berbew | 8d3f894a931548c39a7140c6e6928386449c2c09c1ef1b3a9c24e98508aa3353

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
Size 320KB
Sample260804-wc362aee74
SHA256 8d3f894a931548c39a7140c6e6928386449c2c09c1ef1b3a9c24e98508aa3353
MD5 e1c010fc9320d95d2c20892ccd863848
SHA1 5d3008237bc7e728ba32f713c6bd6697b7008346
SHA512 9919e05d9bd169c0be880b5db8c1622b48f8c6a2be6d67ab1fa3c5d56ae19327575f80ab23a9a4acc25165f68f7d0b389b9dc63e68ca46f9c7db437036946a83
SSDEEP 3072:8phTqB5o2RjYu/yIui03ywS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1vXQyV/Ah1G/AcQ///NR5fn
TLSH
T1E264211A26344AEACEED1BB6AC125AD85141E9F124F1E13E6133DFDCD8E4DA7C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onapnbhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inmplh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbeaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqmkjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meepne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gifjjacn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmhmko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jookdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaenlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haoighmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kijcanhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omnqcfig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baanhi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfeoip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgffci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nliakd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeaagoaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fechhcal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoioeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajbmmcii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnodmijd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enmjedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aegbji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhjlkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neiiiecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palbpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iomood32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkhnab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgfljqia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaoofaoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apeabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobffj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oolgbpei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgccccec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aachaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eeelge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jookdcie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgebif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdmkbmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlhbja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kieaqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jglkfmmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfill32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbbkmebo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgiolkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pploli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnaodbhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipflcnln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlcaeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndaboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eohmdhki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aancojgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpehikja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnfcbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flgaodbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpnhof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgjldfqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihnbih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgghdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hchickeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgimepmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhadmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gklenf32.exe

Executes dropped EXE 64 IoCs

pid	Process
5812	Hkfookmo.exe
3640	Hkhkdjkl.exe
5416	Hbbdad32.exe
4100	Ibeqgdpf.exe
5384	Ifefbbdj.exe
3964	Ippgqg32.exe
2792	Ilfhfh32.exe
3088	Jmfdpkeo.exe
1516	Jfaenqjm.exe
5940	Jlnnfghd.exe
4948	Jfeoip32.exe
3396	Kpncbemh.exe
4692	Kmfmfigl.exe
1188	Kdcbic32.exe
2564	Lmkfah32.exe
5052	Libggiik.exe
5912	Lekeajmm.exe
5944	Llemnd32.exe
2336	Mikjmhaq.exe
4484	Mdanjaqf.exe
4840	Mgddal32.exe
1204	Mlqljb32.exe
3920	Mgimmkgp.exe
3116	Nlefebfg.exe
3704	Ngkjbkem.exe
3428	Nlhbja32.exe
6140	Ngmggj32.exe
4608	Nljopa32.exe
4632	Ngpcmj32.exe
4464	Nphhfp32.exe
3900	Nnlhod32.exe
1636	Ojcidelf.exe
1232	Ojefjd32.exe
2204	Ocmjcjad.exe
2628	Ojgbpd32.exe
4196	Ogkcihgj.exe
3336	Olhlaoea.exe
5020	Ognpoheh.exe
5504	Omjhgoco.exe
3972	Pgpmdh32.exe
2740	Pddmml32.exe
3648	Pjaefc32.exe
5332	Pdfjcl32.exe
1356	Pfgfkd32.exe
1936	Pdifhkni.exe
3168	Pjeoablq.exe
5216	Pdkcnklf.exe
5244	Qcppogqo.exe
4256	Qnfdlpqd.exe
1092	Qmkanmel.exe
4656	Agqekeeb.exe
2696	Ajanmqbc.exe
5356	Aegbji32.exe
3764	Aancojgn.exe
2920	Ajfhhp32.exe
2936	Agjhadmh.exe
4920	Babmjj32.exe
3832	Bjkacoji.exe
2840	Bjmnho32.exe
2164	Bebbeh32.exe
2600	Bchogd32.exe
4984	Bnmcdm32.exe
2108	Bhehmbbj.exe
4728	Ceihffad.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Omjhgoco.exe	Ognpoheh.exe
File created	C:\Windows\SysWOW64\Keonke32.exe	Klfjbpmn.exe
File created	C:\Windows\SysWOW64\Iadejh32.dll	Agqekeeb.exe
File created	C:\Windows\SysWOW64\Kelcga32.dll	Ajeami32.exe
File created	C:\Windows\SysWOW64\Ibjibg32.exe	Igedenca.exe
File created	C:\Windows\SysWOW64\Ipflcnln.exe	Iildfd32.exe
File created	C:\Windows\SysWOW64\Pnfiia32.exe	Pdqelh32.exe
File created	C:\Windows\SysWOW64\Baanhi32.exe	Bobalm32.exe
File created	C:\Windows\SysWOW64\Chibfa32.exe	Caojigoh.exe
File created	C:\Windows\SysWOW64\Nbffkg32.dll	Iofmpb32.exe
File opened for modification	C:\Windows\SysWOW64\Boipfp32.exe	Bjlgnh32.exe
File created	C:\Windows\SysWOW64\Kqlbncjp.dll	Epjadk32.exe
File created	C:\Windows\SysWOW64\Flgaodbm.exe	Ffjignde.exe
File created	C:\Windows\SysWOW64\Onbbpg32.dll	Injmlbkh.exe
File created	C:\Windows\SysWOW64\Bhllpk32.dll	Aajoapdk.exe
File opened for modification	C:\Windows\SysWOW64\Hedaoa32.exe	Hojibgkm.exe
File created	C:\Windows\SysWOW64\Pflikm32.exe	Plcdbghi.exe
File opened for modification	C:\Windows\SysWOW64\Bbbkmebo.exe	Bocoqj32.exe
File created	C:\Windows\SysWOW64\Cafqkmge.dll	Ipmbcm32.exe
File created	C:\Windows\SysWOW64\Apgppaga.dll	Dhmgdo32.exe
File opened for modification	C:\Windows\SysWOW64\Phmhgmpc.exe	Pacojc32.exe
File created	C:\Windows\SysWOW64\Ngikpjml.exe	Nqpccp32.exe
File created	C:\Windows\SysWOW64\Ifbbbl32.exe	Ihnbih32.exe
File created	C:\Windows\SysWOW64\Jdjdkc32.dll	Oiglen32.exe
File created	C:\Windows\SysWOW64\Ccnnmmbp.exe	Cihjpd32.exe
File created	C:\Windows\SysWOW64\Nfbcpgeg.dll	Ndaboafl.exe
File created	C:\Windows\SysWOW64\Pajekb32.exe	Pecefa32.exe
File opened for modification	C:\Windows\SysWOW64\Jidpblik.exe	Jookdcie.exe
File created	C:\Windows\SysWOW64\Jmlpeimn.dll	Nmfchq32.exe
File created	C:\Windows\SysWOW64\Okeaak32.dll	Qjdpoacp.exe
File opened for modification	C:\Windows\SysWOW64\Jdodekhg.exe	Jgkdkg32.exe
File opened for modification	C:\Windows\SysWOW64\Mmdefi32.exe	Lgglnb32.exe
File opened for modification	C:\Windows\SysWOW64\Mgphjk32.exe	Mmkdlbea.exe
File opened for modification	C:\Windows\SysWOW64\Afpjoaeo.exe	Apeabg32.exe
File created	C:\Windows\SysWOW64\Olnedl32.dll	Gklenf32.exe
File created	C:\Windows\SysWOW64\Ejqngl32.dll	Ckkilhjm.exe
File created	C:\Windows\SysWOW64\Lijjba32.dll	Dpehikja.exe
File created	C:\Windows\SysWOW64\Ikfogfco.dll	Mnknkbdk.exe
File opened for modification	C:\Windows\SysWOW64\Ebdcejpk.exe	Ekkkip32.exe
File opened for modification	C:\Windows\SysWOW64\Jikfbkbc.exe	Jofaeb32.exe
File opened for modification	C:\Windows\SysWOW64\Pploli32.exe	Pnkbdqpo.exe
File opened for modification	C:\Windows\SysWOW64\Mgddal32.exe	Mdanjaqf.exe
File created	C:\Windows\SysWOW64\Ojefjd32.exe	Ojcidelf.exe
File created	C:\Windows\SysWOW64\Qlggcp32.exe	Qemoff32.exe
File opened for modification	C:\Windows\SysWOW64\Cmcoflhh.exe	Cckkmg32.exe
File created	C:\Windows\SysWOW64\Ajqfhdik.dll	Chibfa32.exe
File created	C:\Windows\SysWOW64\Nhlpom32.exe	Nppkkj32.exe
File created	C:\Windows\SysWOW64\Iehqncld.dll	Ljbfiegb.exe
File created	C:\Windows\SysWOW64\Lckegmne.dll	Dmjefkap.exe
File opened for modification	C:\Windows\SysWOW64\Oocdme32.exe	Oiglen32.exe
File opened for modification	C:\Windows\SysWOW64\Poomom32.exe	Pakleh32.exe
File created	C:\Windows\SysWOW64\Hlldaape.exe	Hingefqa.exe
File created	C:\Windows\SysWOW64\Mgmphajp.dll	Digeaenp.exe
File created	C:\Windows\SysWOW64\Gggoad32.dll	Cndidlfb.exe
File created	C:\Windows\SysWOW64\Cbeaib32.exe	Ckkilhjm.exe
File created	C:\Windows\SysWOW64\Lkfclf32.dll	Jdbheajp.exe
File created	C:\Windows\SysWOW64\Mbenfq32.exe	Mhoiih32.exe
File opened for modification	C:\Windows\SysWOW64\Gmndjf32.exe	Fbhplnca.exe
File created	C:\Windows\SysWOW64\Iocliecb.exe	Hifcqo32.exe
File opened for modification	C:\Windows\SysWOW64\Banabi32.exe	Bgimepmd.exe
File created	C:\Windows\SysWOW64\Dmenne32.dll	Nlihek32.exe
File created	C:\Windows\SysWOW64\Aokceaoa.exe	Ahakhg32.exe
File created	C:\Windows\SysWOW64\Nnpalk32.exe	Nalpbf32.exe
File created	C:\Windows\SysWOW64\Knmaomdp.dll	Pacojc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7040	7656	WerFault.exe	798

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcmeek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akamol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jookdcie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnlhhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iklgkmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doanno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbnflihq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afelal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imdlgm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebapednb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqpfccgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alimnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiokbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfhbpghl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phjdggoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banabi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaefc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oibbjoij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cninnnfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojigoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcilgco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdbdkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lldfcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahpdnaci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpofbobf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgglnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmdefi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohfafn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfmjjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfgnkgbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljpideje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljobiofi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmhim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apeabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqkmkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfcdph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piphaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadokg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aljcip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekhncp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkgcog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdcbic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foekbg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnmeic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggfombmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlcaeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olmdln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmhmko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iipfgm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gilajmfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medqmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Einmaaqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hknkiokp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idpbhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhjbjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chepehne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klahof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acdbpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jglkfmmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqndahiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boqlqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iocliecb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobalm32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggddfag.dll"	Ibnlbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahakhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ippgqg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kijcanhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdaomobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekhncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afpjoaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqkmkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmlnomif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nadlnoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkhkdjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pphjbgfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpcahb32.dll"	Lpbojlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjhepnno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlggcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfgnle32.dll"	Keonke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqmgbd32.dll"	Bjlgnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqndahiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agfpoqog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igedenca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbljhigl.dll"	Kgenlldo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaflag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogndki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foekbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klfjbpmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhlpom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kopdmlcq.dll"	Ihpgda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olheak32.dll"	Mhoiih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecipeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijpnp32.dll"	Lqjqab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onapnbhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbqlhfgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akpbae32.dll"	Kgiibnib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nppkkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nophgffg.dll"	Qcppogqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqhmie32.dll"	Ohlifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glgjfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnphid32.dll"	Mlohjpoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apeabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfmjjl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kehhjfif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oibbjoij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiecc32.dll"	Pohnhdog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkjpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihjionb.dll"	Hingefqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdlkho32.dll"	Qpolahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlhnng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfibl32.dll"	Edhjji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gilajmfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnihod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkgcaf32.dll"	Iocliecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdjbpgom.dll"	Jlnnfghd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadokg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmndjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfpdoj32.dll"	Lfgnkgbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Haafcf32.dll"	Enhpje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifefbbdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadejh32.dll"	Agqekeeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogmidbal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbiede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acmhgq32.dll"	Dmdhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alimnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnkbdqpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcmeek32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5812	936	2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe	88
PID 5812 wrote to memory of 3640	5812	Hkfookmo.exe	90
PID 3640 wrote to memory of 5416	3640	Hkhkdjkl.exe	91
PID 5416 wrote to memory of 4100	5416	Hbbdad32.exe	92
PID 4100 wrote to memory of 5384	4100	Ibeqgdpf.exe	93
PID 5384 wrote to memory of 3964	5384	Ifefbbdj.exe	94
PID 3964 wrote to memory of 2792	3964	Ippgqg32.exe	95
PID 2792 wrote to memory of 3088	2792	Ilfhfh32.exe	96
PID 3088 wrote to memory of 1516	3088	Jmfdpkeo.exe	97
PID 1516 wrote to memory of 5940	1516	Jfaenqjm.exe	98
PID 5940 wrote to memory of 4948	5940	Jlnnfghd.exe	99
PID 4948 wrote to memory of 3396	4948	Jfeoip32.exe	100
PID 3396 wrote to memory of 4692	3396	Kpncbemh.exe	101
PID 4692 wrote to memory of 1188	4692	Kmfmfigl.exe	102
PID 1188 wrote to memory of 2564	1188	Kdcbic32.exe	103
PID 2564 wrote to memory of 5052	2564	Lmkfah32.exe	104
PID 5052 wrote to memory of 5912	5052	Libggiik.exe	105
PID 5912 wrote to memory of 5944	5912	Lekeajmm.exe	106
PID 5944 wrote to memory of 2336	5944	Llemnd32.exe	107
PID 2336 wrote to memory of 4484	2336	Mikjmhaq.exe	108
PID 4484 wrote to memory of 4840	4484	Mdanjaqf.exe	109
PID 4840 wrote to memory of 1204	4840	Mgddal32.exe	110
PID 1204 wrote to memory of 3920	1204	Mlqljb32.exe	111
PID 3920 wrote to memory of 3116	3920	Mgimmkgp.exe	112
PID 3116 wrote to memory of 3704	3116	Nlefebfg.exe	113
PID 3704 wrote to memory of 3428	3704	Ngkjbkem.exe	114
PID 3428 wrote to memory of 6140	3428	Nlhbja32.exe	115
PID 6140 wrote to memory of 4608	6140	Ngmggj32.exe	116
PID 4608 wrote to memory of 4632	4608	Nljopa32.exe	117
PID 4632 wrote to memory of 4464	4632	Ngpcmj32.exe	118
PID 4464 wrote to memory of 3900	4464	Nphhfp32.exe	119
PID 3900 wrote to memory of 1636	3900	Nnlhod32.exe	120
PID 1636 wrote to memory of 1232	1636	Ojcidelf.exe	121
PID 1232 wrote to memory of 2204	1232	Ojefjd32.exe	122
PID 2204 wrote to memory of 2628	2204	Ocmjcjad.exe	123
PID 2628 wrote to memory of 4196	2628	Ojgbpd32.exe	124
PID 4196 wrote to memory of 3336	4196	Ogkcihgj.exe	125
PID 3336 wrote to memory of 5020	3336	Olhlaoea.exe	126
PID 5020 wrote to memory of 5504	5020	Ognpoheh.exe	127
PID 5504 wrote to memory of 3972	5504	Omjhgoco.exe	128
PID 3972 wrote to memory of 2740	3972	Pgpmdh32.exe	129
PID 2740 wrote to memory of 3648	2740	Pddmml32.exe	130
PID 3648 wrote to memory of 5332	3648	Pjaefc32.exe	131
PID 5332 wrote to memory of 1356	5332	Pdfjcl32.exe	132
PID 1356 wrote to memory of 1936	1356	Pfgfkd32.exe	133
PID 1936 wrote to memory of 3168	1936	Pdifhkni.exe	134
PID 3168 wrote to memory of 5216	3168	Pjeoablq.exe	135
PID 5216 wrote to memory of 5244	5216	Pdkcnklf.exe	136
PID 5244 wrote to memory of 4256	5244	Qcppogqo.exe	137
PID 4256 wrote to memory of 1092	4256	Qnfdlpqd.exe	138
PID 1092 wrote to memory of 4656	1092	Qmkanmel.exe	139
PID 4656 wrote to memory of 2696	4656	Agqekeeb.exe	140
PID 2696 wrote to memory of 5356	2696	Ajanmqbc.exe	141
PID 5356 wrote to memory of 3764	5356	Aegbji32.exe	142
PID 3764 wrote to memory of 2920	3764	Aancojgn.exe	143
PID 2920 wrote to memory of 2936	2920	Ajfhhp32.exe	144
PID 2936 wrote to memory of 4920	2936	Agjhadmh.exe	145
PID 4920 wrote to memory of 3832	4920	Babmjj32.exe	146
PID 3832 wrote to memory of 2840	3832	Bjkacoji.exe	147
PID 2840 wrote to memory of 2164	2840	Bjmnho32.exe	148
PID 2164 wrote to memory of 2600	2164	Bebbeh32.exe	149
PID 2600 wrote to memory of 4984	2600	Bchogd32.exe	150
PID 4984 wrote to memory of 2108	4984	Bnmcdm32.exe	151
PID 2108 wrote to memory of 4728	2108	Bhehmbbj.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e1c010fc9320d95d2c20892ccd863848_elex_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\Hkfookmo.exe
  C:\Windows\system32\Hkfookmo.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\Hkhkdjkl.exe
    C:\Windows\system32\Hkhkdjkl.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\SysWOW64\Hbbdad32.exe
      C:\Windows\system32\Hbbdad32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5416
    - - C:\Windows\SysWOW64\Ibeqgdpf.exe
        
        C:\Windows\system32\Ibeqgdpf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Windows\SysWOW64\Ifefbbdj.exe
        
        C:\Windows\system32\Ifefbbdj.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5384
        
        C:\Windows\SysWOW64\Ippgqg32.exe
        
        C:\Windows\system32\Ippgqg32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Jmfdpkeo.exe
        
        C:\Windows\system32\Jmfdpkeo.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3088
        
        C:\Windows\SysWOW64\Jfaenqjm.exe
        
        C:\Windows\system32\Jfaenqjm.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Jlnnfghd.exe
        
        C:\Windows\system32\Jlnnfghd.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Windows\SysWOW64\Jfeoip32.exe
        
        C:\Windows\system32\Jfeoip32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Kmfmfigl.exe
        
        C:\Windows\system32\Kmfmfigl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Kdcbic32.exe
        
        C:\Windows\system32\Kdcbic32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\SysWOW64\Lmkfah32.exe
        
        C:\Windows\system32\Lmkfah32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Libggiik.exe
        
        C:\Windows\system32\Libggiik.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Lekeajmm.exe
        
        C:\Windows\system32\Lekeajmm.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\SysWOW64\Llemnd32.exe
        
        C:\Windows\system32\Llemnd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5944
        
        C:\Windows\SysWOW64\Mikjmhaq.exe
        
        C:\Windows\system32\Mikjmhaq.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Mdanjaqf.exe
        
        C:\Windows\system32\Mdanjaqf.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Mgddal32.exe
        
        C:\Windows\system32\Mgddal32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Mlqljb32.exe
        
        C:\Windows\system32\Mlqljb32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Mgimmkgp.exe
        
        C:\Windows\system32\Mgimmkgp.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Nlefebfg.exe
        
        C:\Windows\system32\Nlefebfg.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Ngkjbkem.exe
        
        C:\Windows\system32\Ngkjbkem.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Nlhbja32.exe
        
        C:\Windows\system32\Nlhbja32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6140
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Ngpcmj32.exe
        
        C:\Windows\system32\Ngpcmj32.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Nphhfp32.exe
        
        C:\Windows\system32\Nphhfp32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Nnlhod32.exe
        
        C:\Windows\system32\Nnlhod32.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Ogkcihgj.exe
        
        C:\Windows\system32\Ogkcihgj.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Olhlaoea.exe
        
        C:\Windows\system32\Olhlaoea.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Omjhgoco.exe
        
        C:\Windows\system32\Omjhgoco.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Windows\SysWOW64\Pgpmdh32.exe
        
        C:\Windows\system32\Pgpmdh32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Pddmml32.exe
        
        C:\Windows\system32\Pddmml32.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Pjaefc32.exe
        
        C:\Windows\system32\Pjaefc32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Pdfjcl32.exe
        
        C:\Windows\system32\Pdfjcl32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5332
        
        C:\Windows\SysWOW64\Pfgfkd32.exe
        
        C:\Windows\system32\Pfgfkd32.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Pdifhkni.exe
        
        C:\Windows\system32\Pdifhkni.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\SysWOW64\Qcppogqo.exe
        
        C:\Windows\system32\Qcppogqo.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Windows\SysWOW64\Qnfdlpqd.exe
        
        C:\Windows\system32\Qnfdlpqd.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Qmkanmel.exe
        
        C:\Windows\system32\Qmkanmel.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Agqekeeb.exe
        
        C:\Windows\system32\Agqekeeb.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\SysWOW64\Ajanmqbc.exe
        
        C:\Windows\system32\Ajanmqbc.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Aegbji32.exe
        
        C:\Windows\system32\Aegbji32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Windows\SysWOW64\Aancojgn.exe
        
        C:\Windows\system32\Aancojgn.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Ajfhhp32.exe
        
        C:\Windows\system32\Ajfhhp32.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Agjhadmh.exe
        
        C:\Windows\system32\Agjhadmh.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Babmjj32.exe
        
        C:\Windows\system32\Babmjj32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Bjkacoji.exe
        
        C:\Windows\system32\Bjkacoji.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Bjmnho32.exe
        
        C:\Windows\system32\Bjmnho32.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Bebbeh32.exe
        
        C:\Windows\system32\Bebbeh32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Bnmcdm32.exe
        
        C:\Windows\system32\Bnmcdm32.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Bhehmbbj.exe
        
        C:\Windows\system32\Bhehmbbj.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Ceihffad.exe
        
        C:\Windows\system32\Ceihffad.exe
        65⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Celelf32.exe
        
        C:\Windows\system32\Celelf32.exe
        66⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Cndidlfb.exe
        
        C:\Windows\system32\Cndidlfb.exe
        67⤵
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Cdabmcdi.exe
        
        C:\Windows\system32\Cdabmcdi.exe
        68⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Cfakon32.exe
        
        C:\Windows\system32\Cfakon32.exe
        69⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Cmlckhig.exe
        
        C:\Windows\system32\Cmlckhig.exe
        70⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Cjpcel32.exe
        
        C:\Windows\system32\Cjpcel32.exe
        71⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Ddhhnana.exe
        
        C:\Windows\system32\Ddhhnana.exe
        72⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Ddjecalo.exe
        
        C:\Windows\system32\Ddjecalo.exe
        73⤵
        
        PID:596
        
        C:\Windows\SysWOW64\Dmcilgco.exe
        
        C:\Windows\system32\Dmcilgco.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\Dobffj32.exe
        
        C:\Windows\system32\Dobffj32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3460
        
        C:\Windows\SysWOW64\Dfmjjl32.exe
        
        C:\Windows\system32\Dfmjjl32.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Dhmgdo32.exe
        
        C:\Windows\system32\Dhmgdo32.exe
        77⤵
        Drops file in System32 directory
        
        PID:1808
        
        C:\Windows\SysWOW64\Emjomf32.exe
        
        C:\Windows\system32\Emjomf32.exe
        78⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Egbdekcg.exe
        
        C:\Windows\system32\Egbdekcg.exe
        79⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Eecdcckf.exe
        
        C:\Windows\system32\Eecdcckf.exe
        80⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Eoneah32.exe
        
        C:\Windows\system32\Eoneah32.exe
        81⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Ehfjkn32.exe
        
        C:\Windows\system32\Ehfjkn32.exe
        82⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Edmjpoli.exe
        
        C:\Windows\system32\Edmjpoli.exe
        83⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Foekbg32.exe
        
        C:\Windows\system32\Foekbg32.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Fdbdkn32.exe
        
        C:\Windows\system32\Fdbdkn32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Windows\SysWOW64\Fnmeic32.exe
        
        C:\Windows\system32\Fnmeic32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\Folacfcd.exe
        
        C:\Windows\system32\Folacfcd.exe
        87⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Gnaodbhl.exe
        
        C:\Windows\system32\Gnaodbhl.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3364
        
        C:\Windows\SysWOW64\Gekckpgl.exe
        
        C:\Windows\system32\Gekckpgl.exe
        89⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Gochceml.exe
        
        C:\Windows\system32\Gochceml.exe
        90⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Gempqo32.exe
        
        C:\Windows\system32\Gempqo32.exe
        91⤵
        
        PID:124
        
        C:\Windows\SysWOW64\Goediekj.exe
        
        C:\Windows\system32\Goediekj.exe
        92⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\SysWOW64\Gddigk32.exe
        
        C:\Windows\system32\Gddigk32.exe
        94⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Hnmnpano.exe
        
        C:\Windows\system32\Hnmnpano.exe
        95⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Hgebif32.exe
        
        C:\Windows\system32\Hgebif32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:992
        
        C:\Windows\SysWOW64\Hffbfn32.exe
        
        C:\Windows\system32\Hffbfn32.exe
        97⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Hnagkp32.exe
        
        C:\Windows\system32\Hnagkp32.exe
        98⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Hgjldfqj.exe
        
        C:\Windows\system32\Hgjldfqj.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2052
        
        C:\Windows\SysWOW64\Hfklamii.exe
        
        C:\Windows\system32\Hfklamii.exe
        100⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Hocqkc32.exe
        
        C:\Windows\system32\Hocqkc32.exe
        101⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Iofmpb32.exe
        
        C:\Windows\system32\Iofmpb32.exe
        102⤵
        Drops file in System32 directory
        
        PID:2640
        
        C:\Windows\SysWOW64\Ihnbih32.exe
        
        C:\Windows\system32\Ihnbih32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        104⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Ikokkc32.exe
        
        C:\Windows\system32\Ikokkc32.exe
        105⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Ifdohl32.exe
        
        C:\Windows\system32\Ifdohl32.exe
        106⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Ikagpcof.exe
        
        C:\Windows\system32\Ikagpcof.exe
        107⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\Iejlih32.exe
        
        C:\Windows\system32\Iejlih32.exe
        108⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ibnlbm32.exe
        
        C:\Windows\system32\Ibnlbm32.exe
        109⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Jgjekc32.exe
        
        C:\Windows\system32\Jgjekc32.exe
        110⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Jndmgn32.exe
        
        C:\Windows\system32\Jndmgn32.exe
        111⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1412
        
        C:\Windows\SysWOW64\Jilnjf32.exe
        
        C:\Windows\system32\Jilnjf32.exe
        113⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Jnifbmfo.exe
        
        C:\Windows\system32\Jnifbmfo.exe
        114⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Jiokpfee.exe
        
        C:\Windows\system32\Jiokpfee.exe
        115⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Jnkchmdl.exe
        
        C:\Windows\system32\Jnkchmdl.exe
        116⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Jeekeg32.exe
        
        C:\Windows\system32\Jeekeg32.exe
        117⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Jpkpbpko.exe
        
        C:\Windows\system32\Jpkpbpko.exe
        118⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Kehhjfif.exe
        
        C:\Windows\system32\Kehhjfif.exe
        119⤵
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Kpmlhoil.exe
        
        C:\Windows\system32\Kpmlhoil.exe
        120⤵
        
        PID:424
        
        C:\Windows\SysWOW64\Kieaqe32.exe
        
        C:\Windows\system32\Kieaqe32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2208
        
        C:\Windows\SysWOW64\Kbneij32.exe
        
        C:\Windows\system32\Kbneij32.exe
        122⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Klfjbpmn.exe
        
        C:\Windows\system32\Klfjbpmn.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Keonke32.exe
        
        C:\Windows\system32\Keonke32.exe
        124⤵
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Kpdbhn32.exe
        
        C:\Windows\system32\Kpdbhn32.exe
        125⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Kimgad32.exe
        
        C:\Windows\system32\Kimgad32.exe
        126⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Lbekjipe.exe
        
        C:\Windows\system32\Lbekjipe.exe
        127⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Llmpco32.exe
        
        C:\Windows\system32\Llmpco32.exe
        128⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Lfcdph32.exe
        
        C:\Windows\system32\Lfcdph32.exe
        129⤵
        System Location Discovery: System Language Discovery
        
        PID:1200
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        130⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lhfmmp32.exe
        
        C:\Windows\system32\Lhfmmp32.exe
        131⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Lfgnkgbf.exe
        
        C:\Windows\system32\Lfgnkgbf.exe
        132⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Lldfcn32.exe
        
        C:\Windows\system32\Lldfcn32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\Lihfmb32.exe
        
        C:\Windows\system32\Lihfmb32.exe
        134⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        135⤵
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Mfoclflo.exe
        
        C:\Windows\system32\Mfoclflo.exe
        136⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Mpghel32.exe
        
        C:\Windows\system32\Mpghel32.exe
        137⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\Mpiejkql.exe
        
        C:\Windows\system32\Mpiejkql.exe
        139⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Mlpeol32.exe
        
        C:\Windows\system32\Mlpeol32.exe
        140⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        141⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Nbljaf32.exe
        
        C:\Windows\system32\Nbljaf32.exe
        142⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Nppkkj32.exe
        
        C:\Windows\system32\Nppkkj32.exe
        143⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Nhlpom32.exe
        
        C:\Windows\system32\Nhlpom32.exe
        144⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        145⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Nlihek32.exe
        
        C:\Windows\system32\Nlihek32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Ngombd32.exe
        
        C:\Windows\system32\Ngombd32.exe
        147⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Nojagf32.exe
        
        C:\Windows\system32\Nojagf32.exe
        148⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Nipedokm.exe
        
        C:\Windows\system32\Nipedokm.exe
        149⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Oomnmfid.exe
        
        C:\Windows\system32\Oomnmfid.exe
        150⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Oibbjoij.exe
        
        C:\Windows\system32\Oibbjoij.exe
        151⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Ocjgcd32.exe
        
        C:\Windows\system32\Ocjgcd32.exe
        152⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Olcklj32.exe
        
        C:\Windows\system32\Olcklj32.exe
        153⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Oiglen32.exe
        
        C:\Windows\system32\Oiglen32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        155⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ohlifj32.exe
        
        C:\Windows\system32\Ohlifj32.exe
        156⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Ogmidbal.exe
        
        C:\Windows\system32\Ogmidbal.exe
        157⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Pohnhdog.exe
        
        C:\Windows\system32\Pohnhdog.exe
        158⤵
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Pphjbgfj.exe
        
        C:\Windows\system32\Pphjbgfj.exe
        159⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Phcogice.exe
        
        C:\Windows\system32\Phcogice.exe
        160⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pchcdbck.exe
        
        C:\Windows\system32\Pchcdbck.exe
        161⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        162⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Pgfljqia.exe
        
        C:\Windows\system32\Pgfljqia.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Plcdbghi.exe
        
        C:\Windows\system32\Plcdbghi.exe
        164⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Pflikm32.exe
        
        C:\Windows\system32\Pflikm32.exe
        165⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Qodmdb32.exe
        
        C:\Windows\system32\Qodmdb32.exe
        166⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Qlhnng32.exe
        
        C:\Windows\system32\Qlhnng32.exe
        167⤵
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        168⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Acdbpq32.exe
        
        C:\Windows\system32\Acdbpq32.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6648
        
        C:\Windows\SysWOW64\Ahakhg32.exe
        
        C:\Windows\system32\Ahakhg32.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Aokceaoa.exe
        
        C:\Windows\system32\Aokceaoa.exe
        171⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Afelal32.exe
        
        C:\Windows\system32\Afelal32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Aompjamo.exe
        
        C:\Windows\system32\Aompjamo.exe
        173⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Afghgkdl.exe
        
        C:\Windows\system32\Afghgkdl.exe
        174⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Aopmpq32.exe
        
        C:\Windows\system32\Aopmpq32.exe
        175⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        176⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Acnefoac.exe
        
        C:\Windows\system32\Acnefoac.exe
        177⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bjgncihp.exe
        
        C:\Windows\system32\Bjgncihp.exe
        178⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Bodfkpfg.exe
        
        C:\Windows\system32\Bodfkpfg.exe
        179⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Bimkde32.exe
        
        C:\Windows\system32\Bimkde32.exe
        180⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bjlgnh32.exe
        
        C:\Windows\system32\Bjlgnh32.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        182⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Biadoeib.exe
        
        C:\Windows\system32\Biadoeib.exe
        183⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bgbdml32.exe
        
        C:\Windows\system32\Bgbdml32.exe
        184⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bpniaool.exe
        
        C:\Windows\system32\Bpniaool.exe
        185⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Cjcmognb.exe
        
        C:\Windows\system32\Cjcmognb.exe
        186⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Cppfgnlj.exe
        
        C:\Windows\system32\Cppfgnlj.exe
        187⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Cihjpd32.exe
        
        C:\Windows\system32\Cihjpd32.exe
        188⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Ccnnmmbp.exe
        
        C:\Windows\system32\Ccnnmmbp.exe
        189⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Cmfcfb32.exe
        
        C:\Windows\system32\Cmfcfb32.exe
        190⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Cglgck32.exe
        
        C:\Windows\system32\Cglgck32.exe
        191⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Cmipkb32.exe
        
        C:\Windows\system32\Cmipkb32.exe
        192⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Cipppc32.exe
        
        C:\Windows\system32\Cipppc32.exe
        193⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        194⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Dplebmbl.exe
        
        C:\Windows\system32\Dplebmbl.exe
        195⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Djaipe32.exe
        
        C:\Windows\system32\Djaipe32.exe
        196⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Dpnbhl32.exe
        
        C:\Windows\system32\Dpnbhl32.exe
        197⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Djcfee32.exe
        
        C:\Windows\system32\Djcfee32.exe
        198⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Dclknkfp.exe
        
        C:\Windows\system32\Dclknkfp.exe
        199⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Dpckclld.exe
        
        C:\Windows\system32\Dpckclld.exe
        200⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Dfmcpf32.exe
        
        C:\Windows\system32\Dfmcpf32.exe
        201⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Dpehikja.exe
        
        C:\Windows\system32\Dpehikja.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Einmaaqb.exe
        
        C:\Windows\system32\Einmaaqb.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:7336
        
        C:\Windows\SysWOW64\Epgenk32.exe
        
        C:\Windows\system32\Epgenk32.exe
        204⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Eipigqop.exe
        
        C:\Windows\system32\Eipigqop.exe
        205⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Epjadk32.exe
        
        C:\Windows\system32\Epjadk32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Ejofacfb.exe
        
        C:\Windows\system32\Ejofacfb.exe
        207⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Edhjji32.exe
        
        C:\Windows\system32\Edhjji32.exe
        208⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Empococc.exe
        
        C:\Windows\system32\Empococc.exe
        209⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Efhcld32.exe
        
        C:\Windows\system32\Efhcld32.exe
        210⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Fpagdj32.exe
        
        C:\Windows\system32\Fpagdj32.exe
        211⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Fkflbb32.exe
        
        C:\Windows\system32\Fkflbb32.exe
        212⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Fhjlkg32.exe
        
        C:\Windows\system32\Fhjlkg32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Fmgecn32.exe
        
        C:\Windows\system32\Fmgecn32.exe
        214⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Fmiaimki.exe
        
        C:\Windows\system32\Fmiaimki.exe
        215⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Fdcjfg32.exe
        
        C:\Windows\system32\Fdcjfg32.exe
        216⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Fmlnomif.exe
        
        C:\Windows\system32\Fmlnomif.exe
        217⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Fdffkgpc.exe
        
        C:\Windows\system32\Fdffkgpc.exe
        218⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Fibocnnj.exe
        
        C:\Windows\system32\Fibocnnj.exe
        219⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Ggfombmd.exe
        
        C:\Windows\system32\Ggfombmd.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Windows\SysWOW64\Gdjpff32.exe
        
        C:\Windows\system32\Gdjpff32.exe
        221⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Gighom32.exe
        
        C:\Windows\system32\Gighom32.exe
        222⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gdmmlf32.exe
        
        C:\Windows\system32\Gdmmlf32.exe
        223⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Gijedm32.exe
        
        C:\Windows\system32\Gijedm32.exe
        224⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Gdoiaf32.exe
        
        C:\Windows\system32\Gdoiaf32.exe
        225⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Gilajmfp.exe
        
        C:\Windows\system32\Gilajmfp.exe
        226⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Gdafgefe.exe
        
        C:\Windows\system32\Gdafgefe.exe
        227⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Gnjjpk32.exe
        
        C:\Windows\system32\Gnjjpk32.exe
        228⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Hknkiokp.exe
        
        C:\Windows\system32\Hknkiokp.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
        
        C:\Windows\SysWOW64\Hpkcafjg.exe
        
        C:\Windows\system32\Hpkcafjg.exe
        230⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Hnodkjhq.exe
        
        C:\Windows\system32\Hnodkjhq.exe
        231⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Hgghdp32.exe
        
        C:\Windows\system32\Hgghdp32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7644
        
        C:\Windows\SysWOW64\Halmaiog.exe
        
        C:\Windows\system32\Halmaiog.exe
        233⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hgieipmo.exe
        
        C:\Windows\system32\Hgieipmo.exe
        234⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Haoighmd.exe
        
        C:\Windows\system32\Haoighmd.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        236⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Idpbhc32.exe
        
        C:\Windows\system32\Idpbhc32.exe
        237⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
        
        C:\Windows\SysWOW64\Ijlkqj32.exe
        
        C:\Windows\system32\Ijlkqj32.exe
        238⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Iklgkmop.exe
        
        C:\Windows\system32\Iklgkmop.exe
        239⤵
        System Location Discovery: System Language Discovery
        
        PID:8156
        
        C:\Windows\SysWOW64\Ihpgda32.exe
        
        C:\Windows\system32\Ihpgda32.exe
        240⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Iqklhd32.exe
        
        C:\Windows\system32\Iqklhd32.exe
        242⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Igedenca.exe
        
        C:\Windows\system32\Igedenca.exe
        243⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        244⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Iggakn32.exe
        
        C:\Windows\system32\Iggakn32.exe
        245⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Jqpfccgo.exe
        
        C:\Windows\system32\Jqpfccgo.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:7848
        
        C:\Windows\SysWOW64\Jgjnpm32.exe
        
        C:\Windows\system32\Jgjnpm32.exe
        247⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        248⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Jglkfmmi.exe
        
        C:\Windows\system32\Jglkfmmi.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8112
        
        C:\Windows\SysWOW64\Jnfcbg32.exe
        
        C:\Windows\system32\Jnfcbg32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Jkjclk32.exe
        
        C:\Windows\system32\Jkjclk32.exe
        251⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Jdbheajp.exe
        
        C:\Windows\system32\Jdbheajp.exe
        252⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Jjopmh32.exe
        
        C:\Windows\system32\Jjopmh32.exe
        253⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Jipqkopf.exe
        
        C:\Windows\system32\Jipqkopf.exe
        254⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Kbiede32.exe
        
        C:\Windows\system32\Kbiede32.exe
        255⤵
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Kgenlldo.exe
        
        C:\Windows\system32\Kgenlldo.exe
        256⤵
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Kqnbea32.exe
        
        C:\Windows\system32\Kqnbea32.exe
        257⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Kjffngap.exe
        
        C:\Windows\system32\Kjffngap.exe
        258⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        259⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Kndodehf.exe
        
        C:\Windows\system32\Kndodehf.exe
        260⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Kijcanhl.exe
        
        C:\Windows\system32\Kijcanhl.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Knfliefc.exe
        
        C:\Windows\system32\Knfliefc.exe
        262⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Kilpgnfi.exe
        
        C:\Windows\system32\Kilpgnfi.exe
        263⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Lnihod32.exe
        
        C:\Windows\system32\Lnihod32.exe
        264⤵
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Lebalokn.exe
        
        C:\Windows\system32\Lebalokn.exe
        265⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Ljpideje.exe
        
        C:\Windows\system32\Ljpideje.exe
        266⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Windows\SysWOW64\Leenanik.exe
        
        C:\Windows\system32\Leenanik.exe
        267⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Ljbfiegb.exe
        
        C:\Windows\system32\Ljbfiegb.exe
        268⤵
        Drops file in System32 directory
        
        PID:8492
        
        C:\Windows\SysWOW64\Lalnfooo.exe
        
        C:\Windows\system32\Lalnfooo.exe
        269⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Lgffci32.exe
        
        C:\Windows\system32\Lgffci32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8580
        
        C:\Windows\SysWOW64\Lnpopcni.exe
        
        C:\Windows\system32\Lnpopcni.exe
        271⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Llcoihmb.exe
        
        C:\Windows\system32\Llcoihmb.exe
        272⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Laqhao32.exe
        
        C:\Windows\system32\Laqhao32.exe
        273⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Mndhkc32.exe
        
        C:\Windows\system32\Mndhkc32.exe
        274⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Mlhidg32.exe
        
        C:\Windows\system32\Mlhidg32.exe
        275⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Mbbaaapj.exe
        
        C:\Windows\system32\Mbbaaapj.exe
        276⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Mhoiih32.exe
        
        C:\Windows\system32\Mhoiih32.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Mbenfq32.exe
        
        C:\Windows\system32\Mbenfq32.exe
        278⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mhafoh32.exe
        
        C:\Windows\system32\Mhafoh32.exe
        279⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Mnknkbdk.exe
        
        C:\Windows\system32\Mnknkbdk.exe
        280⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Meefhl32.exe
        
        C:\Windows\system32\Meefhl32.exe
        281⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Mjbopcip.exe
        
        C:\Windows\system32\Mjbopcip.exe
        282⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Niconj32.exe
        
        C:\Windows\system32\Niconj32.exe
        283⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Nophfa32.exe
        
        C:\Windows\system32\Nophfa32.exe
        284⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Nldhpeop.exe
        
        C:\Windows\system32\Nldhpeop.exe
        285⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Nelmik32.exe
        
        C:\Windows\system32\Nelmik32.exe
        286⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Nlfeeelm.exe
        
        C:\Windows\system32\Nlfeeelm.exe
        287⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Nacmnlkd.exe
        
        C:\Windows\system32\Nacmnlkd.exe
        288⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Nliakd32.exe
        
        C:\Windows\system32\Nliakd32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Neafdjak.exe
        
        C:\Windows\system32\Neafdjak.exe
        290⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Nknolaob.exe
        
        C:\Windows\system32\Nknolaob.exe
        291⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        292⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Oolgbpei.exe
        
        C:\Windows\system32\Oolgbpei.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8488
        
        C:\Windows\SysWOW64\Oajcnkdl.exe
        
        C:\Windows\system32\Oajcnkdl.exe
        294⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        295⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Oehldi32.exe
        
        C:\Windows\system32\Oehldi32.exe
        296⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Olbdacbp.exe
        
        C:\Windows\system32\Olbdacbp.exe
        297⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Oejijiip.exe
        
        C:\Windows\system32\Oejijiip.exe
        298⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Oldagc32.exe
        
        C:\Windows\system32\Oldagc32.exe
        299⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Oboicmhj.exe
        
        C:\Windows\system32\Oboicmhj.exe
        300⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ohkbldfa.exe
        
        C:\Windows\system32\Ohkbldfa.exe
        301⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ooejhn32.exe
        
        C:\Windows\system32\Ooejhn32.exe
        302⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Peobeh32.exe
        
        C:\Windows\system32\Peobeh32.exe
        303⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Plijbblh.exe
        
        C:\Windows\system32\Plijbblh.exe
        304⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Peaokh32.exe
        
        C:\Windows\system32\Peaokh32.exe
        305⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pojccmii.exe
        
        C:\Windows\system32\Pojccmii.exe
        306⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Piphaf32.exe
        
        C:\Windows\system32\Piphaf32.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:8524
        
        C:\Windows\SysWOW64\Pakleh32.exe
        
        C:\Windows\system32\Pakleh32.exe
        308⤵
        Drops file in System32 directory
        
        PID:8640
        
        C:\Windows\SysWOW64\Poomom32.exe
        
        C:\Windows\system32\Poomom32.exe
        309⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Pehekgmp.exe
        
        C:\Windows\system32\Pehekgmp.exe
        310⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Pcmeek32.exe
        
        C:\Windows\system32\Pcmeek32.exe
        311⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        312⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Qocfjlan.exe
        
        C:\Windows\system32\Qocfjlan.exe
        313⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Qemoff32.exe
        
        C:\Windows\system32\Qemoff32.exe
        314⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Qlggcp32.exe
        
        C:\Windows\system32\Qlggcp32.exe
        315⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Aadokg32.exe
        
        C:\Windows\system32\Aadokg32.exe
        316⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Windows\SysWOW64\Aaflag32.exe
        
        C:\Windows\system32\Aaflag32.exe
        318⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Ahpdnaci.exe
        
        C:\Windows\system32\Ahpdnaci.exe
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:3272
        
        C:\Windows\SysWOW64\Acfhkj32.exe
        
        C:\Windows\system32\Acfhkj32.exe
        320⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Akamol32.exe
        
        C:\Windows\system32\Akamol32.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
        
        C:\Windows\SysWOW64\Ajbmmcii.exe
        
        C:\Windows\system32\Ajbmmcii.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9224
        
        C:\Windows\SysWOW64\Aoofej32.exe
        
        C:\Windows\system32\Aoofej32.exe
        323⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Alcfoo32.exe
        
        C:\Windows\system32\Alcfoo32.exe
        324⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Bbpoge32.exe
        
        C:\Windows\system32\Bbpoge32.exe
        325⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Bocoqj32.exe
        
        C:\Windows\system32\Bocoqj32.exe
        326⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Bbbkmebo.exe
        
        C:\Windows\system32\Bbbkmebo.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9384
        
        C:\Windows\SysWOW64\Bkjpek32.exe
        
        C:\Windows\system32\Bkjpek32.exe
        328⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Bfpdcc32.exe
        
        C:\Windows\system32\Bfpdcc32.exe
        329⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Bmjlpnpb.exe
        
        C:\Windows\system32\Bmjlpnpb.exe
        330⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Bjnmib32.exe
        
        C:\Windows\system32\Bjnmib32.exe
        331⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Bcfabgel.exe
        
        C:\Windows\system32\Bcfabgel.exe
        332⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Bicjjncd.exe
        
        C:\Windows\system32\Bicjjncd.exe
        333⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        334⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Cmabpmjj.exe
        
        C:\Windows\system32\Cmabpmjj.exe
        335⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Cckkmg32.exe
        
        C:\Windows\system32\Cckkmg32.exe
        336⤵
        Drops file in System32 directory
        
        PID:9680
        
        C:\Windows\SysWOW64\Cmcoflhh.exe
        
        C:\Windows\system32\Cmcoflhh.exe
        337⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Cbphncfo.exe
        
        C:\Windows\system32\Cbphncfo.exe
        338⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Cmflkl32.exe
        
        C:\Windows\system32\Cmflkl32.exe
        339⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Cbbdcc32.exe
        
        C:\Windows\system32\Cbbdcc32.exe
        340⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ckkilhjm.exe
        
        C:\Windows\system32\Ckkilhjm.exe
        341⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Cbeaib32.exe
        
        C:\Windows\system32\Cbeaib32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9872
        
        C:\Windows\SysWOW64\Dmjefkap.exe
        
        C:\Windows\system32\Dmjefkap.exe
        343⤵
        Drops file in System32 directory
        
        PID:9904
        
        C:\Windows\SysWOW64\Dcdnce32.exe
        
        C:\Windows\system32\Dcdnce32.exe
        344⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Dkpbgh32.exe
        
        C:\Windows\system32\Dkpbgh32.exe
        345⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Dbikdbnd.exe
        
        C:\Windows\system32\Dbikdbnd.exe
        346⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Dkbomgde.exe
        
        C:\Windows\system32\Dkbomgde.exe
        347⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Dblgja32.exe
        
        C:\Windows\system32\Dblgja32.exe
        348⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Dmakgj32.exe
        
        C:\Windows\system32\Dmakgj32.exe
        349⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Dbndoa32.exe
        
        C:\Windows\system32\Dbndoa32.exe
        350⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Dmdhmj32.exe
        
        C:\Windows\system32\Dmdhmj32.exe
        351⤵
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Dbqqeahl.exe
        
        C:\Windows\system32\Dbqqeahl.exe
        352⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Emfebjgb.exe
        
        C:\Windows\system32\Emfebjgb.exe
        353⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Ebcmjqej.exe
        
        C:\Windows\system32\Ebcmjqej.exe
        354⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Emhahiep.exe
        
        C:\Windows\system32\Emhahiep.exe
        355⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        356⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Elnoifjg.exe
        
        C:\Windows\system32\Elnoifjg.exe
        357⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ebggep32.exe
        
        C:\Windows\system32\Ebggep32.exe
        358⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Emmkci32.exe
        
        C:\Windows\system32\Emmkci32.exe
        359⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ebjckppa.exe
        
        C:\Windows\system32\Ebjckppa.exe
        360⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Emphhhoh.exe
        
        C:\Windows\system32\Emphhhoh.exe
        361⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        362⤵
        Modifies registry class
        
        PID:9772
        
        C:\Windows\SysWOW64\Ejchbmna.exe
        
        C:\Windows\system32\Ejchbmna.exe
        363⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Fppqjcli.exe
        
        C:\Windows\system32\Fppqjcli.exe
        364⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        365⤵
        Drops file in System32 directory
        
        PID:9964
        
        C:\Windows\SysWOW64\Flgaodbm.exe
        
        C:\Windows\system32\Flgaodbm.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10032
        
        C:\Windows\SysWOW64\Flinddpj.exe
        
        C:\Windows\system32\Flinddpj.exe
        367⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Fbcfan32.exe
        
        C:\Windows\system32\Fbcfan32.exe
        368⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Fimonh32.exe
        
        C:\Windows\system32\Fimonh32.exe
        369⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Fjmkhkff.exe
        
        C:\Windows\system32\Fjmkhkff.exe
        370⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Fpjcpbdn.exe
        
        C:\Windows\system32\Fpjcpbdn.exe
        371⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Fbhplnca.exe
        
        C:\Windows\system32\Fbhplnca.exe
        372⤵
        Drops file in System32 directory
        
        PID:9568
        
        C:\Windows\SysWOW64\Gmndjf32.exe
        
        C:\Windows\system32\Gmndjf32.exe
        373⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Gbjlbm32.exe
        
        C:\Windows\system32\Gbjlbm32.exe
        374⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Gmpqof32.exe
        
        C:\Windows\system32\Gmpqof32.exe
        375⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Gbmigm32.exe
        
        C:\Windows\system32\Gbmigm32.exe
        376⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Gmbmefob.exe
        
        C:\Windows\system32\Gmbmefob.exe
        377⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Gkfnnjnl.exe
        
        C:\Windows\system32\Gkfnnjnl.exe
        378⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Glgjfb32.exe
        
        C:\Windows\system32\Glgjfb32.exe
        379⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Gbabblkg.exe
        
        C:\Windows\system32\Gbabblkg.exe
        380⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Gikkof32.exe
        
        C:\Windows\system32\Gikkof32.exe
        381⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Gdaomobj.exe
        
        C:\Windows\system32\Gdaomobj.exe
        382⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Hingefqa.exe
        
        C:\Windows\system32\Hingefqa.exe
        383⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Hlldaape.exe
        
        C:\Windows\system32\Hlldaape.exe
        384⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Hbflnl32.exe
        
        C:\Windows\system32\Hbflnl32.exe
        385⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hmlpkd32.exe
        
        C:\Windows\system32\Hmlpkd32.exe
        386⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Hchickeo.exe
        
        C:\Windows\system32\Hchickeo.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10252
        
        C:\Windows\SysWOW64\Hibape32.exe
        
        C:\Windows\system32\Hibape32.exe
        388⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        389⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Hienee32.exe
        
        C:\Windows\system32\Hienee32.exe
        390⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:10380
        
        C:\Windows\SysWOW64\Higjkehf.exe
        
        C:\Windows\system32\Higjkehf.exe
        392⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        393⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Inecac32.exe
        
        C:\Windows\system32\Inecac32.exe
        394⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Iildfd32.exe
        
        C:\Windows\system32\Iildfd32.exe
        395⤵
        Drops file in System32 directory
        
        PID:10512
        
        C:\Windows\SysWOW64\Ipflcnln.exe
        
        C:\Windows\system32\Ipflcnln.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10552
        
        C:\Windows\SysWOW64\Igpdph32.exe
        
        C:\Windows\system32\Igpdph32.exe
        397⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        398⤵
        Drops file in System32 directory
        
        PID:10648
        
        C:\Windows\SysWOW64\Iknmfg32.exe
        
        C:\Windows\system32\Iknmfg32.exe
        399⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Idfaolpb.exe
        
        C:\Windows\system32\Idfaolpb.exe
        400⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Ijcjgcni.exe
        
        C:\Windows\system32\Ijcjgcni.exe
        401⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Ipmbcm32.exe
        
        C:\Windows\system32\Ipmbcm32.exe
        402⤵
        Drops file in System32 directory
        
        PID:10800
        
        C:\Windows\SysWOW64\Jkbfafel.exe
        
        C:\Windows\system32\Jkbfafel.exe
        403⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Jlcchn32.exe
        
        C:\Windows\system32\Jlcchn32.exe
        404⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Jcmkehcg.exe
        
        C:\Windows\system32\Jcmkehcg.exe
        405⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Jjgcbb32.exe
        
        C:\Windows\system32\Jjgcbb32.exe
        406⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Jpalomaq.exe
        
        C:\Windows\system32\Jpalomaq.exe
        407⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Jgkdkg32.exe
        
        C:\Windows\system32\Jgkdkg32.exe
        408⤵
        Drops file in System32 directory
        
        PID:11000
        
        C:\Windows\SysWOW64\Jdodekhg.exe
        
        C:\Windows\system32\Jdodekhg.exe
        409⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Jjlmmbfo.exe
        
        C:\Windows\system32\Jjlmmbfo.exe
        410⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        411⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Jgpmffeh.exe
        
        C:\Windows\system32\Jgpmffeh.exe
        412⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        413⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Kgbjlf32.exe
        
        C:\Windows\system32\Kgbjlf32.exe
        414⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Kdfjej32.exe
        
        C:\Windows\system32\Kdfjej32.exe
        415⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Kgefae32.exe
        
        C:\Windows\system32\Kgefae32.exe
        416⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Kqmkjk32.exe
        
        C:\Windows\system32\Kqmkjk32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10432
        
        C:\Windows\SysWOW64\Kjepcqnd.exe
        
        C:\Windows\system32\Kjepcqnd.exe
        418⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Kdkdqinj.exe
        
        C:\Windows\system32\Kdkdqinj.exe
        419⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        420⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Kcpqafba.exe
        
        C:\Windows\system32\Kcpqafba.exe
        421⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Knfeoobh.exe
        
        C:\Windows\system32\Knfeoobh.exe
        422⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Ldpmlh32.exe
        
        C:\Windows\system32\Ldpmlh32.exe
        423⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Lnhadnpe.exe
        
        C:\Windows\system32\Lnhadnpe.exe
        424⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ldbjah32.exe
        
        C:\Windows\system32\Ldbjah32.exe
        425⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Ljobiofi.exe
        
        C:\Windows\system32\Ljobiofi.exe
        426⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
        
        C:\Windows\SysWOW64\Lqikfi32.exe
        
        C:\Windows\system32\Lqikfi32.exe
        427⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Lgccccec.exe
        
        C:\Windows\system32\Lgccccec.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10976
        
        C:\Windows\SysWOW64\Lqkgli32.exe
        
        C:\Windows\system32\Lqkgli32.exe
        429⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Lkqliaki.exe
        
        C:\Windows\system32\Lkqliaki.exe
        430⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Lqndahiq.exe
        
        C:\Windows\system32\Lqndahiq.exe
        431⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11140
        
        C:\Windows\SysWOW64\Lgglnb32.exe
        
        C:\Windows\system32\Lgglnb32.exe
        432⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11192
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\Mjhepnno.exe
        
        C:\Windows\system32\Mjhepnno.exe
        434⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Menimfnd.exe
        
        C:\Windows\system32\Menimfnd.exe
        435⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Mkhajq32.exe
        
        C:\Windows\system32\Mkhajq32.exe
        436⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Mminaikp.exe
        
        C:\Windows\system32\Mminaikp.exe
        437⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Mgoboake.exe
        
        C:\Windows\system32\Mgoboake.exe
        438⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        439⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Mceccbpj.exe
        
        C:\Windows\system32\Mceccbpj.exe
        440⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Mjokpm32.exe
        
        C:\Windows\system32\Mjokpm32.exe
        441⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Meepne32.exe
        
        C:\Windows\system32\Meepne32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2844
        
        C:\Windows\SysWOW64\Mlohjpoi.exe
        
        C:\Windows\system32\Mlohjpoi.exe
        443⤵
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        444⤵
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        445⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Neiiiecg.exe
        
        C:\Windows\system32\Neiiiecg.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10324
        
        C:\Windows\SysWOW64\Nlcaeo32.exe
        
        C:\Windows\system32\Nlcaeo32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10308
        
        C:\Windows\SysWOW64\Napjnfik.exe
        
        C:\Windows\system32\Napjnfik.exe
        448⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Nhjbjp32.exe
        
        C:\Windows\system32\Nhjbjp32.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:4592
        
        C:\Windows\SysWOW64\Nmgjbg32.exe
        
        C:\Windows\system32\Nmgjbg32.exe
        450⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Ndaboafl.exe
        
        C:\Windows\system32\Ndaboafl.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10636
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        452⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Neqoidmo.exe
        
        C:\Windows\system32\Neqoidmo.exe
        453⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        454⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        455⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Olmdln32.exe
        
        C:\Windows\system32\Olmdln32.exe
        456⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3248
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        458⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Ojbamj32.exe
        
        C:\Windows\system32\Ojbamj32.exe
        459⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Oaliidon.exe
        
        C:\Windows\system32\Oaliidon.exe
        460⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Ohfafn32.exe
        
        C:\Windows\system32\Ohfafn32.exe
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:11120
        
        C:\Windows\SysWOW64\Oanfodmk.exe
        
        C:\Windows\system32\Oanfodmk.exe
        462⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\Oldjlm32.exe
        
        C:\Windows\system32\Oldjlm32.exe
        463⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Oaqbdc32.exe
        
        C:\Windows\system32\Oaqbdc32.exe
        464⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Pkigmiai.exe
        
        C:\Windows\system32\Pkigmiai.exe
        465⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Pacojc32.exe
        
        C:\Windows\system32\Pacojc32.exe
        466⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Phmhgmpc.exe
        
        C:\Windows\system32\Phmhgmpc.exe
        467⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Pogpcghp.exe
        
        C:\Windows\system32\Pogpcghp.exe
        468⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Peahpa32.exe
        
        C:\Windows\system32\Peahpa32.exe
        469⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\Pknqhh32.exe
        
        C:\Windows\system32\Pknqhh32.exe
        470⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Pecefa32.exe
        
        C:\Windows\system32\Pecefa32.exe
        471⤵
        Drops file in System32 directory
        
        PID:10612
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        472⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2832
        
        C:\Windows\SysWOW64\Qlbfnk32.exe
        
        C:\Windows\system32\Qlbfnk32.exe
        474⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Qaoofaoi.exe
        
        C:\Windows\system32\Qaoofaoi.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1264
        
        C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3432
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        477⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\Qemhlp32.exe
        
        C:\Windows\system32\Qemhlp32.exe
        478⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Alfpijll.exe
        
        C:\Windows\system32\Alfpijll.exe
        479⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Alimnj32.exe
        
        C:\Windows\system32\Alimnj32.exe
        481⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Aeaagoaj.exe
        
        C:\Windows\system32\Aeaagoaj.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:996
        
        C:\Windows\SysWOW64\Akniofoa.exe
        
        C:\Windows\system32\Akniofoa.exe
        483⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Aahblp32.exe
        
        C:\Windows\system32\Aahblp32.exe
        484⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Ahbjij32.exe
        
        C:\Windows\system32\Ahbjij32.exe
        485⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Akqfef32.exe
        
        C:\Windows\system32\Akqfef32.exe
        486⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Aajoapdk.exe
        
        C:\Windows\system32\Aajoapdk.exe
        487⤵
        Drops file in System32 directory
        
        PID:696
        
        C:\Windows\SysWOW64\Alpboida.exe
        
        C:\Windows\system32\Alpboida.exe
        488⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Anaofa32.exe
        
        C:\Windows\system32\Anaofa32.exe
        489⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Bdkgckal.exe
        
        C:\Windows\system32\Bdkgckal.exe
        490⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Boqlqd32.exe
        
        C:\Windows\system32\Boqlqd32.exe
        491⤵
        System Location Discovery: System Language Discovery
        
        PID:11300
        
        C:\Windows\SysWOW64\Bdndik32.exe
        
        C:\Windows\system32\Bdndik32.exe
        492⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        493⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Bkjikd32.exe
        
        C:\Windows\system32\Bkjikd32.exe
        494⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Beomhm32.exe
        
        C:\Windows\system32\Beomhm32.exe
        495⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Bohbackj.exe
        
        C:\Windows\system32\Bohbackj.exe
        496⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        497⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Bojogb32.exe
        
        C:\Windows\system32\Bojogb32.exe
        498⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Cfdgcmqd.exe
        
        C:\Windows\system32\Cfdgcmqd.exe
        499⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Clnopg32.exe
        
        C:\Windows\system32\Clnopg32.exe
        500⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        501⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Chepehne.exe
        
        C:\Windows\system32\Chepehne.exe
        502⤵
        System Location Discovery: System Language Discovery
        
        PID:11804
        
        C:\Windows\SysWOW64\Coohbbeb.exe
        
        C:\Windows\system32\Coohbbeb.exe
        503⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Cfipol32.exe
        
        C:\Windows\system32\Cfipol32.exe
        504⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Ckeigc32.exe
        
        C:\Windows\system32\Ckeigc32.exe
        505⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Cdnmphag.exe
        
        C:\Windows\system32\Cdnmphag.exe
        506⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Ckhelb32.exe
        
        C:\Windows\system32\Ckhelb32.exe
        507⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Cbbnim32.exe
        
        C:\Windows\system32\Cbbnim32.exe
        508⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Chlffghn.exe
        
        C:\Windows\system32\Chlffghn.exe
        509⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Cninnnfe.exe
        
        C:\Windows\system32\Cninnnfe.exe
        510⤵
        System Location Discovery: System Language Discovery
        
        PID:12236
        
        C:\Windows\SysWOW64\Dbfgdllk.exe
        
        C:\Windows\system32\Dbfgdllk.exe
        511⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Ddecpgko.exe
        
        C:\Windows\system32\Ddecpgko.exe
        512⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        513⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        514⤵
        System Location Discovery: System Language Discovery
        
        PID:11316
        
        C:\Windows\SysWOW64\Ddgpfgil.exe
        
        C:\Windows\system32\Ddgpfgil.exe
        515⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Dkahba32.exe
        
        C:\Windows\system32\Dkahba32.exe
        516⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Dfglpjqo.exe
        
        C:\Windows\system32\Dfglpjqo.exe
        517⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Dmqdmd32.exe
        
        C:\Windows\system32\Dmqdmd32.exe
        518⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Dfiiejnl.exe
        
        C:\Windows\system32\Dfiiejnl.exe
        519⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Digeaenp.exe
        
        C:\Windows\system32\Digeaenp.exe
        520⤵
        Drops file in System32 directory
        
        PID:11552
        
        C:\Windows\SysWOW64\Doanno32.exe
        
        C:\Windows\system32\Doanno32.exe
        521⤵
        System Location Discovery: System Language Discovery
        
        PID:11584
        
        C:\Windows\SysWOW64\Efkfkilj.exe
        
        C:\Windows\system32\Efkfkilj.exe
        522⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Ekhncp32.exe
        
        C:\Windows\system32\Ekhncp32.exe
        523⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Engjol32.exe
        
        C:\Windows\system32\Engjol32.exe
        524⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Eeqclfaa.exe
        
        C:\Windows\system32\Eeqclfaa.exe
        525⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Ekkkip32.exe
        
        C:\Windows\system32\Ekkkip32.exe
        526⤵
        Drops file in System32 directory
        
        PID:11844
        
        C:\Windows\SysWOW64\Ebdcejpk.exe
        
        C:\Windows\system32\Ebdcejpk.exe
        527⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Eiokbd32.exe
        
        C:\Windows\system32\Eiokbd32.exe
        528⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\Eohcon32.exe
        
        C:\Windows\system32\Eohcon32.exe
        529⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Eeelge32.exe
        
        C:\Windows\system32\Eeelge32.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5000
        
        C:\Windows\SysWOW64\Epkpdn32.exe
        
        C:\Windows\system32\Epkpdn32.exe
        531⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Fmancbji.exe
        
        C:\Windows\system32\Fmancbji.exe
        532⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Fbnflihq.exe
        
        C:\Windows\system32\Fbnflihq.exe
        533⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Windows\SysWOW64\Fmcjiagf.exe
        
        C:\Windows\system32\Fmcjiagf.exe
        534⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Fnegqjne.exe
        
        C:\Windows\system32\Fnegqjne.exe
        535⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Feoomd32.exe
        
        C:\Windows\system32\Feoomd32.exe
        536⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Fmfgoa32.exe
        
        C:\Windows\system32\Fmfgoa32.exe
        537⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Ffnkggld.exe
        
        C:\Windows\system32\Ffnkggld.exe
        538⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Fnipliip.exe
        
        C:\Windows\system32\Fnipliip.exe
        539⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Fechhcal.exe
        
        C:\Windows\system32\Fechhcal.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1108
        
        C:\Windows\SysWOW64\Gfcebf32.exe
        
        C:\Windows\system32\Gfcebf32.exe
        541⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Gpkiklop.exe
        
        C:\Windows\system32\Gpkiklop.exe
        542⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Gfeahffl.exe
        
        C:\Windows\system32\Gfeahffl.exe
        543⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Glbjpmdd.exe
        
        C:\Windows\system32\Glbjpmdd.exe
        544⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Gblbmg32.exe
        
        C:\Windows\system32\Gblbmg32.exe
        545⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Gifjjacn.exe
        
        C:\Windows\system32\Gifjjacn.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:864
        
        C:\Windows\SysWOW64\Gppcfk32.exe
        
        C:\Windows\system32\Gppcfk32.exe
        547⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Gfjkce32.exe
        
        C:\Windows\system32\Gfjkce32.exe
        548⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Gbqlhfgk.exe
        
        C:\Windows\system32\Gbqlhfgk.exe
        549⤵
        Modifies registry class
        
        PID:12232
        
        C:\Windows\SysWOW64\Gikdep32.exe
        
        C:\Windows\system32\Gikdep32.exe
        550⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Hpdlajfe.exe
        
        C:\Windows\system32\Hpdlajfe.exe
        551⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Headjael.exe
        
        C:\Windows\system32\Headjael.exe
        552⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Hmhmko32.exe
        
        C:\Windows\system32\Hmhmko32.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11536
        
        C:\Windows\SysWOW64\Hojibgkm.exe
        
        C:\Windows\system32\Hojibgkm.exe
        554⤵
        Drops file in System32 directory
        
        PID:11616
        
        C:\Windows\SysWOW64\Hedaoa32.exe
        
        C:\Windows\system32\Hedaoa32.exe
        555⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Hlnjlkjf.exe
        
        C:\Windows\system32\Hlnjlkjf.exe
        556⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Holfhfij.exe
        
        C:\Windows\system32\Holfhfij.exe
        557⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Hiajeoip.exe
        
        C:\Windows\system32\Hiajeoip.exe
        558⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Hoobnf32.exe
        
        C:\Windows\system32\Hoobnf32.exe
        559⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Hidgko32.exe
        
        C:\Windows\system32\Hidgko32.exe
        560⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Hoaocf32.exe
        
        C:\Windows\system32\Hoaocf32.exe
        561⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Hifcqo32.exe
        
        C:\Windows\system32\Hifcqo32.exe
        562⤵
        Drops file in System32 directory
        
        PID:12180
        
        C:\Windows\SysWOW64\Iocliecb.exe
        
        C:\Windows\system32\Iocliecb.exe
        563⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12216
        
        C:\Windows\SysWOW64\Ifjdjbdd.exe
        
        C:\Windows\system32\Ifjdjbdd.exe
        564⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Imdlgm32.exe
        
        C:\Windows\system32\Imdlgm32.exe
        565⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Ioeineap.exe
        
        C:\Windows\system32\Ioeineap.exe
        566⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Igmqpbab.exe
        
        C:\Windows\system32\Igmqpbab.exe
        567⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Imfill32.exe
        
        C:\Windows\system32\Imfill32.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3660
        
        C:\Windows\SysWOW64\Iebnqofj.exe
        
        C:\Windows\system32\Iebnqofj.exe
        569⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Icfnjcec.exe
        
        C:\Windows\system32\Icfnjcec.exe
        570⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Iipfgm32.exe
        
        C:\Windows\system32\Iipfgm32.exe
        571⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
        
        C:\Windows\SysWOW64\Iomood32.exe
        
        C:\Windows\system32\Iomood32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Iibclmkn.exe
        
        C:\Windows\system32\Iibclmkn.exe
        573⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Jookdcie.exe
        
        C:\Windows\system32\Jookdcie.exe
        574⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\Jidpblik.exe
        
        C:\Windows\system32\Jidpblik.exe
        575⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Jpnhof32.exe
        
        C:\Windows\system32\Jpnhof32.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Jghpkq32.exe
        
        C:\Windows\system32\Jghpkq32.exe
        577⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Jiglgl32.exe
        
        C:\Windows\system32\Jiglgl32.exe
        578⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Jocepc32.exe
        
        C:\Windows\system32\Jocepc32.exe
        579⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Jiiiml32.exe
        
        C:\Windows\system32\Jiiiml32.exe
        580⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        581⤵
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\Jikfbkbc.exe
        
        C:\Windows\system32\Jikfbkbc.exe
        582⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Jpenoe32.exe
        
        C:\Windows\system32\Jpenoe32.exe
        583⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Jebfgl32.exe
        
        C:\Windows\system32\Jebfgl32.exe
        584⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        585⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Kgacaopj.exe
        
        C:\Windows\system32\Kgacaopj.exe
        586⤵
        
        PID:484
        
        C:\Windows\SysWOW64\Knlknigf.exe
        
        C:\Windows\system32\Knlknigf.exe
        587⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        588⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Klahof32.exe
        
        C:\Windows\system32\Klahof32.exe
        589⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        590⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Kpoaed32.exe
        
        C:\Windows\system32\Kpoaed32.exe
        591⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Kgiibnib.exe
        
        C:\Windows\system32\Kgiibnib.exe
        592⤵
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Knbaoh32.exe
        
        C:\Windows\system32\Knbaoh32.exe
        593⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Kodnfqgm.exe
        
        C:\Windows\system32\Kodnfqgm.exe
        594⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        595⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Llhnpe32.exe
        
        C:\Windows\system32\Llhnpe32.exe
        596⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Lcbfmomc.exe
        
        C:\Windows\system32\Lcbfmomc.exe
        597⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        598⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Lqfgfclm.exe
        
        C:\Windows\system32\Lqfgfclm.exe
        599⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Lgpocm32.exe
        
        C:\Windows\system32\Lgpocm32.exe
        600⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Llmhkd32.exe
        
        C:\Windows\system32\Llmhkd32.exe
        601⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Ljqhdhpk.exe
        
        C:\Windows\system32\Ljqhdhpk.exe
        602⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Lqjqab32.exe
        
        C:\Windows\system32\Lqjqab32.exe
        603⤵
        Modifies registry class
        
        PID:2716
        
        C:\Windows\SysWOW64\Lgdinmod.exe
        
        C:\Windows\system32\Lgdinmod.exe
        604⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Lnnakg32.exe
        
        C:\Windows\system32\Lnnakg32.exe
        605⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Lqmmgb32.exe
        
        C:\Windows\system32\Lqmmgb32.exe
        606⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        607⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Mmcnlc32.exe
        
        C:\Windows\system32\Mmcnlc32.exe
        608⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Mcnfhmcf.exe
        
        C:\Windows\system32\Mcnfhmcf.exe
        609⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\Mcpcnm32.exe
        
        C:\Windows\system32\Mcpcnm32.exe
        610⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Mqdcga32.exe
        
        C:\Windows\system32\Mqdcga32.exe
        611⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Mgnldkgj.exe
        
        C:\Windows\system32\Mgnldkgj.exe
        612⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Mmkdlbea.exe
        
        C:\Windows\system32\Mmkdlbea.exe
        613⤵
        Drops file in System32 directory
        
        PID:12532
        
        C:\Windows\SysWOW64\Mgphjk32.exe
        
        C:\Windows\system32\Mgphjk32.exe
        614⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Mjodff32.exe
        
        C:\Windows\system32\Mjodff32.exe
        615⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Ncgiolkk.exe
        
        C:\Windows\system32\Ncgiolkk.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12636
        
        C:\Windows\SysWOW64\Njaakf32.exe
        
        C:\Windows\system32\Njaakf32.exe
        617⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Npnjcm32.exe
        
        C:\Windows\system32\Npnjcm32.exe
        618⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Nfhbpghl.exe
        
        C:\Windows\system32\Nfhbpghl.exe
        619⤵
        System Location Discovery: System Language Discovery
        
        PID:12756
        
        C:\Windows\SysWOW64\Nnojad32.exe
        
        C:\Windows\system32\Nnojad32.exe
        620⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12796
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        621⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Nfjofg32.exe
        
        C:\Windows\system32\Nfjofg32.exe
        622⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Nqpccp32.exe
        
        C:\Windows\system32\Nqpccp32.exe
        623⤵
        Drops file in System32 directory
        
        PID:12900
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        624⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Nmfchq32.exe
        
        C:\Windows\system32\Nmfchq32.exe
        625⤵
        Drops file in System32 directory
        
        PID:12972
        
        C:\Windows\SysWOW64\Nfohafad.exe
        
        C:\Windows\system32\Nfohafad.exe
        626⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Nadlnoaj.exe
        
        C:\Windows\system32\Nadlnoaj.exe
        627⤵
        Modifies registry class
        
        PID:13052
        
        C:\Windows\SysWOW64\Ogndki32.exe
        
        C:\Windows\system32\Ogndki32.exe
        628⤵
        Modifies registry class
        
        PID:13092
        
        C:\Windows\SysWOW64\Omkmcpgo.exe
        
        C:\Windows\system32\Omkmcpgo.exe
        629⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Ojommdfh.exe
        
        C:\Windows\system32\Ojommdfh.exe
        630⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        631⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Oakbonkb.exe
        
        C:\Windows\system32\Oakbonkb.exe
        632⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        633⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Ombcdo32.exe
        
        C:\Windows\system32\Ombcdo32.exe
        634⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Oclkqihc.exe
        
        C:\Windows\system32\Oclkqihc.exe
        635⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        636⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\Phjdggoj.exe
        
        C:\Windows\system32\Phjdggoj.exe
        637⤵
        System Location Discovery: System Language Discovery
        
        PID:12492
        
        C:\Windows\SysWOW64\Pndlca32.exe
        
        C:\Windows\system32\Pndlca32.exe
        638⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        639⤵
        Drops file in System32 directory
        
        PID:12592
        
        C:\Windows\SysWOW64\Pnfiia32.exe
        
        C:\Windows\system32\Pnfiia32.exe
        640⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        641⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Phombg32.exe
        
        C:\Windows\system32\Phombg32.exe
        642⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Pagbklae.exe
        
        C:\Windows\system32\Pagbklae.exe
        643⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Pdenghpi.exe
        
        C:\Windows\system32\Pdenghpi.exe
        644⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Pnkbdqpo.exe
        
        C:\Windows\system32\Pnkbdqpo.exe
        645⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Pploli32.exe
        
        C:\Windows\system32\Pploli32.exe
        646⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12924
        
        C:\Windows\SysWOW64\Phcgmffo.exe
        
        C:\Windows\system32\Phcgmffo.exe
        647⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        648⤵
        Modifies registry class
        
        PID:13004
        
        C:\Windows\SysWOW64\Qjdpoacp.exe
        
        C:\Windows\system32\Qjdpoacp.exe
        649⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Ameipl32.exe
        
        C:\Windows\system32\Ameipl32.exe
        650⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Adoamfhn.exe
        
        C:\Windows\system32\Adoamfhn.exe
        651⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Akiijq32.exe
        
        C:\Windows\system32\Akiijq32.exe
        652⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Apeabg32.exe
        
        C:\Windows\system32\Apeabg32.exe
        653⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Afpjoaeo.exe
        
        C:\Windows\system32\Afpjoaeo.exe
        654⤵
        Modifies registry class
        
        PID:12392
        
        C:\Windows\SysWOW64\Aaenlj32.exe
        
        C:\Windows\system32\Aaenlj32.exe
        655⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12396
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        656⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Aoioeo32.exe
        
        C:\Windows\system32\Aoioeo32.exe
        657⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12496
        
        C:\Windows\SysWOW64\Apjkmgjm.exe
        
        C:\Windows\system32\Apjkmgjm.exe
        658⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Akpojpic.exe
        
        C:\Windows\system32\Akpojpic.exe
        659⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Aajggjap.exe
        
        C:\Windows\system32\Aajggjap.exe
        660⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        661⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Baldmiom.exe
        
        C:\Windows\system32\Baldmiom.exe
        662⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Bgimepmd.exe
        
        C:\Windows\system32\Bgimepmd.exe
        663⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        664⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
        
        C:\Windows\SysWOW64\Bhhiocdg.exe
        
        C:\Windows\system32\Bhhiocdg.exe
        665⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Bobalm32.exe
        
        C:\Windows\system32\Bobalm32.exe
        666⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:13032
        
        C:\Windows\SysWOW64\Baanhi32.exe
        
        C:\Windows\system32\Baanhi32.exe
        667⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Bhkfdcbd.exe
        
        C:\Windows\system32\Bhkfdcbd.exe
        668⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Bpfkiepp.exe
        
        C:\Windows\system32\Bpfkiepp.exe
        669⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Bgbpkoej.exe
        
        C:\Windows\system32\Bgbpkoej.exe
        670⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Cnlhhi32.exe
        
        C:\Windows\system32\Cnlhhi32.exe
        671⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Windows\SysWOW64\Cdfpdc32.exe
        
        C:\Windows\system32\Cdfpdc32.exe
        672⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Cnodmijd.exe
        
        C:\Windows\system32\Cnodmijd.exe
        673⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12456
        
        C:\Windows\SysWOW64\Cdhmjc32.exe
        
        C:\Windows\system32\Cdhmjc32.exe
        674⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Cggifn32.exe
        
        C:\Windows\system32\Cggifn32.exe
        675⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Cnaachha.exe
        
        C:\Windows\system32\Cnaachha.exe
        676⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cgiflnoa.exe
        
        C:\Windows\system32\Cgiflnoa.exe
        677⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        678⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Chibfa32.exe
        
        C:\Windows\system32\Chibfa32.exe
        679⤵
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Cneknh32.exe
        
        C:\Windows\system32\Cneknh32.exe
        680⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Chkokq32.exe
        
        C:\Windows\system32\Chkokq32.exe
        681⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Daccdf32.exe
        
        C:\Windows\system32\Daccdf32.exe
        682⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Dhnlapbo.exe
        
        C:\Windows\system32\Dhnlapbo.exe
        683⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Dogdnj32.exe
        
        C:\Windows\system32\Dogdnj32.exe
        684⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Dddlfa32.exe
        
        C:\Windows\system32\Dddlfa32.exe
        685⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Dkndbkop.exe
        
        C:\Windows\system32\Dkndbkop.exe
        686⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Dqkmkb32.exe
        
        C:\Windows\system32\Dqkmkb32.exe
        687⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12324
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        688⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Doojni32.exe
        
        C:\Windows\system32\Doojni32.exe
        689⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Ddkbfp32.exe
        
        C:\Windows\system32\Ddkbfp32.exe
        690⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Eoagdi32.exe
        
        C:\Windows\system32\Eoagdi32.exe
        691⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Eqbclagp.exe
        
        C:\Windows\system32\Eqbclagp.exe
        692⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Ekggijge.exe
        
        C:\Windows\system32\Ekggijge.exe
        693⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ebapednb.exe
        
        C:\Windows\system32\Ebapednb.exe
        694⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
        
        C:\Windows\SysWOW64\Ehlhbn32.exe
        
        C:\Windows\system32\Ehlhbn32.exe
        695⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Enhpje32.exe
        
        C:\Windows\system32\Enhpje32.exe
        696⤵
        Modifies registry class
        
        PID:13172
        
        C:\Windows\SysWOW64\Edbhgokc.exe
        
        C:\Windows\system32\Edbhgokc.exe
        697⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Eohmdhki.exe
        
        C:\Windows\system32\Eohmdhki.exe
        698⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13200
        
        C:\Windows\SysWOW64\Eddemo32.exe
        
        C:\Windows\system32\Eddemo32.exe
        699⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Ekoniian.exe
        
        C:\Windows\system32\Ekoniian.exe
        700⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Enmjedpa.exe
        
        C:\Windows\system32\Enmjedpa.exe
        701⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Edgbbo32.exe
        
        C:\Windows\system32\Edgbbo32.exe
        702⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Fomfpg32.exe
        
        C:\Windows\system32\Fomfpg32.exe
        703⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Fqnbgpmb.exe
        
        C:\Windows\system32\Fqnbgpmb.exe
        704⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Fghkdjdo.exe
        
        C:\Windows\system32\Fghkdjdo.exe
        705⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Fbmoabde.exe
        
        C:\Windows\system32\Fbmoabde.exe
        706⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Figgnm32.exe
        
        C:\Windows\system32\Figgnm32.exe
        707⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Fndpfc32.exe
        
        C:\Windows\system32\Fndpfc32.exe
        708⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Fepehm32.exe
        
        C:\Windows\system32\Fepehm32.exe
        709⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fkjmeggp.exe
        
        C:\Windows\system32\Fkjmeggp.exe
        710⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 448
        711⤵
        Program crash
        
        PID:7040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7656 -ip 7656
1⤵
PID:12452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hbbdad32.exe

Path C:\Windows\SysWOW64\Hbbdad32.exe
Size 320KB
SHA256 dff7007c8135d60fc20b8f8cc508ea8a8b0c48a04f5e5fdd55d2e19a678bbe67
MD5 86debc9f7680742955f8175a418223d9
SHA1 ae9ca18198b06c05be3391d7bae792ea94734e01
SHA512 bba25be9ee5b8cca96ff601975cca54b475c274e05585395751240c703ae97f09e3df3476a70694c476479588fe7f6626635b5cf1343411dcabc814bf42fb5bd
SSDEEP 3072:jhQT9E3OpiDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:9OWOYDV/Ah1G/AcQ///NR5fn
TLSH
T197642F59263009EACDED5BB5AC028DD85942E9F014F1E23E6223DFDCD8E4DB6C859F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkfookmo.exe

Path C:\Windows\SysWOW64\Hkfookmo.exe
Size 320KB
SHA256 061f043245cdceb8a1bb2c1ef7aec388072377d6bacd026be6c7c743b1da5fd2
MD5 3ee10e9056216fdb9728c3f261ddfadd
SHA1 a7ac87697863043038b4ccbe0dce9d62cfd8b053
SHA512 8b161cf4b5a6902e2c65e429ac0a7b58d40943b4fde2d6ce1a4e49bed7621c7f50f8cfab7efeb9313880fb4ec1911d1ed090bb49d24823ec7bee0750007ecfe9
SSDEEP 3072:hg0/j1pGiKZ28z6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hg0/DBs226V/Ah1G/AcQ///NR5fn
TLSH
T11364D9192A3489EACEED5BB5AC124DD86541E9F018F2E13E6123DFDCD8E4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkhkdjkl.exe

Path C:\Windows\SysWOW64\Hkhkdjkl.exe
Size 320KB
SHA256 eaf687894872c26987db66e3a035ed11c45e66bcd3ec28e590b160db577fff13
MD5 7100b0594f32b577140ece1bed9f44e1
SHA1 b0cb7dfe6568aabf037ee9e25170ff7d7384449c
SHA512 12a8203d1382e4552260f639ac48485cd8bbcfbe7eb826663f4adb2095128263638a97cbc9ee0134407cbbcbb52f90e59e3fb5f988df867b5f6fdfa94534a1be
SSDEEP 3072:R+9Neb5QpBN5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:keVQ15V/Ah1G/AcQ///NR5fn
TLSH
T190644219263409EACEED1FB5AD1249D89581E9F058F1E13E6223DFECC8E4DA6CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibeqgdpf.exe

Path C:\Windows\SysWOW64\Ibeqgdpf.exe
Size 320KB
SHA256 214389d7a347fdf65367d7f336b4796ce46cca5ac6672fd268f3334f7be700ff
MD5 e74d78e5063fa641fc8e4fcaef046116
SHA1 3ac60ac8cb427a42d73350318284c6ef8de79d36
SHA512 b310e1bafa9c5e96a22b044bd52bb4d998c1d678f35f4c5dbeb8fdb3b3c64c9448dc78f192519cc579875bb2dcbb779fb3927e8211517e9556aa587ed997d742
SSDEEP 3072:OByqsCjvAj2RXwL0g2MEu5pwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:OE6LAj2RXo0c5pV/Ah1G/AcQ///NR5fn
TLSH
T10364201A263409FACEED1BB5EC1289D89585E9F015F1E13E6223DFDCD8E4DA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ifefbbdj.exe

Path C:\Windows\SysWOW64\Ifefbbdj.exe
Size 320KB
SHA256 7150a9c9c4446924ed2d2e2aaecd043b83a5f5dc1d4c72ffb92cf9dcf000ce91
MD5 712233c3895cdbfc60701cac3a126600
SHA1 722676f4d048eb3da981b216bfe135475652bb0e
SHA512 9f97f7c738e2321769533fd3c61b100f4a2ddeefd439590b67b124c51dce45966bf0542611c06e27fa317c6a00211e8d5bbd0c1be60b814f835604e872b5850f
SSDEEP 3072:3ltNGxbYckgvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:3lDSvV/Ah1G/AcQ///NR5fn
TLSH
T1E464FE191A3409EACDED5BF6AC1249D89241EAF014F2E13E6123DFDDE8E4DA6CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilfhfh32.exe

Path C:\Windows\SysWOW64\Ilfhfh32.exe
Size 320KB
SHA256 05e32c8f043850f6be89184b4a2c1c7bb5b60c8fa20311e1056ca78a8e669900
MD5 3100d3e1711235d6c25b1647234022ac
SHA1 a8a1b477327a392c70f926dd3e4884b7aed83e30
SHA512 0ef7672edf540a29fe3c58db7d13b425543d6f2d1da6fa006b06fe9f8a3071737e91bd79505961d385bbe5c025453122052c9c9b41cbae910d6c81adf0107b53
SSDEEP 3072:WLZ2b0FHvwM6lDiZ0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kC0F4lG0V/Ah1G/AcQ///NR5fn
TLSH
T13264EB1926304DEACDED1BB9AC1289D85141F9B014F1E23E6573EFDCD8E4DAAC819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ippgqg32.exe

Path C:\Windows\SysWOW64\Ippgqg32.exe
Size 320KB
SHA256 c6cadf2fe08cbb0b1fa1ceac18fcdeeb52b0d85dfdfd566d12d7e6b3b90a2e85
MD5 fa0fb489c7b7d50eca5af21e68a98200
SHA1 7e5633cd5ed4516a6f9cb8b1568de10336e69a0d
SHA512 1e071cec33fbfdefb1192b075ddd844cc7dd8e93a745fe4b749ec8da82d2fcabb12a5194bf7c757bdd188c317a7c121faf921bdc55626ab5370e80cc757dd7df
SSDEEP 6144:96rZu55Ct01ApR+v3aYpV/Ah1G/AcQ///NR5fn:96rZl/Nv
TLSH
T1C3643F1A163409EACEED1BB6EC6259E89141E8F014F1E23E6123DFDCD9E4DA2CC15F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfaenqjm.exe

Path C:\Windows\SysWOW64\Jfaenqjm.exe
Size 320KB
SHA256 8b8c65705e569b0dd27cdd81484a395a07b336733db3284b236e4db285bbd8b5
MD5 fa87267c782923c75e901321676086a2
SHA1 e99d9e84dc48d089d2159655f72add5d2bbed205
SHA512 03ea1a366d5f0e6f4e602020639ecf251eb36b9db83b858e489c234b1ecfd0957f2a834c901cffb5c165b974d20c24da2b9af860395c5393d127c82802bcb758
SSDEEP 3072:SQLz8d788854LIhSIEyrTwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:SXd7U4UBEyrTV/Ah1G/AcQ///NR5fn
TLSH
T104640F1A2A3509FACDFD1BBAAC1249D85141EAF114F1E13E6123DFDCD8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jfeoip32.exe

Path C:\Windows\SysWOW64\Jfeoip32.exe
Size 320KB
SHA256 21a7b448cc0316635dc886ec939a124e5cc80308a22ad6e559c7adc60e59c53e
MD5 47cc7faf8103d2f9f4ca09d013f501e2
SHA1 e5432aa501410efd0752313483c8211c6cd47ac4
SHA512 4eeae8e82cb53bd80d74c191b31d38a9782266a3a66b0bd979e579436e7e7fc6aa672587113eb6a7d92f856630c9e84627110b934c8ae1ff8297ba5e77a6b59a
SSDEEP 3072:7QFjCbzVr79N4M41wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tldNm1V/Ah1G/AcQ///NR5fn
TLSH
T1836440196A3909EAEEED1FB5AC1299D89141E8F014F1E53E2123DFDDD8E4DA6CC05F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlnnfghd.exe

Path C:\Windows\SysWOW64\Jlnnfghd.exe
Size 320KB
SHA256 141e5c4e2f7eb023fee481851e8b24ce0f1509fd128b4563a82ad5bd9e955ed1
MD5 72e158accb0379e97b534c9d8e82f51c
SHA1 246683ada66e56031095785aa45c27cd331afaac
SHA512 7757b1da5aea482c3abb1a7abbfc9cce6aef7dd40a2f2c5eb5100b37af1fef1a6e2d81645334d886868f6277043f8bfdc267aa1b2815b93d7da7200495d4d9ad
SSDEEP 3072:Ba7JVtN2xmsEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BqVtcgsEV/Ah1G/AcQ///NR5fn
TLSH
T140641B196A3109EACDFD1BB6AC0249D85141EAF514F1E23E2133DFDCD8E8DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jmfdpkeo.exe

Path C:\Windows\SysWOW64\Jmfdpkeo.exe
Size 320KB
SHA256 20957215ff9e8abb2896c7f3ac4700295cc86f0cdb17e13018963b53df102b2c
MD5 fc56ba8e69109388bfc1c564f8cf9dc7
SHA1 7cb7c405c688778c115d615fdb840905677e1399
SHA512 ad2a05b6dd111bf19cf063f774e15c63c25a9910aa665a65be8a4a33711478d7c7415badba6f46bf5fef1658adeccf10e38b4cc316b568c615275ffdd44c36e7
SSDEEP 3072:NUsgyj37uU433wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:BjiUS3V/Ah1G/AcQ///NR5fn
TLSH
T1886431292A3009FACDED2BB5AC1249E85185EAF514F1E53E6523DFDCC8E4DA3D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kdcbic32.exe

Path C:\Windows\SysWOW64\Kdcbic32.exe
Size 320KB
SHA256 b4840c9e7465f82d690ba535d223a8f08b705df7512c86b67a20194758b4c3cb
MD5 05540e412e1f3b1fb04d26e05e3ebdb4
SHA1 a4bea670636cd4bcc3cf7e90d064f4161fe0e099
SHA512 2942217a484e9d78d25169c5f3c437010591efc50934a4496ada9bc3d5c6d139d94887eca1844db974480cae0edb9330be865bc714977324e1825df51c3e4c19
SSDEEP 3072:gLdUMQsMwelZGttwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:gLeLsMw6ZGttV/Ah1G/AcQ///NR5fn
TLSH
T17E642F191A3409EACEED1FB5AC1249D9AD41E9F018F1E13E6123DFECD8E4DA6C905F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kmfmfigl.exe

Path C:\Windows\SysWOW64\Kmfmfigl.exe
Size 320KB
SHA256 a812937d308af328805d0a3c4663436d7ce82ddae8dee7e4f09ff36f0634d422
MD5 e1988558ecb879cab9da3f9724044122
SHA1 be7cf384ed98471ddcc8cf979840a04b36079293
SHA512 0e06838566bfd4f8bf146a4d64e2c560b1a7cea9e02bcb9961adadd07c006af3d33a1c1d4bc669fb5726d7d87a288c74e4f8710c330a82c2770157c1f622a70a
SSDEEP 3072:ELCIHUirCgsg6xkwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:+U1gs3kV/Ah1G/AcQ///NR5fn
TLSH
T1E0640F59263409EACEED1FB5BC1249DA5142E8F054F2E23E6123DFDCD8E4DA2D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kpncbemh.exe

Path C:\Windows\SysWOW64\Kpncbemh.exe
Size 320KB
SHA256 78486948c41d14a1dafce874576ec1561fe85062332d94ee552987d45e3124d1
MD5 146a6e49a38d7fa60832d8366e7aa4ff
SHA1 6e67da17d1c5881fd536e62c2422dae99b6802d5
SHA512 71794c0663ac96895763535336da3db4e106193483568a0b24a00c7f3d2aaeed390b6b91e20b123a0add8dcd1c7c3162c3973176d8ddc1bcc9f703f2fbd75650
SSDEEP 3072:4JvnQ6TUkcXgnnBn8j/2AwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:4JNUkcXgnB2+AV/Ah1G/AcQ///NR5fn
TLSH
T119642E195A344AEACEEE1BB5BD0289D89581E9F014F1E13E6163DFDCD8E4DA3C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lekeajmm.exe

Path C:\Windows\SysWOW64\Lekeajmm.exe
Size 320KB
SHA256 ec20e0494e61c455cb7b3b1862ef8c6731ba64d0e960ef30fed09b0f382df390
MD5 30aef268116bf397c7979d844dd2642b
SHA1 3f452f98d9b1550f366016809c4735d1348cd06c
SHA512 087735c88f78d3ec642dc9e992bc14b12682ecded65e2cc61077214d4a8c7aca6c00abaec2866341bb465fac8c188fd75e3a0dc432c671af3b5cdb2d076c5ccf
SSDEEP 3072:RuRV71UYUY/WlSEZwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ARQZV/Ah1G/AcQ///NR5fn
TLSH
T120642F291A3009EEDDED2BB5AC1249D89582E9F014F1E13E6533DFDCD8E4DA2E845F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Libggiik.exe

Path C:\Windows\SysWOW64\Libggiik.exe
Size 320KB
SHA256 54456a3fc59f04499f6ed2c5102da462e96272a4c49ce8495d76b2b3d85fab90
MD5 15b3b407cf3003507118d6f15f6490ae
SHA1 ce976b541741bf147b1ec48d1c94f63c3e21efde
SHA512 3c73c395e1b2713b40ba6ff84b2aadf40ccebc1c3288c54e427330429f34c402e357695e67048d971b32ca10edc1dda2f604ba0304591f8cf7670430c29d9771
SSDEEP 3072:s6tv9haj7W6atpwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s6lCTatpwV/Ah1G/AcQ///NR5fn
TLSH
T10D64EA1A663409EACEED1BB5AC1259D89185E8F018F1E17E61339FDCD8F4DA2C825FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Llemnd32.exe

Path C:\Windows\SysWOW64\Llemnd32.exe
Size 320KB
SHA256 93570bc5285e2882f4e4480d6bed2749a866338973c851ba8079198e76b93a23
MD5 0811c53f3a63d223947ea3908e572bbc
SHA1 af8dbf1053a992d747ad36d746a6e50fb642b013
SHA512 1d1bdf0b2b450c79bf06e4b0143bbb743026d2e124d0a1a9e4c7db35ab6162cb8b087047804c397a7e7137f3750a5a90f05b7075028d653670e1c4a2dc9f2a54
SSDEEP 3072:rIqk/PkkW4KPja4Ob3wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kqkGOb3V/Ah1G/AcQ///NR5fn
TLSH
T17D643E5A2A3449FACEED1BB6AC124DD89181E9F015F1E13E6523DFDCD8E4DA2D804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lmkfah32.exe

Path C:\Windows\SysWOW64\Lmkfah32.exe
Size 320KB
SHA256 622364699580ed25d3b034d41459f563e657e94b7f4b8357765307d07f08e8b0
MD5 89edcc8c14040f26229155f442b3291c
SHA1 5406a401b7bec93da83cf892bb8d1ad643443b2d
SHA512 ecde7568a315f8df8d450ff5a981be4cf46e1d8e6e980ea7f013bd168d89cf003f99f30a85e8a06b2c245da20751772cbe9799b20e86df0f87f6d3c397fc5abd
SSDEEP 3072:IH3WzgFzScyIwoAduwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:RgFzSRIwoAduV/Ah1G/AcQ///NR5fn
TLSH
T15164201A6A3009EACEED1BB5BC1249D85241E5F015F5E53E6123EFECC8F4DA2C859F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mdanjaqf.exe

Path C:\Windows\SysWOW64\Mdanjaqf.exe
Size 320KB
SHA256 d3824dac7a34bc455f46e9bc9d47bf89d5a30da73a2e8c076c4571c61b11896e
MD5 b57a074801c6bbdcca5eceb6eb2cb264
SHA1 6120eefd9b921d163a31fe2a6778736a45b889e5
SHA512 eb6343397f8a902b31af3d9c5841e3ff36dded0e62dcf0401ba2b742fc5119e4ddc18323c0b89e37fe0a7f43724b5c3fd42852bc209cf329b5c754aeaba40cb3
SSDEEP 3072:s3UH3Dh1PbHwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:s3UXDPDHV/Ah1G/AcQ///NR5fn
TLSH
T1DB644016263049EACEED1FB5AC1289D88141F5F414F1E13E6227DFDCD8E4DA6C82AF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgddal32.exe

Path C:\Windows\SysWOW64\Mgddal32.exe
Size 320KB
SHA256 d02936af034fb82612339750ba62415bf8b357927d44ef3d49a58f987df1f397
MD5 872e3a7805fa78972efe2f2147b68119
SHA1 39438b14ed60cbe7221b306dee1d113a0bf9bb83
SHA512 2f7a72d884b7895000197660c5bff0ca1564016c2f34420b1994651930381c6dbafbfe4266a55f497e98e1be2aefcaf2d5ddce6b6306122157c6b2713688c9de
SSDEEP 3072:9u8a8ubv21mkrFYOnwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:08aP+MOnV/Ah1G/AcQ///NR5fn
TLSH
T15E6410192A3809EACEED1BB9AC1259D85141E5F128F1E13E6133DFDCDAE4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mgimmkgp.exe

Path C:\Windows\SysWOW64\Mgimmkgp.exe
Size 320KB
SHA256 9a7e34fe40d3969b38a7feea8873ea1b4068502154b65d9b5332085f878e2968
MD5 3075a61b39f92863b747aebf6a82d524
SHA1 e60a25a8de373877d740fa95050bd6d3de626bb9
SHA512 613029a344f8c200ef08b84b046d441f3008a1b42e378a47d0342b1fa811ee3a2ef63a4ec399a2cef93216f4e0f1d61a0fc922ba68c48a3c4580603b386e0b53
SSDEEP 3072:vtUGkMTs6DwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:VxkMThDV/Ah1G/AcQ///NR5fn
TLSH
T137640F1A263409EACDED1BB9AC124AD85141E9F015F1E13E6323DFDCE8E4F66D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mikjmhaq.exe

Path C:\Windows\SysWOW64\Mikjmhaq.exe
Size 320KB
SHA256 1f520676bd97d388d8c0629c8320dd3f0cc8b595adc948dd8048ced1e367a053
MD5 5a58678ae4a4357c678519f109b49782
SHA1 ac0ca9d93176843ca0be291ee1d5ed4d79a2ccc4
SHA512 77efb2782f008e1b76329ec71f8ff028dc42cce14db7e438a192d2195d8b5d435a3c526ff2ef5f48c572696386aa9d9c90ee6aa7b30ff92902cc83b84ddd439e
SSDEEP 3072:G1NMPcJh8mWY1+z8wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:G1NEcJhhS8V/Ah1G/AcQ///NR5fn
TLSH
T1F664401A263409EACEED1FB5AC6249D89141E9F014F1E13E6127EFDDD8E5EA2CD05F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mlqljb32.exe

Path C:\Windows\SysWOW64\Mlqljb32.exe
Size 320KB
SHA256 3b658ee3dcb994ebf5750fde0ec8672508712d107b75888e75eff3b478786cea
MD5 ae230e75652ae855cc12ac0ab8cebb26
SHA1 300f5347e106779b76cd7303dfaa4c7657a8bf1e
SHA512 a4b0151fba5dcbf853e435e4a45f53b5e39f76239519921e0c89f031b34f025a319d3b21cabcf069f551c0c34998a2253c138ad3937818dbcf5c0df4a176f020
SSDEEP 3072:YZGRfotOVFiA82wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ZRVFk2V/Ah1G/AcQ///NR5fn
TLSH
T15364FB1A2A3409EADEED1BB6AC0249D89141E9F114F5E13E6133DFDCC8E5DB6C864F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngkjbkem.exe

Path C:\Windows\SysWOW64\Ngkjbkem.exe
Size 320KB
SHA256 4df50547eb12cde6df587baf3393e1ad9daae2a84899b4337b4e953770d934a2
MD5 de93b0a1be3ff2bf2d8cdb798e4620d3
SHA1 de23daacdc48f389d0da18d41209dd65390dd808
SHA512 352ab2826df66abf9460f3178ff53b490a5790d3212aa9dd9312ec7eadba68213c057cb8f792b5ea1ab539c4a65035b76599f01eddc7ece543671e60e7f6d14c
SSDEEP 3072:wvCpkO73yUzCuoEFVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GCpkiFCKVV/Ah1G/AcQ///NR5fn
TLSH
T10C6451192A3409EACDED1FB6AC1269D85181E8F214F1E17E2527DFDCD8E4DA2EC04F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngmggj32.exe

Path C:\Windows\SysWOW64\Ngmggj32.exe
Size 320KB
SHA256 af37044391754e2468c18573630dd163f4230cee457c99362f6387d46e90a4cd
MD5 641785e9e6b6dc4adb797cc5be559f95
SHA1 50fb6c1b55b754b690836d0bf0a14973fc50a3bf
SHA512 18c478cbf1309ab79e67bd37402f7a02f3c48a1fad54857069aedddb00350931db1eb7361a2f63200834dc064065ad08efb329756e201d6ce895f139abe9f49a
SSDEEP 3072:ar4vVzNqawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:fNqaV/Ah1G/AcQ///NR5fn
TLSH
T11D641E1A263009EACEED5BB6AC124DED5141E8F154F1E23E6523DFDCD8E4DA6C809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngpcmj32.exe

Path C:\Windows\SysWOW64\Ngpcmj32.exe
Size 320KB
SHA256 3ab6b314895aa22bd73ffc053491928630c1552dd0301cbea5854989a48065ad
MD5 15834861f16493ac06f55ce7b2103c82
SHA1 2dcaa23372e973958c0cfd594ea9291e8f9bee2f
SHA512 56deb5ae62cec870f79a4102e73df15cdf57a5839de6d088d37341eb098126a426c7dc06aee1525fd49ef217824c4f044c0d936d83d57c7a14ddab54be990b64
SSDEEP 3072:e2t3S0qFAb8/IcLiMRwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:e2t3S0xbOLbRV/Ah1G/AcQ///NR5fn
TLSH
T1F364FC192A340AEACDED1BB6AC224DD85241E9F114F1E13E6123DFDCD8F4DA6D815F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nlefebfg.exe

Path C:\Windows\SysWOW64\Nlefebfg.exe
Size 320KB
SHA256 1b9d384eb03cf6d36e211eb770d15ab76730f09f061b3e3ba989a0a9becdc46b
MD5 482568837e9511470b953b6f9001f789
SHA1 d8c2609271dd25b894bee72232777f73a8cbccc3
SHA512 8a135ab19e1fa594e4889a4aee851c823cf75bdf51dd644e97a077df7d809dc07cd79afac7131f6bba3462c920b93923d2a629853e10bc12800f7f242eab254e
SSDEEP 3072:KYYQYWU07AMojxwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KYYN079oxV/Ah1G/AcQ///NR5fn
TLSH
T1286431191A3409EACEED2FB5AC0249D89581E9F114F1E13E6563DFDCD8E4DE6E808F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nlhbja32.exe

Path C:\Windows\SysWOW64\Nlhbja32.exe
Size 320KB
SHA256 c3bd9fceabe69ff7151cc02c952f4fd96efc3f229c321911b2b226a2b13cd225
MD5 20dbc5118a7b24aa380861083eaf32a8
SHA1 8457910f8b30525a68e3fff94f0fbb7d22e944ee
SHA512 ad318710d3948967ed7050a1e3f534f68d1659622ab2d35464ff7e2159f49d26e1fc8a2f29ed9bd53addb7a574bf96f2dab1c47b78bc677a1a4c4841142f88af
SSDEEP 6144:xLUTAk98LxiWpvxX2TBfB2xFBmYVFcV/Ah1G/AcQ///NR5fn:h+78LxiWpvxqBfB2xFBmYt/Nv
TLSH
T1EA642E196A3009EADEED1BB5AC025DD89141E8F014F1F17E6123DFDCD8E4EA2D819F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nljopa32.exe

Path C:\Windows\SysWOW64\Nljopa32.exe
Size 320KB
SHA256 49cee8d84f1efbdb2a5849c23c947de513c42361ec0a212abb64053d753015d7
MD5 3e61ed6eb6df0aebcd127bbec3cc9a1f
SHA1 1a7ebac2052603d253f33045dece47d7c133efb1
SHA512 45b36355150e8b7d6e42fe7b94f76e5c17c4945661498774d301993650b7ee24cd625f8a003b35c6d9cbdd7a65d2b64dcf0388aab1a1699d30325a0418ddf5ab
SSDEEP 6144:kQ5miXG6aAExr8gV/Ah1G/AcQ///NR5fn:kQgiXG6aAExri/Nv
TLSH
T115641E1A2B740EEACEED1BB6AC0259D85141E9F114F1E13E6123DFDDD9E4DA2C818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnlhod32.exe

Path C:\Windows\SysWOW64\Nnlhod32.exe
Size 320KB
SHA256 50fd00ab14462b27ecd8af261680329d9f78ba2dd4ad066864ad36d32b8c1d4c
MD5 614fa8bc7c30b74e8ae1fa967c4c959e
SHA1 3fc933ee0d6db1b44ee7d301f1092961846b9cbf
SHA512 331b45620f2084aa2f7aea061e8a54603573f748e37d0692b0bf5537af3404547b27f47e6d6389f1383b38376128aad2be53b67e3634dbfff57ac1b85325f291
SSDEEP 3072:xh4AHkTaqEOGfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x6AHkTaBRfV/Ah1G/AcQ///NR5fn
TLSH
T1E86441191A3509EACEFD1BBAAC424AD85641F8F114F1E13E6123DFECD8E4DA2C855F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nphhfp32.exe

Path C:\Windows\SysWOW64\Nphhfp32.exe
Size 320KB
SHA256 3072708b501ce3cddbb265de649ed0cc71d63eba99b8ba51649355b5da1a93d4
MD5 64d3a9d1cab98aba08cffb1aeca13f97
SHA1 c85913fe59d774b3185a3e6f99167f3c7c6bf531
SHA512 b025c1fdde670d07c24990754624110e8b07a3ef5f6a3c92dead636ff18c79ac6317ddda10c67a67cba89ac35bf65ceb71aff1eea1be727574c95f5d5f48a509
SSDEEP 3072:WwFsaJzMWpkwwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1FsGPywV/Ah1G/AcQ///NR5fn
TLSH
T1016453192A340AEACDED1FB6AD165ED85141E9F014F1E13E6123DFDCD8E4EA2D818F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojcidelf.exe

Path C:\Windows\SysWOW64\Ojcidelf.exe
Size 320KB
SHA256 a56620fe2e2bd8ab52f3f40264e07ea3a655039189981ea144748cd7e1021fa5
MD5 ea5cba361e7a52a89bf5cea96f91fe43
SHA1 fd28bee7d8094e932ed8dadb84f20ec825c3229c
SHA512 30750310761ba5b6baf7c8eec50fb84bb812d6981d664c3ed8bce7e698f087a6fb4244bfbf3b035301a81024681acddb44ad12480e1f7c6b8f91912521fa89f4
SSDEEP 6144:0dRnDak0lbIXdlMRV/Ah1G/AcQ///NR5fn:IG1IXdlP/Nv
TLSH
T12364FC2A16300EEACDED1FB9AC6259E89241E9F014F1E13E5523DFDCD8E4DA2D805F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/884-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/936-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/936-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/936-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/960-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1092-318-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1188-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1204-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1232-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1356-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1516-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1636-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1808-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1904-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1936-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1984-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2108-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2164-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2204-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2336-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2416-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2476-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2564-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2600-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2628-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2668-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2676-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2696-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2740-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2776-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2792-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2792-53-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2840-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2920-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2936-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3088-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3116-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3168-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3252-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3336-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3396-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3428-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3460-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3464-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3556-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3640-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3640-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3648-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3704-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3748-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3764-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3832-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3900-218-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3920-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3964-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3964-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3972-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4100-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4100-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4140-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4196-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4256-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4464-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4484-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4608-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4632-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4656-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4692-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4728-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4836-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4840-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4920-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4940-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4948-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4984-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5020-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5052-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5216-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5244-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5332-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5356-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5384-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5416-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5456-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5504-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5752-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5812-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5812-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5912-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5940-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5972-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6140-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads