berbew | e30808d80278a33b3f8cadac61f44d3ac017ba9219d7d615c97af8343e2611b9

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_846ecfa8ee4cbe2d838474c0e339ad59_elex_wannacry.exe
Size 320KB
Sample260904-gertfsde66
SHA256 e30808d80278a33b3f8cadac61f44d3ac017ba9219d7d615c97af8343e2611b9
MD5 846ecfa8ee4cbe2d838474c0e339ad59
SHA1 ad11ff5e3d7cecc0bf2b7c7ce1a5782ab0622a25
SHA512 484e89c081d9335d084d37a9fec67b8421ed7d1cae0c821b01b24819def3b2b6e2ac235cd9af2d84e53a511c01099bb0782e4a8df57340f3ef85d721b879057d
SSDEEP 3072:PMkKPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EPV/Ah1G/AcQ///NR5fn
TLSH
T1BF644F192A3009EADEED2FB5AC1249D89181E9F054F1E17E6123DFDDC8E4DA2C944FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbkdjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjgncihp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdlolmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcbngeqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojpdgjid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjoma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqhammje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgomnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olangmod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gblbmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnlhhi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbjegg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knnhdied.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medggidb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmnkdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amloakki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmqgjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdfobe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhlhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgamhjja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomqmoob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoollocp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkopgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikndpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhjgdplo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oegejc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcmdkbok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljnloi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bglefdke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihnkobpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpknhfoq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgffci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hckeikcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hienee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dajlafon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjegh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfjpppbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mccfnc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfanmcao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aedfdjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopiqj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpbdiehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eicemccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boipfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cifmjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeaagoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmfkin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfklamii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooaghe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdlcehhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iaaflh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkhpmigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lejgln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppopcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqafpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnpmej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpnlicne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfagee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bimkde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hginoiic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfpdcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlpfak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfchq32.exe

Executes dropped EXE 64 IoCs

pid	Process
1988	Dhfhnfhc.exe
1080	Dhidcffq.exe
4656	Daaiml32.exe
5988	Deoabj32.exe
300	Dafbhkhl.exe
3196	Ekngqqol.exe
248	Eaklcj32.exe
5124	Eoollocp.exe
1876	Eoaianan.exe
5004	Fdpnpe32.exe
428	Fkjfloeo.exe
52	Fdegkdim.exe
4844	Fkopgn32.exe
4840	Fkalmn32.exe
1744	Fbkdjh32.exe
5196	Fhemfbnq.exe
5840	Fooecl32.exe
4160	Gfimpfmj.exe
2184	Ghgjlaln.exe
5528	Goabhl32.exe
3892	Gfkjef32.exe
2408	Glebbpbd.exe
2864	Gcojoj32.exe
5976	Gdqgfbop.exe
4944	Gkjocm32.exe
5436	Gbdgpfni.exe
2372	Ghnpmqef.exe
4916	Gohhik32.exe
3644	Gbgdef32.exe
772	Giqlbqcc.exe
236	Gokdoj32.exe
5116	Hfemkdbm.exe
5708	Hmoehojj.exe
5808	Hcimei32.exe
848	Hejjmage.exe
5884	Hkdbik32.exe
956	Hbnjfefo.exe
4604	Hihbco32.exe
932	Hkfookmo.exe
1388	Hflclcle.exe
2776	Hmfkin32.exe
4380	Hodgei32.exe
700	Hfnpacjb.exe
2020	Hmhhnmao.exe
4516	Icbpkg32.exe
5868	Iioicn32.exe
4668	Ikmepj32.exe
1588	Ifcimb32.exe
3140	Immaimnj.exe
4488	Icgjfgef.exe
2352	Iehfno32.exe
3280	Ilbnkiba.exe
5236	Iblfgc32.exe
3368	Iifodmak.exe
4572	Ippgqg32.exe
1216	Ifjoma32.exe
5304	Imdgjlgb.exe
4348	Jcnpgf32.exe
5772	Jeolonem.exe
4676	Jlidkh32.exe
1872	Jbcmhb32.exe
6092	Jeaidn32.exe
1276	Jlkaahjg.exe
5944	Jbeinb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ladaigki.dll	Daqbbe32.exe
File created	C:\Windows\SysWOW64\Cicipkfg.dll	Agbkfood.exe
File created	C:\Windows\SysWOW64\Fldhln32.dll	Jleicg32.exe
File created	C:\Windows\SysWOW64\Bpaanfce.exe	Bopefnnf.exe
File created	C:\Windows\SysWOW64\Gdncfl32.exe	Goqkne32.exe
File created	C:\Windows\SysWOW64\Fmnkdm32.exe	Fgdbgbof.exe
File opened for modification	C:\Windows\SysWOW64\Olnkfd32.exe	Oeccijoh.exe
File created	C:\Windows\SysWOW64\Oipnkcnm.dll	Plkpmlfi.exe
File created	C:\Windows\SysWOW64\Ipeehhhb.exe	Iepako32.exe
File opened for modification	C:\Windows\SysWOW64\Kemhpl32.exe	Kdllhdco.exe
File created	C:\Windows\SysWOW64\Kbpaon32.dll	Bjgncihp.exe
File opened for modification	C:\Windows\SysWOW64\Ikndpm32.exe	Iddlccfp.exe
File created	C:\Windows\SysWOW64\Bcokah32.exe	Bhjgdplo.exe
File created	C:\Windows\SysWOW64\Lcimcgdd.dll	Ecipeb32.exe
File created	C:\Windows\SysWOW64\Fhpkja32.dll	Flfjdn32.exe
File created	C:\Windows\SysWOW64\Hodgei32.exe	Hmfkin32.exe
File opened for modification	C:\Windows\SysWOW64\Lhijcohe.exe	Lfgnkgbf.exe
File created	C:\Windows\SysWOW64\Hoebhpfd.dll	Niklip32.exe
File created	C:\Windows\SysWOW64\Jdpkoalc.exe	Jnfcbg32.exe
File opened for modification	C:\Windows\SysWOW64\Cnahmo32.exe	Ckclacmi.exe
File opened for modification	C:\Windows\SysWOW64\Lfnfck32.exe	Kpankd32.exe
File opened for modification	C:\Windows\SysWOW64\Nqmfnp32.exe	Nnojad32.exe
File opened for modification	C:\Windows\SysWOW64\Qnfdlpqd.exe	Qgllpf32.exe
File created	C:\Windows\SysWOW64\Hmkpdlhe.dll	Noijmp32.exe
File created	C:\Windows\SysWOW64\Pefhfgoc.exe	Pkqdhnom.exe
File created	C:\Windows\SysWOW64\Nnhcfa32.dll	Mqhmbqlh.exe
File opened for modification	C:\Windows\SysWOW64\Agfpoqog.exe	Aajggjap.exe
File created	C:\Windows\SysWOW64\Bklmebob.dll	Bopefnnf.exe
File opened for modification	C:\Windows\SysWOW64\Liimgh32.exe	Lboeknkf.exe
File created	C:\Windows\SysWOW64\Cqhcab32.dll	Hocqkc32.exe
File created	C:\Windows\SysWOW64\Lhbdbpnm.exe	Knipik32.exe
File created	C:\Windows\SysWOW64\Aijjie32.dll	Pklkmo32.exe
File created	C:\Windows\SysWOW64\Cilmpmki.exe	Ccpdhfmb.exe
File opened for modification	C:\Windows\SysWOW64\Hgokikan.exe	Gmggpekm.exe
File opened for modification	C:\Windows\SysWOW64\Fmhcda32.exe	Ffnkggld.exe
File created	C:\Windows\SysWOW64\Fgdbgbof.exe	Fpjjkh32.exe
File opened for modification	C:\Windows\SysWOW64\Plbmhadm.exe	Pehekgmp.exe
File created	C:\Windows\SysWOW64\Nhhabe32.dll	Eoollocp.exe
File created	C:\Windows\SysWOW64\Acggngam.dll	Immaimnj.exe
File opened for modification	C:\Windows\SysWOW64\Jeaidn32.exe	Jbcmhb32.exe
File opened for modification	C:\Windows\SysWOW64\Nconal32.exe	Nlefebfg.exe
File created	C:\Windows\SysWOW64\Hdpicj32.exe	Hocqkc32.exe
File created	C:\Windows\SysWOW64\Oifekg32.exe	Olbdacbp.exe
File created	C:\Windows\SysWOW64\Opcdbanf.dll	Ahenip32.exe
File opened for modification	C:\Windows\SysWOW64\Gmdcpoid.exe	Gblbmg32.exe
File created	C:\Windows\SysWOW64\Minkhnmc.dll	Fkjfloeo.exe
File created	C:\Windows\SysWOW64\Ljeqcm32.dll	Iioicn32.exe
File created	C:\Windows\SysWOW64\Inhgja32.dll	Ipmbcm32.exe
File created	C:\Windows\SysWOW64\Lfnfck32.exe	Kpankd32.exe
File created	C:\Windows\SysWOW64\Kbebdpca.exe	Kmijliej.exe
File created	C:\Windows\SysWOW64\Bnlqlc32.dll	Nepgcgje.exe
File created	C:\Windows\SysWOW64\Dacmol32.dll	Pqhammje.exe
File created	C:\Windows\SysWOW64\Nhhlog32.exe	Naodbm32.exe
File created	C:\Windows\SysWOW64\Pnafgjbj.dll	Fpbmpc32.exe
File created	C:\Windows\SysWOW64\Fbecgned.exe	Fpggkbfq.exe
File created	C:\Windows\SysWOW64\Adjhld32.dll	Mnkgakpp.exe
File created	C:\Windows\SysWOW64\Ajlngk32.exe	Qcbfjqkp.exe
File created	C:\Windows\SysWOW64\Fpejjabq.dll	Llofnh32.exe
File opened for modification	C:\Windows\SysWOW64\Lqdakjak.exe	Kkgicccd.exe
File opened for modification	C:\Windows\SysWOW64\Odooqo32.exe	Omegdebp.exe
File created	C:\Windows\SysWOW64\Eobikk32.dll	Kfimhkbo.exe
File created	C:\Windows\SysWOW64\Nomjgqpp.dll	Iickdgpb.exe
File created	C:\Windows\SysWOW64\Keonke32.exe	Klfjbpmn.exe
File created	C:\Windows\SysWOW64\Bjlgnh32.exe	Bcboan32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9660	9532	WerFault.exe	1016

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medggidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihknibbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmbkdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beajnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffnkggld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eplnijdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcggbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeccijoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hckeikcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfnbnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baadbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgmffo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgcgje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhkcfmbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pphjbgfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpomme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcepdl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qifnaecf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Allpnplb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nenbdd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghgjlaln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcokah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hienee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajggjap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoijcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgboiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbeece32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dqkmkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcmeek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llemnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfcdph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fieacc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chhdbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjnbfmom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjodch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cilmpmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fclmkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpopb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbddo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olangmod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbnpmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogeklh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkopgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmoehojj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Einmaaqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dckdddcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkdqinj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adbdml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_846ecfa8ee4cbe2d838474c0e339ad59_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlciobhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppopcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nklbfaae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdkgam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nebmnqdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmnkdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhjgdplo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhqmdoef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdphgmlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jofaeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kokkqbog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dafbhkhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejamdca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehappnjj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emjomf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcpakgd.dll"	Lhbdbpnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdahga32.dll"	Ciefpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgnfpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbkdjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiffhkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lehiadfj.dll"	Aakelfhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkimae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onkimc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okbccg32.dll"	Lehaad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkchoaif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgmbimbb.dll"	Ckphamkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampdej32.dll"	Hejjmage.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohgepflm.dll"	Hkdbik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhgefec.dll"	Kfhkop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadejh32.dll"	Aedfdjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghlicg32.dll"	Jdnnjane.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciebfc32.dll"	Allpnplb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkcbhgii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dapkho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mijlhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hldbfp32.dll"	Knnhdied.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhbdkgfd.dll"	Iehfno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaffkdlc.dll"	Nljopa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehifpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggnlhgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjlqklfj.dll"	Iofmpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agbkfood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kqkeoama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igpdph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jodiaqag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiacljhl.dll"	Phmhgmpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdkolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeaidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfoapo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgijnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnlmai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fclnkgap.dll"	Fhemfbnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmmblkpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfhifpdk.dll"	Gjohnkdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gffhbljh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idknol32.dll"	Nanmhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qcbmegol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkfjagad.dll"	Lnmbjd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioeineap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kflink32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jioajliq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagfeioc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hocqkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieknccaj.dll"	Mgjicb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flfjdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baomkono.dll"	Fddqpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahakhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Inmplh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keaaicgb.dll"	Iqklhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpiemj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dqpffaib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpikla32.dll"	Gokdoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgiknio.dll"	Pgihppgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blbhngfl.dll"	Capbaacl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfmcpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdfjbne.dll"	Fgdbgbof.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 1988	5564	2026-09-03_846ecfa8ee4cbe2d838474c0e339ad59_elex_wannacry.exe	89
PID 1988 wrote to memory of 1080	1988	Dhfhnfhc.exe	90
PID 1080 wrote to memory of 4656	1080	Dhidcffq.exe	91
PID 4656 wrote to memory of 5988	4656	Daaiml32.exe	92
PID 5988 wrote to memory of 300	5988	Deoabj32.exe	93
PID 300 wrote to memory of 3196	300	Dafbhkhl.exe	94
PID 3196 wrote to memory of 248	3196	Ekngqqol.exe	95
PID 248 wrote to memory of 5124	248	Eaklcj32.exe	96
PID 5124 wrote to memory of 1876	5124	Eoollocp.exe	97
PID 1876 wrote to memory of 5004	1876	Eoaianan.exe	98
PID 5004 wrote to memory of 428	5004	Fdpnpe32.exe	99
PID 428 wrote to memory of 52	428	Fkjfloeo.exe	100
PID 52 wrote to memory of 4844	52	Fdegkdim.exe	101
PID 4844 wrote to memory of 4840	4844	Fkopgn32.exe	102
PID 4840 wrote to memory of 1744	4840	Fkalmn32.exe	103
PID 1744 wrote to memory of 5196	1744	Fbkdjh32.exe	104
PID 5196 wrote to memory of 5840	5196	Fhemfbnq.exe	105
PID 5840 wrote to memory of 4160	5840	Fooecl32.exe	106
PID 4160 wrote to memory of 2184	4160	Gfimpfmj.exe	107
PID 2184 wrote to memory of 5528	2184	Ghgjlaln.exe	108
PID 5528 wrote to memory of 3892	5528	Goabhl32.exe	109
PID 3892 wrote to memory of 2408	3892	Gfkjef32.exe	110
PID 2408 wrote to memory of 2864	2408	Glebbpbd.exe	111
PID 2864 wrote to memory of 5976	2864	Gcojoj32.exe	112
PID 5976 wrote to memory of 4944	5976	Gdqgfbop.exe	113
PID 4944 wrote to memory of 5436	4944	Gkjocm32.exe	114
PID 5436 wrote to memory of 2372	5436	Gbdgpfni.exe	115
PID 2372 wrote to memory of 4916	2372	Ghnpmqef.exe	116
PID 4916 wrote to memory of 3644	4916	Gohhik32.exe	117
PID 3644 wrote to memory of 772	3644	Gbgdef32.exe	118
PID 772 wrote to memory of 236	772	Giqlbqcc.exe	119
PID 236 wrote to memory of 5116	236	Gokdoj32.exe	120
PID 5116 wrote to memory of 5708	5116	Hfemkdbm.exe	121
PID 5708 wrote to memory of 5808	5708	Hmoehojj.exe	122
PID 5808 wrote to memory of 848	5808	Hcimei32.exe	123
PID 848 wrote to memory of 5884	848	Hejjmage.exe	124
PID 5884 wrote to memory of 956	5884	Hkdbik32.exe	125
PID 956 wrote to memory of 4604	956	Hbnjfefo.exe	126
PID 4604 wrote to memory of 932	4604	Hihbco32.exe	127
PID 932 wrote to memory of 1388	932	Hkfookmo.exe	128
PID 1388 wrote to memory of 2776	1388	Hflclcle.exe	129
PID 2776 wrote to memory of 4380	2776	Hmfkin32.exe	130
PID 4380 wrote to memory of 700	4380	Hodgei32.exe	131
PID 700 wrote to memory of 2020	700	Hfnpacjb.exe	132
PID 2020 wrote to memory of 4516	2020	Hmhhnmao.exe	133
PID 4516 wrote to memory of 5868	4516	Icbpkg32.exe	134
PID 5868 wrote to memory of 4668	5868	Iioicn32.exe	135
PID 4668 wrote to memory of 1588	4668	Ikmepj32.exe	136
PID 1588 wrote to memory of 3140	1588	Ifcimb32.exe	137
PID 3140 wrote to memory of 4488	3140	Immaimnj.exe	138
PID 4488 wrote to memory of 2352	4488	Icgjfgef.exe	139
PID 2352 wrote to memory of 3280	2352	Iehfno32.exe	140
PID 3280 wrote to memory of 5236	3280	Ilbnkiba.exe	141
PID 5236 wrote to memory of 3368	5236	Iblfgc32.exe	142
PID 3368 wrote to memory of 4572	3368	Iifodmak.exe	143
PID 4572 wrote to memory of 1216	4572	Ippgqg32.exe	144
PID 1216 wrote to memory of 5304	1216	Ifjoma32.exe	145
PID 5304 wrote to memory of 4348	5304	Imdgjlgb.exe	146
PID 4348 wrote to memory of 5772	4348	Jcnpgf32.exe	147
PID 5772 wrote to memory of 4676	5772	Jeolonem.exe	148
PID 4676 wrote to memory of 1872	4676	Jlidkh32.exe	149
PID 1872 wrote to memory of 6092	1872	Jbcmhb32.exe	150
PID 6092 wrote to memory of 1276	6092	Jeaidn32.exe	151
PID 1276 wrote to memory of 5944	1276	Jlkaahjg.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-09-03_846ecfa8ee4cbe2d838474c0e339ad59_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_846ecfa8ee4cbe2d838474c0e339ad59_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\SysWOW64\Dhfhnfhc.exe
  C:\Windows\system32\Dhfhnfhc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\Dhidcffq.exe
    C:\Windows\system32\Dhidcffq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\SysWOW64\Daaiml32.exe
      C:\Windows\system32\Daaiml32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\SysWOW64\Deoabj32.exe
        
        C:\Windows\system32\Deoabj32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5988
      - C:\Windows\SysWOW64\Dafbhkhl.exe
        
        C:\Windows\system32\Dafbhkhl.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:300
        
        C:\Windows\SysWOW64\Ekngqqol.exe
        
        C:\Windows\system32\Ekngqqol.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SysWOW64\Eaklcj32.exe
        
        C:\Windows\system32\Eaklcj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:248
        
        C:\Windows\SysWOW64\Eoollocp.exe
        
        C:\Windows\system32\Eoollocp.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5124
        
        C:\Windows\SysWOW64\Eoaianan.exe
        
        C:\Windows\system32\Eoaianan.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\SysWOW64\Fdpnpe32.exe
        
        C:\Windows\system32\Fdpnpe32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Fkjfloeo.exe
        
        C:\Windows\system32\Fkjfloeo.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Fdegkdim.exe
        
        C:\Windows\system32\Fdegkdim.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:52
        
        C:\Windows\SysWOW64\Fkopgn32.exe
        
        C:\Windows\system32\Fkopgn32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Fkalmn32.exe
        
        C:\Windows\system32\Fkalmn32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Fbkdjh32.exe
        
        C:\Windows\system32\Fbkdjh32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Fhemfbnq.exe
        
        C:\Windows\system32\Fhemfbnq.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5196
        
        C:\Windows\SysWOW64\Fooecl32.exe
        
        C:\Windows\system32\Fooecl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Windows\SysWOW64\Gfimpfmj.exe
        
        C:\Windows\system32\Gfimpfmj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Ghgjlaln.exe
        
        C:\Windows\system32\Ghgjlaln.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Goabhl32.exe
        
        C:\Windows\system32\Goabhl32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5528
        
        C:\Windows\SysWOW64\Gfkjef32.exe
        
        C:\Windows\system32\Gfkjef32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Glebbpbd.exe
        
        C:\Windows\system32\Glebbpbd.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\Gcojoj32.exe
        
        C:\Windows\system32\Gcojoj32.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Windows\SysWOW64\Gkjocm32.exe
        
        C:\Windows\system32\Gkjocm32.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Gbdgpfni.exe
        
        C:\Windows\system32\Gbdgpfni.exe
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5436
        
        C:\Windows\SysWOW64\Ghnpmqef.exe
        
        C:\Windows\system32\Ghnpmqef.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Gohhik32.exe
        
        C:\Windows\system32\Gohhik32.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Gbgdef32.exe
        
        C:\Windows\system32\Gbgdef32.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Giqlbqcc.exe
        
        C:\Windows\system32\Giqlbqcc.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Gokdoj32.exe
        
        C:\Windows\system32\Gokdoj32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Windows\SysWOW64\Hfemkdbm.exe
        
        C:\Windows\system32\Hfemkdbm.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5708
        
        C:\Windows\SysWOW64\Hcimei32.exe
        
        C:\Windows\system32\Hcimei32.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\SysWOW64\Hejjmage.exe
        
        C:\Windows\system32\Hejjmage.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Hkdbik32.exe
        
        C:\Windows\system32\Hkdbik32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5884
        
        C:\Windows\SysWOW64\Hbnjfefo.exe
        
        C:\Windows\system32\Hbnjfefo.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Hihbco32.exe
        
        C:\Windows\system32\Hihbco32.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Hkfookmo.exe
        
        C:\Windows\system32\Hkfookmo.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Hflclcle.exe
        
        C:\Windows\system32\Hflclcle.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Hmfkin32.exe
        
        C:\Windows\system32\Hmfkin32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Hodgei32.exe
        
        C:\Windows\system32\Hodgei32.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Hfnpacjb.exe
        
        C:\Windows\system32\Hfnpacjb.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\Hmhhnmao.exe
        
        C:\Windows\system32\Hmhhnmao.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Icbpkg32.exe
        
        C:\Windows\system32\Icbpkg32.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Iioicn32.exe
        
        C:\Windows\system32\Iioicn32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Windows\SysWOW64\Ikmepj32.exe
        
        C:\Windows\system32\Ikmepj32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Ifcimb32.exe
        
        C:\Windows\system32\Ifcimb32.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Immaimnj.exe
        
        C:\Windows\system32\Immaimnj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Icgjfgef.exe
        
        C:\Windows\system32\Icgjfgef.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Iehfno32.exe
        
        C:\Windows\system32\Iehfno32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Ilbnkiba.exe
        
        C:\Windows\system32\Ilbnkiba.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Iblfgc32.exe
        
        C:\Windows\system32\Iblfgc32.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5236
        
        C:\Windows\SysWOW64\Iifodmak.exe
        
        C:\Windows\system32\Iifodmak.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Ippgqg32.exe
        
        C:\Windows\system32\Ippgqg32.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SysWOW64\Ifjoma32.exe
        
        C:\Windows\system32\Ifjoma32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Imdgjlgb.exe
        
        C:\Windows\system32\Imdgjlgb.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        60⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5772
        
        C:\Windows\SysWOW64\Jlidkh32.exe
        
        C:\Windows\system32\Jlidkh32.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Jbcmhb32.exe
        
        C:\Windows\system32\Jbcmhb32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Jeaidn32.exe
        
        C:\Windows\system32\Jeaidn32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:6092
        
        C:\Windows\SysWOW64\Jlkaahjg.exe
        
        C:\Windows\system32\Jlkaahjg.exe
        64⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Jbeinb32.exe
        
        C:\Windows\system32\Jbeinb32.exe
        65⤵
        Executes dropped EXE
        
        PID:5944
        
        C:\Windows\SysWOW64\Jioajliq.exe
        
        C:\Windows\system32\Jioajliq.exe
        66⤵
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Jpijgf32.exe
        
        C:\Windows\system32\Jpijgf32.exe
        67⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Jfcbcp32.exe
        
        C:\Windows\system32\Jfcbcp32.exe
        68⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Jlpklg32.exe
        
        C:\Windows\system32\Jlpklg32.exe
        69⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Jbjciano.exe
        
        C:\Windows\system32\Jbjciano.exe
        70⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Jidkek32.exe
        
        C:\Windows\system32\Jidkek32.exe
        71⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Kpncbemh.exe
        
        C:\Windows\system32\Kpncbemh.exe
        72⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Kfhkop32.exe
        
        C:\Windows\system32\Kfhkop32.exe
        73⤵
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Kmbdkj32.exe
        
        C:\Windows\system32\Kmbdkj32.exe
        74⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Kdllhdco.exe
        
        C:\Windows\system32\Kdllhdco.exe
        75⤵
        Drops file in System32 directory
        
        PID:4232
        
        C:\Windows\SysWOW64\Kemhpl32.exe
        
        C:\Windows\system32\Kemhpl32.exe
        76⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Klgqmfpj.exe
        
        C:\Windows\system32\Klgqmfpj.exe
        77⤵
        
        PID:588
        
        C:\Windows\SysWOW64\Kbaiip32.exe
        
        C:\Windows\system32\Kbaiip32.exe
        78⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        79⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Kpeibdfp.exe
        
        C:\Windows\system32\Kpeibdfp.exe
        80⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Kfoapo32.exe
        
        C:\Windows\system32\Kfoapo32.exe
        81⤵
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        82⤵
        Drops file in System32 directory
        
        PID:4072
        
        C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        83⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Kipkaj32.exe
        
        C:\Windows\system32\Kipkaj32.exe
        84⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Lpjcnd32.exe
        
        C:\Windows\system32\Lpjcnd32.exe
        85⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Lfckjnjh.exe
        
        C:\Windows\system32\Lfckjnjh.exe
        86⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Lmncgh32.exe
        
        C:\Windows\system32\Lmncgh32.exe
        87⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ldgkdbia.exe
        
        C:\Windows\system32\Ldgkdbia.exe
        88⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Liddligi.exe
        
        C:\Windows\system32\Liddligi.exe
        89⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Lpnlicne.exe
        
        C:\Windows\system32\Lpnlicne.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3116
        
        C:\Windows\SysWOW64\Lekeajmm.exe
        
        C:\Windows\system32\Lekeajmm.exe
        91⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Llemnd32.exe
        
        C:\Windows\system32\Llemnd32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Windows\SysWOW64\Lboeknkf.exe
        
        C:\Windows\system32\Lboeknkf.exe
        93⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Liimgh32.exe
        
        C:\Windows\system32\Liimgh32.exe
        94⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Ldoadabi.exe
        
        C:\Windows\system32\Ldoadabi.exe
        95⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Lepnli32.exe
        
        C:\Windows\system32\Lepnli32.exe
        96⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Mljficpd.exe
        
        C:\Windows\system32\Mljficpd.exe
        97⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Mccofn32.exe
        
        C:\Windows\system32\Mccofn32.exe
        98⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Mingbhon.exe
        
        C:\Windows\system32\Mingbhon.exe
        99⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Mdckpqod.exe
        
        C:\Windows\system32\Mdckpqod.exe
        100⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Medggidb.exe
        
        C:\Windows\system32\Medggidb.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:712
        
        C:\Windows\SysWOW64\Mlnpdc32.exe
        
        C:\Windows\system32\Mlnpdc32.exe
        102⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Mchhamcl.exe
        
        C:\Windows\system32\Mchhamcl.exe
        103⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Mibpng32.exe
        
        C:\Windows\system32\Mibpng32.exe
        104⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Mdhdkp32.exe
        
        C:\Windows\system32\Mdhdkp32.exe
        105⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Meiabh32.exe
        
        C:\Windows\system32\Meiabh32.exe
        106⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Mlciobhj.exe
        
        C:\Windows\system32\Mlciobhj.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\Mgimmkgp.exe
        
        C:\Windows\system32\Mgimmkgp.exe
        108⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Nlefebfg.exe
        
        C:\Windows\system32\Nlefebfg.exe
        109⤵
        Drops file in System32 directory
        
        PID:4100
        
        C:\Windows\SysWOW64\Nconal32.exe
        
        C:\Windows\system32\Nconal32.exe
        110⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Niifnf32.exe
        
        C:\Windows\system32\Niifnf32.exe
        111⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Ndokko32.exe
        
        C:\Windows\system32\Ndokko32.exe
        112⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Nepgcgje.exe
        
        C:\Windows\system32\Nepgcgje.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        114⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Ngpcmj32.exe
        
        C:\Windows\system32\Ngpcmj32.exe
        115⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Nnjljd32.exe
        
        C:\Windows\system32\Nnjljd32.exe
        116⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Ndcdfnpa.exe
        
        C:\Windows\system32\Ndcdfnpa.exe
        117⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Nfeqnf32.exe
        
        C:\Windows\system32\Nfeqnf32.exe
        118⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Npjelo32.exe
        
        C:\Windows\system32\Npjelo32.exe
        119⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Ngdmhimb.exe
        
        C:\Windows\system32\Ngdmhimb.exe
        120⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Opmaaodc.exe
        
        C:\Windows\system32\Opmaaodc.exe
        121⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        122⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        123⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Ojjoedfn.exe
        
        C:\Windows\system32\Ojjoedfn.exe
        124⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Olhlaoea.exe
        
        C:\Windows\system32\Olhlaoea.exe
        125⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Ocbdni32.exe
        
        C:\Windows\system32\Ocbdni32.exe
        126⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Ojllkcdk.exe
        
        C:\Windows\system32\Ojllkcdk.exe
        127⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Odaphl32.exe
        
        C:\Windows\system32\Odaphl32.exe
        128⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Pjnipc32.exe
        
        C:\Windows\system32\Pjnipc32.exe
        129⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Pqhammje.exe
        
        C:\Windows\system32\Pqhammje.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        131⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Pmoabn32.exe
        
        C:\Windows\system32\Pmoabn32.exe
        132⤵
        
        PID:896
        
        C:\Windows\SysWOW64\Pfgfkd32.exe
        
        C:\Windows\system32\Pfgfkd32.exe
        133⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Pckfdh32.exe
        
        C:\Windows\system32\Pckfdh32.exe
        134⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Pfjcpc32.exe
        
        C:\Windows\system32\Pfjcpc32.exe
        135⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Pqpgnl32.exe
        
        C:\Windows\system32\Pqpgnl32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Pflpfcbe.exe
        
        C:\Windows\system32\Pflpfcbe.exe
        137⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        138⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Qgllpf32.exe
        
        C:\Windows\system32\Qgllpf32.exe
        139⤵
        Drops file in System32 directory
        
        PID:1956
        
        C:\Windows\SysWOW64\Qnfdlpqd.exe
        
        C:\Windows\system32\Qnfdlpqd.exe
        140⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Qcbmegol.exe
        
        C:\Windows\system32\Qcbmegol.exe
        141⤵
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Qnhabp32.exe
        
        C:\Windows\system32\Qnhabp32.exe
        142⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Agqekeeb.exe
        
        C:\Windows\system32\Agqekeeb.exe
        143⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Anjngp32.exe
        
        C:\Windows\system32\Anjngp32.exe
        144⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Aedfdjdl.exe
        
        C:\Windows\system32\Aedfdjdl.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Ajanmqbc.exe
        
        C:\Windows\system32\Ajanmqbc.exe
        146⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Aegbji32.exe
        
        C:\Windows\system32\Aegbji32.exe
        147⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ajckbp32.exe
        
        C:\Windows\system32\Ajckbp32.exe
        148⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Aancojgn.exe
        
        C:\Windows\system32\Aancojgn.exe
        149⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Agglld32.exe
        
        C:\Windows\system32\Agglld32.exe
        150⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Amdddkma.exe
        
        C:\Windows\system32\Amdddkma.exe
        151⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Agjhadmh.exe
        
        C:\Windows\system32\Agjhadmh.exe
        152⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Amfqikko.exe
        
        C:\Windows\system32\Amfqikko.exe
        153⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Bglefdke.exe
        
        C:\Windows\system32\Bglefdke.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6652
        
        C:\Windows\SysWOW64\Bminokil.exe
        
        C:\Windows\system32\Bminokil.exe
        155⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Bgoalc32.exe
        
        C:\Windows\system32\Bgoalc32.exe
        156⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Bagfeioc.exe
        
        C:\Windows\system32\Bagfeioc.exe
        157⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Bganac32.exe
        
        C:\Windows\system32\Bganac32.exe
        158⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Bnkgomnl.exe
        
        C:\Windows\system32\Bnkgomnl.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Bchogd32.exe
        
        C:\Windows\system32\Bchogd32.exe
        160⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Bmpcpjcd.exe
        
        C:\Windows\system32\Bmpcpjcd.exe
        161⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Bhehmbbj.exe
        
        C:\Windows\system32\Bhehmbbj.exe
        162⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Canlfh32.exe
        
        C:\Windows\system32\Canlfh32.exe
        163⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Chhdbb32.exe
        
        C:\Windows\system32\Chhdbb32.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\Capikhgh.exe
        
        C:\Windows\system32\Capikhgh.exe
        165⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cfmacoep.exe
        
        C:\Windows\system32\Cfmacoep.exe
        166⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Cabfagee.exe
        
        C:\Windows\system32\Cabfagee.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Chmnnamb.exe
        
        C:\Windows\system32\Chmnnamb.exe
        168⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Cmiffhkj.exe
        
        C:\Windows\system32\Cmiffhkj.exe
        169⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Cdcobb32.exe
        
        C:\Windows\system32\Cdcobb32.exe
        170⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cjmgomjc.exe
        
        C:\Windows\system32\Cjmgomjc.exe
        171⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Cagolf32.exe
        
        C:\Windows\system32\Cagolf32.exe
        172⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Cfdhdn32.exe
        
        C:\Windows\system32\Cfdhdn32.exe
        173⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Dajlafon.exe
        
        C:\Windows\system32\Dajlafon.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Dhcdnq32.exe
        
        C:\Windows\system32\Dhcdnq32.exe
        175⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Dmpmfg32.exe
        
        C:\Windows\system32\Dmpmfg32.exe
        176⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dhfacp32.exe
        
        C:\Windows\system32\Dhfacp32.exe
        177⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Dopiqj32.exe
        
        C:\Windows\system32\Dopiqj32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Dejamdca.exe
        
        C:\Windows\system32\Dejamdca.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Dkgjekai.exe
        
        C:\Windows\system32\Dkgjekai.exe
        180⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Daqbbe32.exe
        
        C:\Windows\system32\Daqbbe32.exe
        181⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Dhkjooqb.exe
        
        C:\Windows\system32\Dhkjooqb.exe
        182⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Dmgbgf32.exe
        
        C:\Windows\system32\Dmgbgf32.exe
        183⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Dgpgplej.exe
        
        C:\Windows\system32\Dgpgplej.exe
        184⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Emjomf32.exe
        
        C:\Windows\system32\Emjomf32.exe
        185⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Eddhipdd.exe
        
        C:\Windows\system32\Eddhipdd.exe
        186⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Eoilfidj.exe
        
        C:\Windows\system32\Eoilfidj.exe
        187⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ehappnjj.exe
        
        C:\Windows\system32\Ehappnjj.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Windows\SysWOW64\Eggmqk32.exe
        
        C:\Windows\system32\Eggmqk32.exe
        189⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Eehnnb32.exe
        
        C:\Windows\system32\Eehnnb32.exe
        190⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Egijfjmp.exe
        
        C:\Windows\system32\Egijfjmp.exe
        191⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Eaonccme.exe
        
        C:\Windows\system32\Eaonccme.exe
        192⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ehifpm32.exe
        
        C:\Windows\system32\Ehifpm32.exe
        193⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Fobomglo.exe
        
        C:\Windows\system32\Fobomglo.exe
        194⤵
        
        PID:200
        
        C:\Windows\SysWOW64\Fhkcfmbp.exe
        
        C:\Windows\system32\Fhkcfmbp.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\Foekbg32.exe
        
        C:\Windows\system32\Foekbg32.exe
        196⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Fhmpkmpm.exe
        
        C:\Windows\system32\Fhmpkmpm.exe
        197⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Fddqpn32.exe
        
        C:\Windows\system32\Fddqpn32.exe
        198⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Fknimh32.exe
        
        C:\Windows\system32\Fknimh32.exe
        199⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Fecmjq32.exe
        
        C:\Windows\system32\Fecmjq32.exe
        200⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fkqebg32.exe
        
        C:\Windows\system32\Fkqebg32.exe
        201⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fdijkmbl.exe
        
        C:\Windows\system32\Fdijkmbl.exe
        202⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Gkcbhgii.exe
        
        C:\Windows\system32\Gkcbhgii.exe
        203⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Gdkgam32.exe
        
        C:\Windows\system32\Gdkgam32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
        
        C:\Windows\SysWOW64\Goqkne32.exe
        
        C:\Windows\system32\Goqkne32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Gdncfl32.exe
        
        C:\Windows\system32\Gdncfl32.exe
        206⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Gaadpqmp.exe
        
        C:\Windows\system32\Gaadpqmp.exe
        207⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ggnlhgkg.exe
        
        C:\Windows\system32\Ggnlhgkg.exe
        208⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        209⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        210⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Gfaikoad.exe
        
        C:\Windows\system32\Gfaikoad.exe
        211⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Hkobdeok.exe
        
        C:\Windows\system32\Hkobdeok.exe
        212⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hbhjqp32.exe
        
        C:\Windows\system32\Hbhjqp32.exe
        213⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Hhbbmjne.exe
        
        C:\Windows\system32\Hhbbmjne.exe
        214⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Hffbfn32.exe
        
        C:\Windows\system32\Hffbfn32.exe
        215⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Hkckoe32.exe
        
        C:\Windows\system32\Hkckoe32.exe
        216⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Hhglhi32.exe
        
        C:\Windows\system32\Hhglhi32.exe
        217⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Hfklamii.exe
        
        C:\Windows\system32\Hfklamii.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Hocqkc32.exe
        
        C:\Windows\system32\Hocqkc32.exe
        219⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Hdpicj32.exe
        
        C:\Windows\system32\Hdpicj32.exe
        220⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Iofmpb32.exe
        
        C:\Windows\system32\Iofmpb32.exe
        221⤵
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        222⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ikmnec32.exe
        
        C:\Windows\system32\Ikmnec32.exe
        223⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        224⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Inmggo32.exe
        
        C:\Windows\system32\Inmggo32.exe
        225⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Iickdgpb.exe
        
        C:\Windows\system32\Iickdgpb.exe
        226⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Iomcqa32.exe
        
        C:\Windows\system32\Iomcqa32.exe
        227⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        228⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ifihckmi.exe
        
        C:\Windows\system32\Ifihckmi.exe
        229⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Joamlacj.exe
        
        C:\Windows\system32\Joamlacj.exe
        230⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Jenedhaa.exe
        
        C:\Windows\system32\Jenedhaa.exe
        231⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Jodiaqag.exe
        
        C:\Windows\system32\Jodiaqag.exe
        232⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Jfnbnk32.exe
        
        C:\Windows\system32\Jfnbnk32.exe
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Windows\SysWOW64\Jilnjf32.exe
        
        C:\Windows\system32\Jilnjf32.exe
        234⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Jnifbmfo.exe
        
        C:\Windows\system32\Jnifbmfo.exe
        235⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Jecoog32.exe
        
        C:\Windows\system32\Jecoog32.exe
        236⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Jkmgladi.exe
        
        C:\Windows\system32\Jkmgladi.exe
        237⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Jbgoik32.exe
        
        C:\Windows\system32\Jbgoik32.exe
        238⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Jiageecb.exe
        
        C:\Windows\system32\Jiageecb.exe
        239⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Kfehoj32.exe
        
        C:\Windows\system32\Kfehoj32.exe
        240⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Kgfdfbhj.exe
        
        C:\Windows\system32\Kgfdfbhj.exe
        241⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Knpmcl32.exe
        
        C:\Windows\system32\Knpmcl32.exe
        242⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Kejepfgd.exe
        
        C:\Windows\system32\Kejepfgd.exe
        243⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Kppimogj.exe
        
        C:\Windows\system32\Kppimogj.exe
        244⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Kelaef32.exe
        
        C:\Windows\system32\Kelaef32.exe
        245⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Klfjbpmn.exe
        
        C:\Windows\system32\Klfjbpmn.exe
        246⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Keonke32.exe
        
        C:\Windows\system32\Keonke32.exe
        247⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Kpdbhn32.exe
        
        C:\Windows\system32\Kpdbhn32.exe
        248⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Kimgad32.exe
        
        C:\Windows\system32\Kimgad32.exe
        249⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Knipik32.exe
        
        C:\Windows\system32\Knipik32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Lhbdbpnm.exe
        
        C:\Windows\system32\Lhbdbpnm.exe
        251⤵
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Lfcdph32.exe
        
        C:\Windows\system32\Lfcdph32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7996
        
        C:\Windows\SysWOW64\Llpmhodc.exe
        
        C:\Windows\system32\Llpmhodc.exe
        253⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Lbjeei32.exe
        
        C:\Windows\system32\Lbjeei32.exe
        254⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Lehaad32.exe
        
        C:\Windows\system32\Lehaad32.exe
        255⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Lpneom32.exe
        
        C:\Windows\system32\Lpneom32.exe
        256⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Lfgnkgbf.exe
        
        C:\Windows\system32\Lfgnkgbf.exe
        257⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Lhijcohe.exe
        
        C:\Windows\system32\Lhijcohe.exe
        258⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Lbnnphhk.exe
        
        C:\Windows\system32\Lbnnphhk.exe
        259⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Lhkghofb.exe
        
        C:\Windows\system32\Lhkghofb.exe
        260⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Loeoei32.exe
        
        C:\Windows\system32\Loeoei32.exe
        261⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Meogbcel.exe
        
        C:\Windows\system32\Meogbcel.exe
        262⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mlipomli.exe
        
        C:\Windows\system32\Mlipomli.exe
        263⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Meadgc32.exe
        
        C:\Windows\system32\Meadgc32.exe
        264⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Mojhphij.exe
        
        C:\Windows\system32\Mojhphij.exe
        265⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        266⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Mlnijmhc.exe
        
        C:\Windows\system32\Mlnijmhc.exe
        267⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Mbhafgpp.exe
        
        C:\Windows\system32\Mbhafgpp.exe
        268⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Mefmbbod.exe
        
        C:\Windows\system32\Mefmbbod.exe
        269⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Moobkh32.exe
        
        C:\Windows\system32\Moobkh32.exe
        270⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Midfiq32.exe
        
        C:\Windows\system32\Midfiq32.exe
        271⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Noaoagca.exe
        
        C:\Windows\system32\Noaoagca.exe
        272⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Nifcnpch.exe
        
        C:\Windows\system32\Nifcnpch.exe
        273⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Nleojlbk.exe
        
        C:\Windows\system32\Nleojlbk.exe
        274⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Nboggf32.exe
        
        C:\Windows\system32\Nboggf32.exe
        275⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Npbhqj32.exe
        
        C:\Windows\system32\Npbhqj32.exe
        276⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        277⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Niklip32.exe
        
        C:\Windows\system32\Niklip32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Npedfjfo.exe
        
        C:\Windows\system32\Npedfjfo.exe
        279⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Nebmnqdf.exe
        
        C:\Windows\system32\Nebmnqdf.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:8752
        
        C:\Windows\SysWOW64\Nllekk32.exe
        
        C:\Windows\system32\Nllekk32.exe
        281⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Ncfmhecp.exe
        
        C:\Windows\system32\Ncfmhecp.exe
        282⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Nlnbqjjq.exe
        
        C:\Windows\system32\Nlnbqjjq.exe
        283⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ogcfncjf.exe
        
        C:\Windows\system32\Ogcfncjf.exe
        284⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Oplkgi32.exe
        
        C:\Windows\system32\Oplkgi32.exe
        285⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ogfccchd.exe
        
        C:\Windows\system32\Ogfccchd.exe
        286⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ohgokknb.exe
        
        C:\Windows\system32\Ohgokknb.exe
        287⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ooaghe32.exe
        
        C:\Windows\system32\Ooaghe32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
        
        C:\Windows\SysWOW64\Oekpdoll.exe
        
        C:\Windows\system32\Oekpdoll.exe
        289⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Olehai32.exe
        
        C:\Windows\system32\Olehai32.exe
        290⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ogklob32.exe
        
        C:\Windows\system32\Ogklob32.exe
        291⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Ohlifj32.exe
        
        C:\Windows\system32\Ohlifj32.exe
        292⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Ocamcc32.exe
        
        C:\Windows\system32\Ocamcc32.exe
        293⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Ppemmg32.exe
        
        C:\Windows\system32\Ppemmg32.exe
        294⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Pjnbfmom.exe
        
        C:\Windows\system32\Pjnbfmom.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8292
        
        C:\Windows\SysWOW64\Pphjbgfj.exe
        
        C:\Windows\system32\Pphjbgfj.exe
        296⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Windows\SysWOW64\Pgaboa32.exe
        
        C:\Windows\system32\Pgaboa32.exe
        297⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Plokgh32.exe
        
        C:\Windows\system32\Plokgh32.exe
        298⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Pomgcc32.exe
        
        C:\Windows\system32\Pomgcc32.exe
        299⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Pjbkal32.exe
        
        C:\Windows\system32\Pjbkal32.exe
        300⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Poodicio.exe
        
        C:\Windows\system32\Poodicio.exe
        301⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Pjehflie.exe
        
        C:\Windows\system32\Pjehflie.exe
        302⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ppopcf32.exe
        
        C:\Windows\system32\Ppopcf32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8896
        
        C:\Windows\SysWOW64\Pgihppgo.exe
        
        C:\Windows\system32\Pgihppgo.exe
        304⤵
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Qhjegh32.exe
        
        C:\Windows\system32\Qhjegh32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9016
        
        C:\Windows\SysWOW64\Qqamieno.exe
        
        C:\Windows\system32\Qqamieno.exe
        306⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Qgkeep32.exe
        
        C:\Windows\system32\Qgkeep32.exe
        307⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Qhlamhkj.exe
        
        C:\Windows\system32\Qhlamhkj.exe
        308⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Qcbfjqkp.exe
        
        C:\Windows\system32\Qcbfjqkp.exe
        309⤵
        Drops file in System32 directory
        
        PID:8340
        
        C:\Windows\SysWOW64\Ajlngk32.exe
        
        C:\Windows\system32\Ajlngk32.exe
        310⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Agpoqoaf.exe
        
        C:\Windows\system32\Agpoqoaf.exe
        311⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ahakhg32.exe
        
        C:\Windows\system32\Ahakhg32.exe
        312⤵
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Agbkfood.exe
        
        C:\Windows\system32\Agbkfood.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Aichng32.exe
        
        C:\Windows\system32\Aichng32.exe
        314⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Aompjamo.exe
        
        C:\Windows\system32\Aompjamo.exe
        315⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Agdhln32.exe
        
        C:\Windows\system32\Agdhln32.exe
        316⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Amaqde32.exe
        
        C:\Windows\system32\Amaqde32.exe
        317⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Aopmpq32.exe
        
        C:\Windows\system32\Aopmpq32.exe
        318⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Ajeami32.exe
        
        C:\Windows\system32\Ajeami32.exe
        319⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Aqoijcbo.exe
        
        C:\Windows\system32\Aqoijcbo.exe
        320⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Agiagn32.exe
        
        C:\Windows\system32\Agiagn32.exe
        321⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Bjgncihp.exe
        
        C:\Windows\system32\Bjgncihp.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9240
        
        C:\Windows\SysWOW64\Bqafpc32.exe
        
        C:\Windows\system32\Bqafpc32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Bgknlmgi.exe
        
        C:\Windows\system32\Bgknlmgi.exe
        324⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Bimkde32.exe
        
        C:\Windows\system32\Bimkde32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Bcboan32.exe
        
        C:\Windows\system32\Bcboan32.exe
        326⤵
        Drops file in System32 directory
        
        PID:9368
        
        C:\Windows\SysWOW64\Bjlgnh32.exe
        
        C:\Windows\system32\Bjlgnh32.exe
        327⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9432
        
        C:\Windows\SysWOW64\Bjodch32.exe
        
        C:\Windows\system32\Bjodch32.exe
        329⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
        
        C:\Windows\SysWOW64\Bmmppc32.exe
        
        C:\Windows\system32\Bmmppc32.exe
        330⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bcghlnih.exe
        
        C:\Windows\system32\Bcghlnih.exe
        331⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Bjaqih32.exe
        
        C:\Windows\system32\Bjaqih32.exe
        332⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Bqkifb32.exe
        
        C:\Windows\system32\Bqkifb32.exe
        333⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Bgeabloo.exe
        
        C:\Windows\system32\Bgeabloo.exe
        334⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Cifmjd32.exe
        
        C:\Windows\system32\Cifmjd32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9656
        
        C:\Windows\SysWOW64\Cppfgnlj.exe
        
        C:\Windows\system32\Cppfgnlj.exe
        336⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Cfjnch32.exe
        
        C:\Windows\system32\Cfjnch32.exe
        337⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Capbaacl.exe
        
        C:\Windows\system32\Capbaacl.exe
        338⤵
        Modifies registry class
        
        PID:9752
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        339⤵
        Modifies registry class
        
        PID:9784
        
        C:\Windows\SysWOW64\Cjhfjg32.exe
        
        C:\Windows\system32\Cjhfjg32.exe
        340⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Cabofaaj.exe
        
        C:\Windows\system32\Cabofaaj.exe
        341⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Cglgck32.exe
        
        C:\Windows\system32\Cglgck32.exe
        342⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Cjjcof32.exe
        
        C:\Windows\system32\Cjjcof32.exe
        343⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Cadllq32.exe
        
        C:\Windows\system32\Cadllq32.exe
        344⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Cgndikgd.exe
        
        C:\Windows\system32\Cgndikgd.exe
        345⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Cipppc32.exe
        
        C:\Windows\system32\Cipppc32.exe
        346⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Cpihmmdo.exe
        
        C:\Windows\system32\Cpihmmdo.exe
        347⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Djomjfde.exe
        
        C:\Windows\system32\Djomjfde.exe
        348⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Dplebmbl.exe
        
        C:\Windows\system32\Dplebmbl.exe
        349⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Dgcmdj32.exe
        
        C:\Windows\system32\Dgcmdj32.exe
        350⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Djaipe32.exe
        
        C:\Windows\system32\Djaipe32.exe
        351⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Dmpfla32.exe
        
        C:\Windows\system32\Dmpfla32.exe
        352⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Dfhjefhf.exe
        
        C:\Windows\system32\Dfhjefhf.exe
        353⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Dannbogl.exe
        
        C:\Windows\system32\Dannbogl.exe
        354⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Djfckenm.exe
        
        C:\Windows\system32\Djfckenm.exe
        355⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Dapkho32.exe
        
        C:\Windows\system32\Dapkho32.exe
        356⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Dfmcpf32.exe
        
        C:\Windows\system32\Dfmcpf32.exe
        357⤵
        Modifies registry class
        
        PID:9440
        
        C:\Windows\SysWOW64\Dmglmpkn.exe
        
        C:\Windows\system32\Dmglmpkn.exe
        358⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ehlpjikd.exe
        
        C:\Windows\system32\Ehlpjikd.exe
        359⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Einmaaqb.exe
        
        C:\Windows\system32\Einmaaqb.exe
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Windows\SysWOW64\Eaddcnad.exe
        
        C:\Windows\system32\Eaddcnad.exe
        361⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ehomph32.exe
        
        C:\Windows\system32\Ehomph32.exe
        362⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Emkeho32.exe
        
        C:\Windows\system32\Emkeho32.exe
        363⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Ehaieh32.exe
        
        C:\Windows\system32\Ehaieh32.exe
        364⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Eibfmp32.exe
        
        C:\Windows\system32\Eibfmp32.exe
        365⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Eplnijdj.exe
        
        C:\Windows\system32\Eplnijdj.exe
        366⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
        
        C:\Windows\SysWOW64\Effffd32.exe
        
        C:\Windows\system32\Effffd32.exe
        367⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Eidbbp32.exe
        
        C:\Windows\system32\Eidbbp32.exe
        368⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Edjgpi32.exe
        
        C:\Windows\system32\Edjgpi32.exe
        369⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ekdolcbm.exe
        
        C:\Windows\system32\Ekdolcbm.exe
        370⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Embkhn32.exe
        
        C:\Windows\system32\Embkhn32.exe
        371⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Fdlcehhn.exe
        
        C:\Windows\system32\Fdlcehhn.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9612
        
        C:\Windows\SysWOW64\Fmehnn32.exe
        
        C:\Windows\system32\Fmehnn32.exe
        373⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Fdopkhfk.exe
        
        C:\Windows\system32\Fdopkhfk.exe
        374⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Filicodb.exe
        
        C:\Windows\system32\Filicodb.exe
        375⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Fabqdl32.exe
        
        C:\Windows\system32\Fabqdl32.exe
        376⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Fhmiqfma.exe
        
        C:\Windows\system32\Fhmiqfma.exe
        377⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Fkkemble.exe
        
        C:\Windows\system32\Fkkemble.exe
        378⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Fphneijl.exe
        
        C:\Windows\system32\Fphneijl.exe
        379⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Fhofffjo.exe
        
        C:\Windows\system32\Fhofffjo.exe
        380⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Fipbnn32.exe
        
        C:\Windows\system32\Fipbnn32.exe
        381⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Fpjjkh32.exe
        
        C:\Windows\system32\Fpjjkh32.exe
        382⤵
        Drops file in System32 directory
        
        PID:9344
        
        C:\Windows\SysWOW64\Fgdbgbof.exe
        
        C:\Windows\system32\Fgdbgbof.exe
        383⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Fmnkdm32.exe
        
        C:\Windows\system32\Fmnkdm32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10200
        
        C:\Windows\SysWOW64\Ggfombmd.exe
        
        C:\Windows\system32\Ggfombmd.exe
        385⤵
        
        PID:592
        
        C:\Windows\SysWOW64\Gmqgjl32.exe
        
        C:\Windows\system32\Gmqgjl32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10252
        
        C:\Windows\SysWOW64\Ghflgedf.exe
        
        C:\Windows\system32\Ghflgedf.exe
        387⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Gmcdolbn.exe
        
        C:\Windows\system32\Gmcdolbn.exe
        388⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Gdmmlf32.exe
        
        C:\Windows\system32\Gdmmlf32.exe
        389⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Gijedm32.exe
        
        C:\Windows\system32\Gijedm32.exe
        390⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Gdoiaf32.exe
        
        C:\Windows\system32\Gdoiaf32.exe
        391⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Ggnenagl.exe
        
        C:\Windows\system32\Ggnenagl.exe
        392⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Gpfjfg32.exe
        
        C:\Windows\system32\Gpfjfg32.exe
        393⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Ggpbcaei.exe
        
        C:\Windows\system32\Ggpbcaei.exe
        394⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Gjnnoldm.exe
        
        C:\Windows\system32\Gjnnoldm.exe
        395⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Hddbmedc.exe
        
        C:\Windows\system32\Hddbmedc.exe
        396⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Hgboiq32.exe
        
        C:\Windows\system32\Hgboiq32.exe
        397⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
        
        C:\Windows\SysWOW64\Hnlgekkc.exe
        
        C:\Windows\system32\Hnlgekkc.exe
        398⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Hdfobe32.exe
        
        C:\Windows\system32\Hdfobe32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10756
        
        C:\Windows\SysWOW64\Hnodkjhq.exe
        
        C:\Windows\system32\Hnodkjhq.exe
        400⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Hdhlhd32.exe
        
        C:\Windows\system32\Hdhlhd32.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10824
        
        C:\Windows\SysWOW64\Hkbddo32.exe
        
        C:\Windows\system32\Hkbddo32.exe
        402⤵
        System Location Discovery: System Language Discovery
        
        PID:10856
        
        C:\Windows\SysWOW64\Hpomme32.exe
        
        C:\Windows\system32\Hpomme32.exe
        403⤵
        System Location Discovery: System Language Discovery
        
        PID:10888
        
        C:\Windows\SysWOW64\Hgieipmo.exe
        
        C:\Windows\system32\Hgieipmo.exe
        404⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Hjhaeklb.exe
        
        C:\Windows\system32\Hjhaeklb.exe
        405⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Hhiacb32.exe
        
        C:\Windows\system32\Hhiacb32.exe
        406⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        407⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Iaaflh32.exe
        
        C:\Windows\system32\Iaaflh32.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11048
        
        C:\Windows\SysWOW64\Ihknibbo.exe
        
        C:\Windows\system32\Ihknibbo.exe
        409⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
        
        C:\Windows\SysWOW64\Inhgaipf.exe
        
        C:\Windows\system32\Inhgaipf.exe
        410⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Ihnkobpl.exe
        
        C:\Windows\system32\Ihnkobpl.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11152
        
        C:\Windows\SysWOW64\Iklgkmop.exe
        
        C:\Windows\system32\Iklgkmop.exe
        412⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Injcginc.exe
        
        C:\Windows\system32\Injcginc.exe
        413⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        414⤵
        Drops file in System32 directory
        
        PID:11252
        
        C:\Windows\SysWOW64\Ikndpm32.exe
        
        C:\Windows\system32\Ikndpm32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10276
        
        C:\Windows\SysWOW64\Inmplh32.exe
        
        C:\Windows\system32\Inmplh32.exe
        416⤵
        Modifies registry class
        
        PID:10336
        
        C:\Windows\SysWOW64\Iqklhd32.exe
        
        C:\Windows\system32\Iqklhd32.exe
        417⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        418⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        419⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Iggakn32.exe
        
        C:\Windows\system32\Iggakn32.exe
        420⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Jnaighhk.exe
        
        C:\Windows\system32\Jnaighhk.exe
        421⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Jqpfccgo.exe
        
        C:\Windows\system32\Jqpfccgo.exe
        422⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Jhgneqha.exe
        
        C:\Windows\system32\Jhgneqha.exe
        423⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jncfmgfi.exe
        
        C:\Windows\system32\Jncfmgfi.exe
        424⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Jdnnjane.exe
        
        C:\Windows\system32\Jdnnjane.exe
        425⤵
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Jkggfl32.exe
        
        C:\Windows\system32\Jkggfl32.exe
        426⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Jnfcbg32.exe
        
        C:\Windows\system32\Jnfcbg32.exe
        427⤵
        Drops file in System32 directory
        
        PID:10948
        
        C:\Windows\SysWOW64\Jdpkoalc.exe
        
        C:\Windows\system32\Jdpkoalc.exe
        428⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Jgngkmkf.exe
        
        C:\Windows\system32\Jgngkmkf.exe
        429⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Jbdliejl.exe
        
        C:\Windows\system32\Jbdliejl.exe
        430⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Jhndepbi.exe
        
        C:\Windows\system32\Jhndepbi.exe
        431⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Jjopmh32.exe
        
        C:\Windows\system32\Jjopmh32.exe
        432⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Jqihjbod.exe
        
        C:\Windows\system32\Jqihjbod.exe
        433⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Jgcafl32.exe
        
        C:\Windows\system32\Jgcafl32.exe
        434⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Kjambg32.exe
        
        C:\Windows\system32\Kjambg32.exe
        435⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Kqkeoama.exe
        
        C:\Windows\system32\Kqkeoama.exe
        436⤵
        Modifies registry class
        
        PID:10684
        
        C:\Windows\SysWOW64\Kgenlldo.exe
        
        C:\Windows\system32\Kgenlldo.exe
        437⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Keinepch.exe
        
        C:\Windows\system32\Keinepch.exe
        438⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Knabne32.exe
        
        C:\Windows\system32\Knabne32.exe
        439⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        440⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Kbpkdd32.exe
        
        C:\Windows\system32\Kbpkdd32.exe
        441⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Kijcanhl.exe
        
        C:\Windows\system32\Kijcanhl.exe
        442⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Kkhpmigp.exe
        
        C:\Windows\system32\Kkhpmigp.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10748
        
        C:\Windows\SysWOW64\Kaehepeg.exe
        
        C:\Windows\system32\Kaehepeg.exe
        444⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Lkjlciem.exe
        
        C:\Windows\system32\Lkjlciem.exe
        445⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Lagekp32.exe
        
        C:\Windows\system32\Lagekp32.exe
        446⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10312
        
        C:\Windows\SysWOW64\Lnkedd32.exe
        
        C:\Windows\system32\Lnkedd32.exe
        448⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Liqibm32.exe
        
        C:\Windows\system32\Liqibm32.exe
        449⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Llofnh32.exe
        
        C:\Windows\system32\Llofnh32.exe
        450⤵
        Drops file in System32 directory
        
        PID:11308
        
        C:\Windows\SysWOW64\Lnmbjd32.exe
        
        C:\Windows\system32\Lnmbjd32.exe
        451⤵
        Modifies registry class
        
        PID:11340
        
        C:\Windows\SysWOW64\Legjgn32.exe
        
        C:\Windows\system32\Legjgn32.exe
        452⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Lgffci32.exe
        
        C:\Windows\system32\Lgffci32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11404
        
        C:\Windows\SysWOW64\Lnpopcni.exe
        
        C:\Windows\system32\Lnpopcni.exe
        454⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Lejgln32.exe
        
        C:\Windows\system32\Lejgln32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Llcoihmb.exe
        
        C:\Windows\system32\Llcoihmb.exe
        456⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Lbngfbdo.exe
        
        C:\Windows\system32\Lbngfbdo.exe
        457⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Mhjpnibf.exe
        
        C:\Windows\system32\Mhjpnibf.exe
        458⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Mndhkc32.exe
        
        C:\Windows\system32\Mndhkc32.exe
        459⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Mijlhl32.exe
        
        C:\Windows\system32\Mijlhl32.exe
        460⤵
        Modifies registry class
        
        PID:11632
        
        C:\Windows\SysWOW64\Mngepb32.exe
        
        C:\Windows\system32\Mngepb32.exe
        461⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Meqmmm32.exe
        
        C:\Windows\system32\Meqmmm32.exe
        462⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Mjneec32.exe
        
        C:\Windows\system32\Mjneec32.exe
        463⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Miofcked.exe
        
        C:\Windows\system32\Miofcked.exe
        464⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Mjpbkc32.exe
        
        C:\Windows\system32\Mjpbkc32.exe
        465⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Meefhl32.exe
        
        C:\Windows\system32\Meefhl32.exe
        466⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Mlooef32.exe
        
        C:\Windows\system32\Mlooef32.exe
        467⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Mbigapjb.exe
        
        C:\Windows\system32\Mbigapjb.exe
        468⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Mehcnlie.exe
        
        C:\Windows\system32\Mehcnlie.exe
        469⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Njdlfbgm.exe
        
        C:\Windows\system32\Njdlfbgm.exe
        470⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Naodbm32.exe
        
        C:\Windows\system32\Naodbm32.exe
        471⤵
        Drops file in System32 directory
        
        PID:11988
        
        C:\Windows\SysWOW64\Nhhlog32.exe
        
        C:\Windows\system32\Nhhlog32.exe
        472⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Nbnpmp32.exe
        
        C:\Windows\system32\Nbnpmp32.exe
        473⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12052
        
        C:\Windows\SysWOW64\Nihiiimi.exe
        
        C:\Windows\system32\Nihiiimi.exe
        474⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Nkieab32.exe
        
        C:\Windows\system32\Nkieab32.exe
        475⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Neoink32.exe
        
        C:\Windows\system32\Neoink32.exe
        476⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Nklbfaae.exe
        
        C:\Windows\system32\Nklbfaae.exe
        477⤵
        System Location Discovery: System Language Discovery
        
        PID:12180
        
        C:\Windows\SysWOW64\Naejcl32.exe
        
        C:\Windows\system32\Naejcl32.exe
        478⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Nhpbpepo.exe
        
        C:\Windows\system32\Nhpbpepo.exe
        479⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Noijmp32.exe
        
        C:\Windows\system32\Noijmp32.exe
        480⤵
        Drops file in System32 directory
        
        PID:12276
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        481⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11300
        
        C:\Windows\SysWOW64\Olnkfd32.exe
        
        C:\Windows\system32\Olnkfd32.exe
        482⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        483⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Oiakpheo.exe
        
        C:\Windows\system32\Oiakpheo.exe
        484⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        485⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Oehldi32.exe
        
        C:\Windows\system32\Oehldi32.exe
        486⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Olbdacbp.exe
        
        C:\Windows\system32\Olbdacbp.exe
        487⤵
        Drops file in System32 directory
        
        PID:11688
        
        C:\Windows\SysWOW64\Oifekg32.exe
        
        C:\Windows\system32\Oifekg32.exe
        488⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Oboicmhj.exe
        
        C:\Windows\system32\Oboicmhj.exe
        489⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Oemephgn.exe
        
        C:\Windows\system32\Oemephgn.exe
        490⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        491⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Obafim32.exe
        
        C:\Windows\system32\Obafim32.exe
        492⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Piknfgmd.exe
        
        C:\Windows\system32\Piknfgmd.exe
        493⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Pklkmo32.exe
        
        C:\Windows\system32\Pklkmo32.exe
        494⤵
        Drops file in System32 directory
        
        PID:12140
        
        C:\Windows\SysWOW64\Pimkkfka.exe
        
        C:\Windows\system32\Pimkkfka.exe
        495⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        496⤵
        System Location Discovery: System Language Discovery
        
        PID:12264
        
        C:\Windows\SysWOW64\Piphaf32.exe
        
        C:\Windows\system32\Piphaf32.exe
        497⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Pkqdhnom.exe
        
        C:\Windows\system32\Pkqdhnom.exe
        498⤵
        Drops file in System32 directory
        
        PID:11456
        
        C:\Windows\SysWOW64\Pefhfgoc.exe
        
        C:\Windows\system32\Pefhfgoc.exe
        499⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Phddbbnf.exe
        
        C:\Windows\system32\Phddbbnf.exe
        500⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Poomom32.exe
        
        C:\Windows\system32\Poomom32.exe
        501⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Pehekgmp.exe
        
        C:\Windows\system32\Pehekgmp.exe
        502⤵
        Drops file in System32 directory
        
        PID:11964
        
        C:\Windows\SysWOW64\Plbmhadm.exe
        
        C:\Windows\system32\Plbmhadm.exe
        503⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Pcmeek32.exe
        
        C:\Windows\system32\Pcmeek32.exe
        504⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        505⤵
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\SysWOW64\Qkhjim32.exe
        
        C:\Windows\system32\Qkhjim32.exe
        506⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Qemoff32.exe
        
        C:\Windows\system32\Qemoff32.exe
        507⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Qlggcp32.exe
        
        C:\Windows\system32\Qlggcp32.exe
        508⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Acaopjgd.exe
        
        C:\Windows\system32\Acaopjgd.exe
        509⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        510⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Acclejeb.exe
        
        C:\Windows\system32\Acclejeb.exe
        511⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Aebhaede.exe
        
        C:\Windows\system32\Aebhaede.exe
        512⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Allpnplb.exe
        
        C:\Windows\system32\Allpnplb.exe
        513⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12312
        
        C:\Windows\SysWOW64\Acfhkj32.exe
        
        C:\Windows\system32\Acfhkj32.exe
        514⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Ajpqhdkl.exe
        
        C:\Windows\system32\Ajpqhdkl.exe
        515⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Aomipkic.exe
        
        C:\Windows\system32\Aomipkic.exe
        516⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Aakelfhg.exe
        
        C:\Windows\system32\Aakelfhg.exe
        517⤵
        Modifies registry class
        
        PID:12440
        
        C:\Windows\SysWOW64\Ahenip32.exe
        
        C:\Windows\system32\Ahenip32.exe
        518⤵
        Drops file in System32 directory
        
        PID:12472
        
        C:\Windows\SysWOW64\Ackbfioj.exe
        
        C:\Windows\system32\Ackbfioj.exe
        519⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Alcfoo32.exe
        
        C:\Windows\system32\Alcfoo32.exe
        520⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Bcmolimg.exe
        
        C:\Windows\system32\Bcmolimg.exe
        521⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Bhjgdplo.exe
        
        C:\Windows\system32\Bhjgdplo.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12600
        
        C:\Windows\SysWOW64\Bcokah32.exe
        
        C:\Windows\system32\Bcokah32.exe
        523⤵
        System Location Discovery: System Language Discovery
        
        PID:12632
        
        C:\Windows\SysWOW64\Bjicnbba.exe
        
        C:\Windows\system32\Bjicnbba.exe
        524⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Boflfiai.exe
        
        C:\Windows\system32\Boflfiai.exe
        525⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Bfpdcc32.exe
        
        C:\Windows\system32\Bfpdcc32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12728
        
        C:\Windows\SysWOW64\Bhnqoo32.exe
        
        C:\Windows\system32\Bhnqoo32.exe
        527⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Bohiliof.exe
        
        C:\Windows\system32\Bohiliof.exe
        528⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Bbgehd32.exe
        
        C:\Windows\system32\Bbgehd32.exe
        529⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Bhqmdoef.exe
        
        C:\Windows\system32\Bhqmdoef.exe
        530⤵
        System Location Discovery: System Language Discovery
        
        PID:12856
        
        C:\Windows\SysWOW64\Bokeai32.exe
        
        C:\Windows\system32\Bokeai32.exe
        531⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Bjpjoa32.exe
        
        C:\Windows\system32\Bjpjoa32.exe
        532⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Bmofkm32.exe
        
        C:\Windows\system32\Bmofkm32.exe
        533⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        534⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Ciefpn32.exe
        
        C:\Windows\system32\Ciefpn32.exe
        535⤵
        Modifies registry class
        
        PID:13016
        
        C:\Windows\SysWOW64\Cooolhin.exe
        
        C:\Windows\system32\Cooolhin.exe
        536⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Cfigib32.exe
        
        C:\Windows\system32\Cfigib32.exe
        537⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Cmcoflhh.exe
        
        C:\Windows\system32\Cmcoflhh.exe
        538⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Cobkbhgk.exe
        
        C:\Windows\system32\Cobkbhgk.exe
        539⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Cfldob32.exe
        
        C:\Windows\system32\Cfldob32.exe
        540⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Cmflkl32.exe
        
        C:\Windows\system32\Cmflkl32.exe
        541⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Ccpdhfmb.exe
        
        C:\Windows\system32\Ccpdhfmb.exe
        542⤵
        Drops file in System32 directory
        
        PID:13264
        
        C:\Windows\SysWOW64\Cilmpmki.exe
        
        C:\Windows\system32\Cilmpmki.exe
        543⤵
        System Location Discovery: System Language Discovery
        
        PID:13296
        
        C:\Windows\SysWOW64\Cofemg32.exe
        
        C:\Windows\system32\Cofemg32.exe
        544⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Cbeaib32.exe
        
        C:\Windows\system32\Cbeaib32.exe
        545⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Cjlijp32.exe
        
        C:\Windows\system32\Cjlijp32.exe
        546⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Doiabgqc.exe
        
        C:\Windows\system32\Doiabgqc.exe
        547⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Dfcjoa32.exe
        
        C:\Windows\system32\Dfcjoa32.exe
        548⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Dmmblkpm.exe
        
        C:\Windows\system32\Dmmblkpm.exe
        549⤵
        Modifies registry class
        
        PID:12640
        
        C:\Windows\SysWOW64\Dpknhfoq.exe
        
        C:\Windows\system32\Dpknhfoq.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12704
        
        C:\Windows\SysWOW64\Dfefeq32.exe
        
        C:\Windows\system32\Dfefeq32.exe
        551⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Dmooak32.exe
        
        C:\Windows\system32\Dmooak32.exe
        552⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        553⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Difpflco.exe
        
        C:\Windows\system32\Difpflco.exe
        554⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Dckdddcd.exe
        
        C:\Windows\system32\Dckdddcd.exe
        555⤵
        System Location Discovery: System Language Discovery
        
        PID:13024
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1796
        
        C:\Windows\SysWOW64\Dpbdiehi.exe
        
        C:\Windows\system32\Dpbdiehi.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13160
        
        C:\Windows\SysWOW64\Dflmep32.exe
        
        C:\Windows\system32\Dflmep32.exe
        558⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Emfebjgb.exe
        
        C:\Windows\system32\Emfebjgb.exe
        559⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Epdaneff.exe
        
        C:\Windows\system32\Epdaneff.exe
        560⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Ebcmjqej.exe
        
        C:\Windows\system32\Ebcmjqej.exe
        561⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        562⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Epgndedc.exe
        
        C:\Windows\system32\Epgndedc.exe
        563⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Ejlban32.exe
        
        C:\Windows\system32\Ejlban32.exe
        564⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Ecefjckj.exe
        
        C:\Windows\system32\Ecefjckj.exe
        565⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Efccfojn.exe
        
        C:\Windows\system32\Efccfojn.exe
        566⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Emmkci32.exe
        
        C:\Windows\system32\Emmkci32.exe
        567⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Eplgod32.exe
        
        C:\Windows\system32\Eplgod32.exe
        568⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Efepln32.exe
        
        C:\Windows\system32\Efepln32.exe
        569⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Emphhhoh.exe
        
        C:\Windows\system32\Emphhhoh.exe
        570⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Ecipeb32.exe
        
        C:\Windows\system32\Ecipeb32.exe
        571⤵
        Drops file in System32 directory
        
        PID:12592
        
        C:\Windows\SysWOW64\Ejchbmna.exe
        
        C:\Windows\system32\Ejchbmna.exe
        572⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Fclmkb32.exe
        
        C:\Windows\system32\Fclmkb32.exe
        573⤵
        System Location Discovery: System Language Discovery
        
        PID:12948
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        574⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Fpbmpc32.exe
        
        C:\Windows\system32\Fpbmpc32.exe
        575⤵
        Drops file in System32 directory
        
        PID:13208
        
        C:\Windows\SysWOW64\Fikbhiaf.exe
        
        C:\Windows\system32\Fikbhiaf.exe
        576⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Flinddpj.exe
        
        C:\Windows\system32\Flinddpj.exe
        577⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Fdqffaql.exe
        
        C:\Windows\system32\Fdqffaql.exe
        578⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Fimonh32.exe
        
        C:\Windows\system32\Fimonh32.exe
        579⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Fpggkbfq.exe
        
        C:\Windows\system32\Fpggkbfq.exe
        580⤵
        Drops file in System32 directory
        
        PID:12628
        
        C:\Windows\SysWOW64\Fbecgned.exe
        
        C:\Windows\system32\Fbecgned.exe
        581⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Fjmkhkff.exe
        
        C:\Windows\system32\Fjmkhkff.exe
        582⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Flngpc32.exe
        
        C:\Windows\system32\Flngpc32.exe
        583⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Fbhplnca.exe
        
        C:\Windows\system32\Fbhplnca.exe
        584⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Gjohnkdd.exe
        
        C:\Windows\system32\Gjohnkdd.exe
        585⤵
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Glpdecjb.exe
        
        C:\Windows\system32\Glpdecjb.exe
        586⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Gffhbljh.exe
        
        C:\Windows\system32\Gffhbljh.exe
        587⤵
        Modifies registry class
        
        PID:4820
        
        C:\Windows\SysWOW64\Gideogil.exe
        
        C:\Windows\system32\Gideogil.exe
        588⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Glbakchp.exe
        
        C:\Windows\system32\Glbakchp.exe
        589⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Gbmigm32.exe
        
        C:\Windows\system32\Gbmigm32.exe
        590⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Gkdaij32.exe
        
        C:\Windows\system32\Gkdaij32.exe
        591⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Glenpb32.exe
        
        C:\Windows\system32\Glenpb32.exe
        592⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Gfkbnk32.exe
        
        C:\Windows\system32\Gfkbnk32.exe
        593⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Gmdjjemp.exe
        
        C:\Windows\system32\Gmdjjemp.exe
        594⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Gpcffalc.exe
        
        C:\Windows\system32\Gpcffalc.exe
        595⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        596⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Gmggpekm.exe
        
        C:\Windows\system32\Gmggpekm.exe
        597⤵
        Drops file in System32 directory
        
        PID:244
        
        C:\Windows\SysWOW64\Hgokikan.exe
        
        C:\Windows\system32\Hgokikan.exe
        598⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Hmicee32.exe
        
        C:\Windows\system32\Hmicee32.exe
        599⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Hdclbopg.exe
        
        C:\Windows\system32\Hdclbopg.exe
        600⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Hlnqfanb.exe
        
        C:\Windows\system32\Hlnqfanb.exe
        601⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\Hplimpdi.exe
        
        C:\Windows\system32\Hplimpdi.exe
        602⤵
        
        PID:13596
        
        C:\Windows\SysWOW64\Hckeikcl.exe
        
        C:\Windows\system32\Hckeikcl.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13636
        
        C:\Windows\SysWOW64\Hienee32.exe
        
        C:\Windows\system32\Hienee32.exe
        604⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:13668
        
        C:\Windows\SysWOW64\Hpofbobf.exe
        
        C:\Windows\system32\Hpofbobf.exe
        605⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        606⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13748
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        607⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\Hdmohnhl.exe
        
        C:\Windows\system32\Hdmohnhl.exe
        608⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Ikfgeh32.exe
        
        C:\Windows\system32\Ikfgeh32.exe
        609⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Inecac32.exe
        
        C:\Windows\system32\Inecac32.exe
        610⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Idoknmfj.exe
        
        C:\Windows\system32\Idoknmfj.exe
        611⤵
        
        PID:13948
        
        C:\Windows\SysWOW64\Ikickgnf.exe
        
        C:\Windows\system32\Ikickgnf.exe
        612⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\Ingpgcmj.exe
        
        C:\Windows\system32\Ingpgcmj.exe
        613⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\Idahcm32.exe
        
        C:\Windows\system32\Idahcm32.exe
        614⤵
        
        PID:14068
        
        C:\Windows\SysWOW64\Igpdph32.exe
        
        C:\Windows\system32\Igpdph32.exe
        615⤵
        Modifies registry class
        
        PID:14108
        
        C:\Windows\SysWOW64\Illmho32.exe
        
        C:\Windows\system32\Illmho32.exe
        616⤵
        
        PID:14152
        
        C:\Windows\SysWOW64\Iknmfg32.exe
        
        C:\Windows\system32\Iknmfg32.exe
        617⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Inlibb32.exe
        
        C:\Windows\system32\Inlibb32.exe
        618⤵
        
        PID:14228
        
        C:\Windows\SysWOW64\Idfaolpb.exe
        
        C:\Windows\system32\Idfaolpb.exe
        619⤵
        
        PID:14276
        
        C:\Windows\SysWOW64\Ikpjkf32.exe
        
        C:\Windows\system32\Ikpjkf32.exe
        620⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\Innfgb32.exe
        
        C:\Windows\system32\Innfgb32.exe
        621⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Ipmbcm32.exe
        
        C:\Windows\system32\Ipmbcm32.exe
        622⤵
        Drops file in System32 directory
        
        PID:13336
        
        C:\Windows\SysWOW64\Jjeflc32.exe
        
        C:\Windows\system32\Jjeflc32.exe
        623⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        624⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\Jlfpnn32.exe
        
        C:\Windows\system32\Jlfpnn32.exe
        625⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\Jjjpgb32.exe
        
        C:\Windows\system32\Jjjpgb32.exe
        626⤵
        
        PID:13784
        
        C:\Windows\SysWOW64\Jdodekhg.exe
        
        C:\Windows\system32\Jdodekhg.exe
        627⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Jkimae32.exe
        
        C:\Windows\system32\Jkimae32.exe
        628⤵
        Modifies registry class
        
        PID:1240
        
        C:\Windows\SysWOW64\Jqfejl32.exe
        
        C:\Windows\system32\Jqfejl32.exe
        629⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\Jcdafg32.exe
        
        C:\Windows\system32\Jcdafg32.exe
        630⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Jjoibadl.exe
        
        C:\Windows\system32\Jjoibadl.exe
        631⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Jlmfomcp.exe
        
        C:\Windows\system32\Jlmfomcp.exe
        632⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\Kcgnkgkl.exe
        
        C:\Windows\system32\Kcgnkgkl.exe
        633⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\Knlbipjb.exe
        
        C:\Windows\system32\Knlbipjb.exe
        634⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\Kqknekjf.exe
        
        C:\Windows\system32\Kqknekjf.exe
        635⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\Kgefae32.exe
        
        C:\Windows\system32\Kgefae32.exe
        636⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\Knoonphp.exe
        
        C:\Windows\system32\Knoonphp.exe
        637⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Kdigkjpl.exe
        
        C:\Windows\system32\Kdigkjpl.exe
        638⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Kkbohc32.exe
        
        C:\Windows\system32\Kkbohc32.exe
        639⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\Kmdlolmg.exe
        
        C:\Windows\system32\Kmdlolmg.exe
        640⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13324
        
        C:\Windows\SysWOW64\Kdkdqinj.exe
        
        C:\Windows\system32\Kdkdqinj.exe
        641⤵
        System Location Discovery: System Language Discovery
        
        PID:13364
        
        C:\Windows\SysWOW64\Kkelmc32.exe
        
        C:\Windows\system32\Kkelmc32.exe
        642⤵
        
        PID:13384
        
        C:\Windows\SysWOW64\Kmfhelke.exe
        
        C:\Windows\system32\Kmfhelke.exe
        643⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Kdmqfi32.exe
        
        C:\Windows\system32\Kdmqfi32.exe
        644⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Kkgicccd.exe
        
        C:\Windows\system32\Kkgicccd.exe
        645⤵
        Drops file in System32 directory
        
        PID:13488
        
        C:\Windows\SysWOW64\Lqdakjak.exe
        
        C:\Windows\system32\Lqdakjak.exe
        646⤵
        
        PID:204
        
        C:\Windows\SysWOW64\Lcbngeqo.exe
        
        C:\Windows\system32\Lcbngeqo.exe
        647⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2684
        
        C:\Windows\SysWOW64\Ljmfdp32.exe
        
        C:\Windows\system32\Ljmfdp32.exe
        648⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Lcggbd32.exe
        
        C:\Windows\system32\Lcggbd32.exe
        649⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Lnmkpm32.exe
        
        C:\Windows\system32\Lnmkpm32.exe
        650⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Lcjchd32.exe
        
        C:\Windows\system32\Lcjchd32.exe
        651⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\Lmbhqj32.exe
        
        C:\Windows\system32\Lmbhqj32.exe
        652⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Lkchoaif.exe
        
        C:\Windows\system32\Lkchoaif.exe
        653⤵
        Modifies registry class
        
        PID:14224
        
        C:\Windows\SysWOW64\Mmdefi32.exe
        
        C:\Windows\system32\Mmdefi32.exe
        654⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Mgjicb32.exe
        
        C:\Windows\system32\Mgjicb32.exe
        655⤵
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Mjhepnno.exe
        
        C:\Windows\system32\Mjhepnno.exe
        656⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Mabnlh32.exe
        
        C:\Windows\system32\Mabnlh32.exe
        657⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Mglfibmh.exe
        
        C:\Windows\system32\Mglfibmh.exe
        658⤵
        
        PID:13352
        
        C:\Windows\SysWOW64\Mnfnfl32.exe
        
        C:\Windows\system32\Mnfnfl32.exe
        659⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Mccfnc32.exe
        
        C:\Windows\system32\Mccfnc32.exe
        660⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13468
        
        C:\Windows\SysWOW64\Mjmokmji.exe
        
        C:\Windows\system32\Mjmokmji.exe
        661⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\Mebchf32.exe
        
        C:\Windows\system32\Mebchf32.exe
        662⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Mgaoda32.exe
        
        C:\Windows\system32\Mgaoda32.exe
        663⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Mnkgakpp.exe
        
        C:\Windows\system32\Mnkgakpp.exe
        664⤵
        Drops file in System32 directory
        
        PID:2600
        
        C:\Windows\SysWOW64\Maicmgoc.exe
        
        C:\Windows\system32\Maicmgoc.exe
        665⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        666⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        667⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        668⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Ncjmob32.exe
        
        C:\Windows\system32\Ncjmob32.exe
        669⤵
        
        PID:13812
        
        C:\Windows\SysWOW64\Nanmhf32.exe
        
        C:\Windows\system32\Nanmhf32.exe
        670⤵
        Modifies registry class
        
        PID:14164
        
        C:\Windows\SysWOW64\Napjnfik.exe
        
        C:\Windows\system32\Napjnfik.exe
        671⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\Nhjbjp32.exe
        
        C:\Windows\system32\Nhjbjp32.exe
        672⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Nndjgjhe.exe
        
        C:\Windows\system32\Nndjgjhe.exe
        673⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Nenbdd32.exe
        
        C:\Windows\system32\Nenbdd32.exe
        674⤵
        System Location Discovery: System Language Discovery
        
        PID:6052
        
        C:\Windows\SysWOW64\Nlhkqngo.exe
        
        C:\Windows\system32\Nlhkqngo.exe
        675⤵
        
        PID:13368
        
        C:\Windows\SysWOW64\Nnfgmjfb.exe
        
        C:\Windows\system32\Nnfgmjfb.exe
        676⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Neqoidmo.exe
        
        C:\Windows\system32\Neqoidmo.exe
        677⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Nhokeolc.exe
        
        C:\Windows\system32\Nhokeolc.exe
        678⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\Omldnfkj.exe
        
        C:\Windows\system32\Omldnfkj.exe
        679⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Odfljp32.exe
        
        C:\Windows\system32\Odfljp32.exe
        680⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Ojpdgjid.exe
        
        C:\Windows\system32\Ojpdgjid.exe
        681⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13656
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        682⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ohceqo32.exe
        
        C:\Windows\system32\Ohceqo32.exe
        683⤵
        
        PID:264
        
        C:\Windows\SysWOW64\Ompmie32.exe
        
        C:\Windows\system32\Ompmie32.exe
        684⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\Oegejc32.exe
        
        C:\Windows\system32\Oegejc32.exe
        685⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1288
        
        C:\Windows\SysWOW64\Olangmod.exe
        
        C:\Windows\system32\Olangmod.exe
        686⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1584
        
        C:\Windows\SysWOW64\Oopjchnh.exe
        
        C:\Windows\system32\Oopjchnh.exe
        687⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        688⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Ohhnln32.exe
        
        C:\Windows\system32\Ohhnln32.exe
        689⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Omegdebp.exe
        
        C:\Windows\system32\Omegdebp.exe
        690⤵
        Drops file in System32 directory
        
        PID:2144
        
        C:\Windows\SysWOW64\Odooqo32.exe
        
        C:\Windows\system32\Odooqo32.exe
        691⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Pkigmiai.exe
        
        C:\Windows\system32\Pkigmiai.exe
        692⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Pmgcidqm.exe
        
        C:\Windows\system32\Pmgcidqm.exe
        693⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Phmhgmpc.exe
        
        C:\Windows\system32\Phmhgmpc.exe
        694⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Plkpmlfi.exe
        
        C:\Windows\system32\Plkpmlfi.exe
        695⤵
        Drops file in System32 directory
        
        PID:13532
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        696⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        697⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Plmmbkdf.exe
        
        C:\Windows\system32\Plmmbkdf.exe
        698⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
        
        C:\Windows\SysWOW64\Pmoijcje.exe
        
        C:\Windows\system32\Pmoijcje.exe
        699⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\Pdhbgn32.exe
        
        C:\Windows\system32\Pdhbgn32.exe
        700⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Plpjhk32.exe
        
        C:\Windows\system32\Plpjhk32.exe
        701⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Ponfdf32.exe
        
        C:\Windows\system32\Ponfdf32.exe
        702⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Pdkolm32.exe
        
        C:\Windows\system32\Pdkolm32.exe
        703⤵
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Qlbfnk32.exe
        
        C:\Windows\system32\Qlbfnk32.exe
        704⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Qmccecfp.exe
        
        C:\Windows\system32\Qmccecfp.exe
        705⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        706⤵
        
        PID:572
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        707⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Qmepkb32.exe
        
        C:\Windows\system32\Qmepkb32.exe
        708⤵
        
        PID:364
        
        C:\Windows\SysWOW64\Qdphgmlj.exe
        
        C:\Windows\system32\Qdphgmlj.exe
        709⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        710⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Amhlpb32.exe
        
        C:\Windows\system32\Amhlpb32.exe
        711⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Adbdml32.exe
        
        C:\Windows\system32\Adbdml32.exe
        712⤵
        System Location Discovery: System Language Discovery
        
        PID:8
        
        C:\Windows\SysWOW64\Aogije32.exe
        
        C:\Windows\system32\Aogije32.exe
        713⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\Aeaagoaj.exe
        
        C:\Windows\system32\Aeaagoaj.exe
        714⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1888
        
        C:\Windows\SysWOW64\Ahpmckpn.exe
        
        C:\Windows\system32\Ahpmckpn.exe
        715⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Aojepe32.exe
        
        C:\Windows\system32\Aojepe32.exe
        716⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Aahblp32.exe
        
        C:\Windows\system32\Aahblp32.exe
        717⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Ahbjij32.exe
        
        C:\Windows\system32\Ahbjij32.exe
        718⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13900
        
        C:\Windows\SysWOW64\Aajoapdk.exe
        
        C:\Windows\system32\Aajoapdk.exe
        719⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Anaofa32.exe
        
        C:\Windows\system32\Anaofa32.exe
        720⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Bdkgckal.exe
        
        C:\Windows\system32\Bdkgckal.exe
        721⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Bkeppeii.exe
        
        C:\Windows\system32\Bkeppeii.exe
        722⤵
        
        PID:13480
        
        C:\Windows\SysWOW64\Bekdmnio.exe
        
        C:\Windows\system32\Bekdmnio.exe
        723⤵
        
        PID:780
        
        C:\Windows\SysWOW64\Bldljh32.exe
        
        C:\Windows\system32\Bldljh32.exe
        724⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Baadbo32.exe
        
        C:\Windows\system32\Baadbo32.exe
        725⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
        
        C:\Windows\SysWOW64\Bhkmoifp.exe
        
        C:\Windows\system32\Bhkmoifp.exe
        726⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        727⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Beomhm32.exe
        
        C:\Windows\system32\Beomhm32.exe
        728⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Blieeglf.exe
        
        C:\Windows\system32\Blieeglf.exe
        729⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Bohbackj.exe
        
        C:\Windows\system32\Bohbackj.exe
        730⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Beajnm32.exe
        
        C:\Windows\system32\Beajnm32.exe
        731⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\Bkobfdao.exe
        
        C:\Windows\system32\Bkobfdao.exe
        732⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        733⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Clnopg32.exe
        
        C:\Windows\system32\Clnopg32.exe
        734⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        735⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        736⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Ckclacmi.exe
        
        C:\Windows\system32\Ckclacmi.exe
        737⤵
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Cnahmo32.exe
        
        C:\Windows\system32\Cnahmo32.exe
        738⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Chglkg32.exe
        
        C:\Windows\system32\Chglkg32.exe
        739⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ckeigc32.exe
        
        C:\Windows\system32\Ckeigc32.exe
        740⤵
        
        PID:14284
        
        C:\Windows\SysWOW64\Clgbfe32.exe
        
        C:\Windows\system32\Clgbfe32.exe
        741⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Dbdjol32.exe
        
        C:\Windows\system32\Dbdjol32.exe
        742⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dmjole32.exe
        
        C:\Windows\system32\Dmjole32.exe
        743⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Dbfgdllk.exe
        
        C:\Windows\system32\Dbfgdllk.exe
        744⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dmlkaela.exe
        
        C:\Windows\system32\Dmlkaela.exe
        745⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        746⤵
        
        PID:13988
        
        C:\Windows\SysWOW64\Diclff32.exe
        
        C:\Windows\system32\Diclff32.exe
        747⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Dnpdom32.exe
        
        C:\Windows\system32\Dnpdom32.exe
        748⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Dieilepc.exe
        
        C:\Windows\system32\Dieilepc.exe
        749⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Dnbadlnj.exe
        
        C:\Windows\system32\Dnbadlnj.exe
        750⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Digeaenp.exe
        
        C:\Windows\system32\Digeaenp.exe
        751⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dndnjllg.exe
        
        C:\Windows\system32\Dndnjllg.exe
        752⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Eenfff32.exe
        
        C:\Windows\system32\Eenfff32.exe
        753⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Eodjdocj.exe
        
        C:\Windows\system32\Eodjdocj.exe
        754⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Eeqclfaa.exe
        
        C:\Windows\system32\Eeqclfaa.exe
        755⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Eofgioah.exe
        
        C:\Windows\system32\Eofgioah.exe
        756⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Efpofi32.exe
        
        C:\Windows\system32\Efpofi32.exe
        757⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ekmhnpfl.exe
        
        C:\Windows\system32\Ekmhnpfl.exe
        758⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ebimqi32.exe
        
        C:\Windows\system32\Ebimqi32.exe
        759⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Eicemccc.exe
        
        C:\Windows\system32\Eicemccc.exe
        760⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Fnpmej32.exe
        
        C:\Windows\system32\Fnpmej32.exe
        761⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3524
        
        C:\Windows\SysWOW64\Fieacc32.exe
        
        C:\Windows\system32\Fieacc32.exe
        762⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Fppjpmim.exe
        
        C:\Windows\system32\Fppjpmim.exe
        763⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Felbhdgd.exe
        
        C:\Windows\system32\Felbhdgd.exe
        764⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Flfjdn32.exe
        
        C:\Windows\system32\Flfjdn32.exe
        765⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Fbpcah32.exe
        
        C:\Windows\system32\Fbpcah32.exe
        766⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        767⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Fpdckm32.exe
        
        C:\Windows\system32\Fpdckm32.exe
        768⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ffnkggld.exe
        
        C:\Windows\system32\Ffnkggld.exe
        769⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Windows\SysWOW64\Fmhcda32.exe
        
        C:\Windows\system32\Fmhcda32.exe
        770⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Fpfppl32.exe
        
        C:\Windows\system32\Fpfppl32.exe
        771⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Fechhcal.exe
        
        C:\Windows\system32\Fechhcal.exe
        772⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Fmjqjqao.exe
        
        C:\Windows\system32\Fmjqjqao.exe
        773⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Gnlmai32.exe
        
        C:\Windows\system32\Gnlmai32.exe
        774⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Gefencoj.exe
        
        C:\Windows\system32\Gefencoj.exe
        775⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        776⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Gbjegg32.exe
        
        C:\Windows\system32\Gbjegg32.exe
        777⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13348
        
        C:\Windows\SysWOW64\Gmojep32.exe
        
        C:\Windows\system32\Gmojep32.exe
        778⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Gblbmg32.exe
        
        C:\Windows\system32\Gblbmg32.exe
        779⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Gmdcpoid.exe
        
        C:\Windows\system32\Gmdcpoid.exe
        780⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Goepgg32.exe
        
        C:\Windows\system32\Goepgg32.exe
        781⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Geohdago.exe
        
        C:\Windows\system32\Geohdago.exe
        782⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Hpdlajfe.exe
        
        C:\Windows\system32\Hpdlajfe.exe
        783⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Hbchnfei.exe
        
        C:\Windows\system32\Hbchnfei.exe
        784⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Himqjpme.exe
        
        C:\Windows\system32\Himqjpme.exe
        785⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        786⤵
        System Location Discovery: System Language Discovery
        
        PID:7356
        
        C:\Windows\SysWOW64\Hiomppkc.exe
        
        C:\Windows\system32\Hiomppkc.exe
        787⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Hpiemj32.exe
        
        C:\Windows\system32\Hpiemj32.exe
        788⤵
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Hefneq32.exe
        
        C:\Windows\system32\Hefneq32.exe
        789⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hlpfak32.exe
        
        C:\Windows\system32\Hlpfak32.exe
        790⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7688
        
        C:\Windows\SysWOW64\Hbjonepq.exe
        
        C:\Windows\system32\Hbjonepq.exe
        791⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Hehkjpod.exe
        
        C:\Windows\system32\Hehkjpod.exe
        792⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Hlbcgj32.exe
        
        C:\Windows\system32\Hlbcgj32.exe
        793⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Hblkddmn.exe
        
        C:\Windows\system32\Hblkddmn.exe
        794⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Hifcqo32.exe
        
        C:\Windows\system32\Hifcqo32.exe
        795⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Iocliecb.exe
        
        C:\Windows\system32\Iocliecb.exe
        796⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ifjdjbdd.exe
        
        C:\Windows\system32\Ifjdjbdd.exe
        797⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Imdlgm32.exe
        
        C:\Windows\system32\Imdlgm32.exe
        798⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Ioeineap.exe
        
        C:\Windows\system32\Ioeineap.exe
        799⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Iepako32.exe
        
        C:\Windows\system32\Iepako32.exe
        800⤵
        Drops file in System32 directory
        
        PID:6868
        
        C:\Windows\SysWOW64\Ipeehhhb.exe
        
        C:\Windows\system32\Ipeehhhb.exe
        801⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Imieblgl.exe
        
        C:\Windows\system32\Imieblgl.exe
        802⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Icfnjcec.exe
        
        C:\Windows\system32\Icfnjcec.exe
        803⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Iipfgm32.exe
        
        C:\Windows\system32\Iipfgm32.exe
        804⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ipjocgdm.exe
        
        C:\Windows\system32\Ipjocgdm.exe
        805⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Iibclmkn.exe
        
        C:\Windows\system32\Iibclmkn.exe
        806⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Jplkig32.exe
        
        C:\Windows\system32\Jplkig32.exe
        807⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Jgfcfajg.exe
        
        C:\Windows\system32\Jgfcfajg.exe
        808⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Jlclnhho.exe
        
        C:\Windows\system32\Jlclnhho.exe
        809⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        810⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Jiglgl32.exe
        
        C:\Windows\system32\Jiglgl32.exe
        811⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Jleicg32.exe
        
        C:\Windows\system32\Jleicg32.exe
        812⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Jgkmap32.exe
        
        C:\Windows\system32\Jgkmap32.exe
        813⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Jndenjmo.exe
        
        C:\Windows\system32\Jndenjmo.exe
        814⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        815⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
        
        C:\Windows\SysWOW64\Jepjbm32.exe
        
        C:\Windows\system32\Jepjbm32.exe
        816⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Jljbogaf.exe
        
        C:\Windows\system32\Jljbogaf.exe
        817⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Jcdjka32.exe
        
        C:\Windows\system32\Jcdjka32.exe
        818⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Knioij32.exe
        
        C:\Windows\system32\Knioij32.exe
        819⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Kokkqbog.exe
        
        C:\Windows\system32\Kokkqbog.exe
        820⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
        
        C:\Windows\SysWOW64\Kjponk32.exe
        
        C:\Windows\system32\Kjponk32.exe
        821⤵
        
        PID:14428
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        822⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:14556
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        823⤵
        Drops file in System32 directory
        
        PID:14616
        
        C:\Windows\SysWOW64\Koaaaaip.exe
        
        C:\Windows\system32\Koaaaaip.exe
        824⤵
        
        PID:14652
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        825⤵
        Modifies registry class
        
        PID:14688
        
        C:\Windows\SysWOW64\Kpankd32.exe
        
        C:\Windows\system32\Kpankd32.exe
        826⤵
        Drops file in System32 directory
        
        PID:14724
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        827⤵
        
        PID:14760
        
        C:\Windows\SysWOW64\Lnendhol.exe
        
        C:\Windows\system32\Lnendhol.exe
        828⤵
        
        PID:14796
        
        C:\Windows\SysWOW64\Lcbfmomc.exe
        
        C:\Windows\system32\Lcbfmomc.exe
        829⤵
        
        PID:14832
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        830⤵
        
        PID:14864
        
        C:\Windows\SysWOW64\Lcdcbokq.exe
        
        C:\Windows\system32\Lcdcbokq.exe
        831⤵
        
        PID:14904
        
        C:\Windows\SysWOW64\Ljnloi32.exe
        
        C:\Windows\system32\Ljnloi32.exe
        832⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14940
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        833⤵
        
        PID:14980
        
        C:\Windows\SysWOW64\Ljqhdhpk.exe
        
        C:\Windows\system32\Ljqhdhpk.exe
        834⤵
        
        PID:15016
        
        C:\Windows\SysWOW64\Lomqmoob.exe
        
        C:\Windows\system32\Lomqmoob.exe
        835⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:15052
        
        C:\Windows\SysWOW64\Lfgiii32.exe
        
        C:\Windows\system32\Lfgiii32.exe
        836⤵
        
        PID:15084
        
        C:\Windows\SysWOW64\Lqmmgb32.exe
        
        C:\Windows\system32\Lqmmgb32.exe
        837⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        838⤵
        
        PID:15160
        
        C:\Windows\SysWOW64\Mqojlbcb.exe
        
        C:\Windows\system32\Mqojlbcb.exe
        839⤵
        
        PID:15196
        
        C:\Windows\SysWOW64\Mcnfhmcf.exe
        
        C:\Windows\system32\Mcnfhmcf.exe
        840⤵
        
        PID:15288
        
        C:\Windows\SysWOW64\Modgnn32.exe
        
        C:\Windows\system32\Modgnn32.exe
        841⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Mnegkf32.exe
        
        C:\Windows\system32\Mnegkf32.exe
        842⤵
        
        PID:14368
        
        C:\Windows\SysWOW64\Mogccnfg.exe
        
        C:\Windows\system32\Mogccnfg.exe
        843⤵
        
        PID:14392
        
        C:\Windows\SysWOW64\Mjlhpgfn.exe
        
        C:\Windows\system32\Mjlhpgfn.exe
        844⤵
        
        PID:14420
        
        C:\Windows\SysWOW64\Mmkdlbea.exe
        
        C:\Windows\system32\Mmkdlbea.exe
        845⤵
        
        PID:14500
        
        C:\Windows\SysWOW64\Mcdlil32.exe
        
        C:\Windows\system32\Mcdlil32.exe
        846⤵
        
        PID:14488
        
        C:\Windows\SysWOW64\Mjodff32.exe
        
        C:\Windows\system32\Mjodff32.exe
        847⤵
        
        PID:14540
        
        C:\Windows\SysWOW64\Mqhmbqlh.exe
        
        C:\Windows\system32\Mqhmbqlh.exe
        848⤵
        Drops file in System32 directory
        
        PID:14572
        
        C:\Windows\SysWOW64\Nnmmleja.exe
        
        C:\Windows\system32\Nnmmleja.exe
        849⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Npnjcm32.exe
        
        C:\Windows\system32\Npnjcm32.exe
        850⤵
        
        PID:14660
        
        C:\Windows\SysWOW64\Nnojad32.exe
        
        C:\Windows\system32\Nnojad32.exe
        851⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Nqmfnp32.exe
        
        C:\Windows\system32\Nqmfnp32.exe
        852⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\Nggnjjoo.exe
        
        C:\Windows\system32\Nggnjjoo.exe
        853⤵
        
        PID:14792
        
        C:\Windows\SysWOW64\Nmdgbamf.exe
        
        C:\Windows\system32\Nmdgbamf.exe
        854⤵
        
        PID:14824
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        855⤵
        
        PID:14872
        
        C:\Windows\SysWOW64\Nmfchq32.exe
        
        C:\Windows\system32\Nmfchq32.exe
        856⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14912
        
        C:\Windows\SysWOW64\Ncplekbq.exe
        
        C:\Windows\system32\Ncplekbq.exe
        857⤵
        
        PID:14952
        
        C:\Windows\SysWOW64\Nnfpbcbf.exe
        
        C:\Windows\system32\Nnfpbcbf.exe
        858⤵
        
        PID:14988
        
        C:\Windows\SysWOW64\Ocbhjjqn.exe
        
        C:\Windows\system32\Ocbhjjqn.exe
        859⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Onkimc32.exe
        
        C:\Windows\system32\Onkimc32.exe
        860⤵
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Oplfekdp.exe
        
        C:\Windows\system32\Oplfekdp.exe
        861⤵
        
        PID:15272
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        862⤵
        
        PID:15312
        
        C:\Windows\SysWOW64\Oakbonkb.exe
        
        C:\Windows\system32\Oakbonkb.exe
        863⤵
        
        PID:15328
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        864⤵
        System Location Discovery: System Language Discovery
        
        PID:15344
        
        C:\Windows\SysWOW64\Onochbjl.exe
        
        C:\Windows\system32\Onochbjl.exe
        865⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Ohggah32.exe
        
        C:\Windows\system32\Ohggah32.exe
        866⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        867⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Phjdggoj.exe
        
        C:\Windows\system32\Phjdggoj.exe
        868⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Pndlca32.exe
        
        C:\Windows\system32\Pndlca32.exe
        869⤵
        
        PID:14476
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        870⤵
        
        PID:14536
        
        C:\Windows\SysWOW64\Pjkmhblk.exe
        
        C:\Windows\system32\Pjkmhblk.exe
        871⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        872⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        873⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7700
        
        C:\Windows\SysWOW64\Pmkfjn32.exe
        
        C:\Windows\system32\Pmkfjn32.exe
        874⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Pdenghpi.exe
        
        C:\Windows\system32\Pdenghpi.exe
        875⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Pfdjccol.exe
        
        C:\Windows\system32\Pfdjccol.exe
        876⤵
        
        PID:14816
        
        C:\Windows\SysWOW64\Pnkbdqpo.exe
        
        C:\Windows\system32\Pnkbdqpo.exe
        877⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Phcgmffo.exe
        
        C:\Windows\system32\Phcgmffo.exe
        878⤵
        System Location Discovery: System Language Discovery
        
        PID:15040
        
        C:\Windows\SysWOW64\Qoplop32.exe
        
        C:\Windows\system32\Qoplop32.exe
        879⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        880⤵
        
        PID:15144
        
        C:\Windows\SysWOW64\Ameipl32.exe
        
        C:\Windows\system32\Ameipl32.exe
        881⤵
        
        PID:15120
        
        C:\Windows\SysWOW64\Adoamfhn.exe
        
        C:\Windows\system32\Adoamfhn.exe
        882⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Aodejohd.exe
        
        C:\Windows\system32\Aodejohd.exe
        883⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Apeabg32.exe
        
        C:\Windows\system32\Apeabg32.exe
        884⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        885⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Aaenlj32.exe
        
        C:\Windows\system32\Aaenlj32.exe
        886⤵
        
        PID:15340
        
        C:\Windows\SysWOW64\Akmbepke.exe
        
        C:\Windows\system32\Akmbepke.exe
        887⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Amloakki.exe
        
        C:\Windows\system32\Amloakki.exe
        888⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Adfgne32.exe
        
        C:\Windows\system32\Adfgne32.exe
        889⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Aokkknbl.exe
        
        C:\Windows\system32\Aokkknbl.exe
        890⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Aajggjap.exe
        
        C:\Windows\system32\Aajggjap.exe
        891⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        892⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Bdjqienq.exe
        
        C:\Windows\system32\Bdjqienq.exe
        893⤵
        
        PID:14600
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        894⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Bpaanfce.exe
        
        C:\Windows\system32\Bpaanfce.exe
        895⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Bobalm32.exe
        
        C:\Windows\system32\Bobalm32.exe
        896⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Bgnfpp32.exe
        
        C:\Windows\system32\Bgnfpp32.exe
        897⤵
        Modifies registry class
        
        PID:8928
        
        C:\Windows\SysWOW64\Bngnmjql.exe
        
        C:\Windows\system32\Bngnmjql.exe
        898⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Bdagidhi.exe
        
        C:\Windows\system32\Bdagidhi.exe
        899⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Bkkofn32.exe
        
        C:\Windows\system32\Bkkofn32.exe
        900⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Baegchgb.exe
        
        C:\Windows\system32\Baegchgb.exe
        901⤵
        
        PID:15148
        
        C:\Windows\SysWOW64\Bhpopb32.exe
        
        C:\Windows\system32\Bhpopb32.exe
        902⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Windows\SysWOW64\Cnlhhi32.exe
        
        C:\Windows\system32\Cnlhhi32.exe
        903⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Cdfpdc32.exe
        
        C:\Windows\system32\Cdfpdc32.exe
        904⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ckphamkp.exe
        
        C:\Windows\system32\Ckphamkp.exe
        905⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Cajqng32.exe
        
        C:\Windows\system32\Cajqng32.exe
        906⤵
        
        PID:15296
        
        C:\Windows\SysWOW64\Chdikajj.exe
        
        C:\Windows\system32\Chdikajj.exe
        907⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ckbegmin.exe
        
        C:\Windows\system32\Ckbegmin.exe
        908⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        909⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Cgiflnoa.exe
        
        C:\Windows\system32\Cgiflnoa.exe
        910⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        911⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Cglbanmo.exe
        
        C:\Windows\system32\Cglbanmo.exe
        912⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Cneknh32.exe
        
        C:\Windows\system32\Cneknh32.exe
        913⤵
        
        PID:14604
        
        C:\Windows\SysWOW64\Cdpckbli.exe
        
        C:\Windows\system32\Cdpckbli.exe
        914⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\Dkikglce.exe
        
        C:\Windows\system32\Dkikglce.exe
        915⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Daccdf32.exe
        
        C:\Windows\system32\Daccdf32.exe
        916⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Dgpllm32.exe
        
        C:\Windows\system32\Dgpllm32.exe
        917⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Dgbhbm32.exe
        
        C:\Windows\system32\Dgbhbm32.exe
        918⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Dqkmkb32.exe
        
        C:\Windows\system32\Dqkmkb32.exe
        919⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
        
        C:\Windows\SysWOW64\Dolmijef.exe
        
        C:\Windows\system32\Dolmijef.exe
        920⤵
        
        PID:15108
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        921⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Doojni32.exe
        
        C:\Windows\system32\Doojni32.exe
        922⤵
        
        PID:15116
        
        C:\Windows\SysWOW64\Dqpffaib.exe
        
        C:\Windows\system32\Dqpffaib.exe
        923⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Egjobl32.exe
        
        C:\Windows\system32\Egjobl32.exe
        924⤵
        
        PID:15268
        
        C:\Windows\SysWOW64\Encgofhl.exe
        
        C:\Windows\system32\Encgofhl.exe
        925⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Ehikmohb.exe
        
        C:\Windows\system32\Ehikmohb.exe
        926⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Eoccii32.exe
        
        C:\Windows\system32\Eoccii32.exe
        927⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Eqdpaa32.exe
        
        C:\Windows\system32\Eqdpaa32.exe
        928⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9532 -s 448
        929⤵
        Program crash
        
        PID:9660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 9532 -ip 9532
1⤵
PID:9596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daaiml32.exe

Path C:\Windows\SysWOW64\Daaiml32.exe
Size 320KB
SHA256 ad63029534387ec315b5da0f13098e6f81ecd545982e774dd2202c0007e7ab0d
MD5 c71ef9363898026e6124efd2871cb67e
SHA1 47351e2048e83ffaaa22a953f7242e802f57f298
SHA512 39fe9eeb86b1b0ca5df557d2abffb5e6c1a7af3414d91e98665805674f6691b0016f3e004c1bcc406d236cad9a7bdd2a3076bd700b3169a60dd8699c19146797
SSDEEP 3072:XMkndAHvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:1dqvV/Ah1G/AcQ///NR5fn
TLSH
T18964EA192A3009EACDED1BB5AC1259D89181E9B018F1E63E6523DFECD8F4DB6DC05F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dafbhkhl.exe

Path C:\Windows\SysWOW64\Dafbhkhl.exe
Size 320KB
SHA256 c60caefe3b213ba7084c93b653a440045bdb1f8f2924b4289035d2381afbd780
MD5 3323741b6d0bad13eae1e6b1b8e0eb90
SHA1 a94a8732f9ef5574d588e5ea93925dcdd11af2c8
SHA512 31fc7264baa221a7ab2788bb30e14fa4ac897420f985b3dd7fd100888533c6af585baf171b1b0223115c1659c6eff9aa95d10eaf8eaaef0c57ada944066c0bbd
SSDEEP 3072:USwqDk0TzK2j0KMfwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:5wqD9TUfV/Ah1G/AcQ///NR5fn
TLSH
T169643F292A740AEACEED1FB5AC1249D89151E9F014F1E13E6123DFDCD8E4DE2D849F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Deoabj32.exe

Path C:\Windows\SysWOW64\Deoabj32.exe
Size 320KB
SHA256 92de0b5d52474526facfd4e2ea2dcb3fbd5aadc61fff95cd5e73b5e91945e88b
MD5 631a5f23dd3d4ef62bdf3af4a6fea039
SHA1 8168b0444c46b2f4e33017a5096a72b8ccbe2ed2
SHA512 18b8b6a13c129418a4e9d1dd0a13d096ad0e4883ff06772c31c5939bc175738ce7e456bd93104fc4fee5338e325e5a43c7bd6157e49c356ac7e2d54d04f29133
SSDEEP 3072:GHBTmykkaDPGo49geeVx2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DtZeWx2V/Ah1G/AcQ///NR5fn
TLSH
T13B64C819267409EACEEE1BB5BC124DDA9141E8F014F5E23E6167DFDCD8E4DA2CC09B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhfhnfhc.exe

Path C:\Windows\SysWOW64\Dhfhnfhc.exe
Size 320KB
SHA256 03075877faadc7f12e8708a8f21356480f6b7abe0a9bd14814e82286b23b3211
MD5 b9efef90b6a3f02232cda0a8379f037d
SHA1 4807518845c260cfb72184d7afd7f1ddae639dc2
SHA512 25f28dc6f4afaf81ecc8f11b5e46d3fae132ecad1d4a2591c053e7cdbe1eb09884b1392a6c3c56e26eaec7ba8ae0728599067037df93d7bb3a8e93a4eef899a9
SSDEEP 3072:XSVd1xiWrcmA4NwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:CNiAA4NV/Ah1G/AcQ///NR5fn
TLSH
T1CA64DB192A3819FACDED5BB5AD124DD85181E9B014F1E23E61739FECC8E8DA2C814FC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dhidcffq.exe

Path C:\Windows\SysWOW64\Dhidcffq.exe
Size 320KB
SHA256 617e9195e56be2bb9462c2815cd8881271e44282771cdc4894ad6c5b6c1b686c
MD5 24f42c3aa292a2b250300e6d3968437e
SHA1 e98108fcb700f91fcb672029dd2963f65247ecd1
SHA512 d97c8ba8580c3ceebf467404d43eaf33260e1e47cf7903d8b3ffea994b56b17cbe69ec4c79e428cd44ad4350b3bb32cc6ef4f79c02ec49c9fd89a3905df63417
SSDEEP 3072:badqPSXc841qV0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:2dqPSs84sV0V/Ah1G/AcQ///NR5fn
TLSH
T1646430192A3489EACEED5BB5AC2259D89141E9F214F1E13E6523DFDCC8E4DB2D804FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eaklcj32.exe

Path C:\Windows\SysWOW64\Eaklcj32.exe
Size 320KB
SHA256 7aac101054baee4ee633c05a85053ea5a880baef73c86e09df8301c3afd8229d
MD5 a6c860db6756df33d6d5f31c4369d982
SHA1 9ddd87de5469e6c9c5d5281b51c5827cc47cd91e
SHA512 b43776ca448a64d8439851c828e0a476a9c54076a2345dea7e72db9ed884ba9ceefe7c8d36fb25822b756158ba2b621cd568d248df2c289bc10c6d1189139ef6
SSDEEP 3072:V6UPQDInntx0ThwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:pKInnn0ThV/Ah1G/AcQ///NR5fn
TLSH
T1F164EA1A2A3009EACEFD1BB5BC1259DD9141E9B014F1E13EA523DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ekngqqol.exe

Path C:\Windows\SysWOW64\Ekngqqol.exe
Size 320KB
SHA256 1e57120712bca65cd6bbaf48f183cd3bf202cd9c563aa66793b929ce69686f02
MD5 04f850de92b0c87fe381049861bcc7fc
SHA1 0bdd13f2016a4df242349323f324018e7193e3d7
SHA512 86796670e76fa48b09c5bf407e3c49ab098a18ec49f0be4a82407d61ab382424aaf2d59a377adf6e868dabd6fbc7cee6dfb1298567b1dc3cc2b79930853d04bf
SSDEEP 3072:wI5J/uG4/A4O+dSlD8aihwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:w2f4/Aq0aamV/Ah1G/AcQ///NR5fn
TLSH
T158641D1A2A3409EACEED1BB5AD0349D89141E8F014F1E17E7127DFDCD9E4DA6D809F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eoaianan.exe

Path C:\Windows\SysWOW64\Eoaianan.exe
Size 320KB
SHA256 ca2363b7e8fdb4e18001d6f398743eb26e477cf5cfceb867274632af37fa4cfd
MD5 ab03e9c1718e2771ad7e73d2c2f3a8ce
SHA1 80395005b74162f463858e944ea602fb4d8dad42
SHA512 cb93216107637ca4360f968ec2518f0aaa77e69470568f68a6fc623b99584c7b2a65b0cd33e5bed271707a2039dc9c2f2002b284af50c43304d08e514230d2c7
SSDEEP 3072:DhZxz+skM/iwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DhZl+skM/iV/Ah1G/AcQ///NR5fn
TLSH
T19D643F192A340AEACDED1BB5AC1359D99149E8F014F2E13E6523DFDCD8E4DA3C914F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eoollocp.exe

Path C:\Windows\SysWOW64\Eoollocp.exe
Size 320KB
SHA256 7224f4bdcbb4d4b2f771726cd9912a380680d6db8a75c628bd1f243b6376b789
MD5 173cd3ce5caa3e58a20e003c94d81b07
SHA1 def79e13de18358ca275d10a590e7c37a009ca7a
SHA512 ed59e8f0eb2ee92bee88ead37746dae6ac2f1ca2a1d6065cc0996f95f94e4ae0ee951b7c211db4e228395ed552239056cb7cb20fcbfabb46c0baf3fea93bb2e4
SSDEEP 3072:iUnAhxBsfkXwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Axi8XV/Ah1G/AcQ///NR5fn
TLSH
T100643319263409EACDED5FB5AC1249D85141E9F014F1E13EA223DFECD8E4DA2EE06F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbkdjh32.exe

Path C:\Windows\SysWOW64\Fbkdjh32.exe
Size 320KB
SHA256 1d62fdee6e896c897c5fa016b835d34da5a654e370234fd2f8ae7d3d9a73315f
MD5 6b6ee3295424ccfafee0fe9c02193213
SHA1 54a96156a5e47c60e1794927118596dc885dcf16
SHA512 4d8005061092d6acfaf33b098ff3983c2a1df41dd0988711e5dcea554d885ef862ddd5d7ed0db01962fe2f42cf93872080ccfa4c305cdd802377fdb1e1ce87c7
SSDEEP 3072:XUtjCken1PnDud2xq0tSywwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:XJ1LudN0cywV/Ah1G/AcQ///NR5fn
TLSH
T1C2643119263019EACEED1BB5AC1349D89141E9F014F1E23E6633EFDCD8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdegkdim.exe

Path C:\Windows\SysWOW64\Fdegkdim.exe
Size 320KB
SHA256 f328529a087ab6567dc4ad91e8c677d2269725809a2f87c66b1287ffc5ed9a57
MD5 f8080f65001226776c612b113b055c0a
SHA1 187803de22c274ae5d52aef835ec8a424e9d908e
SHA512 5b71d6d0e5f2a9c2d58ddd503f81d4cac3579b5380366c0e8f86ee3f2af9acd22df3ebc7ab66fcd1ca3b4cd931f2b177984cf9cc1e3157b46688780ffbc985c5
SSDEEP 3072:UhB6p5I/fwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:UmpAfV/Ah1G/AcQ///NR5fn
TLSH
T1E664311A263509EACDED5BB5ED1249E85141F9F014F2E13E6123EFDCD8E4DA2C829F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fdpnpe32.exe

Path C:\Windows\SysWOW64\Fdpnpe32.exe
Size 320KB
SHA256 f2700ae144206ce07d945dcb2218eff603b989e153c8e57520dd811d53dae9f7
MD5 81b3825d660e8e496b2912b3fb7f6ce1
SHA1 e402ceb844713c72d51fa7468109e9305b044493
SHA512 8d08032b953e5637a70427eebca20b5f552cc11fca3e939f11f9ff6341ea9f1c89c432f649ea8b818b70c5e5a084d63c02d37ba1cffb450947d47a55863738f5
SSDEEP 3072:7rqNx/OcwMhx6wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7rlcp76V/Ah1G/AcQ///NR5fn
TLSH
T1DF641F2A2A340DEACEED5BB5AC1249D89141F8F414F1E13E6123DFDCD8E4DA6E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fhemfbnq.exe

Path C:\Windows\SysWOW64\Fhemfbnq.exe
Size 320KB
SHA256 b1d9e4d68aa644967659dc887bd4309afee0a83fc85d0cdc0b53088159a5cf01
MD5 6d256755d267ea45bb6438dba1ab6d88
SHA1 1a0bd98e01f224145e491e6a427b0e4b4f5021ce
SHA512 7f250fbb2d4411f7c49c7f986ff7a65165cc295ece5458cc789797f525ebb559832c09e3d3c06ba4dee3ae9e6ea39e22843df50c1faf939287f07bfa44292c1d
SSDEEP 3072:DQ5Ume4BKvwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:DQVwvV/Ah1G/AcQ///NR5fn
TLSH
T12564401A263409EACEED1FB6AC1249D99541E9F014F1F13E6623EFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkalmn32.exe

Path C:\Windows\SysWOW64\Fkalmn32.exe
Size 320KB
SHA256 cdc35cf8110425b7519988c618d5a38bde9c912ae75c998991ed2e85a0f209a4
MD5 3a13d60d4377652b18da5c221e7ce2b0
SHA1 a0aa6cd18d32b769bc07e91e844260fca8272947
SHA512 5e70a5c7f1e83de78769fef1da60c7ef78ee69cf6511297bf50503d9613bbc049a4c257976fe9144b61e52e90de6a3ba88e4f17d3f47cc0b5a7b727101a76513
SSDEEP 3072:4WBpb2Ykv/0MPObwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:nVSMmObV/Ah1G/AcQ///NR5fn
TLSH
T1EC642E196A3019EACEED1FB5AC224AD89181E9F014F1E13E6127DFDCD8E4DA3C815F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkjfloeo.exe

Path C:\Windows\SysWOW64\Fkjfloeo.exe
Size 320KB
SHA256 a7eb010d1328fab3cd5f29fabc5afc883d166633d1391f54d951ec087edafa73
MD5 cdaeebdb995b35d3c03cea1aaf6d8897
SHA1 679e35d051ed66c3b2f43022654470f37741d272
SHA512 de60fc834660895c4c09b2f76e312199a932ea72f029580423825363a5a1e76a98127c534d18558b9fa76415fd512c02bc4fa109392d39627ce37b075c1bad8a
SSDEEP 3072:SetLACdFt/cJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:H2iFt/cJV/Ah1G/AcQ///NR5fn
TLSH
T1EA641019163419EACDED2BBAEC0249D85141E5F014F2E23E6523EFDCDCE4D66E81AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkopgn32.exe

Path C:\Windows\SysWOW64\Fkopgn32.exe
Size 320KB
SHA256 60519870ed9f1085c42b3bb23deb6c28397f520923ad2dec9536a15eeeab5deb
MD5 db9fc381c7e7460e4f26030abaa07f52
SHA1 0385f02bc2ee485723ed5a92641abfe73a30e702
SHA512 b6db02585383ebdf3cfabb5483f8e54edff6107cf6d8919032fbf8a20dce367d18031e4b7100ac95905aa5c817072e441e68c9f13b6c9623c208045b57ee0ff6
SSDEEP 3072:v4u9JybaLKBW2usVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QuHyGmQ2nVV/Ah1G/AcQ///NR5fn
TLSH
T1C464EB192A740AEACEED1BB6AC0249D891C6E5F014F1E13E6523EFDCD8E4D66D805FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fooecl32.exe

Path C:\Windows\SysWOW64\Fooecl32.exe
Size 320KB
SHA256 41c2397127afe6a28fccbd585b59bd514a1102f07a4275223a070a4b4319f114
MD5 4cc3b019e5b670314d709d88fda0d1f1
SHA1 49af0df8cb262b189c96fec3ba581f5036c9c3c5
SHA512 37695ffdd5c785e5fb85264e9625cec7275bc7cd38175c66ecff74ed748a890a5b1bead43f45ec2a9c82b41d702a7fa924c75c5b1e33a6f55b5e8e092ecc4383
SSDEEP 3072:urYongkA34vyjCqmqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hYgdjjmqV/Ah1G/AcQ///NR5fn
TLSH
T195642E191A3409FACEED5BB5EC1249D89641E9F054F1E13E6223DFDCD8E8DA2D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbdgpfni.exe

Path C:\Windows\SysWOW64\Gbdgpfni.exe
Size 320KB
SHA256 e2899ce32755c76f5d4fe96f1af86034b2b760a95747559dfd4d5de97c7405ab
MD5 7712d761b2346a409883823eb1796df4
SHA1 8c65b65256af07272ca1eb062a502d8d11acfc3f
SHA512 3c781212513eb38c4020bdcb238deab96497ce97baead4cf86a7e53c709be4fbd437d510c7c31f1e25d65e6b710c2071b2acff9fd8114d10f7def214053ed426
SSDEEP 3072:hXqX9TIZGY3gBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:h6X9T4P3gBV/Ah1G/AcQ///NR5fn
TLSH
T11964FC19263409EACEFD1FB5AC1299E89142E9F014F1E13E6127DFDCC8E4DA6D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbgdef32.exe

Path C:\Windows\SysWOW64\Gbgdef32.exe
Size 320KB
SHA256 530c3b355c5fed0cf914560c15fbedc2a581f47f590bc224ac119c526359333f
MD5 83a7a4b9ca3fb5fbfc89a9d446b23d79
SHA1 2e51270b8ba7a4000605efaa625808b06a32b374
SHA512 6b45d20ff78db1b0efac4d1ee55a2c84831b71a81e28ae10de2a6b5177394bece3a899ee9da9c777efa00b90a7fa5ede1f7105a3df904191489b7a77c5167b69
SSDEEP 3072:kQFbFVcKFyLp4XrdbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ksbFVcwlbV/Ah1G/AcQ///NR5fn
TLSH
T19864101A163409EADEED1FB9AC1249DD5241E9F014F1E23EA123DFECD8E4DA2D815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gcojoj32.exe

Path C:\Windows\SysWOW64\Gcojoj32.exe
Size 320KB
SHA256 e7eb8a0d3fbcb1d6ddb1e827286892a01ee30b7a681e3fb60a622251661a975b
MD5 1673d1d6a0eda841c3c5d6d39744f135
SHA1 31fc578d6ddad4217f45c7a2a276dc6e379732f8
SHA512 c9810fbecf9a83c3dfda5eddaa274c16e7b4ac5e72fca327d220a8b29c7031353600247d25c061d3059fed3aea1127941d64c16ca92de72a509dbd4a4ccde8d4
SSDEEP 3072:FIx95kBkfDwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FIx9RfDV/Ah1G/AcQ///NR5fn
TLSH
T1AC64E91A263049EACDED1FB6FC1259D8A181E9F114F1E53E65239FDCD8E5DA6C808F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gdqgfbop.exe

Path C:\Windows\SysWOW64\Gdqgfbop.exe
Size 320KB
SHA256 2bb63eac212abcf3a42d56fa3b0238f5a79a9ec77c13d2ca7ecef30cb5683c21
MD5 0e1033db663b6ea796f6317bb24c2238
SHA1 6a63453b3a8dafeb874258bdd562a8dad52e4943
SHA512 6669fff069cbc38f7200846f90fc389987f2182d0be9ee2d87feee52fe01e8fe76629b51f25040a21f1b4f269f3c9d4f587f3d0c63c9985098eae467efff8966
SSDEEP 3072:AgDz5CTBvI65tuGdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:AggTxLXuGdV/Ah1G/AcQ///NR5fn
TLSH
T1DE640C192A7009EACEED5BB6AD1249DC9181F9F014F1E13E6123DFDCD8E4DA2D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfimpfmj.exe

Path C:\Windows\SysWOW64\Gfimpfmj.exe
Size 320KB
SHA256 b3ecbc1b117d5334a85104cd963ace53f94c582b174be402cd5ff38857882c0e
MD5 a5c7239da2dfc34811fe526a1e52c9c3
SHA1 c8be0f4b8ad7104bfa301ca1e96fe4591942180c
SHA512 3648051c82439542dce79aead072177177e44629cc3afad5979c18d4ed6da5e6547843667ce2039a73795c6f704470f29522bcd7f236ad02c0263b50c280f8a6
SSDEEP 6144:nsyg0+xjRNZNF4RWV/Ah1G/AcQ///NR5fn:ncjRN67/Nv
TLSH
T198642119163409EACEEE1FB6AD0249D89141EAF015F1E13E6123DFDCD9E4DA2DC19F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gfkjef32.exe

Path C:\Windows\SysWOW64\Gfkjef32.exe
Size 320KB
SHA256 18ff7203f3618f8b39fa574ea82dbe5d5042215496f97b4e73e877a2a7ad9645
MD5 371593d40de980ac00aa4d5d0f8acca6
SHA1 df204a97f9b0a4a74eada6b8ab4cdf5263cfadda
SHA512 faca461bdc2694d5ca40816d2f1ceb9f322a2507c3816b8f7a8bcfd333b795171802893615e4ba08d7d2ede0b7fff9897bdd8cb8147a7499d3953a5d052f3eb1
SSDEEP 3072:O5JXN9vUsHfF5kTJn1WVTU0wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ODnH95yio0V/Ah1G/AcQ///NR5fn
TLSH
T19264F9192A340DEBCEED1BB6AC1249D89181E9B018F1E13F6123DFDDC8E4DA2D955F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghgjlaln.exe

Path C:\Windows\SysWOW64\Ghgjlaln.exe
Size 320KB
SHA256 6780c116934929932c53cfec2e1abf6f639e6a0c3381292a3da925f19d48cf1a
MD5 62fd947a4070af161228e791dc4dd9f8
SHA1 b1966b6ac568c8d47306a76c1b9159c6d0c4db46
SHA512 47c157139a8c3f7dd4cc28724f2bd9fdbcd287edb694eea53dc12617924bf58f72e0950bd04304e55cc78e74fe1d64ff621513956cc685d06e945c8b167930f8
SSDEEP 3072:OHYsC7gT2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bET2V/Ah1G/AcQ///NR5fn
TLSH
T1FC641F29263409EADDED1BF5AC1349D85182E9F114F1E27E6563DFDCE8E8DA2C804F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghnpmqef.exe

Path C:\Windows\SysWOW64\Ghnpmqef.exe
Size 320KB
SHA256 ba7e6c7db924fb062bcad15128c16dd12955e8b2e938e048a6241d2ebe7e8855
MD5 6cde095731c237d553b3d79eee7dc85f
SHA1 f2b4856c279105ef3b72288c93eea25c1f62d204
SHA512 8ad46f97726d8220587be9ebd4e0d9a6de75c1282d8e82234c3e984d5812e25fc2d537c075878d9ed15bbc6ebcc724673b2cf22d956747d2710b0ff7d4701bee
SSDEEP 3072:IhHaCig97jt86wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:AaCi+7jt86V/Ah1G/AcQ///NR5fn
TLSH
T11664321A2A344AEACEED1FB5EC1649D85181E4F214F2E13E5123DFDCD8E4DA2C919F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Giqlbqcc.exe

Path C:\Windows\SysWOW64\Giqlbqcc.exe
Size 320KB
SHA256 f503f657a41246cbad45b6078446aa4c6dd614dcf308df12432797180792456d
MD5 32d28c3093400828c6cdf187b6a3dc1b
SHA1 c57e0c6c64a05b5a2327d7cf7424b1c6746a9e61
SHA512 8e3dd1713952e8403269091c685777a735ee66c08906a3778d0c13f9e4c5d066c5c485c5932a17a207375e2d2531a9617461d0266bbdd883554a97dc177a5455
SSDEEP 3072:DGJ7tX/k4EnalpcQwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yTX/k4EymQV/Ah1G/AcQ///NR5fn
TLSH
T1A5640E19267409EACEED1BBAAD1249D85141F5F024F1F13E6123DFDCD8E4EAAC815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gkjocm32.exe

Path C:\Windows\SysWOW64\Gkjocm32.exe
Size 320KB
SHA256 26955fbb4188f50c2c333123eac177955f0b24595eb895b6f9d4f6c8eb65d8b1
MD5 77c3f5e52e010b037e3dad34f084fb8d
SHA1 17b02770c9958ecea0109b610b73fe4852ff7dc5
SHA512 11fcc9fe936d5f8afae1b2cd7f3ef1f52efab9ebba8484f80260a0fd150b367c088bae258697ff52b782514c6437589a8604b30c698ec3c53c8fdc0ce248684a
SSDEEP 3072:jUXTSMQwpqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:juQwpqV/Ah1G/AcQ///NR5fn
TLSH
T181642F195A340AEACEED1FF5AC1249D85141E9F114F1E13EA923DFDCE8E8DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glebbpbd.exe

Path C:\Windows\SysWOW64\Glebbpbd.exe
Size 320KB
SHA256 45a8064bb7d8c068f46b65a219bafa13947d0029c425da786554c3afd15d41b4
MD5 4194947d4bd7291165ef80cf106dabdd
SHA1 53fc92390410c694566ae90703d9b65eee7cd825
SHA512 1a98a9bb2910692ab86c860fbb6b7bea6b955d9fa7ad7d6e8da06f80d8faad0fc6d7ff259dec97982111dea31e2e793c805431c4c65480bfbd74c879d5f7a411
SSDEEP 3072:fqS6f3VA5pJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ef2vJV/Ah1G/AcQ///NR5fn
TLSH
T146640C1926300AEACEED1BB5AD1249D89251E8F114F1E13EA127DFDCD8F4DA2D909FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Goabhl32.exe

Path C:\Windows\SysWOW64\Goabhl32.exe
Size 320KB
SHA256 a67d6f9489368d8f50f671a19cc0297b3361462e925bf481f320cc23dfaa8012
MD5 bcd89bbf693bc8cd849f8d68715555d5
SHA1 df8c0c2a196442ffcec821d8c86f72cccb059890
SHA512 8b588137048385156fa2237eddc14a92713411982db223b09577270116496c44db9db02c19387d5ec38084a146f8899a3e0dab114693b030fb7c0796c4cabe99
SSDEEP 3072:XkfOM8z7tWPq2BvwX04wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QONYPLh4V/Ah1G/AcQ///NR5fn
TLSH
T11F64EB1A2A3409EACEED1BB5AD1A4ED85181F5F014F1E13E6523DFDCD8E4DA2E805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gohhik32.exe

Path C:\Windows\SysWOW64\Gohhik32.exe
Size 320KB
SHA256 7762d35698c6362b3dddcc5a599b37205ac46c2256fbb8f01614cf8ecb8ec5c3
MD5 cbfaf98e4a30d647d2da448bff3f6a60
SHA1 efa73a7f9bfa2b812bbb6b574e04609529e55fb7
SHA512 0f64c3ee02166d4b428e9e9de8fcb513712461c69db7f70a4949d83debe9e34d9851a1e3d7ac2a8dec210795c904049ee698cdc7468e688da9309e72d623fc22
SSDEEP 3072:8ijZqaMC080mQW5w2T2wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8iyC3nPT2V/Ah1G/AcQ///NR5fn
TLSH
T1E76430191A310AFACEEE1BB5BD1249E85151EAF114F1E53E5123EFDCD8E4DA6C805F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gokdoj32.exe

Path C:\Windows\SysWOW64\Gokdoj32.exe
Size 320KB
SHA256 efa45e064765697ed76fe823eea5b731c4e59cac306baaec61f1d610d180319a
MD5 58c04141c26c5ac7a64f0d7a0df2125e
SHA1 8daa3924e98788bda180079594b799673a51838f
SHA512 954ecf23be7587c33f2e3f1805c21be7b618f27969134b7847d78ce4ecae41b75ad3cc4543b01572649a1f6673195a511afb40736b665b470ae705064d67f70c
SSDEEP 3072:vHWfBbVMYWiSzwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vHAVMy8V/Ah1G/AcQ///NR5fn
TLSH
T1D664415A263009EACEEE1FB5EC024AD99141E9F125F1E13E6523DFDDC8E5DA2C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hfemkdbm.exe

Path C:\Windows\SysWOW64\Hfemkdbm.exe
Size 320KB
SHA256 2cf2986492e8b356ee38cee42056ca8c1084488a3bc91a4170944cb02ee4ae2f
MD5 2041437e42f1348e428c954ef8096730
SHA1 823d244a8041b1bf766206b2b7d0880f7c44d366
SHA512 6a366a8668355c7893de721f591db9cb03c2b67a558e3e0affe4756471bfbcf46f8f593ac953b0ffe783d80f40137a0980ecf24168a0481a2c4e2e109da28d31
SSDEEP 3072:75bSd9n5SwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:70d9n5SV/Ah1G/AcQ///NR5fn
TLSH
T1F6640C192A3109EBCDED1BB5AC024BE85141E9F414F1E13E6923DFDED8E5EA2D805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-85-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/236-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/248-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/248-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/300-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/300-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/428-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/588-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/700-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/724-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/772-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/848-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/932-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/956-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1080-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1080-477-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1216-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1276-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1388-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1588-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1744-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1872-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1876-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-8-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-471-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2020-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2124-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2184-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2304-478-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2344-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2352-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2372-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2392-461-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2408-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2540-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2748-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2760-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2776-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2864-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2888-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2896-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3140-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3152-484-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3196-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3280-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3368-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3400-455-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3644-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3648-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3732-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3892-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4072-472-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4160-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4220-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4232-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4236-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4348-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4380-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4488-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4516-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4564-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4572-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4592-466-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4604-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4656-483-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4656-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4668-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4676-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4840-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4844-95-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4916-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4944-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5004-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5116-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5124-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5196-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5236-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5304-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5436-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5440-450-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5528-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5564-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/5564-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5564-460-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5708-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5772-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5808-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5840-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5868-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5884-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5944-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5976-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5988-489-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6092-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads