berbew | d21934774ea5af5b7994941ac6f339e35ee2b35675ddeec14ab177c5be5a2533

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_3df2782531c79ca1f843177a7a713d86_elex_wannacry.exe
Size 320KB
Sample261014-23bglaae23
SHA256 d21934774ea5af5b7994941ac6f339e35ee2b35675ddeec14ab177c5be5a2533
MD5 3df2782531c79ca1f843177a7a713d86
SHA1 de6786ff900987c533cd7885396df6894dc7812a
SHA512 bbc7afb7945e665afcb001431787ef3209881af562ee58e598a99084568ca5a559593c486206cfb4b160df758f121cd1b30136cd704d1eef280b9f71dd401624
SSDEEP 3072:5xIpeLbZKrCtZzawS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:LIu1aV/Ah1G/AcQ///NR5fn
TLSH
T17164EA1A2A3509EACEED1FB5ED1249D95141E8B114F1E23E6123EFDCD8E4DA2DC09F81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fboellof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhfenc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdlgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iedjfodg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnmojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkcnnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqpomo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogoinka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiagnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Podcnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akiijq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkfcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlljglpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhklcldi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmjpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blgiphni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Komhfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koaaaaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjcmgmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcknpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enkdjkep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfjfoidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnldkgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdlfdnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgnjjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcjmapng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnnjgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikqqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcigneeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmlmdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebimqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmnbpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbdeba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfgboc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqnbgpmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bihhbocn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpefkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffjignde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojmqgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhhonl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igmgji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdndik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkikglce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhlkep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjfqljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapjpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fifhmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjocgdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnkfgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpejikg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhephfpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhenko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmkopgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqafbaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adoamfhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbojfkjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodijffl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmphkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdgcmqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emoanbll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmccecfp.exe

Executes dropped EXE 64 IoCs

pid	Process
1340	Hknkiokp.exe
3888	Hnodkjhq.exe
2960	Hhdhhchf.exe
4128	Hjedpkne.exe
3392	Halmaiog.exe
4904	Hhfenc32.exe
4968	Hkeajn32.exe
2096	Haoighmd.exe
1196	Hdmecdlh.exe
1288	Hkgnpn32.exe
236	Iaaflh32.exe
4704	Ignndo32.exe
2988	Inhgaipf.exe
5036	Iqfcmdpj.exe
2744	Igpkjo32.exe
3176	Injcginc.exe
4548	Iddlccfp.exe
5508	Ikndpm32.exe
3024	Ibhlmgdj.exe
5860	Idfhibdn.exe
3976	Ikqqfm32.exe
996	Ibjibg32.exe
5072	Ihdaoajd.exe
3452	Jjfngi32.exe
4816	Jqpfccgo.exe
3560	Jgjnpm32.exe
1988	Jbobnf32.exe
4856	Jdnnjane.exe
4468	Jkggfl32.exe
1392	Jnfcbg32.exe
5500	Jdpkoalc.exe
3404	Jkjclk32.exe
2680	Jbdliejl.exe
2916	Jhndepbi.exe
4724	Jnklnfpq.exe
5144	Jdddjq32.exe
1212	Kjambg32.exe
2896	Kqkeoama.exe
1608	Kgenlldo.exe
1372	Knofif32.exe
4276	Kqnbea32.exe
4232	Kghjakbl.exe
3152	Kjffngap.exe
1900	Kelkkpae.exe
3536	Kkechjib.exe
5368	Kbpkdd32.exe
4284	Kijcanhl.exe
4504	Kkhpmigp.exe
896	Kbbhjc32.exe
4648	Kilpgnfi.exe
6000	Ljmmnf32.exe
2800	Lbddpclj.exe
5092	Linmlm32.exe
2124	Ljpideje.exe
1660	Leenanik.exe
4516	Llofnh32.exe
4000	Lbinkb32.exe
5420	Licfgmpa.exe
1456	Ljdboe32.exe
2984	Lankloml.exe
3260	Lhhchi32.exe
2392	Lnbkeclf.exe
1932	Lelcbmcc.exe
1800	Mlflog32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eoagdi32.exe	Dhgogojd.exe
File created	C:\Windows\SysWOW64\Gnppbapl.exe	Ggfgegho.exe
File created	C:\Windows\SysWOW64\Ibhjkk32.dll	Jnklnfpq.exe
File created	C:\Windows\SysWOW64\Fbipejob.dll	Gkfnnjnl.exe
File created	C:\Windows\SysWOW64\Nmenmgab.exe	Njfaalao.exe
File created	C:\Windows\SysWOW64\Pbhndmfj.dll	Mdikpjeb.exe
File created	C:\Windows\SysWOW64\Pohdamqh.exe	Pioleb32.exe
File created	C:\Windows\SysWOW64\Hkeajn32.exe	Hhfenc32.exe
File created	C:\Windows\SysWOW64\Pbdcac32.dll	Lelcbmcc.exe
File opened for modification	C:\Windows\SysWOW64\Dfdpjj32.exe	Dkokma32.exe
File opened for modification	C:\Windows\SysWOW64\Fnbjkj32.exe	Fmancbji.exe
File opened for modification	C:\Windows\SysWOW64\Ojfcmc32.exe	Oclkqihc.exe
File created	C:\Windows\SysWOW64\Fmapgp32.dll	Geenclkn.exe
File opened for modification	C:\Windows\SysWOW64\Bbacekmj.exe	Bapgmb32.exe
File opened for modification	C:\Windows\SysWOW64\Kqkeoama.exe	Kjambg32.exe
File created	C:\Windows\SysWOW64\Dccpdooi.dll	Bicjjncd.exe
File opened for modification	C:\Windows\SysWOW64\Iioplg32.exe	Iahgki32.exe
File created	C:\Windows\SysWOW64\Khmepapg.dll	Hkhblo32.exe
File created	C:\Windows\SysWOW64\Cjcdbb32.dll	Bcfabgel.exe
File opened for modification	C:\Windows\SysWOW64\Mgjicb32.exe	Mqpqghgn.exe
File opened for modification	C:\Windows\SysWOW64\Dkahba32.exe	Dfdpjj32.exe
File created	C:\Windows\SysWOW64\Dkcehaof.exe	Dieilepc.exe
File created	C:\Windows\SysWOW64\Ceehhk32.dll	Dnqcop32.exe
File opened for modification	C:\Windows\SysWOW64\Lahboo32.exe	Lknjbdad.exe
File created	C:\Windows\SysWOW64\Fphnff32.dll	Olnkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Dbgnobpg.exe	Dmjefkap.exe
File created	C:\Windows\SysWOW64\Bmpdhk32.dll	Pioleb32.exe
File opened for modification	C:\Windows\SysWOW64\Jjfngi32.exe	Ihdaoajd.exe
File created	C:\Windows\SysWOW64\Acamhnjh.dll	Gdleap32.exe
File created	C:\Windows\SysWOW64\Aggdaq32.dll	Hbflnl32.exe
File created	C:\Windows\SysWOW64\Oflkln32.dll	Amhlpb32.exe
File created	C:\Windows\SysWOW64\Cpmajdig.exe	Coldbl32.exe
File opened for modification	C:\Windows\SysWOW64\Lhkdkj32.exe	Lobpadoe.exe
File created	C:\Windows\SysWOW64\Bmliem32.exe	Bbgehd32.exe
File opened for modification	C:\Windows\SysWOW64\Eglkhk32.exe	Eqbclagp.exe
File created	C:\Windows\SysWOW64\Ogioakmh.dll	Ocdnedkp.exe
File opened for modification	C:\Windows\SysWOW64\Bikdgn32.exe	Bihhbocn.exe
File created	C:\Windows\SysWOW64\Dbikdbnd.exe	Dmmblkpm.exe
File opened for modification	C:\Windows\SysWOW64\Anmfkane.exe	Alkidi32.exe
File created	C:\Windows\SysWOW64\Cqcmdl32.dll	Mnegkf32.exe
File opened for modification	C:\Windows\SysWOW64\Jidigfeo.exe	Jbjqkl32.exe
File created	C:\Windows\SysWOW64\Jjgkjh32.exe	Jhhonl32.exe
File opened for modification	C:\Windows\SysWOW64\Akipdg32.exe	Qaalkamf.exe
File created	C:\Windows\SysWOW64\Lojeld32.dll	Ckjbbbga.exe
File opened for modification	C:\Windows\SysWOW64\Iedjfodg.exe	Iojbid32.exe
File created	C:\Windows\SysWOW64\Pkfbpoog.exe	Pigfdcoc.exe
File created	C:\Windows\SysWOW64\Bfgopcfm.exe	Bpngcinp.exe
File created	C:\Windows\SysWOW64\Cqedgaji.dll	Dbaeab32.exe
File created	C:\Windows\SysWOW64\Fbbpgh32.exe	Fpdckm32.exe
File created	C:\Windows\SysWOW64\Dcbllh32.exe	Caqpdpii.exe
File created	C:\Windows\SysWOW64\Kqnbea32.exe	Knofif32.exe
File opened for modification	C:\Windows\SysWOW64\Gibhihko.exe	Fbhplnca.exe
File created	C:\Windows\SysWOW64\Mjndbb32.dll	Nfeekgjo.exe
File created	C:\Windows\SysWOW64\Gjgipldf.dll	Bbmjjk32.exe
File created	C:\Windows\SysWOW64\Ekimdc32.exe	Ecbecfqe.exe
File created	C:\Windows\SysWOW64\Gknpfp32.exe	Gqikigoi.exe
File created	C:\Windows\SysWOW64\Nlnpbe32.exe	Nedgfk32.exe
File opened for modification	C:\Windows\SysWOW64\Kijcanhl.exe	Kbpkdd32.exe
File created	C:\Windows\SysWOW64\Cajcffka.dll	Nblcgpho.exe
File created	C:\Windows\SysWOW64\Igmgji32.exe	Ipcomo32.exe
File created	C:\Windows\SysWOW64\Deaced32.dll	Pdkolm32.exe
File created	C:\Windows\SysWOW64\Bkmaomkp.dll	Iioplg32.exe
File opened for modification	C:\Windows\SysWOW64\Ajmljjhj.exe	Adccnpqm.exe
File created	C:\Windows\SysWOW64\Mcbjlflk.dll	Nhephfpi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8924	9372	WerFault.exe	1004

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbpdkabl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnhadnpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnjdigpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgoadi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljpideje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcnnebhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alcfoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebejpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijqmacpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoglmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfjfoidl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogeklh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjdkeaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caqpdpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpejec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bncllqhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfabfbnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhdcfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecbecfqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbhlbaed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meefhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgkijp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocbapdmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnkgakpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabafkgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfhgdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfgboc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Occgkngd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afinbdon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocamaam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojmqgd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Haghje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmmffnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqhmbqlh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iogoinka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcldmbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbecgned.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kjponk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njekfenc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enemjobn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofpgaihj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plijbblh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emenhcdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbnflihq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqpfccgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnbkeclf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipeehhhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bopefnnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqmlmiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhfmic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oblhlpne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idfmmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nedgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kahqbgjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfbaka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dinanb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcgfnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpbmpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njinfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phmhgmpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nabpiocm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olgbidbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Inhgaipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Allpnplb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmakgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjhaml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmlmdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeidan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enhpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpefkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ingpgcmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnnakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qjcidkpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kobkle32.dll"	Kaemba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgqcnjba.dll"	Dcigneeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agccld32.dll"	Fgoadi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbacekmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfnccg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmmnanao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqedgaji.dll"	Dbaeab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qicnip32.dll"	Lnbkeclf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nifldj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjlpcbqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llhncc32.dll"	Ebimqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmancbji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbgibgpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqpclm32.dll"	Gihgoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lokdgpqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aebhaede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfjmcb32.dll"	Nfnafpni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbngd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cibabdno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mamljndl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mchpibng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkokma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkobck32.dll"	Mqhmbqlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mknfldgn.dll"	Ncifdlii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkmmkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gideogil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnkgakpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihibb32.dll"	Dohkhq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iobeno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khplia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcepdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmpjfdcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nclida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflkln32.dll"	Amhlpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dieilepc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbhifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbgehd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lokdgpqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbmjjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfqdid32.dll"	Gnmlbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchngi32.dll"	Hnmeiipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljdboe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmbflc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejdhokji.dll"	Icfediio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhgcdjje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmnomk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqpomo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bakmbcka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjkipdpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccmgbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghhea32.dll"	Emhahiep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gifadggi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1340	4976	2026-10-14_3df2782531c79ca1f843177a7a713d86_elex_wannacry.exe	88
PID 1340 wrote to memory of 3888	1340	Hknkiokp.exe	89
PID 3888 wrote to memory of 2960	3888	Hnodkjhq.exe	90
PID 2960 wrote to memory of 4128	2960	Hhdhhchf.exe	91
PID 4128 wrote to memory of 3392	4128	Hjedpkne.exe	92
PID 3392 wrote to memory of 4904	3392	Halmaiog.exe	93
PID 4904 wrote to memory of 4968	4904	Hhfenc32.exe	94
PID 4968 wrote to memory of 2096	4968	Hkeajn32.exe	95
PID 2096 wrote to memory of 1196	2096	Haoighmd.exe	96
PID 1196 wrote to memory of 1288	1196	Hdmecdlh.exe	97
PID 1288 wrote to memory of 236	1288	Hkgnpn32.exe	98
PID 236 wrote to memory of 4704	236	Iaaflh32.exe	99
PID 4704 wrote to memory of 2988	4704	Ignndo32.exe	100
PID 2988 wrote to memory of 5036	2988	Inhgaipf.exe	101
PID 5036 wrote to memory of 2744	5036	Iqfcmdpj.exe	102
PID 2744 wrote to memory of 3176	2744	Igpkjo32.exe	103
PID 3176 wrote to memory of 4548	3176	Injcginc.exe	104
PID 4548 wrote to memory of 5508	4548	Iddlccfp.exe	105
PID 5508 wrote to memory of 3024	5508	Ikndpm32.exe	106
PID 3024 wrote to memory of 5860	3024	Ibhlmgdj.exe	107
PID 5860 wrote to memory of 3976	5860	Idfhibdn.exe	108
PID 3976 wrote to memory of 996	3976	Ikqqfm32.exe	109
PID 996 wrote to memory of 5072	996	Ibjibg32.exe	110
PID 5072 wrote to memory of 3452	5072	Ihdaoajd.exe	111
PID 3452 wrote to memory of 4816	3452	Jjfngi32.exe	112
PID 4816 wrote to memory of 3560	4816	Jqpfccgo.exe	113
PID 3560 wrote to memory of 1988	3560	Jgjnpm32.exe	114
PID 1988 wrote to memory of 4856	1988	Jbobnf32.exe	115
PID 4856 wrote to memory of 4468	4856	Jdnnjane.exe	116
PID 4468 wrote to memory of 1392	4468	Jkggfl32.exe	117
PID 1392 wrote to memory of 5500	1392	Jnfcbg32.exe	118
PID 5500 wrote to memory of 3404	5500	Jdpkoalc.exe	119
PID 3404 wrote to memory of 2680	3404	Jkjclk32.exe	120
PID 2680 wrote to memory of 2916	2680	Jbdliejl.exe	121
PID 2916 wrote to memory of 4724	2916	Jhndepbi.exe	122
PID 4724 wrote to memory of 5144	4724	Jnklnfpq.exe	123
PID 5144 wrote to memory of 1212	5144	Jdddjq32.exe	124
PID 1212 wrote to memory of 2896	1212	Kjambg32.exe	125
PID 2896 wrote to memory of 1608	2896	Kqkeoama.exe	126
PID 1608 wrote to memory of 1372	1608	Kgenlldo.exe	127
PID 1372 wrote to memory of 4276	1372	Knofif32.exe	128
PID 4276 wrote to memory of 4232	4276	Kqnbea32.exe	129
PID 4232 wrote to memory of 3152	4232	Kghjakbl.exe	130
PID 3152 wrote to memory of 1900	3152	Kjffngap.exe	131
PID 1900 wrote to memory of 3536	1900	Kelkkpae.exe	132
PID 3536 wrote to memory of 5368	3536	Kkechjib.exe	133
PID 5368 wrote to memory of 4284	5368	Kbpkdd32.exe	134
PID 4284 wrote to memory of 4504	4284	Kijcanhl.exe	135
PID 4504 wrote to memory of 896	4504	Kkhpmigp.exe	136
PID 896 wrote to memory of 4648	896	Kbbhjc32.exe	137
PID 4648 wrote to memory of 6000	4648	Kilpgnfi.exe	138
PID 6000 wrote to memory of 2800	6000	Ljmmnf32.exe	139
PID 2800 wrote to memory of 5092	2800	Lbddpclj.exe	140
PID 5092 wrote to memory of 2124	5092	Linmlm32.exe	141
PID 2124 wrote to memory of 1660	2124	Ljpideje.exe	142
PID 1660 wrote to memory of 4516	1660	Leenanik.exe	143
PID 4516 wrote to memory of 4000	4516	Llofnh32.exe	144
PID 4000 wrote to memory of 5420	4000	Lbinkb32.exe	145
PID 5420 wrote to memory of 1456	5420	Licfgmpa.exe	146
PID 1456 wrote to memory of 2984	1456	Ljdboe32.exe	147
PID 2984 wrote to memory of 3260	2984	Lankloml.exe	148
PID 3260 wrote to memory of 2392	3260	Lhhchi32.exe	149
PID 2392 wrote to memory of 1932	2392	Lnbkeclf.exe	150
PID 1932 wrote to memory of 1800	1932	Lelcbmcc.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-10-14_3df2782531c79ca1f843177a7a713d86_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_3df2782531c79ca1f843177a7a713d86_elex_wannacry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\Hknkiokp.exe
  C:\Windows\system32\Hknkiokp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\Hnodkjhq.exe
    C:\Windows\system32\Hnodkjhq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\SysWOW64\Hhdhhchf.exe
      C:\Windows\system32\Hhdhhchf.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\Hjedpkne.exe
        
        C:\Windows\system32\Hjedpkne.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
      - C:\Windows\SysWOW64\Halmaiog.exe
        
        C:\Windows\system32\Halmaiog.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Hhfenc32.exe
        
        C:\Windows\system32\Hhfenc32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Hkeajn32.exe
        
        C:\Windows\system32\Hkeajn32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Haoighmd.exe
        
        C:\Windows\system32\Haoighmd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Hdmecdlh.exe
        
        C:\Windows\system32\Hdmecdlh.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Hkgnpn32.exe
        
        C:\Windows\system32\Hkgnpn32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Iaaflh32.exe
        
        C:\Windows\system32\Iaaflh32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Windows\SysWOW64\Ignndo32.exe
        
        C:\Windows\system32\Ignndo32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Inhgaipf.exe
        
        C:\Windows\system32\Inhgaipf.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Iqfcmdpj.exe
        
        C:\Windows\system32\Iqfcmdpj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Igpkjo32.exe
        
        C:\Windows\system32\Igpkjo32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Injcginc.exe
        
        C:\Windows\system32\Injcginc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Ikndpm32.exe
        
        C:\Windows\system32\Ikndpm32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\SysWOW64\Ibhlmgdj.exe
        
        C:\Windows\system32\Ibhlmgdj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Idfhibdn.exe
        
        C:\Windows\system32\Idfhibdn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5860
        
        C:\Windows\SysWOW64\Ikqqfm32.exe
        
        C:\Windows\system32\Ikqqfm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\SysWOW64\Ibjibg32.exe
        
        C:\Windows\system32\Ibjibg32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Ihdaoajd.exe
        
        C:\Windows\system32\Ihdaoajd.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Jjfngi32.exe
        
        C:\Windows\system32\Jjfngi32.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Jqpfccgo.exe
        
        C:\Windows\system32\Jqpfccgo.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Jgjnpm32.exe
        
        C:\Windows\system32\Jgjnpm32.exe
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Jdnnjane.exe
        
        C:\Windows\system32\Jdnnjane.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Jkggfl32.exe
        
        C:\Windows\system32\Jkggfl32.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Jnfcbg32.exe
        
        C:\Windows\system32\Jnfcbg32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Jdpkoalc.exe
        
        C:\Windows\system32\Jdpkoalc.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5500
        
        C:\Windows\SysWOW64\Jkjclk32.exe
        
        C:\Windows\system32\Jkjclk32.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SysWOW64\Jbdliejl.exe
        
        C:\Windows\system32\Jbdliejl.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SysWOW64\Jhndepbi.exe
        
        C:\Windows\system32\Jhndepbi.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Jdddjq32.exe
        
        C:\Windows\system32\Jdddjq32.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5144
        
        C:\Windows\SysWOW64\Kjambg32.exe
        
        C:\Windows\system32\Kjambg32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Kqkeoama.exe
        
        C:\Windows\system32\Kqkeoama.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Kgenlldo.exe
        
        C:\Windows\system32\Kgenlldo.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Knofif32.exe
        
        C:\Windows\system32\Knofif32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Kqnbea32.exe
        
        C:\Windows\system32\Kqnbea32.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Kghjakbl.exe
        
        C:\Windows\system32\Kghjakbl.exe
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Kjffngap.exe
        
        C:\Windows\system32\Kjffngap.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Kkechjib.exe
        
        C:\Windows\system32\Kkechjib.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Kbpkdd32.exe
        
        C:\Windows\system32\Kbpkdd32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Windows\SysWOW64\Kijcanhl.exe
        
        C:\Windows\system32\Kijcanhl.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Kkhpmigp.exe
        
        C:\Windows\system32\Kkhpmigp.exe
        49⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Kbbhjc32.exe
        
        C:\Windows\system32\Kbbhjc32.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Windows\SysWOW64\Kilpgnfi.exe
        
        C:\Windows\system32\Kilpgnfi.exe
        51⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Ljmmnf32.exe
        
        C:\Windows\system32\Ljmmnf32.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\SysWOW64\Lbddpclj.exe
        
        C:\Windows\system32\Lbddpclj.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Linmlm32.exe
        
        C:\Windows\system32\Linmlm32.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Ljpideje.exe
        
        C:\Windows\system32\Ljpideje.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Leenanik.exe
        
        C:\Windows\system32\Leenanik.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Llofnh32.exe
        
        C:\Windows\system32\Llofnh32.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Lbinkb32.exe
        
        C:\Windows\system32\Lbinkb32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Licfgmpa.exe
        
        C:\Windows\system32\Licfgmpa.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Windows\SysWOW64\Ljdboe32.exe
        
        C:\Windows\system32\Ljdboe32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Lankloml.exe
        
        C:\Windows\system32\Lankloml.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Lhhchi32.exe
        
        C:\Windows\system32\Lhhchi32.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Lnbkeclf.exe
        
        C:\Windows\system32\Lnbkeclf.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Lelcbmcc.exe
        
        C:\Windows\system32\Lelcbmcc.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Mlflog32.exe
        
        C:\Windows\system32\Mlflog32.exe
        65⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:472
        
        C:\Windows\SysWOW64\Mijlhl32.exe
        
        C:\Windows\system32\Mijlhl32.exe
        67⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Mjkipdpg.exe
        
        C:\Windows\system32\Mjkipdpg.exe
        68⤵
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Maealn32.exe
        
        C:\Windows\system32\Maealn32.exe
        69⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Mhoiih32.exe
        
        C:\Windows\system32\Mhoiih32.exe
        70⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Mniafbfn.exe
        
        C:\Windows\system32\Mniafbfn.exe
        71⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Mecjbl32.exe
        
        C:\Windows\system32\Mecjbl32.exe
        72⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Mlmbofdh.exe
        
        C:\Windows\system32\Mlmbofdh.exe
        73⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Mbgjlq32.exe
        
        C:\Windows\system32\Mbgjlq32.exe
        74⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Meefhl32.exe
        
        C:\Windows\system32\Meefhl32.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Windows\SysWOW64\Mjbopcip.exe
        
        C:\Windows\system32\Mjbopcip.exe
        76⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Mehcnlie.exe
        
        C:\Windows\system32\Mehcnlie.exe
        77⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Nlbkjf32.exe
        
        C:\Windows\system32\Nlbkjf32.exe
        78⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Nblcgpho.exe
        
        C:\Windows\system32\Nblcgpho.exe
        79⤵
        Drops file in System32 directory
        
        PID:1960
        
        C:\Windows\SysWOW64\Nifldj32.exe
        
        C:\Windows\system32\Nifldj32.exe
        80⤵
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Njghkb32.exe
        
        C:\Windows\system32\Njghkb32.exe
        81⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Nklbfaae.exe
        
        C:\Windows\system32\Nklbfaae.exe
        82⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Olnkfd32.exe
        
        C:\Windows\system32\Olnkfd32.exe
        83⤵
        Drops file in System32 directory
        
        PID:3460
        
        C:\Windows\SysWOW64\Oiakpheo.exe
        
        C:\Windows\system32\Oiakpheo.exe
        84⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Ohfhqd32.exe
        
        C:\Windows\system32\Ohfhqd32.exe
        85⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Oblmnmjl.exe
        
        C:\Windows\system32\Oblmnmjl.exe
        86⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Ohiefdhd.exe
        
        C:\Windows\system32\Ohiefdhd.exe
        87⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        88⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Ooejhn32.exe
        
        C:\Windows\system32\Ooejhn32.exe
        89⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Plijbblh.exe
        
        C:\Windows\system32\Plijbblh.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:3128
        
        C:\Windows\SysWOW64\Peaokh32.exe
        
        C:\Windows\system32\Peaokh32.exe
        91⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Pllggbje.exe
        
        C:\Windows\system32\Pllggbje.exe
        92⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        93⤵
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Piphaf32.exe
        
        C:\Windows\system32\Piphaf32.exe
        94⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Pkqdhnom.exe
        
        C:\Windows\system32\Pkqdhnom.exe
        95⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Pibdff32.exe
        
        C:\Windows\system32\Pibdff32.exe
        96⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Poomom32.exe
        
        C:\Windows\system32\Poomom32.exe
        97⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Pehekgmp.exe
        
        C:\Windows\system32\Pehekgmp.exe
        98⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Plbmhadm.exe
        
        C:\Windows\system32\Plbmhadm.exe
        99⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Pcmeek32.exe
        
        C:\Windows\system32\Pcmeek32.exe
        100⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Qifnaecf.exe
        
        C:\Windows\system32\Qifnaecf.exe
        101⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Qkhjim32.exe
        
        C:\Windows\system32\Qkhjim32.exe
        102⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Qaabfgpa.exe
        
        C:\Windows\system32\Qaabfgpa.exe
        103⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Qkjgomgb.exe
        
        C:\Windows\system32\Qkjgomgb.exe
        104⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Aadokg32.exe
        
        C:\Windows\system32\Aadokg32.exe
        105⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        106⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Aebhaede.exe
        
        C:\Windows\system32\Aebhaede.exe
        107⤵
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Allpnplb.exe
        
        C:\Windows\system32\Allpnplb.exe
        108⤵
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Aaiiffjj.exe
        
        C:\Windows\system32\Aaiiffjj.exe
        109⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Alnmdojp.exe
        
        C:\Windows\system32\Alnmdojp.exe
        110⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Acheqi32.exe
        
        C:\Windows\system32\Acheqi32.exe
        111⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Ahenip32.exe
        
        C:\Windows\system32\Ahenip32.exe
        112⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Aoofej32.exe
        
        C:\Windows\system32\Aoofej32.exe
        113⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Afinbdon.exe
        
        C:\Windows\system32\Afinbdon.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Windows\SysWOW64\Alcfoo32.exe
        
        C:\Windows\system32\Alcfoo32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\Bcmolimg.exe
        
        C:\Windows\system32\Bcmolimg.exe
        116⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Bjgghc32.exe
        
        C:\Windows\system32\Bjgghc32.exe
        117⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Bkhcpkkb.exe
        
        C:\Windows\system32\Bkhcpkkb.exe
        118⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Bbbkmebo.exe
        
        C:\Windows\system32\Bbbkmebo.exe
        119⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Blhpjnbe.exe
        
        C:\Windows\system32\Blhpjnbe.exe
        120⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        121⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Bjlpcbqo.exe
        
        C:\Windows\system32\Bjlpcbqo.exe
        122⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        123⤵
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Bbgehd32.exe
        
        C:\Windows\system32\Bbgehd32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Bmliem32.exe
        
        C:\Windows\system32\Bmliem32.exe
        125⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Bcfabgel.exe
        
        C:\Windows\system32\Bcfabgel.exe
        126⤵
        Drops file in System32 directory
        
        PID:4620
        
        C:\Windows\SysWOW64\Bicjjncd.exe
        
        C:\Windows\system32\Bicjjncd.exe
        127⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        128⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Ciefpn32.exe
        
        C:\Windows\system32\Ciefpn32.exe
        129⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Ckdcli32.exe
        
        C:\Windows\system32\Ckdcli32.exe
        130⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Cbnkhcha.exe
        
        C:\Windows\system32\Cbnkhcha.exe
        131⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Cmcoflhh.exe
        
        C:\Windows\system32\Cmcoflhh.exe
        132⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ccmgbf32.exe
        
        C:\Windows\system32\Ccmgbf32.exe
        133⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Cjgpoq32.exe
        
        C:\Windows\system32\Cjgpoq32.exe
        134⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Codhgg32.exe
        
        C:\Windows\system32\Codhgg32.exe
        135⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Cjjlep32.exe
        
        C:\Windows\system32\Cjjlep32.exe
        136⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ckkilhjm.exe
        
        C:\Windows\system32\Ckkilhjm.exe
        137⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cbeaib32.exe
        
        C:\Windows\system32\Cbeaib32.exe
        138⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dmjefkap.exe
        
        C:\Windows\system32\Dmjefkap.exe
        139⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Dbgnobpg.exe
        
        C:\Windows\system32\Dbgnobpg.exe
        140⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Dmmblkpm.exe
        
        C:\Windows\system32\Dmmblkpm.exe
        141⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Dbikdbnd.exe
        
        C:\Windows\system32\Dbikdbnd.exe
        142⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Dmooak32.exe
        
        C:\Windows\system32\Dmooak32.exe
        143⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Dcigneeg.exe
        
        C:\Windows\system32\Dcigneeg.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Dmakgj32.exe
        
        C:\Windows\system32\Dmakgj32.exe
        145⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        146⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Dlfhhgpp.exe
        
        C:\Windows\system32\Dlfhhgpp.exe
        147⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Dbqqeahl.exe
        
        C:\Windows\system32\Dbqqeahl.exe
        148⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Djhifnho.exe
        
        C:\Windows\system32\Djhifnho.exe
        149⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ecpmod32.exe
        
        C:\Windows\system32\Ecpmod32.exe
        150⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Efoiko32.exe
        
        C:\Windows\system32\Efoiko32.exe
        151⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Emhahiep.exe
        
        C:\Windows\system32\Emhahiep.exe
        152⤵
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Ebejpp32.exe
        
        C:\Windows\system32\Ebejpp32.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Windows\SysWOW64\Eiobmjkd.exe
        
        C:\Windows\system32\Eiobmjkd.exe
        154⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Epikid32.exe
        
        C:\Windows\system32\Epikid32.exe
        155⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Ejoogm32.exe
        
        C:\Windows\system32\Ejoogm32.exe
        156⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Eplgod32.exe
        
        C:\Windows\system32\Eplgod32.exe
        157⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Efepln32.exe
        
        C:\Windows\system32\Efepln32.exe
        158⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Epndddnk.exe
        
        C:\Windows\system32\Epndddnk.exe
        159⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Efhlan32.exe
        
        C:\Windows\system32\Efhlan32.exe
        160⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Fifhmi32.exe
        
        C:\Windows\system32\Fifhmi32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Fmdach32.exe
        
        C:\Windows\system32\Fmdach32.exe
        163⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Fpbmpc32.exe
        
        C:\Windows\system32\Fpbmpc32.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:6656
        
        C:\Windows\SysWOW64\Fjhaml32.exe
        
        C:\Windows\system32\Fjhaml32.exe
        165⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Fpejec32.exe
        
        C:\Windows\system32\Fpejec32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Fjjnblhi.exe
        
        C:\Windows\system32\Fjjnblhi.exe
        167⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Fllkjd32.exe
        
        C:\Windows\system32\Fllkjd32.exe
        168⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fbecgned.exe
        
        C:\Windows\system32\Fbecgned.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Fmkgdgej.exe
        
        C:\Windows\system32\Fmkgdgej.exe
        170⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Fbhplnca.exe
        
        C:\Windows\system32\Fbhplnca.exe
        171⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Gibhihko.exe
        
        C:\Windows\system32\Gibhihko.exe
        172⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Gplpfb32.exe
        
        C:\Windows\system32\Gplpfb32.exe
        173⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Gffhbljh.exe
        
        C:\Windows\system32\Gffhbljh.exe
        174⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Gideogil.exe
        
        C:\Windows\system32\Gideogil.exe
        175⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Gbmigm32.exe
        
        C:\Windows\system32\Gbmigm32.exe
        176⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Gifadggi.exe
        
        C:\Windows\system32\Gifadggi.exe
        177⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Gdleap32.exe
        
        C:\Windows\system32\Gdleap32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Gkfnnjnl.exe
        
        C:\Windows\system32\Gkfnnjnl.exe
        179⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Gpcffalc.exe
        
        C:\Windows\system32\Gpcffalc.exe
        180⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        181⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Gljgkb32.exe
        
        C:\Windows\system32\Gljgkb32.exe
        182⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hkkgii32.exe
        
        C:\Windows\system32\Hkkgii32.exe
        183⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Hlldaape.exe
        
        C:\Windows\system32\Hlldaape.exe
        184⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Hbflnl32.exe
        
        C:\Windows\system32\Hbflnl32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Hmlpkd32.exe
        
        C:\Windows\system32\Hmlpkd32.exe
        186⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Hdehho32.exe
        
        C:\Windows\system32\Hdehho32.exe
        187⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Hibape32.exe
        
        C:\Windows\system32\Hibape32.exe
        188⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Hgfaij32.exe
        
        C:\Windows\system32\Hgfaij32.exe
        190⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Hmpjfdcb.exe
        
        C:\Windows\system32\Hmpjfdcb.exe
        191⤵
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Hginoiic.exe
        
        C:\Windows\system32\Hginoiic.exe
        192⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Hmbflc32.exe
        
        C:\Windows\system32\Hmbflc32.exe
        193⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Hpabho32.exe
        
        C:\Windows\system32\Hpabho32.exe
        194⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Iiigqdfd.exe
        
        C:\Windows\system32\Iiigqdfd.exe
        195⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Ipcomo32.exe
        
        C:\Windows\system32\Ipcomo32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Ingpgcmj.exe
        
        C:\Windows\system32\Ingpgcmj.exe
        198⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Idahcm32.exe
        
        C:\Windows\system32\Idahcm32.exe
        199⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ikkppgld.exe
        
        C:\Windows\system32\Ikkppgld.exe
        200⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Illmho32.exe
        
        C:\Windows\system32\Illmho32.exe
        201⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Icfediio.exe
        
        C:\Windows\system32\Icfediio.exe
        202⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Ijqmacpl.exe
        
        C:\Windows\system32\Ijqmacpl.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Windows\SysWOW64\Ipjenn32.exe
        
        C:\Windows\system32\Ipjenn32.exe
        204⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Igdnkhoe.exe
        
        C:\Windows\system32\Igdnkhoe.exe
        205⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ilafcomm.exe
        
        C:\Windows\system32\Ilafcomm.exe
        206⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Jcknpi32.exe
        
        C:\Windows\system32\Jcknpi32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Jnqbmadp.exe
        
        C:\Windows\system32\Jnqbmadp.exe
        208⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        209⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Jjgcbb32.exe
        
        C:\Windows\system32\Jjgcbb32.exe
        210⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Jdmgok32.exe
        
        C:\Windows\system32\Jdmgok32.exe
        211⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Jkgpleaf.exe
        
        C:\Windows\system32\Jkgpleaf.exe
        212⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Jlhlcnge.exe
        
        C:\Windows\system32\Jlhlcnge.exe
        213⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Jcbdph32.exe
        
        C:\Windows\system32\Jcbdph32.exe
        214⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Jljiimeb.exe
        
        C:\Windows\system32\Jljiimeb.exe
        215⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Jgpmffeh.exe
        
        C:\Windows\system32\Jgpmffeh.exe
        216⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Jlmfomcp.exe
        
        C:\Windows\system32\Jlmfomcp.exe
        217⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Kcgnkgkl.exe
        
        C:\Windows\system32\Kcgnkgkl.exe
        218⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Kjafha32.exe
        
        C:\Windows\system32\Kjafha32.exe
        219⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Kdfjej32.exe
        
        C:\Windows\system32\Kdfjej32.exe
        220⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Kkpbbdil.exe
        
        C:\Windows\system32\Kkpbbdil.exe
        221⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Kmaojl32.exe
        
        C:\Windows\system32\Kmaojl32.exe
        222⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Kckgff32.exe
        
        C:\Windows\system32\Kckgff32.exe
        223⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Kmdlolmg.exe
        
        C:\Windows\system32\Kmdlolmg.exe
        224⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Kkelmc32.exe
        
        C:\Windows\system32\Kkelmc32.exe
        225⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Kdmqfi32.exe
        
        C:\Windows\system32\Kdmqfi32.exe
        226⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Kmhejk32.exe
        
        C:\Windows\system32\Kmhejk32.exe
        227⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Lgnihd32.exe
        
        C:\Windows\system32\Lgnihd32.exe
        228⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Lnhadnpe.exe
        
        C:\Windows\system32\Lnhadnpe.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
        
        C:\Windows\SysWOW64\Ldbjah32.exe
        
        C:\Windows\system32\Ldbjah32.exe
        230⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Ljobiofi.exe
        
        C:\Windows\system32\Ljobiofi.exe
        231⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Lqikfi32.exe
        
        C:\Windows\system32\Lqikfi32.exe
        232⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Lgccccec.exe
        
        C:\Windows\system32\Lgccccec.exe
        233⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Lnmkpm32.exe
        
        C:\Windows\system32\Lnmkpm32.exe
        234⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Lcjchd32.exe
        
        C:\Windows\system32\Lcjchd32.exe
        235⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Lnohemjm.exe
        
        C:\Windows\system32\Lnohemjm.exe
        236⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Lclpmdhd.exe
        
        C:\Windows\system32\Lclpmdhd.exe
        237⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ljfhjn32.exe
        
        C:\Windows\system32\Ljfhjn32.exe
        238⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Mqpqghgn.exe
        
        C:\Windows\system32\Mqpqghgn.exe
        239⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Mgjicb32.exe
        
        C:\Windows\system32\Mgjicb32.exe
        240⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Mndapl32.exe
        
        C:\Windows\system32\Mndapl32.exe
        241⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Mabnlh32.exe
        
        C:\Windows\system32\Mabnlh32.exe
        242⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Mglfibmh.exe
        
        C:\Windows\system32\Mglfibmh.exe
        243⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Mjkbemll.exe
        
        C:\Windows\system32\Mjkbemll.exe
        244⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Madjbg32.exe
        
        C:\Windows\system32\Madjbg32.exe
        245⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Mgoboake.exe
        
        C:\Windows\system32\Mgoboake.exe
        246⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Maggggaf.exe
        
        C:\Windows\system32\Maggggaf.exe
        247⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Mgaoda32.exe
        
        C:\Windows\system32\Mgaoda32.exe
        248⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Mnkgakpp.exe
        
        C:\Windows\system32\Mnkgakpp.exe
        249⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        250⤵
        Modifies registry class
        
        PID:7840
        
        C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        251⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Nalpbf32.exe
        
        C:\Windows\system32\Nalpbf32.exe
        252⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Ngehoqdn.exe
        
        C:\Windows\system32\Ngehoqdn.exe
        253⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Njdeklca.exe
        
        C:\Windows\system32\Njdeklca.exe
        254⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Nmbaggce.exe
        
        C:\Windows\system32\Nmbaggce.exe
        255⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Nclida32.exe
        
        C:\Windows\system32\Nclida32.exe
        256⤵
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Njfaalao.exe
        
        C:\Windows\system32\Njfaalao.exe
        257⤵
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Nmenmgab.exe
        
        C:\Windows\system32\Nmenmgab.exe
        258⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Ncofjaho.exe
        
        C:\Windows\system32\Ncofjaho.exe
        259⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Njinfk32.exe
        
        C:\Windows\system32\Njinfk32.exe
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:8300
        
        C:\Windows\SysWOW64\Nmgjbg32.exe
        
        C:\Windows\system32\Nmgjbg32.exe
        261⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ndaboafl.exe
        
        C:\Windows\system32\Ndaboafl.exe
        262⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Njkklk32.exe
        
        C:\Windows\system32\Njkklk32.exe
        263⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Neqoidmo.exe
        
        C:\Windows\system32\Neqoidmo.exe
        264⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Nljgfn32.exe
        
        C:\Windows\system32\Nljgfn32.exe
        265⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Onicbi32.exe
        
        C:\Windows\system32\Onicbi32.exe
        266⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Oeclockl.exe
        
        C:\Windows\system32\Oeclockl.exe
        267⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Olmdln32.exe
        
        C:\Windows\system32\Olmdln32.exe
        268⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        269⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Oeehdcij.exe
        
        C:\Windows\system32\Oeehdcij.exe
        270⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Oloaamqf.exe
        
        C:\Windows\system32\Oloaamqf.exe
        271⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Oaliidon.exe
        
        C:\Windows\system32\Oaliidon.exe
        272⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Odjeepna.exe
        
        C:\Windows\system32\Odjeepna.exe
        273⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ojdnbj32.exe
        
        C:\Windows\system32\Ojdnbj32.exe
        274⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        275⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Ojgjhicl.exe
        
        C:\Windows\system32\Ojgjhicl.exe
        276⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Oaqbdc32.exe
        
        C:\Windows\system32\Oaqbdc32.exe
        277⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Ohkkanbe.exe
        
        C:\Windows\system32\Ohkkanbe.exe
        278⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Podcnh32.exe
        
        C:\Windows\system32\Podcnh32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Phmhgmpc.exe
        
        C:\Windows\system32\Phmhgmpc.exe
        280⤵
        System Location Discovery: System Language Discovery
        
        PID:8944
        
        C:\Windows\SysWOW64\Pmjpod32.exe
        
        C:\Windows\system32\Pmjpod32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Phodlm32.exe
        
        C:\Windows\system32\Phodlm32.exe
        282⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Pecefa32.exe
        
        C:\Windows\system32\Pecefa32.exe
        284⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Pkpmnh32.exe
        
        C:\Windows\system32\Pkpmnh32.exe
        285⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Peeakakg.exe
        
        C:\Windows\system32\Peeakakg.exe
        286⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Pkbjchio.exe
        
        C:\Windows\system32\Pkbjchio.exe
        287⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Pdkolm32.exe
        
        C:\Windows\system32\Pdkolm32.exe
        288⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Qkegiggl.exe
        
        C:\Windows\system32\Qkegiggl.exe
        289⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Qmccecfp.exe
        
        C:\Windows\system32\Qmccecfp.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8292
        
        C:\Windows\SysWOW64\Qldccjno.exe
        
        C:\Windows\system32\Qldccjno.exe
        291⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Qaalkamf.exe
        
        C:\Windows\system32\Qaalkamf.exe
        292⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Akipdg32.exe
        
        C:\Windows\system32\Akipdg32.exe
        293⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Amhlpb32.exe
        
        C:\Windows\system32\Amhlpb32.exe
        294⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Adbdml32.exe
        
        C:\Windows\system32\Adbdml32.exe
        295⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Aklmjfad.exe
        
        C:\Windows\system32\Aklmjfad.exe
        296⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Aafefq32.exe
        
        C:\Windows\system32\Aafefq32.exe
        297⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Alkidi32.exe
        
        C:\Windows\system32\Alkidi32.exe
        298⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Anmfkane.exe
        
        C:\Windows\system32\Anmfkane.exe
        299⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Alnfiifd.exe
        
        C:\Windows\system32\Alnfiifd.exe
        300⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Aolbedeh.exe
        
        C:\Windows\system32\Aolbedeh.exe
        301⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Aefjbo32.exe
        
        C:\Windows\system32\Aefjbo32.exe
        302⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Akccje32.exe
        
        C:\Windows\system32\Akccje32.exe
        303⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Aamkgpbi.exe
        
        C:\Windows\system32\Aamkgpbi.exe
        304⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Bhgcdjje.exe
        
        C:\Windows\system32\Bhgcdjje.exe
        305⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Bncllqhm.exe
        
        C:\Windows\system32\Bncllqhm.exe
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:8404
        
        C:\Windows\SysWOW64\Bdndik32.exe
        
        C:\Windows\system32\Bdndik32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8532
        
        C:\Windows\SysWOW64\Bkgleegf.exe
        
        C:\Windows\system32\Bkgleegf.exe
        308⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Bemqcngl.exe
        
        C:\Windows\system32\Bemqcngl.exe
        309⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Blgiphni.exe
        
        C:\Windows\system32\Blgiphni.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8920
        
        C:\Windows\SysWOW64\Bnhegp32.exe
        
        C:\Windows\system32\Bnhegp32.exe
        311⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bklfqd32.exe
        
        C:\Windows\system32\Bklfqd32.exe
        312⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Bddjijia.exe
        
        C:\Windows\system32\Bddjijia.exe
        313⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Bkobfdao.exe
        
        C:\Windows\system32\Bkobfdao.exe
        314⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Cfdgcmqd.exe
        
        C:\Windows\system32\Cfdgcmqd.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8888
        
        C:\Windows\SysWOW64\Cnokhonp.exe
        
        C:\Windows\system32\Cnokhonp.exe
        316⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Cffcilob.exe
        
        C:\Windows\system32\Cffcilob.exe
        317⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Coohbbeb.exe
        
        C:\Windows\system32\Coohbbeb.exe
        318⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ckeigc32.exe
        
        C:\Windows\system32\Ckeigc32.exe
        319⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Cbpacmbc.exe
        
        C:\Windows\system32\Cbpacmbc.exe
        320⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Chiipg32.exe
        
        C:\Windows\system32\Chiipg32.exe
        321⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Cocamaam.exe
        
        C:\Windows\system32\Cocamaam.exe
        322⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Windows\SysWOW64\Cdpjeh32.exe
        
        C:\Windows\system32\Cdpjeh32.exe
        323⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        324⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Cninnnfe.exe
        
        C:\Windows\system32\Cninnnfe.exe
        325⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Dhnbkfek.exe
        
        C:\Windows\system32\Dhnbkfek.exe
        326⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Dohkhq32.exe
        
        C:\Windows\system32\Dohkhq32.exe
        327⤵
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Ddecpgko.exe
        
        C:\Windows\system32\Ddecpgko.exe
        328⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Dkokma32.exe
        
        C:\Windows\system32\Dkokma32.exe
        329⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Dfdpjj32.exe
        
        C:\Windows\system32\Dfdpjj32.exe
        330⤵
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Dkahba32.exe
        
        C:\Windows\system32\Dkahba32.exe
        331⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Dnpdom32.exe
        
        C:\Windows\system32\Dnpdom32.exe
        332⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Dieilepc.exe
        
        C:\Windows\system32\Dieilepc.exe
        333⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9584
        
        C:\Windows\SysWOW64\Dkcehaof.exe
        
        C:\Windows\system32\Dkcehaof.exe
        334⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Dbnmek32.exe
        
        C:\Windows\system32\Dbnmek32.exe
        335⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Digeaenp.exe
        
        C:\Windows\system32\Digeaenp.exe
        336⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Dndnjllg.exe
        
        C:\Windows\system32\Dndnjllg.exe
        337⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Efkfkilj.exe
        
        C:\Windows\system32\Efkfkilj.exe
        338⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        339⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
        
        C:\Windows\SysWOW64\Engjol32.exe
        
        C:\Windows\system32\Engjol32.exe
        340⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Eeqclfaa.exe
        
        C:\Windows\system32\Eeqclfaa.exe
        341⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Ekkkip32.exe
        
        C:\Windows\system32\Ekkkip32.exe
        342⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Ebdcejpk.exe
        
        C:\Windows\system32\Ebdcejpk.exe
        343⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Emjgcc32.exe
        
        C:\Windows\system32\Emjgcc32.exe
        344⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Enkdjkep.exe
        
        C:\Windows\system32\Enkdjkep.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Eeelge32.exe
        
        C:\Windows\system32\Eeelge32.exe
        346⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Ekoddodi.exe
        
        C:\Windows\system32\Ekoddodi.exe
        347⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Ebimqi32.exe
        
        C:\Windows\system32\Ebimqi32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Emoanbll.exe
        
        C:\Windows\system32\Emoanbll.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10096
        
        C:\Windows\SysWOW64\Fnpmej32.exe
        
        C:\Windows\system32\Fnpmej32.exe
        350⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Fmancbji.exe
        
        C:\Windows\system32\Fmancbji.exe
        351⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Fnbjkj32.exe
        
        C:\Windows\system32\Fnbjkj32.exe
        352⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Fbnflihq.exe
        
        C:\Windows\system32\Fbnflihq.exe
        353⤵
        System Location Discovery: System Language Discovery
        
        PID:10228
        
        C:\Windows\SysWOW64\Fihnhc32.exe
        
        C:\Windows\system32\Fihnhc32.exe
        354⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Fpbfem32.exe
        
        C:\Windows\system32\Fpbfem32.exe
        355⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Fflobgng.exe
        
        C:\Windows\system32\Fflobgng.exe
        356⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        357⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Fpdckm32.exe
        
        C:\Windows\system32\Fpdckm32.exe
        358⤵
        Drops file in System32 directory
        
        PID:9512
        
        C:\Windows\SysWOW64\Fbbpgh32.exe
        
        C:\Windows\system32\Fbbpgh32.exe
        359⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Fmhcda32.exe
        
        C:\Windows\system32\Fmhcda32.exe
        360⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Fbellhbi.exe
        
        C:\Windows\system32\Fbellhbi.exe
        361⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Fechhcal.exe
        
        C:\Windows\system32\Fechhcal.exe
        362⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Flmqem32.exe
        
        C:\Windows\system32\Flmqem32.exe
        363⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Gbgibgpf.exe
        
        C:\Windows\system32\Gbgibgpf.exe
        364⤵
        Modifies registry class
        
        PID:9896
        
        C:\Windows\SysWOW64\Giaaoa32.exe
        
        C:\Windows\system32\Giaaoa32.exe
        365⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Gnnjgh32.exe
        
        C:\Windows\system32\Gnnjgh32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10020
        
        C:\Windows\SysWOW64\Gmojep32.exe
        
        C:\Windows\system32\Gmojep32.exe
        367⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Gnqflhcg.exe
        
        C:\Windows\system32\Gnqflhcg.exe
        368⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Gfgnnedj.exe
        
        C:\Windows\system32\Gfgnnedj.exe
        369⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Gldgflba.exe
        
        C:\Windows\system32\Gldgflba.exe
        370⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Gbnobf32.exe
        
        C:\Windows\system32\Gbnobf32.exe
        371⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Gihgoq32.exe
        
        C:\Windows\system32\Gihgoq32.exe
        372⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Gpbplkhh.exe
        
        C:\Windows\system32\Gpbplkhh.exe
        373⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Gflhie32.exe
        
        C:\Windows\system32\Gflhie32.exe
        374⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Gmfpeoga.exe
        
        C:\Windows\system32\Gmfpeoga.exe
        375⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Hoglmg32.exe
        
        C:\Windows\system32\Hoglmg32.exe
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:10056
        
        C:\Windows\SysWOW64\Hmhmko32.exe
        
        C:\Windows\system32\Hmhmko32.exe
        377⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Hfaaddlo.exe
        
        C:\Windows\system32\Hfaaddlo.exe
        378⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Hmkiqn32.exe
        
        C:\Windows\system32\Hmkiqn32.exe
        379⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Hbhbie32.exe
        
        C:\Windows\system32\Hbhbie32.exe
        380⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Hmmffnai.exe
        
        C:\Windows\system32\Hmmffnai.exe
        381⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
        
        C:\Windows\SysWOW64\Hoobnf32.exe
        
        C:\Windows\system32\Hoobnf32.exe
        382⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Hidgko32.exe
        
        C:\Windows\system32\Hidgko32.exe
        383⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Hlbcgj32.exe
        
        C:\Windows\system32\Hlbcgj32.exe
        384⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Hfhgdc32.exe
        
        C:\Windows\system32\Hfhgdc32.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:9624
        
        C:\Windows\SysWOW64\Hifcqo32.exe
        
        C:\Windows\system32\Hifcqo32.exe
        386⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Iocliecb.exe
        
        C:\Windows\system32\Iocliecb.exe
        387⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Imdlgm32.exe
        
        C:\Windows\system32\Imdlgm32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10324
        
        C:\Windows\SysWOW64\Ibadoc32.exe
        
        C:\Windows\system32\Ibadoc32.exe
        389⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Iepako32.exe
        
        C:\Windows\system32\Iepako32.exe
        390⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Ipeehhhb.exe
        
        C:\Windows\system32\Ipeehhhb.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:10420
        
        C:\Windows\SysWOW64\Iebnqofj.exe
        
        C:\Windows\system32\Iebnqofj.exe
        392⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Iojbid32.exe
        
        C:\Windows\system32\Iojbid32.exe
        393⤵
        Drops file in System32 directory
        
        PID:10484
        
        C:\Windows\SysWOW64\Iedjfodg.exe
        
        C:\Windows\system32\Iedjfodg.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10516
        
        C:\Windows\SysWOW64\Ipjocgdm.exe
        
        C:\Windows\system32\Ipjocgdm.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10628
        
        C:\Windows\SysWOW64\Jmnomk32.exe
        
        C:\Windows\system32\Jmnomk32.exe
        396⤵
        Modifies registry class
        
        PID:10672
        
        C:\Windows\SysWOW64\Jplkig32.exe
        
        C:\Windows\system32\Jplkig32.exe
        397⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Jeidan32.exe
        
        C:\Windows\system32\Jeidan32.exe
        398⤵
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Jlclnhho.exe
        
        C:\Windows\system32\Jlclnhho.exe
        399⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        400⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Jleicg32.exe
        
        C:\Windows\system32\Jleicg32.exe
        401⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Jcoapami.exe
        
        C:\Windows\system32\Jcoapami.exe
        402⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Jlgeig32.exe
        
        C:\Windows\system32\Jlgeig32.exe
        403⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        404⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Jngbcj32.exe
        
        C:\Windows\system32\Jngbcj32.exe
        405⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Johnkbaj.exe
        
        C:\Windows\system32\Johnkbaj.exe
        406⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Jebfgl32.exe
        
        C:\Windows\system32\Jebfgl32.exe
        407⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        408⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Kcfgaq32.exe
        
        C:\Windows\system32\Kcfgaq32.exe
        409⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Kjponk32.exe
        
        C:\Windows\system32\Kjponk32.exe
        410⤵
        System Location Discovery: System Language Discovery
        
        PID:11120
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11152
        
        C:\Windows\SysWOW64\Kfgpblda.exe
        
        C:\Windows\system32\Kfgpblda.exe
        412⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Koodka32.exe
        
        C:\Windows\system32\Koodka32.exe
        413⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Kgflmo32.exe
        
        C:\Windows\system32\Kgflmo32.exe
        414⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Knpeii32.exe
        
        C:\Windows\system32\Knpeii32.exe
        415⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Koaaaaip.exe
        
        C:\Windows\system32\Koaaaaip.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10396
        
        C:\Windows\SysWOW64\Kflink32.exe
        
        C:\Windows\system32\Kflink32.exe
        417⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Kleajegi.exe
        
        C:\Windows\system32\Kleajegi.exe
        418⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        419⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Lnendhol.exe
        
        C:\Windows\system32\Lnendhol.exe
        420⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Lcbfmomc.exe
        
        C:\Windows\system32\Lcbfmomc.exe
        421⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Lljked32.exe
        
        C:\Windows\system32\Lljked32.exe
        422⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Lcdcbokq.exe
        
        C:\Windows\system32\Lcdcbokq.exe
        423⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Ljnloi32.exe
        
        C:\Windows\system32\Ljnloi32.exe
        424⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        425⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Lnldeg32.exe
        
        C:\Windows\system32\Lnldeg32.exe
        426⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Lcimmn32.exe
        
        C:\Windows\system32\Lcimmn32.exe
        427⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Lnnakg32.exe
        
        C:\Windows\system32\Lnnakg32.exe
        428⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Lckicnei.exe
        
        C:\Windows\system32\Lckicnei.exe
        429⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11204
        
        C:\Windows\SysWOW64\Mmcnlc32.exe
        
        C:\Windows\system32\Mmcnlc32.exe
        431⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Mjgneg32.exe
        
        C:\Windows\system32\Mjgneg32.exe
        432⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Mqafbaap.exe
        
        C:\Windows\system32\Mqafbaap.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Mgkoolil.exe
        
        C:\Windows\system32\Mgkoolil.exe
        434⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Mnegkf32.exe
        
        C:\Windows\system32\Mnegkf32.exe
        435⤵
        Drops file in System32 directory
        
        PID:10620
        
        C:\Windows\SysWOW64\Mgnldkgj.exe
        
        C:\Windows\system32\Mgnldkgj.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10728
        
        C:\Windows\SysWOW64\Mjlhpgfn.exe
        
        C:\Windows\system32\Mjlhpgfn.exe
        437⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Mqfpma32.exe
        
        C:\Windows\system32\Mqfpma32.exe
        438⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Mfchehla.exe
        
        C:\Windows\system32\Mfchehla.exe
        439⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Mqhmbqlh.exe
        
        C:\Windows\system32\Mqhmbqlh.exe
        440⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11236
        
        C:\Windows\SysWOW64\Nfeekgjo.exe
        
        C:\Windows\system32\Nfeekgjo.exe
        441⤵
        Drops file in System32 directory
        
        PID:10380
        
        C:\Windows\SysWOW64\Nmomga32.exe
        
        C:\Windows\system32\Nmomga32.exe
        442⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Ncifdlii.exe
        
        C:\Windows\system32\Ncifdlii.exe
        443⤵
        Modifies registry class
        
        PID:10808
        
        C:\Windows\SysWOW64\Njcnafpe.exe
        
        C:\Windows\system32\Njcnafpe.exe
        444⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Nqmfnp32.exe
        
        C:\Windows\system32\Nqmfnp32.exe
        445⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Nggnjjoo.exe
        
        C:\Windows\system32\Nggnjjoo.exe
        446⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Njekfenc.exe
        
        C:\Windows\system32\Njekfenc.exe
        447⤵
        System Location Discovery: System Language Discovery
        
        PID:11212
        
        C:\Windows\SysWOW64\Nqpccp32.exe
        
        C:\Windows\system32\Nqpccp32.exe
        448⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Nflkkf32.exe
        
        C:\Windows\system32\Nflkkf32.exe
        449⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Nabpiocm.exe
        
        C:\Windows\system32\Nabpiocm.exe
        450⤵
        System Location Discovery: System Language Discovery
        
        PID:11288
        
        C:\Windows\SysWOW64\Ncplekbq.exe
        
        C:\Windows\system32\Ncplekbq.exe
        451⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Nnfpbcbf.exe
        
        C:\Windows\system32\Nnfpbcbf.exe
        452⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Ocbhjjqn.exe
        
        C:\Windows\system32\Ocbhjjqn.exe
        453⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Ojmqgd32.exe
        
        C:\Windows\system32\Ojmqgd32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11416
        
        C:\Windows\SysWOW64\Opiipkfb.exe
        
        C:\Windows\system32\Opiipkfb.exe
        455⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Ofcale32.exe
        
        C:\Windows\system32\Ofcale32.exe
        456⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        457⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Ocgbej32.exe
        
        C:\Windows\system32\Ocgbej32.exe
        458⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Ojajbdde.exe
        
        C:\Windows\system32\Ojajbdde.exe
        459⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Oakbonkb.exe
        
        C:\Windows\system32\Oakbonkb.exe
        460⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        461⤵
        System Location Discovery: System Language Discovery
        
        PID:11640
        
        C:\Windows\SysWOW64\Onochbjl.exe
        
        C:\Windows\system32\Onochbjl.exe
        462⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Oclkqihc.exe
        
        C:\Windows\system32\Oclkqihc.exe
        463⤵
        Drops file in System32 directory
        
        PID:11704
        
        C:\Windows\SysWOW64\Ojfcmc32.exe
        
        C:\Windows\system32\Ojfcmc32.exe
        464⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Pcnhfi32.exe
        
        C:\Windows\system32\Pcnhfi32.exe
        465⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Pjhpccnn.exe
        
        C:\Windows\system32\Pjhpccnn.exe
        466⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Pmgmonma.exe
        
        C:\Windows\system32\Pmgmonma.exe
        467⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Phlqlgmg.exe
        
        C:\Windows\system32\Phlqlgmg.exe
        468⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Pnfiia32.exe
        
        C:\Windows\system32\Pnfiia32.exe
        469⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        470⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        471⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Pmkfjn32.exe
        
        C:\Windows\system32\Pmkfjn32.exe
        472⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Pdenghpi.exe
        
        C:\Windows\system32\Pdenghpi.exe
        473⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Pfdjccol.exe
        
        C:\Windows\system32\Pfdjccol.exe
        474⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Pmnbpm32.exe
        
        C:\Windows\system32\Pmnbpm32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12088
        
        C:\Windows\SysWOW64\Phcgmffo.exe
        
        C:\Windows\system32\Phcgmffo.exe
        476⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Pnmojp32.exe
        
        C:\Windows\system32\Pnmojp32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12152
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        478⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Qoplop32.exe
        
        C:\Windows\system32\Qoplop32.exe
        479⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Qdldgg32.exe
        
        C:\Windows\system32\Qdldgg32.exe
        480⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Qobhepjf.exe
        
        C:\Windows\system32\Qobhepjf.exe
        481⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Adoamfhn.exe
        
        C:\Windows\system32\Adoamfhn.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11316
        
        C:\Windows\SysWOW64\Akiijq32.exe
        
        C:\Windows\system32\Akiijq32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11380
        
        C:\Windows\SysWOW64\Aabafkgh.exe
        
        C:\Windows\system32\Aabafkgh.exe
        484⤵
        System Location Discovery: System Language Discovery
        
        PID:11444
        
        C:\Windows\SysWOW64\Ahmjce32.exe
        
        C:\Windows\system32\Ahmjce32.exe
        485⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Aogbpo32.exe
        
        C:\Windows\system32\Aogbpo32.exe
        486⤵
        System Location Discovery: System Language Discovery
        
        PID:11572
        
        C:\Windows\SysWOW64\Adcjhf32.exe
        
        C:\Windows\system32\Adcjhf32.exe
        487⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Akmbepke.exe
        
        C:\Windows\system32\Akmbepke.exe
        488⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Aagkaj32.exe
        
        C:\Windows\system32\Aagkaj32.exe
        489⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Adfgne32.exe
        
        C:\Windows\system32\Adfgne32.exe
        490⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Agdcja32.exe
        
        C:\Windows\system32\Agdcja32.exe
        491⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Amnlfk32.exe
        
        C:\Windows\system32\Amnlfk32.exe
        492⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Adhdcepc.exe
        
        C:\Windows\system32\Adhdcepc.exe
        493⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Baldmiom.exe
        
        C:\Windows\system32\Baldmiom.exe
        494⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Bhfmic32.exe
        
        C:\Windows\system32\Bhfmic32.exe
        495⤵
        System Location Discovery: System Language Discovery
        
        PID:12144
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        496⤵
        System Location Discovery: System Language Discovery
        
        PID:12212
        
        C:\Windows\SysWOW64\Bpaanfce.exe
        
        C:\Windows\system32\Bpaanfce.exe
        497⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        498⤵
        System Location Discovery: System Language Discovery
        
        PID:11372
        
        C:\Windows\SysWOW64\Bmeagjbo.exe
        
        C:\Windows\system32\Bmeagjbo.exe
        499⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Bdojdd32.exe
        
        C:\Windows\system32\Bdojdd32.exe
        500⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Bgnfpp32.exe
        
        C:\Windows\system32\Bgnfpp32.exe
        501⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Bngnmjql.exe
        
        C:\Windows\system32\Bngnmjql.exe
        502⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Bdagidhi.exe
        
        C:\Windows\system32\Bdagidhi.exe
        503⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Bgpceogl.exe
        
        C:\Windows\system32\Bgpceogl.exe
        504⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Bnjkbi32.exe
        
        C:\Windows\system32\Bnjkbi32.exe
        505⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Bhpopb32.exe
        
        C:\Windows\system32\Bhpopb32.exe
        506⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Cahdhhep.exe
        
        C:\Windows\system32\Cahdhhep.exe
        507⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Chblebll.exe
        
        C:\Windows\system32\Chblebll.exe
        508⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        509⤵
        Drops file in System32 directory
        
        PID:12240
        
        C:\Windows\SysWOW64\Cpmajdig.exe
        
        C:\Windows\system32\Cpmajdig.exe
        510⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Cggifn32.exe
        
        C:\Windows\system32\Cggifn32.exe
        511⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        512⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Cgiflnoa.exe
        
        C:\Windows\system32\Cgiflnoa.exe
        513⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        514⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Chibfa32.exe
        
        C:\Windows\system32\Chibfa32.exe
        515⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Cocjbkna.exe
        
        C:\Windows\system32\Cocjbkna.exe
        516⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Cpdgjc32.exe
        
        C:\Windows\system32\Cpdgjc32.exe
        517⤵
        System Location Discovery: System Language Discovery
        
        PID:12396
        
        C:\Windows\SysWOW64\Dkikglce.exe
        
        C:\Windows\system32\Dkikglce.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12432
        
        C:\Windows\SysWOW64\Dnhgcgbi.exe
        
        C:\Windows\system32\Dnhgcgbi.exe
        519⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Dhnlapbo.exe
        
        C:\Windows\system32\Dhnlapbo.exe
        520⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Dklhmlac.exe
        
        C:\Windows\system32\Dklhmlac.exe
        521⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Dnjdigpf.exe
        
        C:\Windows\system32\Dnjdigpf.exe
        522⤵
        System Location Discovery: System Language Discovery
        
        PID:12564
        
        C:\Windows\SysWOW64\Dddlfa32.exe
        
        C:\Windows\system32\Dddlfa32.exe
        523⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Dnmaog32.exe
        
        C:\Windows\system32\Dnmaog32.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12628
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        525⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Dgeegled.exe
        
        C:\Windows\system32\Dgeegled.exe
        526⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Dolmijef.exe
        
        C:\Windows\system32\Dolmijef.exe
        527⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Dhdaao32.exe
        
        C:\Windows\system32\Dhdaao32.exe
        528⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Dkcnnk32.exe
        
        C:\Windows\system32\Dkcnnk32.exe
        529⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12796
        
        C:\Windows\SysWOW64\Dhgogojd.exe
        
        C:\Windows\system32\Dhgogojd.exe
        530⤵
        Drops file in System32 directory
        
        PID:12828
        
        C:\Windows\SysWOW64\Eoagdi32.exe
        
        C:\Windows\system32\Eoagdi32.exe
        531⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Eqbclagp.exe
        
        C:\Windows\system32\Eqbclagp.exe
        532⤵
        Drops file in System32 directory
        
        PID:12892
        
        C:\Windows\SysWOW64\Eglkhk32.exe
        
        C:\Windows\system32\Eglkhk32.exe
        533⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Edplapnf.exe
        
        C:\Windows\system32\Edplapnf.exe
        534⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Ekjdnj32.exe
        
        C:\Windows\system32\Ekjdnj32.exe
        535⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\Enhpje32.exe
        
        C:\Windows\system32\Enhpje32.exe
        536⤵
        Modifies registry class
        
        PID:13020
        
        C:\Windows\SysWOW64\Ehndhn32.exe
        
        C:\Windows\system32\Ehndhn32.exe
        537⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Ekladi32.exe
        
        C:\Windows\system32\Ekladi32.exe
        538⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Eqiilp32.exe
        
        C:\Windows\system32\Eqiilp32.exe
        539⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Ekoniian.exe
        
        C:\Windows\system32\Ekoniian.exe
        540⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Enmjedpa.exe
        
        C:\Windows\system32\Enmjedpa.exe
        541⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Edgbbo32.exe
        
        C:\Windows\system32\Edgbbo32.exe
        542⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Fomfpg32.exe
        
        C:\Windows\system32\Fomfpg32.exe
        543⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Fqnbgpmb.exe
        
        C:\Windows\system32\Fqnbgpmb.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13280
        
        C:\Windows\SysWOW64\Fiekhm32.exe
        
        C:\Windows\system32\Fiekhm32.exe
        545⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Fqpomo32.exe
        
        C:\Windows\system32\Fqpomo32.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12356
        
        C:\Windows\SysWOW64\Fkfcjh32.exe
        
        C:\Windows\system32\Fkfcjh32.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12416
        
        C:\Windows\SysWOW64\Fbplgbbb.exe
        
        C:\Windows\system32\Fbplgbbb.exe
        548⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\Fijdcljo.exe
        
        C:\Windows\system32\Fijdcljo.exe
        549⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Fnfmlchf.exe
        
        C:\Windows\system32\Fnfmlchf.exe
        550⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Faeihogj.exe
        
        C:\Windows\system32\Faeihogj.exe
        551⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Fgoadi32.exe
        
        C:\Windows\system32\Fgoadi32.exe
        552⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12748
        
        C:\Windows\SysWOW64\Fbdeba32.exe
        
        C:\Windows\system32\Fbdeba32.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12816
        
        C:\Windows\SysWOW64\Ginnokej.exe
        
        C:\Windows\system32\Ginnokej.exe
        554⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Gnkfgb32.exe
        
        C:\Windows\system32\Gnkfgb32.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12932
        
        C:\Windows\SysWOW64\Geenclkn.exe
        
        C:\Windows\system32\Geenclkn.exe
        556⤵
        Drops file in System32 directory
        
        PID:12996
        
        C:\Windows\SysWOW64\Gkofpf32.exe
        
        C:\Windows\system32\Gkofpf32.exe
        557⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Gbiomqjh.exe
        
        C:\Windows\system32\Gbiomqjh.exe
        558⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Ggfgegho.exe
        
        C:\Windows\system32\Ggfgegho.exe
        559⤵
        Drops file in System32 directory
        
        PID:13220
        
        C:\Windows\SysWOW64\Gnppbapl.exe
        
        C:\Windows\system32\Gnppbapl.exe
        560⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Giecojpb.exe
        
        C:\Windows\system32\Giecojpb.exe
        561⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Gldpkfoe.exe
        
        C:\Windows\system32\Gldpkfoe.exe
        562⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Gbnhhp32.exe
        
        C:\Windows\system32\Gbnhhp32.exe
        563⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Ggjqqg32.exe
        
        C:\Windows\system32\Ggjqqg32.exe
        564⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Haceil32.exe
        
        C:\Windows\system32\Haceil32.exe
        565⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Hhmmffbg.exe
        
        C:\Windows\system32\Hhmmffbg.exe
        566⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Hbbacobm.exe
        
        C:\Windows\system32\Hbbacobm.exe
        567⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Heqnokaq.exe
        
        C:\Windows\system32\Heqnokaq.exe
        568⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Hpfbmcaf.exe
        
        C:\Windows\system32\Hpfbmcaf.exe
        569⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Hagodlge.exe
        
        C:\Windows\system32\Hagodlge.exe
        570⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Hiofeigg.exe
        
        C:\Windows\system32\Hiofeigg.exe
        571⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Hpiobc32.exe
        
        C:\Windows\system32\Hpiobc32.exe
        572⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Heegjj32.exe
        
        C:\Windows\system32\Heegjj32.exe
        573⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Hhdcfe32.exe
        
        C:\Windows\system32\Hhdcfe32.exe
        574⤵
        System Location Discovery: System Language Discovery
        
        PID:13308
        
        C:\Windows\SysWOW64\Halhpkbp.exe
        
        C:\Windows\system32\Halhpkbp.exe
        575⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Hhfplejl.exe
        
        C:\Windows\system32\Hhfplejl.exe
        576⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Iaodek32.exe
        
        C:\Windows\system32\Iaodek32.exe
        577⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Iifmfh32.exe
        
        C:\Windows\system32\Iifmfh32.exe
        578⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Iobeno32.exe
        
        C:\Windows\system32\Iobeno32.exe
        579⤵
        Modifies registry class
        
        PID:2640
        
        C:\Windows\SysWOW64\Ihkigd32.exe
        
        C:\Windows\system32\Ihkigd32.exe
        580⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Ioebdomd.exe
        
        C:\Windows\system32\Ioebdomd.exe
        581⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Ieojqi32.exe
        
        C:\Windows\system32\Ieojqi32.exe
        582⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Ilibmcln.exe
        
        C:\Windows\system32\Ilibmcln.exe
        583⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Iogoinka.exe
        
        C:\Windows\system32\Iogoinka.exe
        584⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Windows\SysWOW64\Iimcgg32.exe
        
        C:\Windows\system32\Iimcgg32.exe
        585⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Ipgkcabd.exe
        
        C:\Windows\system32\Ipgkcabd.exe
        586⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Iahgki32.exe
        
        C:\Windows\system32\Iahgki32.exe
        587⤵
        Drops file in System32 directory
        
        PID:2816
        
        C:\Windows\SysWOW64\Iioplg32.exe
        
        C:\Windows\system32\Iioplg32.exe
        588⤵
        Drops file in System32 directory
        
        PID:1544
        
        C:\Windows\SysWOW64\Iolhdn32.exe
        
        C:\Windows\system32\Iolhdn32.exe
        589⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Jefpahoi.exe
        
        C:\Windows\system32\Jefpahoi.exe
        590⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Jlphnbfe.exe
        
        C:\Windows\system32\Jlphnbfe.exe
        591⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Jbjqkl32.exe
        
        C:\Windows\system32\Jbjqkl32.exe
        592⤵
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Jidigfeo.exe
        
        C:\Windows\system32\Jidigfeo.exe
        593⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Jbojfkjm.exe
        
        C:\Windows\system32\Jbojfkjm.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12508
        
        C:\Windows\SysWOW64\Jhkbnbhd.exe
        
        C:\Windows\system32\Jhkbnbhd.exe
        595⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jpbjophf.exe
        
        C:\Windows\system32\Jpbjophf.exe
        596⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Jikohe32.exe
        
        C:\Windows\system32\Jikohe32.exe
        597⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Koggqlmo.exe
        
        C:\Windows\system32\Koggqlmo.exe
        598⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Kafcmglb.exe
        
        C:\Windows\system32\Kafcmglb.exe
        599⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Khplia32.exe
        
        C:\Windows\system32\Khplia32.exe
        600⤵
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Kojdflkl.exe
        
        C:\Windows\system32\Kojdflkl.exe
        601⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Kahqbgjp.exe
        
        C:\Windows\system32\Kahqbgjp.exe
        602⤵
        System Location Discovery: System Language Discovery
        
        PID:908
        
        C:\Windows\SysWOW64\Klndopje.exe
        
        C:\Windows\system32\Klndopje.exe
        603⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Kchmljab.exe
        
        C:\Windows\system32\Kchmljab.exe
        604⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Khdedapj.exe
        
        C:\Windows\system32\Khdedapj.exe
        605⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Kamjmf32.exe
        
        C:\Windows\system32\Kamjmf32.exe
        606⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Klbnjo32.exe
        
        C:\Windows\system32\Klbnjo32.exe
        607⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Kcmfgimm.exe
        
        C:\Windows\system32\Kcmfgimm.exe
        608⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Kifodcej.exe
        
        C:\Windows\system32\Kifodcej.exe
        609⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Lpqgqn32.exe
        
        C:\Windows\system32\Lpqgqn32.exe
        610⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Laachfbe.exe
        
        C:\Windows\system32\Laachfbe.exe
        611⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Lhlkep32.exe
        
        C:\Windows\system32\Lhlkep32.exe
        612⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4120
        
        C:\Windows\SysWOW64\Lcapbi32.exe
        
        C:\Windows\system32\Lcapbi32.exe
        613⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Lafmce32.exe
        
        C:\Windows\system32\Lafmce32.exe
        614⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Lpgmamfo.exe
        
        C:\Windows\system32\Lpgmamfo.exe
        615⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Lhbafo32.exe
        
        C:\Windows\system32\Lhbafo32.exe
        616⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Lfgboc32.exe
        
        C:\Windows\system32\Lfgboc32.exe
        617⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\Lhenko32.exe
        
        C:\Windows\system32\Lhenko32.exe
        618⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3164
        
        C:\Windows\SysWOW64\Mckbhg32.exe
        
        C:\Windows\system32\Mckbhg32.exe
        619⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Mjdkeaij.exe
        
        C:\Windows\system32\Mjdkeaij.exe
        620⤵
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Windows\SysWOW64\Moacnh32.exe
        
        C:\Windows\system32\Moacnh32.exe
        621⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Mfkkjbnn.exe
        
        C:\Windows\system32\Mfkkjbnn.exe
        622⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Mledgm32.exe
        
        C:\Windows\system32\Mledgm32.exe
        623⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Mbbloc32.exe
        
        C:\Windows\system32\Mbbloc32.exe
        624⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mhldlnko.exe
        
        C:\Windows\system32\Mhldlnko.exe
        625⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Mqclmk32.exe
        
        C:\Windows\system32\Mqclmk32.exe
        626⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Mbdiecbp.exe
        
        C:\Windows\system32\Mbdiecbp.exe
        627⤵
        
        PID:588
        
        C:\Windows\SysWOW64\Mhnaam32.exe
        
        C:\Windows\system32\Mhnaam32.exe
        628⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Mohingqi.exe
        
        C:\Windows\system32\Mohingqi.exe
        629⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Mfbaka32.exe
        
        C:\Windows\system32\Mfbaka32.exe
        630⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\Nlljglpc.exe
        
        C:\Windows\system32\Nlljglpc.exe
        631⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Ncfbdfgp.exe
        
        C:\Windows\system32\Ncfbdfgp.exe
        632⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Nhckmmeg.exe
        
        C:\Windows\system32\Nhckmmeg.exe
        633⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Nomcig32.exe
        
        C:\Windows\system32\Nomcig32.exe
        634⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Nmacbk32.exe
        
        C:\Windows\system32\Nmacbk32.exe
        635⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Nqolii32.exe
        
        C:\Windows\system32\Nqolii32.exe
        636⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\Njgqaohd.exe
        
        C:\Windows\system32\Njgqaohd.exe
        637⤵
        
        PID:13596
        
        C:\Windows\SysWOW64\Nodijffl.exe
        
        C:\Windows\system32\Nodijffl.exe
        638⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13636
        
        C:\Windows\SysWOW64\Nfnafpni.exe
        
        C:\Windows\system32\Nfnafpni.exe
        639⤵
        Modifies registry class
        
        PID:13676
        
        C:\Windows\SysWOW64\Omhicj32.exe
        
        C:\Windows\system32\Omhicj32.exe
        640⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Ocbapdmb.exe
        
        C:\Windows\system32\Ocbapdmb.exe
        641⤵
        System Location Discovery: System Language Discovery
        
        PID:13740
        
        C:\Windows\SysWOW64\Ofqnlplf.exe
        
        C:\Windows\system32\Ofqnlplf.exe
        642⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\Oqfbihll.exe
        
        C:\Windows\system32\Oqfbihll.exe
        643⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\Ocdnedkp.exe
        
        C:\Windows\system32\Ocdnedkp.exe
        644⤵
        Drops file in System32 directory
        
        PID:13836
        
        C:\Windows\SysWOW64\Oiagnk32.exe
        
        C:\Windows\system32\Oiagnk32.exe
        645⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13876
        
        C:\Windows\SysWOW64\Ookokeqd.exe
        
        C:\Windows\system32\Ookokeqd.exe
        646⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Obikgppg.exe
        
        C:\Windows\system32\Obikgppg.exe
        647⤵
        
        PID:13948
        
        C:\Windows\SysWOW64\Oicccj32.exe
        
        C:\Windows\system32\Oicccj32.exe
        648⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\Opnlpdoa.exe
        
        C:\Windows\system32\Opnlpdoa.exe
        649⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\Oblhlpne.exe
        
        C:\Windows\system32\Oblhlpne.exe
        650⤵
        System Location Discovery: System Language Discovery
        
        PID:14052
        
        C:\Windows\SysWOW64\Omalii32.exe
        
        C:\Windows\system32\Omalii32.exe
        651⤵
        
        PID:14096
        
        C:\Windows\SysWOW64\Ockdfceh.exe
        
        C:\Windows\system32\Ockdfceh.exe
        652⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\Pjemcm32.exe
        
        C:\Windows\system32\Pjemcm32.exe
        653⤵
        
        PID:14168
        
        C:\Windows\SysWOW64\Pqoepgca.exe
        
        C:\Windows\system32\Pqoepgca.exe
        654⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Pbqago32.exe
        
        C:\Windows\system32\Pbqago32.exe
        655⤵
        
        PID:14232
        
        C:\Windows\SysWOW64\Pijjdial.exe
        
        C:\Windows\system32\Pijjdial.exe
        656⤵
        
        PID:14276
        
        C:\Windows\SysWOW64\Ppdbqchi.exe
        
        C:\Windows\system32\Ppdbqchi.exe
        657⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Pimfji32.exe
        
        C:\Windows\system32\Pimfji32.exe
        658⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Pcbkgb32.exe
        
        C:\Windows\system32\Pcbkgb32.exe
        659⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Pfagcm32.exe
        
        C:\Windows\system32\Pfagcm32.exe
        660⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Pmkopgep.exe
        
        C:\Windows\system32\Pmkopgep.exe
        661⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2648
        
        C:\Windows\SysWOW64\Pceglamm.exe
        
        C:\Windows\system32\Pceglamm.exe
        662⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\Pfcchmlq.exe
        
        C:\Windows\system32\Pfcchmlq.exe
        663⤵
        
        PID:13624
        
        C:\Windows\SysWOW64\Pmmleg32.exe
        
        C:\Windows\system32\Pmmleg32.exe
        664⤵
        
        PID:272
        
        C:\Windows\SysWOW64\Pplhab32.exe
        
        C:\Windows\system32\Pplhab32.exe
        665⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\Qfepnmjn.exe
        
        C:\Windows\system32\Qfepnmjn.exe
        666⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Qmphkg32.exe
        
        C:\Windows\system32\Qmphkg32.exe
        667⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13844
        
        C:\Windows\SysWOW64\Qciqga32.exe
        
        C:\Windows\system32\Qciqga32.exe
        668⤵
        
        PID:13896
        
        C:\Windows\SysWOW64\Qjcidkpd.exe
        
        C:\Windows\system32\Qjcidkpd.exe
        669⤵
        Modifies registry class
        
        PID:13940
        
        C:\Windows\SysWOW64\Qamaae32.exe
        
        C:\Windows\system32\Qamaae32.exe
        670⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Abonimmp.exe
        
        C:\Windows\system32\Abonimmp.exe
        671⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Ajfejknb.exe
        
        C:\Windows\system32\Ajfejknb.exe
        672⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\Apbnbali.exe
        
        C:\Windows\system32\Apbnbali.exe
        673⤵
        
        PID:14152
        
        C:\Windows\SysWOW64\Ajhboj32.exe
        
        C:\Windows\system32\Ajhboj32.exe
        674⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\Aabkldcl.exe
        
        C:\Windows\system32\Aabkldcl.exe
        675⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\Abcgdm32.exe
        
        C:\Windows\system32\Abcgdm32.exe
        676⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\Amikae32.exe
        
        C:\Windows\system32\Amikae32.exe
        677⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Adccnpqm.exe
        
        C:\Windows\system32\Adccnpqm.exe
        678⤵
        Drops file in System32 directory
        
        PID:13368
        
        C:\Windows\SysWOW64\Ajmljjhj.exe
        
        C:\Windows\system32\Ajmljjhj.exe
        679⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\Apjdbqfa.exe
        
        C:\Windows\system32\Apjdbqfa.exe
        680⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Ajohpifg.exe
        
        C:\Windows\system32\Ajohpifg.exe
        681⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Bjaeei32.exe
        
        C:\Windows\system32\Bjaeei32.exe
        682⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Bakmbcka.exe
        
        C:\Windows\system32\Bakmbcka.exe
        683⤵
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Bbmjjk32.exe
        
        C:\Windows\system32\Bbmjjk32.exe
        684⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13972
        
        C:\Windows\SysWOW64\Bmbngd32.exe
        
        C:\Windows\system32\Bmbngd32.exe
        685⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Bdlfdnhb.exe
        
        C:\Windows\system32\Bdlfdnhb.exe
        686⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Bjfoqhpo.exe
        
        C:\Windows\system32\Bjfoqhpo.exe
        687⤵
        
        PID:14156
        
        C:\Windows\SysWOW64\Bapgmb32.exe
        
        C:\Windows\system32\Bapgmb32.exe
        688⤵
        Drops file in System32 directory
        
        PID:14228
        
        C:\Windows\SysWOW64\Bbacekmj.exe
        
        C:\Windows\system32\Bbacekmj.exe
        689⤵
        Modifies registry class
        
        PID:14296
        
        C:\Windows\SysWOW64\Bkhkfhnl.exe
        
        C:\Windows\system32\Bkhkfhnl.exe
        690⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Babccb32.exe
        
        C:\Windows\system32\Babccb32.exe
        691⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Bfolki32.exe
        
        C:\Windows\system32\Bfolki32.exe
        692⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Bmidhc32.exe
        
        C:\Windows\system32\Bmidhc32.exe
        693⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Cdcldmbj.exe
        
        C:\Windows\system32\Cdcldmbj.exe
        694⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
        
        C:\Windows\SysWOW64\Cipemdqa.exe
        
        C:\Windows\system32\Cipemdqa.exe
        695⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Cpjmjn32.exe
        
        C:\Windows\system32\Cpjmjn32.exe
        696⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\Cbhifj32.exe
        
        C:\Windows\system32\Cbhifj32.exe
        697⤵
        Modifies registry class
        
        PID:13560
        
        C:\Windows\SysWOW64\Cibabdno.exe
        
        C:\Windows\system32\Cibabdno.exe
        698⤵
        Modifies registry class
        
        PID:1724
        
        C:\Windows\SysWOW64\Cpljonfl.exe
        
        C:\Windows\system32\Cpljonfl.exe
        699⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Cgfblh32.exe
        
        C:\Windows\system32\Cgfblh32.exe
        700⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Cmpjhbee.exe
        
        C:\Windows\system32\Cmpjhbee.exe
        701⤵
        
        PID:13864
        
        C:\Windows\SysWOW64\Cdjbel32.exe
        
        C:\Windows\system32\Cdjbel32.exe
        702⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Cigknc32.exe
        
        C:\Windows\system32\Cigknc32.exe
        703⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Cdmokljp.exe
        
        C:\Windows\system32\Cdmokljp.exe
        704⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Caqpdpii.exe
        
        C:\Windows\system32\Caqpdpii.exe
        705⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:13408
        
        C:\Windows\SysWOW64\Dcbllh32.exe
        
        C:\Windows\system32\Dcbllh32.exe
        706⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Dildibfd.exe
        
        C:\Windows\system32\Dildibfd.exe
        707⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Dacmjpgf.exe
        
        C:\Windows\system32\Dacmjpgf.exe
        708⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\Dgpebf32.exe
        
        C:\Windows\system32\Dgpebf32.exe
        709⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Dinanb32.exe
        
        C:\Windows\system32\Dinanb32.exe
        710⤵
        System Location Discovery: System Language Discovery
        
        PID:13700
        
        C:\Windows\SysWOW64\Ddcekk32.exe
        
        C:\Windows\system32\Ddcekk32.exe
        711⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\Dgbagf32.exe
        
        C:\Windows\system32\Dgbagf32.exe
        712⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Dnljdqkh.exe
        
        C:\Windows\system32\Dnljdqkh.exe
        713⤵
        
        PID:14040
        
        C:\Windows\SysWOW64\Dpjfqljl.exe
        
        C:\Windows\system32\Dpjfqljl.exe
        714⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13996
        
        C:\Windows\SysWOW64\Dgdnmfai.exe
        
        C:\Windows\system32\Dgdnmfai.exe
        715⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\Djckiapl.exe
        
        C:\Windows\system32\Djckiapl.exe
        716⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Ddhofjpb.exe
        
        C:\Windows\system32\Ddhofjpb.exe
        717⤵
        
        PID:14192
        
        C:\Windows\SysWOW64\Dggkbeof.exe
        
        C:\Windows\system32\Dggkbeof.exe
        718⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Dnqcop32.exe
        
        C:\Windows\system32\Dnqcop32.exe
        719⤵
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Edklljnp.exe
        
        C:\Windows\system32\Edklljnp.exe
        720⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Ejgddq32.exe
        
        C:\Windows\system32\Ejgddq32.exe
        721⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Ecphmfbg.exe
        
        C:\Windows\system32\Ecphmfbg.exe
        722⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Enemjobn.exe
        
        C:\Windows\system32\Enemjobn.exe
        723⤵
        System Location Discovery: System Language Discovery
        
        PID:13660
        
        C:\Windows\SysWOW64\Ecbecfqe.exe
        
        C:\Windows\system32\Ecbecfqe.exe
        724⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:13668
        
        C:\Windows\SysWOW64\Ekimdc32.exe
        
        C:\Windows\system32\Ekimdc32.exe
        725⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\Epfflj32.exe
        
        C:\Windows\system32\Epfflj32.exe
        726⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ecgone32.exe
        
        C:\Windows\system32\Ecgone32.exe
        727⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ejagkodl.exe
        
        C:\Windows\system32\Ejagkodl.exe
        728⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Fqkogiki.exe
        
        C:\Windows\system32\Fqkogiki.exe
        729⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Fjccpo32.exe
        
        C:\Windows\system32\Fjccpo32.exe
        730⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Fqmlmiif.exe
        
        C:\Windows\system32\Fqmlmiif.exe
        731⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\Fjepfo32.exe
        
        C:\Windows\system32\Fjepfo32.exe
        732⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Fqphbi32.exe
        
        C:\Windows\system32\Fqphbi32.exe
        733⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Fgiqocoq.exe
        
        C:\Windows\system32\Fgiqocoq.exe
        734⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Fboellof.exe
        
        C:\Windows\system32\Fboellof.exe
        735⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3488
        
        C:\Windows\SysWOW64\Fdmahgnj.exe
        
        C:\Windows\system32\Fdmahgnj.exe
        736⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Fjjjanla.exe
        
        C:\Windows\system32\Fjjjanla.exe
        737⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\Fqdbnhco.exe
        
        C:\Windows\system32\Fqdbnhco.exe
        738⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Fgnjjb32.exe
        
        C:\Windows\system32\Fgnjjb32.exe
        739⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:632
        
        C:\Windows\SysWOW64\Gbcngk32.exe
        
        C:\Windows\system32\Gbcngk32.exe
        740⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Gcekocqp.exe
        
        C:\Windows\system32\Gcekocqp.exe
        741⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Gjoclm32.exe
        
        C:\Windows\system32\Gjoclm32.exe
        742⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Gqikigoi.exe
        
        C:\Windows\system32\Gqikigoi.exe
        743⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Gknpfp32.exe
        
        C:\Windows\system32\Gknpfp32.exe
        744⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Gnmlbl32.exe
        
        C:\Windows\system32\Gnmlbl32.exe
        745⤵
        Modifies registry class
        
        PID:2848
        
        C:\Windows\SysWOW64\Gcjdjb32.exe
        
        C:\Windows\system32\Gcjdjb32.exe
        746⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Gjcmgmdg.exe
        
        C:\Windows\system32\Gjcmgmdg.exe
        747⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Gcnnebhe.exe
        
        C:\Windows\system32\Gcnnebhe.exe
        748⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
        
        C:\Windows\SysWOW64\Hbonci32.exe
        
        C:\Windows\system32\Hbonci32.exe
        749⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Hcqjkafb.exe
        
        C:\Windows\system32\Hcqjkafb.exe
        750⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\Hkhblo32.exe
        
        C:\Windows\system32\Hkhblo32.exe
        751⤵
        Drops file in System32 directory
        
        PID:6868
        
        C:\Windows\SysWOW64\Hadkdf32.exe
        
        C:\Windows\system32\Hadkdf32.exe
        752⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Hkjoao32.exe
        
        C:\Windows\system32\Hkjoao32.exe
        753⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\Haghje32.exe
        
        C:\Windows\system32\Haghje32.exe
        754⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\Hcedfa32.exe
        
        C:\Windows\system32\Hcedfa32.exe
        755⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hjolck32.exe
        
        C:\Windows\system32\Hjolck32.exe
        756⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Haidpeaf.exe
        
        C:\Windows\system32\Haidpeaf.exe
        757⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Hgcmlo32.exe
        
        C:\Windows\system32\Hgcmlo32.exe
        758⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Hnmeiipp.exe
        
        C:\Windows\system32\Hnmeiipp.exe
        759⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Hcjmapng.exe
        
        C:\Windows\system32\Hcjmapng.exe
        760⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Ijdenj32.exe
        
        C:\Windows\system32\Ijdenj32.exe
        761⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ibknohff.exe
        
        C:\Windows\system32\Ibknohff.exe
        762⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Icljgp32.exe
        
        C:\Windows\system32\Icljgp32.exe
        763⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ilcbhm32.exe
        
        C:\Windows\system32\Ilcbhm32.exe
        764⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Iapjpd32.exe
        
        C:\Windows\system32\Iapjpd32.exe
        765⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Igjbmnbk.exe
        
        C:\Windows\system32\Igjbmnbk.exe
        766⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Ibpgjg32.exe
        
        C:\Windows\system32\Ibpgjg32.exe
        767⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Icacbohp.exe
        
        C:\Windows\system32\Icacbohp.exe
        768⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Iagqac32.exe
        
        C:\Windows\system32\Iagqac32.exe
        769⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Idfmmo32.exe
        
        C:\Windows\system32\Idfmmo32.exe
        770⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
        
        C:\Windows\SysWOW64\Jjpejikg.exe
        
        C:\Windows\system32\Jjpejikg.exe
        771⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6760
        
        C:\Windows\SysWOW64\Jbgmkfli.exe
        
        C:\Windows\system32\Jbgmkfli.exe
        772⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Jdhibn32.exe
        
        C:\Windows\system32\Jdhibn32.exe
        773⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Jnnnpg32.exe
        
        C:\Windows\system32\Jnnnpg32.exe
        774⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Jegfla32.exe
        
        C:\Windows\system32\Jegfla32.exe
        775⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Jhfbim32.exe
        
        C:\Windows\system32\Jhfbim32.exe
        776⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Jjdoeh32.exe
        
        C:\Windows\system32\Jjdoeh32.exe
        777⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Jbkffe32.exe
        
        C:\Windows\system32\Jbkffe32.exe
        778⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Jhhonl32.exe
        
        C:\Windows\system32\Jhhonl32.exe
        779⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Jjgkjh32.exe
        
        C:\Windows\system32\Jjgkjh32.exe
        780⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jaqcgbml.exe
        
        C:\Windows\system32\Jaqcgbml.exe
        781⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Jhklcldi.exe
        
        C:\Windows\system32\Jhklcldi.exe
        782⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Joddqf32.exe
        
        C:\Windows\system32\Joddqf32.exe
        783⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Jeolmpcb.exe
        
        C:\Windows\system32\Jeolmpcb.exe
        784⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Kogqff32.exe
        
        C:\Windows\system32\Kogqff32.exe
        785⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Kaemba32.exe
        
        C:\Windows\system32\Kaemba32.exe
        786⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Khoeok32.exe
        
        C:\Windows\system32\Khoeok32.exe
        787⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Koimkegp.exe
        
        C:\Windows\system32\Koimkegp.exe
        788⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Kecehp32.exe
        
        C:\Windows\system32\Kecehp32.exe
        789⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Khabdk32.exe
        
        C:\Windows\system32\Khabdk32.exe
        790⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Kkpnqf32.exe
        
        C:\Windows\system32\Kkpnqf32.exe
        791⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Kdhbilde.exe
        
        C:\Windows\system32\Kdhbilde.exe
        792⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Kalccp32.exe
        
        C:\Windows\system32\Kalccp32.exe
        793⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Kkeglfio.exe
        
        C:\Windows\system32\Kkeglfio.exe
        794⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Kblomcja.exe
        
        C:\Windows\system32\Kblomcja.exe
        795⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Lejlioie.exe
        
        C:\Windows\system32\Lejlioie.exe
        796⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Llddei32.exe
        
        C:\Windows\system32\Llddei32.exe
        797⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Lobpadoe.exe
        
        C:\Windows\system32\Lobpadoe.exe
        798⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Lhkdkj32.exe
        
        C:\Windows\system32\Lhkdkj32.exe
        799⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Loemgdmc.exe
        
        C:\Windows\system32\Loemgdmc.exe
        800⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Leoedn32.exe
        
        C:\Windows\system32\Leoedn32.exe
        801⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Llimqhll.exe
        
        C:\Windows\system32\Llimqhll.exe
        802⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Laffio32.exe
        
        C:\Windows\system32\Laffio32.exe
        803⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Lddbej32.exe
        
        C:\Windows\system32\Lddbej32.exe
        804⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Lknjbdad.exe
        
        C:\Windows\system32\Lknjbdad.exe
        805⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Lahboo32.exe
        
        C:\Windows\system32\Lahboo32.exe
        806⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Lhbkkipn.exe
        
        C:\Windows\system32\Lhbkkipn.exe
        807⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Lkqggdoa.exe
        
        C:\Windows\system32\Lkqggdoa.exe
        808⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Lajodnfo.exe
        
        C:\Windows\system32\Lajodnfo.exe
        809⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Mdikpjeb.exe
        
        C:\Windows\system32\Mdikpjeb.exe
        810⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Mkccmd32.exe
        
        C:\Windows\system32\Mkccmd32.exe
        811⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Mamljndl.exe
        
        C:\Windows\system32\Mamljndl.exe
        812⤵
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Mhgdfh32.exe
        
        C:\Windows\system32\Mhgdfh32.exe
        813⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Moqlcbce.exe
        
        C:\Windows\system32\Moqlcbce.exe
        814⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Maoionbi.exe
        
        C:\Windows\system32\Maoionbi.exe
        815⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Mldmlf32.exe
        
        C:\Windows\system32\Mldmlf32.exe
        816⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Meonklfm.exe
        
        C:\Windows\system32\Meonklfm.exe
        817⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Mlifgfnj.exe
        
        C:\Windows\system32\Mlifgfnj.exe
        818⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Mohbcamn.exe
        
        C:\Windows\system32\Mohbcamn.exe
        819⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Nafopmla.exe
        
        C:\Windows\system32\Nafopmla.exe
        820⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Nhpgmg32.exe
        
        C:\Windows\system32\Nhpgmg32.exe
        821⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Nojoiakk.exe
        
        C:\Windows\system32\Nojoiakk.exe
        822⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Nedgfk32.exe
        
        C:\Windows\system32\Nedgfk32.exe
        823⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Windows\SysWOW64\Nlnpbe32.exe
        
        C:\Windows\system32\Nlnpbe32.exe
        824⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Nchhooaa.exe
        
        C:\Windows\system32\Nchhooaa.exe
        825⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Nhephfpi.exe
        
        C:\Windows\system32\Nhephfpi.exe
        826⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Ncjdeooo.exe
        
        C:\Windows\system32\Ncjdeooo.exe
        827⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ndlamg32.exe
        
        C:\Windows\system32\Ndlamg32.exe
        828⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Nkeiia32.exe
        
        C:\Windows\system32\Nkeiia32.exe
        829⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Nbpafkdf.exe
        
        C:\Windows\system32\Nbpafkdf.exe
        830⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Nhijce32.exe
        
        C:\Windows\system32\Nhijce32.exe
        831⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Oconpn32.exe
        
        C:\Windows\system32\Oconpn32.exe
        832⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Ofmjlj32.exe
        
        C:\Windows\system32\Ofmjlj32.exe
        833⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Olgbidbj.exe
        
        C:\Windows\system32\Olgbidbj.exe
        834⤵
        Modifies registry class
        
        PID:7256
        
        C:\Windows\SysWOW64\Ofpgaihj.exe
        
        C:\Windows\system32\Ofpgaihj.exe
        835⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Windows\SysWOW64\Oljonc32.exe
        
        C:\Windows\system32\Oljonc32.exe
        836⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Occgkngd.exe
        
        C:\Windows\system32\Occgkngd.exe
        837⤵
        System Location Discovery: System Language Discovery
        
        PID:8312
        
        C:\Windows\SysWOW64\Odedcf32.exe
        
        C:\Windows\system32\Odedcf32.exe
        838⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Oojhpo32.exe
        
        C:\Windows\system32\Oojhpo32.exe
        839⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Obidljll.exe
        
        C:\Windows\system32\Obidljll.exe
        840⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Ohcmid32.exe
        
        C:\Windows\system32\Ohcmid32.exe
        841⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Okaiep32.exe
        
        C:\Windows\system32\Okaiep32.exe
        842⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ofgmbh32.exe
        
        C:\Windows\system32\Ofgmbh32.exe
        843⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Oheiod32.exe
        
        C:\Windows\system32\Oheiod32.exe
        844⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Pooaknic.exe
        
        C:\Windows\system32\Pooaknic.exe
        845⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Pbnngi32.exe
        
        C:\Windows\system32\Pbnngi32.exe
        846⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Pigfdcoc.exe
        
        C:\Windows\system32\Pigfdcoc.exe
        847⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Pkfbpoog.exe
        
        C:\Windows\system32\Pkfbpoog.exe
        848⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Pbpjmi32.exe
        
        C:\Windows\system32\Pbpjmi32.exe
        849⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Pijcjcmq.exe
        
        C:\Windows\system32\Pijcjcmq.exe
        850⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Podkfm32.exe
        
        C:\Windows\system32\Podkfm32.exe
        851⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Pfnccg32.exe
        
        C:\Windows\system32\Pfnccg32.exe
        852⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Pkklkn32.exe
        
        C:\Windows\system32\Pkklkn32.exe
        853⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9020
        
        C:\Windows\SysWOW64\Pcacll32.exe
        
        C:\Windows\system32\Pcacll32.exe
        854⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Pioleb32.exe
        
        C:\Windows\system32\Pioleb32.exe
        855⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Pohdamqh.exe
        
        C:\Windows\system32\Pohdamqh.exe
        856⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Peemjcop.exe
        
        C:\Windows\system32\Peemjcop.exe
        857⤵
        
        PID:14344
        
        C:\Windows\SysWOW64\Pmlekq32.exe
        
        C:\Windows\system32\Pmlekq32.exe
        858⤵
        
        PID:14380
        
        C:\Windows\SysWOW64\Qcfmgkgo.exe
        
        C:\Windows\system32\Qcfmgkgo.exe
        859⤵
        
        PID:14412
        
        C:\Windows\SysWOW64\Qfeicffb.exe
        
        C:\Windows\system32\Qfeicffb.exe
        860⤵
        
        PID:14444
        
        C:\Windows\SysWOW64\Qmoapq32.exe
        
        C:\Windows\system32\Qmoapq32.exe
        861⤵
        
        PID:14524
        
        C:\Windows\SysWOW64\Qfgfifdp.exe
        
        C:\Windows\system32\Qfgfifdp.exe
        862⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\Amanfpkl.exe
        
        C:\Windows\system32\Amanfpkl.exe
        863⤵
        
        PID:14684
        
        C:\Windows\SysWOW64\Ackfbj32.exe
        
        C:\Windows\system32\Ackfbj32.exe
        864⤵
        
        PID:14716
        
        C:\Windows\SysWOW64\Aficoe32.exe
        
        C:\Windows\system32\Aficoe32.exe
        865⤵
        
        PID:14756
        
        C:\Windows\SysWOW64\Apbghkhn.exe
        
        C:\Windows\system32\Apbghkhn.exe
        866⤵
        
        PID:14812
        
        C:\Windows\SysWOW64\Aflpde32.exe
        
        C:\Windows\system32\Aflpde32.exe
        867⤵
        
        PID:14852
        
        C:\Windows\SysWOW64\Amfhao32.exe
        
        C:\Windows\system32\Amfhao32.exe
        868⤵
        
        PID:14888
        
        C:\Windows\SysWOW64\Acppniod.exe
        
        C:\Windows\system32\Acppniod.exe
        869⤵
        
        PID:14920
        
        C:\Windows\SysWOW64\Aealea32.exe
        
        C:\Windows\system32\Aealea32.exe
        870⤵
        
        PID:14952
        
        C:\Windows\SysWOW64\Apfqbj32.exe
        
        C:\Windows\system32\Apfqbj32.exe
        871⤵
        
        PID:14992
        
        C:\Windows\SysWOW64\Afqipdle.exe
        
        C:\Windows\system32\Afqipdle.exe
        872⤵
        
        PID:15024
        
        C:\Windows\SysWOW64\Aioelpki.exe
        
        C:\Windows\system32\Aioelpki.exe
        873⤵
        
        PID:15060
        
        C:\Windows\SysWOW64\Apimhjbe.exe
        
        C:\Windows\system32\Apimhjbe.exe
        874⤵
        
        PID:15096
        
        C:\Windows\SysWOW64\Afceed32.exe
        
        C:\Windows\system32\Afceed32.exe
        875⤵
        
        PID:15132
        
        C:\Windows\SysWOW64\Bmmnanao.exe
        
        C:\Windows\system32\Bmmnanao.exe
        876⤵
        Modifies registry class
        
        PID:15168
        
        C:\Windows\SysWOW64\Bcgfnh32.exe
        
        C:\Windows\system32\Bcgfnh32.exe
        877⤵
        System Location Discovery: System Language Discovery
        
        PID:15204
        
        C:\Windows\SysWOW64\Behbfqoj.exe
        
        C:\Windows\system32\Behbfqoj.exe
        878⤵
        
        PID:15240
        
        C:\Windows\SysWOW64\Bpngcinp.exe
        
        C:\Windows\system32\Bpngcinp.exe
        879⤵
        Drops file in System32 directory
        
        PID:15276
        
        C:\Windows\SysWOW64\Bfgopcfm.exe
        
        C:\Windows\system32\Bfgopcfm.exe
        880⤵
        
        PID:15316
        
        C:\Windows\SysWOW64\Bldghjdd.exe
        
        C:\Windows\system32\Bldghjdd.exe
        881⤵
        
        PID:15348
        
        C:\Windows\SysWOW64\Bbnped32.exe
        
        C:\Windows\system32\Bbnped32.exe
        882⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bihhbocn.exe
        
        C:\Windows\system32\Bihhbocn.exe
        883⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:14540
        
        C:\Windows\SysWOW64\Bikdgn32.exe
        
        C:\Windows\system32\Bikdgn32.exe
        884⤵
        
        PID:14600
        
        C:\Windows\SysWOW64\Bdpidg32.exe
        
        C:\Windows\system32\Bdpidg32.exe
        885⤵
        
        PID:14616
        
        C:\Windows\SysWOW64\Cimamn32.exe
        
        C:\Windows\system32\Cimamn32.exe
        886⤵
        
        PID:14668
        
        C:\Windows\SysWOW64\Cpgjjhfe.exe
        
        C:\Windows\system32\Cpgjjhfe.exe
        887⤵
        
        PID:14704
        
        C:\Windows\SysWOW64\Cfabfbnb.exe
        
        C:\Windows\system32\Cfabfbnb.exe
        888⤵
        System Location Discovery: System Language Discovery
        
        PID:14740
        
        C:\Windows\SysWOW64\Cionbnmf.exe
        
        C:\Windows\system32\Cionbnmf.exe
        889⤵
        
        PID:14796
        
        C:\Windows\SysWOW64\Cpifoh32.exe
        
        C:\Windows\system32\Cpifoh32.exe
        890⤵
        
        PID:14840
        
        C:\Windows\SysWOW64\Cfcolblp.exe
        
        C:\Windows\system32\Cfcolblp.exe
        891⤵
        
        PID:14884
        
        C:\Windows\SysWOW64\Ciakhmkc.exe
        
        C:\Windows\system32\Ciakhmkc.exe
        892⤵
        
        PID:14928
        
        C:\Windows\SysWOW64\Cplceg32.exe
        
        C:\Windows\system32\Cplceg32.exe
        893⤵
        
        PID:14960
        
        C:\Windows\SysWOW64\Cfekaajm.exe
        
        C:\Windows\system32\Cfekaajm.exe
        894⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Cmpcnlaj.exe
        
        C:\Windows\system32\Cmpcnlaj.exe
        895⤵
        
        PID:15048
        
        C:\Windows\SysWOW64\Cbllfboa.exe
        
        C:\Windows\system32\Cbllfboa.exe
        896⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cifdcm32.exe
        
        C:\Windows\system32\Cifdcm32.exe
        897⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Cleqoh32.exe
        
        C:\Windows\system32\Cleqoh32.exe
        898⤵
        
        PID:15164
        
        C:\Windows\SysWOW64\Cfjdma32.exe
        
        C:\Windows\system32\Cfjdma32.exe
        899⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Dmdmik32.exe
        
        C:\Windows\system32\Dmdmik32.exe
        900⤵
        
        PID:15260
        
        C:\Windows\SysWOW64\Dbaeab32.exe
        
        C:\Windows\system32\Dbaeab32.exe
        901⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:15296
        
        C:\Windows\SysWOW64\Diknnlbi.exe
        
        C:\Windows\system32\Diknnlbi.exe
        902⤵
        
        PID:15336
        
        C:\Windows\SysWOW64\Dpefkf32.exe
        
        C:\Windows\system32\Dpefkf32.exe
        903⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Dfongpab.exe
        
        C:\Windows\system32\Dfongpab.exe
        904⤵
        
        PID:14432
        
        C:\Windows\SysWOW64\Dllfpg32.exe
        
        C:\Windows\system32\Dllfpg32.exe
        905⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Dgakmp32.exe
        
        C:\Windows\system32\Dgakmp32.exe
        906⤵
        
        PID:14612
        
        C:\Windows\SysWOW64\Dlnceg32.exe
        
        C:\Windows\system32\Dlnceg32.exe
        907⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Dbhlbaed.exe
        
        C:\Windows\system32\Dbhlbaed.exe
        908⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
        
        C:\Windows\SysWOW64\Dmnpojej.exe
        
        C:\Windows\system32\Dmnpojej.exe
        909⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Ddhhldlf.exe
        
        C:\Windows\system32\Ddhhldlf.exe
        910⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Eeiddl32.exe
        
        C:\Windows\system32\Eeiddl32.exe
        911⤵
        
        PID:14908
        
        C:\Windows\SysWOW64\Elcmqfja.exe
        
        C:\Windows\system32\Elcmqfja.exe
        912⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Ecmemp32.exe
        
        C:\Windows\system32\Ecmemp32.exe
        913⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Eekail32.exe
        
        C:\Windows\system32\Eekail32.exe
        914⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Epqegd32.exe
        
        C:\Windows\system32\Epqegd32.exe
        915⤵
        
        PID:15104
        
        C:\Windows\SysWOW64\Egknco32.exe
        
        C:\Windows\system32\Egknco32.exe
        916⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Emefpiob.exe
        
        C:\Windows\system32\Emefpiob.exe
        917⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9372 -s 448
        918⤵
        Program crash
        
        PID:8924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9372 -ip 9372
1⤵
PID:8876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Halmaiog.exe

Path C:\Windows\SysWOW64\Halmaiog.exe
Size 320KB
SHA256 196eb88cab3b8b6c16c9464666bc6355279be3472cacff87e4399ac3aae202e2
MD5 df8b4651b9a926a469d74728cbf01a74
SHA1 205b47e9242874b396ddec32c18bd90e9b79d539
SHA512 5414544cd4ab0850315db8edf5b1aa1a87de7954c7dc7d0bb6d136131bcd647c5f529ee84782e24943e6beafae3b9e6fbd811754d2fff469af86262accb97d10
SSDEEP 3072:mGsoJ8W1txBxJ6IwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:JsoJ8otxBxUIV/Ah1G/AcQ///NR5fn
TLSH
T1896430192A3409EACEED1FB5ED1249E89141E9F124F5E13E6223DFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Haoighmd.exe

Path C:\Windows\SysWOW64\Haoighmd.exe
Size 320KB
SHA256 cd0be55a42d16b793ecb9e9bc90e89e5212c679fbaeb8f06a5cca06d07de1bd6
MD5 13f762d1a58f14122fbc563815cb7237
SHA1 9782cfecb884ad02789c93fe73eaa070472d279b
SHA512 d452288c977f74837d86aeae6699cde8220c5d1a1345338884887593a16c55bb68867634fc88112c68958d91bc09116948af1292e2558643cecd14c496d1f043
SSDEEP 3072:PnSMF+vYoA+5wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:PnF+W+5V/Ah1G/AcQ///NR5fn
TLSH
T19C642E29667009FACDED1BB7AC0249E85281E8F115F1E13E2123DFDCD8E4DA6E915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hdmecdlh.exe

Path C:\Windows\SysWOW64\Hdmecdlh.exe
Size 320KB
SHA256 b64d542cb42e4067f71cbd24429a3e5e9d281a13ff379e87709a98c7c924c398
MD5 192c02b21743e61859011371eaf0a1b2
SHA1 7059d13f5d5f38b515e7ff6dc9340626fb251e81
SHA512 c426738f4f3554ced1d03e89e5ee35c3068e4f8e47fe5d62d811ee51afcdb82291483a8cdf348219af8a9292f918952c05137cf2ee8584545c82eac4bde06cae
SSDEEP 3072:KQZleDLVVJoEb3vwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:KAEbvV/Ah1G/AcQ///NR5fn
TLSH
T168641E19663809EACEED5FB5AC1249D89142E9F014F1E13E6123DFECD8E4DA6CC25F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhdhhchf.exe

Path C:\Windows\SysWOW64\Hhdhhchf.exe
Size 320KB
SHA256 098989e2476bc6939377a9a87bb6d536d9f321662f828cd4b87b854bcf76b3fb
MD5 74f7a59a5e9775297568aea30fb82b9e
SHA1 452500ed6d3bb97caf0fff576dbf62b7c0c61877
SHA512 b7a83cf9a1df77a1765eb71d3c0199c9eee6a7ab54fc7611477abc619f91e63edab3eea3a90392a3024cd88a78d5b452392d586dfa19f234f0de7b6af55a7052
SSDEEP 3072:UbVmschy9JzhwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:ip9JzhV/Ah1G/AcQ///NR5fn
TLSH
T1D764D91966740AEACDED1BB5BC124DD89241FAB015F1E13EA123DFDCD8E4DA2C809F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhfenc32.exe

Path C:\Windows\SysWOW64\Hhfenc32.exe
Size 320KB
SHA256 83e7e0b99f70ff63ec9920e1849f6a84d8bedf9d9aca6bf31f4a558eeff998eb
MD5 bffbce86439e222fa9b38cbf5fb48816
SHA1 5ea97ce88731fbc4acea6330e24f743d76c42f1f
SHA512 9632116a22de9490111f09a8383cbcfa8175a9cdb2da12bd58ea7807373dd143ea02b4bd49c79e9772b45acf2920d8b5a2789727804b3fa410f78aac253e782b
SSDEEP 3072:tt4hi/l1kAz3bcFyAF3DtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:tt4KDq3DtV/Ah1G/AcQ///NR5fn
TLSH
T175641D1926340DFACEED1BB6AC0249D89185E9F014F1E23E6123DFDCD8E4DA6C825F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hjedpkne.exe

Path C:\Windows\SysWOW64\Hjedpkne.exe
Size 320KB
SHA256 21c3da37f5bea147a286b0e66cac6a2b9715a6db3358185f838c4548fa7eba57
MD5 079e46df8143793f1831f4cb1508bf76
SHA1 8154e0d84cadfa3f18641b139675d5230f9d61e1
SHA512 045b65d98b542167f42223ba40c1834b556cc62df39ce15121cd3996adf785dbbb7f8a672ac83469e2ccfc4147ab0fe29681b1be6d1960928edcf7c33a981f7f
SSDEEP 3072:aI0sHxMoNkCKTpwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:GsHxvspV/Ah1G/AcQ///NR5fn
TLSH
T1336444292A340AEADEED1FB6AC1249D85151E9F014F1E13E6123EFDCD8E8D62DC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkeajn32.exe

Path C:\Windows\SysWOW64\Hkeajn32.exe
Size 320KB
SHA256 33a4a5767958f02b2923ec081d858128215daf14624174a53ea13d141425cf53
MD5 358be24d0aaa15bd5ae8401955401cf7
SHA1 1f0a6b1451feddab87663121201518646155a731
SHA512 be6e683533f8b5666f20b22614334b67cfb13261d107b6b1b4b2831604b5f4652908428dbfb14b97410a1281018a851d4a79e584782b4034fe4f2bd634de658a
SSDEEP 3072:J2BPnJp2fZ//+HwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:yp0p+HV/Ah1G/AcQ///NR5fn
TLSH
T1B964201A2A340AEACDED9FB5AC1249D89141E9F014F1E17E6123EFDDD8E4DA2CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkgnpn32.exe

Path C:\Windows\SysWOW64\Hkgnpn32.exe
Size 320KB
SHA256 871eeea7e78e4fb7c4849aa4c2a56f0b024e613cac4ccc34c71585c6b15ed00f
MD5 05ca07026b69404955e552197eed24f6
SHA1 f1e52151ec4e7c59e173c7311daef9ae90fbf3fc
SHA512 ec7d4477df319cb25554ff29a6b00010096417206bccd50017ab1c2a4f5996ead29ec50849c942df9c4955703ffdf619245591cab0b6d617803388de96c78eed
SSDEEP 6144:144hDp9JHhlCPhrV/Ah1G/AcQ///NR5fn:5Z/Nv
TLSH
T13B64522A663009EACEED1FB5AD2259D99141E8F014F1E13E6123DFECD8E4DA6CC15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hknkiokp.exe

Path C:\Windows\SysWOW64\Hknkiokp.exe
Size 320KB
SHA256 119efbd3c94c235df4577e25dc6ed2089cbe943976b0f50e30ae480b0fb4aac8
MD5 b4fbe2483f047748ded8b9774dcfdcec
SHA1 6657a34bd94dd29f99d5f0106d654429111e8530
SHA512 ef81c93cfee8a9dc6468af7433b0f3962ab12514bd74f692f82c93e5aa09210009df4f3cc036451aad7303278a1f6b61e87670a4d1e09e28972d55a860250778
SSDEEP 6144:uPrV0g8wUAcMsY0g8oEwM4UAcIkQsY0g8oEwM4UAcIkQsY0g8oEwM4UIkD3rfTHw:cV0g8wUAcMsY0g8oEwM4UAcIkQsY0g8s
TLSH
T1D9640B192A700DEACDED1BB5AC4249D89145EAF118F1E23EA123DFDCC8E4DA2DD15F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hnodkjhq.exe

Path C:\Windows\SysWOW64\Hnodkjhq.exe
Size 320KB
SHA256 98b2152168d5659b8f336420c604422bc75009cf10910a0e531d2866d0c51e94
MD5 c25c34add51b6a4a2cb8dd093f330739
SHA1 15bcb4195552fbc76ae894104ff16f3006c42a98
SHA512 95f15666d272fe4aa1212ef41d975dabb11c650e4b77b5d2c71ec0d1c00ca5079fcc7f07374691a993ff6c1f21df20f63c3e72cc61cebcb100db1bb0fc368b37
SSDEEP 3072:Tc/9s2CwXWpR2CLlqwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Tks0YR2CxqV/Ah1G/AcQ///NR5fn
TLSH
T185643F196A7109EACEED5FB5AC0A49D85141E9F018F1E23E6133DFDDD8E4DA2C805F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iaaflh32.exe

Path C:\Windows\SysWOW64\Iaaflh32.exe
Size 320KB
SHA256 59d78f7e7fc78f48aa4a53e9cfb75533bac809e143918f745ece3b8be2425aab
MD5 9f56880c192a9e315f0637aa21d2b6a0
SHA1 d8808ab0b25bbe157f5191826e26fe3b84e83906
SHA512 a5f09f280fe3a57a4d6f8cb34af0317a6e9083474074c507e984bd20744819b36b3085f15e0ecf7f205b34e2663337cc947b7aecd2bcc0ce8e0265ffeb56231c
SSDEEP 3072:vFTpNydOXMbckXyhCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:vR6duMIhCV/Ah1G/AcQ///NR5fn
TLSH
T1296421292A3409EACDED1BB6AC024DDCA141E9F114F1E13E6623DFDCD8E5D62D819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibhlmgdj.exe

Path C:\Windows\SysWOW64\Ibhlmgdj.exe
Size 320KB
SHA256 1d3a9dac584c69a17586e726fe1cc21fa1dd550fcf8d6105ec36f82f0ca80be7
MD5 de03fd1630c17de637aa58999dc0d99a
SHA1 2b949655dc306c7342f6ecffe5fc7db2dee901d6
SHA512 fc90bd26992bc7c61ced85a9fa52cfce9a323f9dbf3c37887c74e4a75c6395856d9d16f64e638eb6e63d0b7f033b34163bcb2f82c5ae0d5863ae0a496cf752d5
SSDEEP 3072:KjqnW39c8qn87wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Kmn89c587V/Ah1G/AcQ///NR5fn
TLSH
T158642F196A3449EECEED1FB5AC0249DA9181E9F014F1E13E6123DFDDD8E4DAAC805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ibjibg32.exe

Path C:\Windows\SysWOW64\Ibjibg32.exe
Size 320KB
SHA256 97df08129a851d07cecbcfdd39b3e06ab8bb69de314f4e964753003ed583f78f
MD5 cbb3b0a0e1983793fea00c9d991af068
SHA1 1f3cd84312e64684e9079989c749fa0f1a347e52
SHA512 e28585286aaca899e46abe54c7e6281e23d02175630a39cf88b561a32a865d3bbf312afb4de89d9c80d8c2320d5602fd549b705fe212c8c086cbd8efa7a747b7
SSDEEP 3072:IuslW48rKTjjTJFl5MPwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:7ceyLrMPV/Ah1G/AcQ///NR5fn
TLSH
T197641D1A2A3409EACDFD1BB6AC125AD86141E8F014F1E13E6133DFDCD9E4DA2D815F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iddlccfp.exe

Path C:\Windows\SysWOW64\Iddlccfp.exe
Size 320KB
SHA256 c5e033ba2016c5ec141f4c5a958c02d0ccdfe01bcf852f6f2b9dc393dd9ec955
MD5 c3932eafa4e4bf0c6d5b4799018cd3f3
SHA1 82a52de872f6ad7ab164a13aee3559843b7c5f92
SHA512 0a7449a507edc64876608c5672039db567804596b446b6f19e2475b693e424cb042845471187aaade5d76725ede7660ca518fb4c4f0634eb52782bb89a9b59f0
SSDEEP 3072:VCJWDPT+4YwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:qyrlYV/Ah1G/AcQ///NR5fn
TLSH
T1BA64FD292A340DEACDED1BB9AD124AD85141E9F014F1E23E6123DFDCE8E4DA2D815FD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idfhibdn.exe

Path C:\Windows\SysWOW64\Idfhibdn.exe
Size 320KB
SHA256 2d822cacfc6c22e5276d0fa062352705a60f92a8a96929134d11be7b02cf6899
MD5 e90d99349cbbad3c0f07adfbbece7a24
SHA1 35fecb4f99439bfb57887ff9b9f3bebcc9db9f12
SHA512 347aa4d366b35279d6f1af906eb673c8b86ef4a4885e88c9581136b2db67531a3e86bf5763972ae1b6debae7356938c4b1486d14d59f40f8a3b6e6893184baf8
SSDEEP 3072:CBins2r4fFMuUP4XAelwtwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0qs2fqktV/Ah1G/AcQ///NR5fn
TLSH
T18D64D9191A350EFACEED1BF5BC1289D85641E9B414F1E53E6123EFDDC8E4DA2C809B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ignndo32.exe

Path C:\Windows\SysWOW64\Ignndo32.exe
Size 320KB
SHA256 cc2f08b72b36df4e84409ab8d3841d7cbdb50392a4ebb65d788a18e745262a89
MD5 598c4870c2c500b3d4b0b8b75af782e8
SHA1 85222b3ffcb04a6cd956add25ea36dfbff80bf12
SHA512 9ea4cdefe734bdb0698dc1b75dca34982a0b147fcb3fb9fad702aed06e7a8511da0c9f92621e61b0c25b36aca9c4fc9f8c581858eac6de8f272df05fa0472ad8
SSDEEP 3072:QBefqnjswS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:QB7njsV/Ah1G/AcQ///NR5fn
TLSH
T13D641E192A3009EACEED5BB6BC0289D89541E9F014F1E13E6123DFDDD8F5DA6E804F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Igpkjo32.exe

Path C:\Windows\SysWOW64\Igpkjo32.exe
Size 320KB
SHA256 f2f6f08e88be3a441660e221d8f07187ac568233472a93f98bc7819623365fdd
MD5 387865abc5f7d494371de65fa57390a3
SHA1 d7fbbc81decde528867187c39c17c778abd99a99
SHA512 78dd629ab03adefe9edbec88e4ad4ac294dd357ccfd5e030c21136081ec4230a3850f9969ff1e85d317f604f0183939447cef65c7c654454ffeca41db0e8f93f
SSDEEP 3072:WwxaFwpkvhBYBM/IwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:zxaGDSIV/Ah1G/AcQ///NR5fn
TLSH
T1FD6431196A3409EACEED1FB6AC1249EC5181E9F014F1E13E6123DFDCD8E4EA2D915F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ihdaoajd.exe

Path C:\Windows\SysWOW64\Ihdaoajd.exe
Size 320KB
SHA256 f8860972dd721e83e86c50a412d11185a8c74bc5c8a7bdd6b07a16af8ab0110b
MD5 6be0bab6157ae10aacbc96db2e15b24f
SHA1 219a6e64f2970f1b49cb9c5f0343ea5cfe162066
SHA512 6cdecbcf73fdf51c63ae9e37fd32c9261cf87bc754d8b9e68f96842a286a648cbcaa18e00d3dd00ea69b42b92bd324f3dfc13f1a728e2687215fcdaa7466c8d5
SSDEEP 3072:W8/1JDXqIExSFCwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:B/XqhwCV/Ah1G/AcQ///NR5fn
TLSH
T1F864201926700AEACEED2FB6AC1249D89541E8F114F1E13F6623DFDCD8E4DA6C805F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ikndpm32.exe

Path C:\Windows\SysWOW64\Ikndpm32.exe
Size 320KB
SHA256 cfd1433cff84a18ffde712c66d93612809bea4b3a8a98090a6c0114a272b22e6
MD5 c54c3b8eaacdee643388c20a89ba12b7
SHA1 0224c639a30c6b8a5f206a22461e885b21c9749b
SHA512 66bd0d9389b428fafeabeedc5296123e19cbe8777b0751e655d871449447ca47d3baf6def2acfea7cd14631662148bd0ec00c6b7b4eeec74bd539cca564b77eb
SSDEEP 3072:hZo02E162nsS/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:h3C2nv/V/Ah1G/AcQ///NR5fn
TLSH
T103641E192A7409FACDED1BB5AC1249D99182E9F014F1E23E6123DFDCD8E5DB2C849F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ikqqfm32.exe

Path C:\Windows\SysWOW64\Ikqqfm32.exe
Size 320KB
SHA256 b1c839a5bf6cde8d7c1d16bb90a401946bd183f3cfa66a520595de8527b740e0
MD5 c4ed1d27d8cd342e3c7d4184afe92350
SHA1 d60cba91cff643cb855f0912cca5ebb135001675
SHA512 7fd7d50fef8dc9d295d9eb23d9089d35a61f3b79c928bb535572f98f6ac41e55c4299a47dfcb5cba76c7c42de59725bbb2acdf7e6e641f09d3c79f03714c5d51
SSDEEP 3072:pp94KyfhEoUmfyPfG/wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:FoKmfwO/V/Ah1G/AcQ///NR5fn
TLSH
T1DF642F19663009EACEED1BB5AC0259DC9541E8F018F9E13E6123DFDCDCE4EA6E815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inhgaipf.exe

Path C:\Windows\SysWOW64\Inhgaipf.exe
Size 320KB
SHA256 53e427c66908c96b059e9306c42747f2a272ac718bba0fb084b59ee517120e7a
MD5 50a720c45ace687082f44c949d21816e
SHA1 f5012cbdd475bbf8b473df2293b0cc22fb9ce3c3
SHA512 0c0b81f333e0a46573b84dcebb75b0b7686bc2d41f3a8f22bce2a952ed9bf6a9f40863797ac9be658f173a7755f85404b3f7b09233b6a96571435c97da116bf7
SSDEEP 3072:65q00sKq/rY9x5owS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:EJ0sKq/rA+V/Ah1G/AcQ///NR5fn
TLSH
T198643E592A3009EACEED1BB5AC135DD89191E9F014F1E17E2523DFDCD9E9DAAC804F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Injcginc.exe

Path C:\Windows\SysWOW64\Injcginc.exe
Size 320KB
SHA256 1c94dca8f3648fdfcfd944df3187d9a9d62c27e29b703b6eb7f9572e65cc027d
MD5 d3db3c6ef924115ca165e28fd8d2ad66
SHA1 8bd41d24cc0f31bb28a1771c5a4f9c737ac70235
SHA512 2245f2aa888eaa6426e78151057c730be3fe3c42c23b312d2f0689dd40dc8778743f9b42f658bc9ff7006e5e03f45868b9f7334730f2b0f28637f05f543a8971
SSDEEP 3072:Jt1dggfc6OD0pwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:Jtggfc6OD0pV/Ah1G/AcQ///NR5fn
TLSH
T1FF6431192A3809EECDED1FB5AC6249D89141E6F069F1E13E6123DFDCD8E4DA2C815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iqfcmdpj.exe

Path C:\Windows\SysWOW64\Iqfcmdpj.exe
Size 320KB
SHA256 d54ae52c0f275c708a72d52b80eb4de5076578a4f420765945cc73ded498e9ba
MD5 c8d8881d4b38a73ce19e09125f02dbde
SHA1 8091cc7c43df5390bf475a3f30f41236f9b5d9f0
SHA512 a216b0e0f7f3e121e0519ac146d8c42d401d563ac1481f577fca27e2cabe6230b0e000f60d974925fdf47eafffa7ec7e36ccafc8c3344dbd8a5da416740d26ec
SSDEEP 3072:MK1yU2LR00Tq5d9SEwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:/bWRed9SEV/Ah1G/AcQ///NR5fn
TLSH
T18D6420192A3449EACEED1BB5AC1249D85141E9F025F1E13E6123DFECD9ECDA3C816F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbobnf32.exe

Path C:\Windows\SysWOW64\Jbobnf32.exe
Size 320KB
SHA256 ea8cbbeceda7d043a75351d66e1ddf5b915a69981093d27dc98a326a2ce67216
MD5 76e48051347afca65586a7b53a9497e1
SHA1 ba9a03ba035fddb3692049b2163046ac1f2635df
SHA512 98c2ff4152bee0d3750058f890837618997939e459e974fc93759a62914d8162531234d1e5b003ee653735eb9c0319c819219d65fbf314553a6797b3792894aa
SSDEEP 3072:xQY6iCTMlEtey9aoabZjwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:x36ngmv9VEZjV/Ah1G/AcQ///NR5fn
TLSH
T1DF6453191A348EEACDED5FB6AC0249D89141E9F014F5E57EA123DFDCD8E8DA2C814F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdnnjane.exe

Path C:\Windows\SysWOW64\Jdnnjane.exe
Size 320KB
SHA256 666df4ce0dc10398023125bf489f157206d7f811e1fb81658ea310a9b85e7484
MD5 4a9f665af9ccfdd83fe5f58e3a9b9fdd
SHA1 963bc104e637fb9b67b06702f350a09cff492801
SHA512 f3cdb1749e8a5ca9dd7935747ba2a58a2f72e4c830202e3199e6341b7fc81197ce238552667ac007955222bc51753c06a77efe734629c9775c52ec0aafa626f8
SSDEEP 3072:/gg7hXjh7DkGyBdVwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:V7hxDkGyBdVV/Ah1G/AcQ///NR5fn
TLSH
T1DA6453191A3809EACDED1FB5AC0249D85145EAF215F2E13EA523DFDCC9E4DA2CC25F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jdpkoalc.exe

Path C:\Windows\SysWOW64\Jdpkoalc.exe
Size 320KB
SHA256 4f09a0084001c5ab7c950e4d22648e6d5c932e4ef54ac044ee2949b640156ffc
MD5 3080d50fd3a32e5422a88a1fb32c32cc
SHA1 554b3a2e65bb2b9b28a2c4db7374f0274ee0538f
SHA512 b82bf67c70ecf26c820ffced10834cf7e206afe84a67a0da6f2f53ea804c84d0b84543ae81a6e8f13acedb46938b1e0bbf2d818fddff310f71d9c1a8954d5dba
SSDEEP 3072:hO9dkFMmkI84LEBwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:hidWMhI844BV/Ah1G/AcQ///NR5fn
TLSH
T1D86441192A7409EACDED1FB5AC5249DC9141E9F014F1E13E6123EFDCD8E6EA2E904F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jgjnpm32.exe

Path C:\Windows\SysWOW64\Jgjnpm32.exe
Size 320KB
SHA256 13a54dd516b61fe6f69426232ac304770219aa0e0d4b79c2de9c5872c2c3ff70
MD5 a0be67742b208caa6884a42e70bd6c49
SHA1 a9278baacd9f5b71bf75ce0b9277d44cb5cc55c8
SHA512 dc718810857b55e12aafdc34e739f7b7c0747df77a9ac6857f0fba8c9ad538272ee8aaba8893b39b8a83e21c69d630fec4ddd2db7d98f868ae001718799ef99f
SSDEEP 3072:c1WOnNJwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:8WYJV/Ah1G/AcQ///NR5fn
TLSH
T18E64B71A6A3409EACDED1FB6ED124DD89141E8F014F1E13E62239FDDD8E4DA6C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jjfngi32.exe

Path C:\Windows\SysWOW64\Jjfngi32.exe
Size 320KB
SHA256 f17dfb0642b4191960a18f98683acb07ea72d3e3ff8c25a28f484c8b54b41dcb
MD5 26efb543131b9b9c211323e5de60e2e4
SHA1 eb2479e87aa3373bc2f9dfa539824e5450ae7183
SHA512 7d4f9384e16f685e8d911e81c1a127f2b93480d7c0884c0a9671d6b7b3a9eefcfefcfc65f12d40f0a978759f0d2a5d8d2adea97feffb511a4fe886efc307dd99
SSDEEP 3072:M/fgQesWWjUwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:MngVs9jUV/Ah1G/AcQ///NR5fn
TLSH
T1F564FB192A3409EACDED5BF6BC0249D89141E9F014F1E63E6223DFDCD8E5DAAC815F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkggfl32.exe

Path C:\Windows\SysWOW64\Jkggfl32.exe
Size 320KB
SHA256 f8e71bce6081ffec495e3f9e72d7126409f21ccb59b76a96e8210a3c1cbaefd9
MD5 4f2a48b4dbdcd6429664d856dcb2837f
SHA1 f483b3888830b0ebde434de1bfdb5e246364cc93
SHA512 e746bbbac400acadfcaabd6f3b61f6a5592dc5bed1a8c6bb5122e17cc136010aa485c87d3e8f3cc2679f7a0f5b81365f097ca77c6b2882bb7de63925338bf933
SSDEEP 3072:kbsDvfnyI2OXe3RdwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:kbsGI2sehdV/Ah1G/AcQ///NR5fn
TLSH
T1C86433191A3409FACDED1FB5AC024AD86191E8F114F1E13EA523DFDCC8E4E66C899F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkjclk32.exe

Path C:\Windows\SysWOW64\Jkjclk32.exe
Size 320KB
SHA256 b9841b92a82fb797cd257a7ddbe617b97d2473acf2741914e0742ab5d54808fd
MD5 736cd03576afa1c119789719f5228ec2
SHA1 88b7aef18f3b8d2ec72471784cd1b768cec9268c
SHA512 f8a58a6c4191527358552523902076654700f0688d37a4b36123a645d252da27703e4e00c49115dd50722b168ce49f38a7b875e63fb9963a1b75225138e933b3
SSDEEP 3072:4HAStcuYUmpK1cs/fla4wS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:0AhuYQ1c6Na4V/Ah1G/AcQ///NR5fn
TLSH
T13C6440192A7009EACDED1FB6AC5249D9A152F8F054F1E53E6123DFDCD8E4DA2C808F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jnfcbg32.exe

Path C:\Windows\SysWOW64\Jnfcbg32.exe
Size 320KB
SHA256 eddc2612a184fdc1e90c6f77297153d42fa2f36e8389df228ada99c9e990137c
MD5 c91afc5610ba97c4ee998e4b0c81ee9a
SHA1 82322578e4df7ffe4d3e7ac048ba4d0a955e68aa
SHA512 d3c68f7d1d5bc9521ee3fb29c576d02f85b64eb9afdfdf2d76b7090ca2b7678993766b0362a7f117aba068075af81722df938bf7d769c7a53f3326cc9539a84e
SSDEEP 3072:1BxL2kAik3EcbwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:bt2Pik0cbV/Ah1G/AcQ///NR5fn
TLSH
T1B2641E1A2A3409EACEED5BB9AC0659D85181E9F014F5F13E6123DFDCD8E4DB2C819F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jqpfccgo.exe

Path C:\Windows\SysWOW64\Jqpfccgo.exe
Size 320KB
SHA256 af42823c6ea4bc8032357c2e9a98d96ef3c3319d0a983385629826db8d244eb1
MD5 43e3736fde35faa28037f6f8f4ba4240
SHA1 5c48149a66d877999b751729e446c978f965730b
SHA512 edcae7f09ca781cd34639dbac4cfcd81045c0af9a310ed59aaecc447dec6ba0df4730a024268e3d93b0fc68370cb0dc77b5b9c154ac0707ed991b7529656ab98
SSDEEP 3072:d1wneb9jpsttaMACwS/A4MK0FzJG/AMBxjUSmkCMQ/9h/NR5f0m:d1wneb9jpst8CV/Ah1G/AcQ///NR5fn
TLSH
T1AA640E192A3409EACDED1FB5AC1249D89185FAF014F1E13E6523DFDCD8E8DA6D809F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-77-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/472-390-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/896-310-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/996-154-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1056-420-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1196-63-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1212-250-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1288-70-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1340-467-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1340-7-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1372-265-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1392-210-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1456-360-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1608-260-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1660-340-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1800-385-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1876-502-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1900-285-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1908-440-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1932-380-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1960-451-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1988-189-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2096-507-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2096-56-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2124-335-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2324-462-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2392-375-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2568-425-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2624-480-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2680-230-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2744-105-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2800-325-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2896-255-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2916-235-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2932-445-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2960-21-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2960-479-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2984-365-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2988-91-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3024-133-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3152-280-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3176-112-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3260-370-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3280-415-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3384-446-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3388-468-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-490-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3392-35-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3404-224-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3452-168-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3460-474-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3536-290-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3560-182-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3888-473-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3888-14-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/3976-147-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4000-350-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4128-28-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4128-485-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4204-435-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4232-275-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4276-270-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4284-300-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4324-405-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4468-203-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4504-305-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4516-345-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4548-119-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4648-315-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4704-84-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4724-240-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4780-400-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4816-175-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4856-196-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4880-457-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4904-42-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4904-495-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4968-49-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4968-501-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4976-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/4976-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/4976-456-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5036-98-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5072-161-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5092-330-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5144-245-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5368-295-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5420-355-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5500-217-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5508-126-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5788-496-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5860-140-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5900-430-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5916-395-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/5976-410-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/6000-320-0x0000000000400000-0x000000000046D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads