584fd596d069689ec5e2adf79c117c729d6dec55366f1a0
SSDEEP 3072:y5LOxrlPvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8QlPvV/Ah1G/AcQ///NR5fn
TLSH
T1FE644F19667049FACEED1FB5AD5249D8A241E9F018F1E13E2123DFDCC8E4DA2D818F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibagmiie.exe

Path C:\Windows\SysWOW64\Ibagmiie.exe
Size 320KB
SHA256 a51ef7e5fe463b2548cea096c3868496c99a8c8047dc4c663291774856c1f26c
MD5 b465daff995cde8c6699beff44b00375
SHA1 6ba04d2ffda88efe2e5f36b3e0995685ccbb9b6b
SHA512 9a75870b2eb2cf7c9008209752a5010d38c0e0ea6cd4c93d8260250bc6150f0db7a8249c07dd39266e4e70fcd46d09ee2888eba39c0d6fc895ee998343cd8db6
SSDEEP 3072:ZXEhNyaKkTUrDqgpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZXEtRI/pV/Ah1G/AcQ///NR5fn
TLSH
T1EA642E19263109EADEED1FB5AD024AD89143E9F118F1E13E6523DFDCD8E4DA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibojgikg.exe

Path C:\Windows\SysWOW64\Ibojgikg.exe
Size 320KB
SHA256 1d3cc56182c3dccabae40135f7aeff4bf193e5c158b6ac99dcdfaa03232f29ac
MD5 3a61340e0273e5326bf225ec4b8c8129
SHA1 3cedc222cb3cad4c565d1f967aca21e394132901
SHA512 b15342a6a39f204c4d71285110cf06ae44819a4310a0b08f12ccb85c835d83491ed874cc4293d5196a814da7fa12e901b9d74203b45efdfcf0b837964c59ef6e
SSDEEP 3072:dF4UVLAdymOtF93HNBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:djVLN9HNBV/Ah1G/AcQ///NR5fn
TLSH
T178642F19163409EACEED2BF6AE1249D95141EAF024F1E53E6133DFDCD8E4DA6C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iiffoc32.exe

Path C:\Windows\SysWOW64\Iiffoc32.exe
Size 320KB
SHA256 c55939c6be806421a915e99eada1c37896018888b0888f8b7f3f615711bd2233
MD5 a1561c55e183c0859b6f3a864980f696
SHA1 2e51ada4e625d3a4b312ae8350d9a64872568b0a
SHA512 a4f69f4410d3c7d0cc7a40ccfc2d7d37339b4a2c9f87e2a9ce64836b8a8aeb5c2e8162381fa49a8b85282ac035a03e99135010714c9723d1e0bc0693adb95e5f
SSDEEP 3072:6xQYNeqGQ34atRH4RrezwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KTNjIq4RezV/Ah1G/AcQ///NR5fn
TLSH
T1B0640D19263409EACDED1BF5AC164AD85181E8F514F1E23EA123DFDCE8E4DB6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ijmobhdd.exe

Path C:\Windows\SysWOW64\Ijmobhdd.exe
Size 320KB
SHA256 3395e766263d5ee46796cf26aaf3f0250fa26670a6a836758e8750a476989f52
MD5 5abfb8b7a7913e81fd9fcedd2ff85fbe
SHA1 45de8553cec8953ef7eed1e6849a0ba689ca8d9c
SHA512 c56c6cab9ff4962f2a7264a2889652c8ec3cf0b4f479d52b9d7bbdb1506a4261eb0e9a541094bd7f33e525ea6f24bf52640f9160eb94af678375b8da2094205c
SSDEEP 3072:qYC3rhzGJLIf3q4tFvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qYwCQ/tFvV/Ah1G/AcQ///NR5fn
TLSH
T14F64411A2A3409EACEED1FB5AE1259D89181F8F514F5E13E6123DFDCD8E4DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Immhdc32.exe

Path C:\Windows\SysWOW64\Immhdc32.exe
Size 320KB
SHA256 f3d01b89ffb1f1dc1d194a3daf39325817abb6c8b4a88c3b47543c15d9a37423
MD5 dd8fe06732ff40a52f94f8b30c1f48af
SHA1 33bb1bc9de18369a0682577c8488da2cbe110602
SHA512 b8eb22be792898177d6feb9a919199ef6ce3c263054ee3dc45865026f68bd70d4e491f44ec17002c25a569aa0086c78f4e96819800cbba510d0aa485f825d536
SSDEEP 3072:+ooxOdoDcxDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+ootDcxDV/Ah1G/AcQ///NR5fn
TLSH
T12C6433152A3009EECDED2FB6AC1289D85181E9F014F2E13E6523DFDDD8E4DA6C819F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipnaen32.exe

Path C:\Windows\SysWOW64\Ipnaen32.exe
Size 320KB
SHA256 be6436b58472b56581dbabfc3aea92e46e9ba4b1304ef61eb1bcedcd76ce516a
MD5 47f8ff959894ca3d61c07e62bc660f5f
SHA1 06ca51d9c9e418f93a42b8378897fb3045ef28ad
SHA512 2cef3116784c9babd3c22943f4cb3cf1fd8d96df406b7b436e32dca14aeac6127eacf319c5a2ff7d295d16d5766faffdcb0246511b553db427f0ff422100e5e7
SSDEEP 3072:tn6+KGpbMsW0DxEJtv9wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NrW8otlV/Ah1G/AcQ///NR5fn
TLSH
T1F164312A2A3809EACEED1FB6AD1249D85141E4F114F1E53EA123DFDCD8E4DA2DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jaljaoii.exe

Path C:\Windows\SysWOW64\Jaljaoii.exe
Size 320KB
SHA256 b1e8c473cc6ff4655974240a8701cf3520fbbedca335bf1ea754ae00dd7b9915
MD5 7d1ee953fffd544fd96cd34f536c73d0
SHA1 9fff7f35fdd5170da2586820ca272e97e005c60d
SHA512 a0b33c7eebc31cca43158686381452b192763b60ea9154174591b818c9a8834fbc0e7977514048dca61d95bb20a2e9c83475d7a30d9c6aeb400b77df4c99ac86
SSDEEP 3072:6UcguL7WsTKz1+XwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:TcgCWslXV/Ah1G/AcQ///NR5fn
TLSH
T157643029263409EACEED5FB6AC1249D89241EAF014F1E53E5123DFDCDCE4DA6D806F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfdinf32.exe

Path C:\Windows\SysWOW64\Jfdinf32.exe
Size 320KB
SHA256 0f421f2e59719e1eccce3cdeaa947b8450b971bb9b91eb39e95c7de16455bac7
MD5 b8089e7197541a84fbb68a94ef7ccb1b
SHA1 0e62597ec0f4f6ddeb3e2586c129cd32d92dd512
SHA512 bcaf7bb250dce72e6721a5d0d398f7ef4764e2e5d048d5b2e46122bcf71ffb49b0689e4c819013949ec09d20fa6c10627c2bdc2a0505e432623b08ac20040b71
SSDEEP 3072:1Gu6/k4trumwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:n+tCmV/Ah1G/AcQ///NR5fn
TLSH
T196642E192A3409EACEED1FF9AC1249D89181E9F014F1E13E6527DFDCD8E5DA2C816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfffcf32.exe

Path C:\Windows\SysWOW64\Jfffcf32.exe
Size 320KB
SHA256 0920f2a65adee9a59e8873305abc28b6a54e077c67f8139d0ab935b79d908a46
MD5 1cf97210f83b7b266b4dbd310059917d
SHA1 0b2e8bf5c0b38fa86841e801bbf2815b01695238
SHA512 f278db4e6183a7f709671ee0a04369330d3351006b43eeed42d19b4a19dc1e8dd757441c0bf2653cf5b542ac6e1374c818f546beff7f9302a578128901db4622
SSDEEP 3072:YgrZuBdx/5vNwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:YgrZGhvNV/Ah1G/AcQ///NR5fn
TLSH
T10664411A663409EACEED1FB6AE1249D95141E8F214F1E53E6123DFDCC8E8DA2DC14F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfopcgpk.exe

Path C:\Windows\SysWOW64\Jfopcgpk.exe
Size 320KB
SHA256 a7afc64d79addfb7a0e8a81be9fc2eafc289b4a2380021cee53888740232b9bd
MD5 9adf6b743963f2fbe23eb5512a286ee9
SHA1 034df3a64f1c557b335b94c56daf0bb22832a37f
SHA512 940ba5ac4a7c2ff9fc576d29c799c79f248a4f4401114b1c0d3eaecb83032df5f55c4c6d59adbc3ddc0f3a012dab054db05faae4928d6a7bca18670452ac01b3
SSDEEP 3072:rh5KvafDrFwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rQGfFV/Ah1G/AcQ///NR5fn
TLSH
T156640C991A3409EACEED1BF5BC0259D89142E8F114F1E13E6263DFDCD8E4DA2D816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jplmglbf.exe

Path C:\Windows\SysWOW64\Jplmglbf.exe
Size 320KB
SHA256 64b49e7e9d1d6d2c4985aeb3319565fe0e900bf5064d85128514cc2787846df2
MD5 94f11d9a9a1748f1756f2f651a19cdd5
SHA1 1b19be06263d216d07889a25c9084c5208d286d1
SHA512 ae03fa5ac738196942aeb0589350405028fb2ddf70c39032ce95804ef7e5908c60dc7814b96f363a56409370fdaf9ba91a76e9cc0ec9e580a7c634192bdc23f9
SSDEEP 3072:P0+NG5NUx/l5B6sOwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Fw2xPcsOV/Ah1G/AcQ///NR5fn
TLSH
T13B64EB1A26340AEADEED1BB5AC224DD85181E9F114F1E13E6133DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkdnjd32.exe

Path C:\Windows\SysWOW64\Kkdnjd32.exe
Size 320KB
SHA256 d00b72b10fba40820ea73bd59613f02143927e78e67450b8d83f489d1932d5ea
MD5 a063941b11865717c6d3112999104ac5
SHA1 cd8641f4b7f6cf319fbea8fe0ffc682e17b0b9fb
SHA512 f642aaee66a9d38ceaa91d9a7c95ebc8675920b745b5169aa106da3137414292108910585d0a44db898178e74c0f48cd79ffd616fb9dc936d8d18a909edff0a5
SSDEEP 3072:fMaPCAsXGwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fM4cGV/Ah1G/AcQ///NR5fn
TLSH
T17A64411926304AEACEED1FB5AC4249D8A181E9F115F1E13E6123DFDCD8E4DA6CC19F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kkkdjcjb.exe

Path C:\Windows\SysWOW64\Kkkdjcjb.exe
Size 320KB
SHA256 c28bf03f684b3e75148cceb7ae278253ce0cce311b3880d716e9fd66d48cbc97
MD5 63fc5987afcc8231412597bdb2ab1f6d
SHA1 49de545570af5008a121937270b316eb0f0163c3
SHA512 b1e789bd4d734caf93d206be20c61947c5bcc45796446e32c76bf00e3b9c7a9914c3e97cc547ccdb67dbcf99577850ef8993a53a558ef9d4ae4cc172813f4a51
SSDEEP 3072:Oo+NGhgsCHRQeQgXKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:28gsgNQgXKV/Ah1G/AcQ///NR5fn
TLSH
T13E640B192A300DEACEED1BB5AC2249D85141E9F415F5E63E6133DFECD8E4DA6C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmlmlo32.exe

Path C:\Windows\SysWOW64\Kmlmlo32.exe
Size 320KB
SHA256 80fa5973f6312d1bcc8477daebbc47a5914b91c86a7df6c38584ce81b910cfd4
MD5 c46f0b3bc010d54c29ccebfe90ad0cc7
SHA1 0157f444eab5a8874934d4791f150e9968c3d2f9
SHA512 13b4ef2790b8f3f08b1eb940e0510d7f48bc0923a958081247a32bb3c4596748d0981a74549f40603393a81cdecf6474e8e2393d010840643219166766863175
SSDEEP 6144:cnOcA1s44NSav54V/Ah1G/AcQ///NR5fn:cnOcAGTHf/Nv
TLSH
T1A5641D1926345DEACDED2BB6AE124DE85141E8F014F1E23E6123DFDDD8E4DA6C908F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lanpml32.exe

Path C:\Windows\SysWOW64\Lanpml32.exe
Size 320KB
SHA256 28510612f694764fa228cad61cf404096b1bb63588e3cdfc1989c97d2379ba68
MD5 4476dc6bca441ac49e72255b5c6bd3f1
SHA1 40e7946e229af9309a99cae404e9a8b29df6c082
SHA512 2537af648eb94b73ce4d46a9d2603d7b67ea54df22cc2e72fdb895b5153055638a792be3100f1e927dc285b5049e5f907701b39a463dd5730094473749fcee1f
SSDEEP 3072:lJH7ftpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:lJHppV/Ah1G/AcQ///NR5fn
TLSH
T12164EB5A1A341AEACDED1BF5BC0249D86181E6B015F1E23E6123DFDCD8E4EA2D815FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkbkkbdj.exe

Path C:\Windows\SysWOW64\Lkbkkbdj.exe
Size 320KB
SHA256 d1d7f521d7fdd0b445f50785b0fe3448e528c36e13e0d75296430c11dfbdeb83
MD5 8bf0e2a1234f94d715af9310ebe95ea2
SHA1 bec61eee487332eb6d665b7ad404026f7b3d63dd
SHA512 a8811919fc510aa6fb3e2e447fd2f79063519203c110810c1bd5132ffd1c7d2ac4e96226de914e1df0a61cee07e354dd906977e65ac0bea0dcbc7fae3dfc9c98
SSDEEP 3072:Lh9gWwLwDzHwvlprSXrKPBmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LULMTKprSXGBmV/Ah1G/AcQ///NR5fn
TLSH
T1C964EC292A3409EACEED1BF6AC124DD85245E9F164F1E13E6123DFDCD8E4D66C825F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lkgdfb32.exe

Path C:\Windows\SysWOW64\Lkgdfb32.exe
Size 320KB
SHA256 4ab3be3dcd97301b0b59806603a87154fb5b625ee6b7d7d054318c5655a851b4
MD5 8c614637bdb7448f5d2d4d9fb8db514b
SHA1 bd5b29b627d50a37325545ee9f0756d9d3372bcc
SHA512 bf43aae5481c5c198cc3c14911d9e229fca90756da67c603b4f08e905ee299c46dbfd1559768f85ceff045b301e85e4aa7ac819f58e893d18123cbd17e5eff35
SSDEEP 3072:U29V//nnPWPPvvvsUrPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:xnPWPPvvvsUrPV/Ah1G/AcQ///NR5fn
TLSH
T1DF64DA191A700EEACEED1BB6BD1249D85181E8F014F1E13E6123DFECD8E4DA6D825F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgpaqbcf.exe

Path C:\Windows\SysWOW64\Mgpaqbcf.exe
Size 320KB
SHA256 b3a8b166dc06c9e3b1c1760b7fb7da35f2794c81eb0790dc0cd6b7fb4d8a3ada
MD5 9e3222fb56f199f2256ba6e04ac0b09a
SHA1 0bbe4a4b132cef966f2e8ce9f56ab7bd46c0fc68
SHA512 6f53ee5525956022128fc1e6281033aad98cf89ddaaf909e9f5ea2f5b36400c2f9707bd85f79b37c5d5c1daf93b752f83bdbd9965c8aa5f68f8a711ea2a4e451
SSDEEP 3072:ECD4Xnz3YNXEKwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DD4Xz3Y+KV/Ah1G/AcQ///NR5fn
TLSH
T11364FC1926340DEACEED2BB5AC1349D85141E9F255F2E13E6123DFECD8E4DA2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mjqjbn32.exe

Path C:\Windows\SysWOW64\Mjqjbn32.exe
Size 320KB
SHA256 e8be039827e2dd3b154d46dc32e814232d2ef29e22951d8d11a91d124d75422d
MD5 4bef9d6fc65853fdd80fd2357b6cc6df
SHA1 5bd102bed7ff08b19d91c5e23a8aae998493a5fe
SHA512 359ce89391830030264a09306c141a08a9b02bf751f22ca77b729c6e2c9088afa2d9a41d78c677c9f52c1568086eece80a294aae8994c3b99870505a81bc4d3d
SSDEEP 3072:X9+GANDQnz62hdI43wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ITkz62h243V/Ah1G/AcQ///NR5fn
TLSH
T11C6422192A3409FACEED1FB5AC1249D89181EAF014F1E13E6523DFDCC8E4DA2D959F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mnapnl32.exe

Path C:\Windows\SysWOW64\Mnapnl32.exe
Size 320KB
SHA256 41635a3ca9fdb4a00836ecc4c5b917ee65c433252d95a460888a9c813c3416a6
MD5 b4fe4b2d0232c67688300214db8b7608
SHA1 c6655b3835752c525669655b5efeed411855bb6e
SHA512 8adb36dc818a55425db10fe1f35c8c3fc5aee25e2e6d6955a2013d544d75e2015832d3c31546b5895ce9dae1b920bd08ec732fd08212bf90645d01877262594f
SSDEEP 3072:8k0n7xB3bTeh9s1xawWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:TOxB3bsAxvWV/Ah1G/AcQ///NR5fn
TLSH
T1DD641D192A3009EACEFD1BB5EC0259D89251E8F114F1E13E6223DFDCE8E4DA6D815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mpmodg32.exe

Path C:\Windows\SysWOW64\Mpmodg32.exe
Size 320KB
SHA256 fd3b36ec4652b76e52116f7b00b19ccc78d9f538f6b3d656f4553eddc795311e
MD5 eef2c48b0af28abafaacab37628d091d
SHA1 5e321da8a600de087c3d83d5b5c9e409f1e55048
SHA512 da0519f0b9a06b64e55a47712055c972a480f826aa690629b03555e19456a6db1910545f2cc4ef65703ad83798c46a4b293f843408eefd6bee3042f765a4632e
SSDEEP 6144:bgyr84unP2JVDXqoTV/Ah1G/AcQ///NR5fn:cyr84unP2JVDXm/Nv
TLSH
T13B64512A6A3849EACDED1FB5AE1289D85141E9F014F1E13E6523DFDDC8E5DB2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Naaejj32.exe

Path C:\Windows\SysWOW64\Naaejj32.exe
Size 320KB
SHA256 d23719093aab610ee8f6ab117e3604d030d7ab0ef41618fbc5256b89edcff598
MD5 eb66870a7f2f495a32a3e2e9bf15ccf1
SHA1 8b88aac653bdaa1e165a69f7197254b8f0135a78
SHA512 a4f2cb2a573ae8fd2f6add1c773e799f65ac6a5632b2180a6927ebab7d767228d6ea1d1427698add36db121ce708d1bcc63daca93697393323cc27b437475974
SSDEEP 3072:q6C8nni4agi8rXWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:rC+i4agi8rXWV/Ah1G/AcQ///NR5fn
TLSH
T14E643019263409EACEED2FB5AC0649D85181EAF014F1E13E6523DFDCD8F4DA2C91AF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncgkma32.exe

Path C:\Windows\SysWOW64\Ncgkma32.exe
Size 320KB
SHA256 c6acb2434e4f093216c1f55e5dd66e68c5f56d24d98d0f9f56cae2bac566dd86
MD5 4dced944051c43b78d552552b22b7465
SHA1 cdef48716bea638034eba2648dccacc0bf16c4ed
SHA512 c80bb87a64855ec6eba53430dfdde4961558193a7415066200bdc56e96bf5a18848a3449942b4aa0a6d22af946aa4113ee4b1a0cd1b64ccc43ef9d68afafcba5
SSDEEP 3072:7NyKus2RtRSEmwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7NyKuuEmV/Ah1G/AcQ///NR5fn
TLSH
T1B5641E161A340DEADEED2BBAAC1249D85645E9F014F1E13E6123DFECD8E4DA2DC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncihbaie.exe

Path C:\Windows\SysWOW64\Ncihbaie.exe
Size 320KB
SHA256 08ac89784cd70e1bc04a286ecfa28797e4bfa39904e8c7db7e73f807f974f3b8
MD5 ff6d6e5a668d83eac06801111f80a3dd
SHA1 97e2469cdb8f4f35f90b5343673d928d98d9ae5b
SHA512 e3fdb73c6aab5de29c4f3c818796ac461d8792ec846e258261b85d31067653cce5a9ed546a320f9e6cd373de62263ab19497674a18938a2c81af9bd076be8b11
SSDEEP 3072:NAezIgyTkSPTioYpWwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:NfNuksTioyWV/Ah1G/AcQ///NR5fn
TLSH
T16564221A6A3409EACDED1FB5AC124AD85182F9F014F1E13E6523DFDCD8E4DA6C816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nglala32.exe

Path C:\Windows\SysWOW64\Nglala32.exe
Size 320KB
SHA256 fa31a6147b401868768fdbd056a9b8cdceea2970690fe3985b67a47d354578eb
MD5 1621d5053bad953bc95b759040b6fa6d
SHA1 30db7a374c6280505416ac71ce670d4e97d2a457
SHA512 209b4b0c0146afb451ab4fc5ede59ec9b8509be17f0ea8a5f2fa869c4a1f51346bd2bfa183817c066114207ee577b65fbc74d01456ee1b9d0f3e19abf097256d
SSDEEP 3072:X/yfCejGkoOZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PYVvoOZV/Ah1G/AcQ///NR5fn
TLSH
T103642F1A1A3009EACEED1BB5AD125DD89141E9F014F1E13F6123EFDCD8E4EA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnjbdj32.exe

Path C:\Windows\SysWOW64\Nnjbdj32.exe
Size 320KB
SHA256 8e629e55b95ab751234cc47a18343ecea18dda89792539213366e19bbe9b5d9c
MD5 6c0f5395fc4a1ad6df02aa9ed4785277
SHA1 6e72d6fb86a218ea72e6e4a0dc6176686ef2f373
SHA512 9d1ce85dd4d4ecf6cf335dfb911a4062e6751488bb0ad1a7c7b6e7fe5383e6808babae7713adaf32450d5517151c4e23f9391d8b5a013fb363185412ee89b57e
SSDEEP 3072:mqRk0n7y6EUl4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:m4k07y6D4V/Ah1G/AcQ///NR5fn
TLSH
T12A643F196A3009EACDED1BB5AC1249D85192E8F054F1E13E6127DFDEC8F4EA2DC05F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oboakhmo.exe

Path C:\Windows\SysWOW64\Oboakhmo.exe
Size 320KB
SHA256 e68eb6df3bf2d9852e618502ea2129d0f5c8d27c9b4c90be05b3159c899232d9
MD5 fa1ca7687c8180cb69d0cd1a97143388
SHA1 e44e234aff232e0579c6ce25a5c597207114952f
SHA512 2b6d6aca7f09dee2fcd8fbf1c0072e034208cf093a4465c679be965a5d4ccdde10f607dbfc64aa2bbb611b2f7f47dddb3b97c5542b93eb21aec1e6135cb4ed5e
SSDEEP 3072:G4aWJoX00OwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:daKmvOV/Ah1G/AcQ///NR5fn
TLSH
T14C64EC592A3409EACEED2BB5BC1259D89141E5F814F2E13E6123DFDCD8E4DB2D806F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogjmnomi.exe

Path C:\Windows\SysWOW64\Ogjmnomi.exe
Size 320KB
SHA256 5df626161d7607ed144fc809c88ed431ecb911cd97b3287c7f8fe88e42148890
MD5 f76b8adbdeed4327bf11b298aaca73fd
SHA1 39db92507cc725800eb61fb61115afe9dac78ea7
SHA512 0d14a0ae1fb819cd171dedf779d0eae3802dba71953ab909ee968c570224239a67535de9a3f99e5f2b76718da1aea92ce1c11a314e64f009afcbcadd270b31fd
SSDEEP 3072:DwMOBM6CjQpHMC+wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8MOBPCjk9+V/Ah1G/AcQ///NR5fn
TLSH
T1D7642E1A2E3849EACEED5BB6AC1249DC5141E9F014F1E53E6123DFDCD8E4DA6C819F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oqmhlego.exe

Path C:\Windows\SysWOW64\Oqmhlego.exe
Size 320KB
SHA256 b7142af8c09bd9d9d5b906a9cf2528a517d2b0fa40c91be49e44472c029ff243
MD5 785733efdb074ae8c74b1e655f845e92
SHA1 5915c977b8b82eb67ef4a25f773896d3d786784e
SHA512 9044063d899c5de7d33649be9145d239733ffd7af7de19401fed9d88a8309178d2ec3cf30d09b2a5a70fe5b0ae6c0c782f6324a0698152ad04776f3fbf491ec3
SSDEEP 3072:LOI6YsRM5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:N6YeM5V/Ah1G/AcQ///NR5fn
TLSH
T10C64301A263409EACDED1FB5AC024AD86545E8F114F1E13E6133DFDCD8E8DAAC859F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/472-514-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/480-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/624-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/704-197-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/948-494-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1044-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1108-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1328-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1332-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1352-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1464-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1492-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1536-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1568-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1588-81-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1592-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1592-479-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1772-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1824-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1912-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1956-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2276-402-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2564-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2608-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2648-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2692-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2804-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2840-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2868-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2880-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2896-307-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2940-506-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2940-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2952-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2956-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2964-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2972-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3016-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3104-493-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3104-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3120-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3132-155-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3216-487-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3244-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3260-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3260-3-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/3260-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3328-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3348-500-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3376-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3508-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3552-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3608-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3624-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3660-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3728-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3740-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3788-473-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3872-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4132-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4168-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4184-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4184-486-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4208-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4216-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4224-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4248-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4300-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4368-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4568-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4656-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4740-480-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4748-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4752-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5060-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5060-499-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5076-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5148-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5272-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5364-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5404-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5428-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5428-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5448-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5512-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5516-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5540-283-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5740-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5836-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5936-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5956-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6060-190-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6128-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6136-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads