a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b.exe
Size

63KB
MD5

8bf4819d4ac4dd14754344a069429321
SHA1

e48e9b3623becf39864eebc2fc967566dd648626
SHA256

a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b
SHA512

68ac98a1646a223c910d18e1cbe885147641b0e2e2983c2931dd7807f17820fdb04809dbdd1b37817f67b5f3c2713ce39191733878b66cd47df47d7eb6b3e270
SSDEEP

1536:BfAjHkCZEXQQ/pDsGK/e2RE6eQH1juIZo:BfAQ7XBhDsxREDQH1juIZo

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcqjal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cemeoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljoiibbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kamjda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flboch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfmpob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceeaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqdaadln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abmjqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfjnjcni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccbadp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeokal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpcgpihi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllffa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikcmbfcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emanjldl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlbkap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlbcnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hegmlnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igjlibib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgngih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjohde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcifkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlkfbocp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkgdhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdnoplhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iaedanal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilkhog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdoel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gehbjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nipffmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejiiippb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcigeooj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipgbdbqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhdbhifj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhoahh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fclhpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceeaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Midoph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohfami32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljehpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ienlbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odbpij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eecfah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcclld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcoepkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdfmkjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leqkeajd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikcmbfcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdmoohbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfcqpa32.exe

Executes dropped EXE 64 IoCs

pid	Process
5108	Pflplnlg.exe
3208	Pnfdcjkg.exe
3900	Qmkadgpo.exe
4548	Adgbpc32.exe
2808	Anadoi32.exe
1228	Aeniabfd.exe
2196	Aepefb32.exe
4464	Eggmge32.exe
1044	Edknqiho.exe
3724	Eobocb32.exe
4500	Emhldnkj.exe
3056	Feapkk32.exe
2776	Fkqeib32.exe
2320	Fkcboack.exe
1660	Fgjccb32.exe
4348	Gkglja32.exe
2416	Ggnlobej.exe
3840	Gohaeo32.exe
4984	Gkobjpin.exe
3360	Ghbbcd32.exe
3920	Hakgmjoh.exe
2112	Hfipbh32.exe
2684	Hgjljpkm.exe
4816	Hhlejcpm.exe
2268	Hkmnln32.exe
4468	Igcoqocb.exe
4988	Iickkbje.exe
2528	Ikfabm32.exe
4252	Jilnqqbj.exe
3220	Jfpojead.exe
3320	Jgdhgmep.exe
2144	Jpmlnjco.exe
2928	Knbiofhg.exe
3444	Kgknhl32.exe
4552	Khmknk32.exe
4868	Kpgodhkd.exe
1420	Kiodmn32.exe
1840	Kfcdfbqo.exe
2228	Lhdqnj32.exe
3248	Lbjelc32.exe
4248	Lhfmdj32.exe
5072	Lblaabdp.exe
5000	Lejnmncd.exe
1476	Lldfjh32.exe
3092	Lpbopfag.exe
3276	Lpekef32.exe
400	Mlklkgei.exe
4528	Mlnipg32.exe
4436	Mhdjehhj.exe
4928	Mhgfkg32.exe
2044	Mockmala.exe
3672	Nohehq32.exe
4332	Nojanpej.exe
4992	Nchjdo32.exe
3664	Nookip32.exe
1800	Opogbbig.exe
3880	Oocddono.exe
1048	Opcqnb32.exe
548	Ogpepl32.exe
1804	Ohqbhdpj.exe
916	Ocffempp.exe
4012	Pfillg32.exe
2456	Pgihfj32.exe
4300	Pfnegggi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lpbopfag.exe	Lldfjh32.exe
File opened for modification	C:\Windows\SysWOW64\Nliaao32.exe	Nhkikq32.exe
File opened for modification	C:\Windows\SysWOW64\Nqaiecjd.exe	Nfldgk32.exe
File created	C:\Windows\SysWOW64\Keceoj32.exe	Jaemilci.exe
File created	C:\Windows\SysWOW64\Pqdako32.dll	Lfjchn32.exe
File created	C:\Windows\SysWOW64\Ndqmkfni.dll	Kanidd32.exe
File created	C:\Windows\SysWOW64\Mnkqde32.dll	Gllajf32.exe
File opened for modification	C:\Windows\SysWOW64\Bqpbboeg.exe	Bkcjjhgp.exe
File created	C:\Windows\SysWOW64\Djfoankj.dll	Coknoaic.exe
File created	C:\Windows\SysWOW64\Mchppmij.exe	Mgaokl32.exe
File opened for modification	C:\Windows\SysWOW64\Mchppmij.exe	Mgaokl32.exe
File opened for modification	C:\Windows\SysWOW64\Koonge32.exe	Kefiopki.exe
File created	C:\Windows\SysWOW64\Jbjabqbh.dll	Mccokj32.exe
File opened for modification	C:\Windows\SysWOW64\Bkefphem.exe	Bqpbboeg.exe
File created	C:\Windows\SysWOW64\Gojgkl32.exe	Glinjqhb.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Eiildjag.exe	Ehfcfb32.exe
File created	C:\Windows\SysWOW64\Afakoidm.dll	Ipjoja32.exe
File created	C:\Windows\SysWOW64\Oqmhqapg.exe	Omopjcjp.exe
File created	C:\Windows\SysWOW64\Jjlmclqa.exe	Jjjpnlbd.exe
File opened for modification	C:\Windows\SysWOW64\Dnbakghm.exe	Dnpdegjp.exe
File created	C:\Windows\SysWOW64\Fealin32.exe	Fijkdmhn.exe
File opened for modification	C:\Windows\SysWOW64\Ookoaokf.exe	Ofckhj32.exe
File created	C:\Windows\SysWOW64\Hhbdko32.exe	Himgjbii.exe
File created	C:\Windows\SysWOW64\Bmmpfn32.exe	Boipmj32.exe
File opened for modification	C:\Windows\SysWOW64\Jgogbgei.exe	Jdnoplhh.exe
File created	C:\Windows\SysWOW64\Golneb32.dll	Gfokoelp.exe
File created	C:\Windows\SysWOW64\Cnboma32.exe	Cbknhqbl.exe
File opened for modification	C:\Windows\SysWOW64\Lbgalmej.exe	Kageaj32.exe
File created	C:\Windows\SysWOW64\Njhgbp32.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Feapkk32.exe	Emhldnkj.exe
File created	C:\Windows\SysWOW64\Gdmmbq32.exe	Fpodlbng.exe
File created	C:\Windows\SysWOW64\Lcjldk32.exe	Lolcnman.exe
File created	C:\Windows\SysWOW64\Clnkig32.dll	Ihjafd32.exe
File created	C:\Windows\SysWOW64\Lblaabdp.exe	Lhfmdj32.exe
File created	C:\Windows\SysWOW64\Kjmejc32.dll	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Jbpkfa32.exe	Jjefao32.exe
File opened for modification	C:\Windows\SysWOW64\Ahfdjanb.exe	Qcdbfk32.exe
File created	C:\Windows\SysWOW64\Aocfbi32.dll	Ahfdjanb.exe
File created	C:\Windows\SysWOW64\Geaepk32.exe	Geohklaa.exe
File created	C:\Windows\SysWOW64\Gdojoeki.dll	Oloipmfd.exe
File created	C:\Windows\SysWOW64\Cjaiac32.exe	Ceeaim32.exe
File opened for modification	C:\Windows\SysWOW64\Kdkdgchl.exe	Kjccdkki.exe
File opened for modification	C:\Windows\SysWOW64\Hkbdki32.exe	Gdfoio32.exe
File created	C:\Windows\SysWOW64\Cfnqklgh.exe	Cmflbf32.exe
File created	C:\Windows\SysWOW64\Kqbdldnq.exe	Kdkdgchl.exe
File opened for modification	C:\Windows\SysWOW64\Hhlejcpm.exe	Hgjljpkm.exe
File created	C:\Windows\SysWOW64\Mmbheilp.dll	Lnnbqnjn.exe
File created	C:\Windows\SysWOW64\Cgdojhec.dll	Hgmgqc32.exe
File created	C:\Windows\SysWOW64\Ficlfj32.dll	Geaepk32.exe
File created	C:\Windows\SysWOW64\Qppkhfec.exe	Qejfkmem.exe
File created	C:\Windows\SysWOW64\Lacdmh32.exe	Lihpif32.exe
File opened for modification	C:\Windows\SysWOW64\Daollh32.exe	Dpopbepi.exe
File opened for modification	C:\Windows\SysWOW64\Dcigeooj.exe	Coknoaic.exe
File opened for modification	C:\Windows\SysWOW64\Flngfn32.exe	Fbfcmhpg.exe
File created	C:\Windows\SysWOW64\Dlkplk32.exe	Dfngcdhi.exe
File created	C:\Windows\SysWOW64\Gcoheeen.dll	Glchjedc.exe
File opened for modification	C:\Windows\SysWOW64\Mgphpe32.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Bklomh32.exe
File opened for modification	C:\Windows\SysWOW64\Hhaggp32.exe	Hecjke32.exe
File created	C:\Windows\SysWOW64\Lnlden32.dll	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Bcnbjd32.dll	Kpgodhkd.exe
File created	C:\Windows\SysWOW64\Icgcab32.dll	Bqdblmhl.exe
File created	C:\Windows\SysWOW64\Fiebmc32.dll	Mniallpq.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6512	6732	WerFault.exe	926

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iimcma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jojdlfeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagmdllg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdjjgggk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkdoje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnhmnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjmlaac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opogbbig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldanloba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckbncapd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnmlhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igcoqocb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dndgfpbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkdpbpih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbgjbkfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljclki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmgjia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhqcgnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chddpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aiqkmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihmnldib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceeaim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cflkpblf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omjpeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gllajf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahdpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngipjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bflham32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dghadidj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpnjah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpogkhnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afkipi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ellicihn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmedmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfmcfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knkcmild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bifkcioc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eecfah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqiipljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fefedmil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgmgqc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giboijgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajjjjghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiodha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkmijf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heegad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lojmcdgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knbiofhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngndaccj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jgpfbjlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjkiephp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pofjpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilkoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbgeqmjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncaklhdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jonlimkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikbfgppo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmqiec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mklpof32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njkkbehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plmell32.dll"	Giljfddl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdaile32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikfabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boipmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gengjl32.dll"	Jqiipljg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kifona32.dll"	Pekbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbbdk32.dll"	Hienlpel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omcjep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blgifbil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcain32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocffempp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ombkojfh.dll"	Hfhbipdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijkdkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaioi32.dll"	Dmcain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjdhhc32.dll"	Pmoiqneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcoepkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfiloih.dll"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qppaclio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kongmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abjfqpji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkefphem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnindhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqdako32.dll"	Lfjchn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okedcjcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcjldk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dghadidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgnfmhaj.dll"	Nhkikq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlfpdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajfmkfhq.dll"	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gccnfmnd.dll"	Ienlbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdipag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgiiak32.dll"	Iiopca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ienlbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfieagka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlkplk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgflobdk.dll"	Dlkplk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldanloba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfcqpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Poomegpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekgqennl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eafbmgad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obpkcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bifkcioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foalam32.dll"	Lblaabdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqmggi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkhbi32.dll"	Ilibdmgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfemoei.dll"	Elilmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjdhlc32.dll"	Eliecc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oondnini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iciaqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfefigf.dll"	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kocgbend.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lecipbeq.dll"	Infqklol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cobkhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fideeaco.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 5108	3928	a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b.exe	87
PID 3928 wrote to memory of 5108	3928	a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b.exe	87
PID 3928 wrote to memory of 5108	3928	a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b.exe	87
PID 5108 wrote to memory of 3208	5108	Pflplnlg.exe	88
PID 5108 wrote to memory of 3208	5108	Pflplnlg.exe	88
PID 5108 wrote to memory of 3208	5108	Pflplnlg.exe	88
PID 3208 wrote to memory of 3900	3208	Pnfdcjkg.exe	89
PID 3208 wrote to memory of 3900	3208	Pnfdcjkg.exe	89
PID 3208 wrote to memory of 3900	3208	Pnfdcjkg.exe	89
PID 3900 wrote to memory of 4548	3900	Qmkadgpo.exe	91
PID 3900 wrote to memory of 4548	3900	Qmkadgpo.exe	91
PID 3900 wrote to memory of 4548	3900	Qmkadgpo.exe	91
PID 4548 wrote to memory of 2808	4548	Adgbpc32.exe	92
PID 4548 wrote to memory of 2808	4548	Adgbpc32.exe	92
PID 4548 wrote to memory of 2808	4548	Adgbpc32.exe	92
PID 2808 wrote to memory of 1228	2808	Anadoi32.exe	93
PID 2808 wrote to memory of 1228	2808	Anadoi32.exe	93
PID 2808 wrote to memory of 1228	2808	Anadoi32.exe	93
PID 1228 wrote to memory of 2196	1228	Aeniabfd.exe	94
PID 1228 wrote to memory of 2196	1228	Aeniabfd.exe	94
PID 1228 wrote to memory of 2196	1228	Aeniabfd.exe	94
PID 2196 wrote to memory of 4464	2196	Aepefb32.exe	95
PID 2196 wrote to memory of 4464	2196	Aepefb32.exe	95
PID 2196 wrote to memory of 4464	2196	Aepefb32.exe	95
PID 4464 wrote to memory of 1044	4464	Eggmge32.exe	96
PID 4464 wrote to memory of 1044	4464	Eggmge32.exe	96
PID 4464 wrote to memory of 1044	4464	Eggmge32.exe	96
PID 1044 wrote to memory of 3724	1044	Edknqiho.exe	97
PID 1044 wrote to memory of 3724	1044	Edknqiho.exe	97
PID 1044 wrote to memory of 3724	1044	Edknqiho.exe	97
PID 3724 wrote to memory of 4500	3724	Eobocb32.exe	98
PID 3724 wrote to memory of 4500	3724	Eobocb32.exe	98
PID 3724 wrote to memory of 4500	3724	Eobocb32.exe	98
PID 4500 wrote to memory of 3056	4500	Emhldnkj.exe	99
PID 4500 wrote to memory of 3056	4500	Emhldnkj.exe	99
PID 4500 wrote to memory of 3056	4500	Emhldnkj.exe	99
PID 3056 wrote to memory of 2776	3056	Feapkk32.exe	100
PID 3056 wrote to memory of 2776	3056	Feapkk32.exe	100
PID 3056 wrote to memory of 2776	3056	Feapkk32.exe	100
PID 2776 wrote to memory of 2320	2776	Fkqeib32.exe	101
PID 2776 wrote to memory of 2320	2776	Fkqeib32.exe	101
PID 2776 wrote to memory of 2320	2776	Fkqeib32.exe	101
PID 2320 wrote to memory of 1660	2320	Fkcboack.exe	102
PID 2320 wrote to memory of 1660	2320	Fkcboack.exe	102
PID 2320 wrote to memory of 1660	2320	Fkcboack.exe	102
PID 1660 wrote to memory of 4348	1660	Fgjccb32.exe	103
PID 1660 wrote to memory of 4348	1660	Fgjccb32.exe	103
PID 1660 wrote to memory of 4348	1660	Fgjccb32.exe	103
PID 4348 wrote to memory of 2416	4348	Gkglja32.exe	104
PID 4348 wrote to memory of 2416	4348	Gkglja32.exe	104
PID 4348 wrote to memory of 2416	4348	Gkglja32.exe	104
PID 2416 wrote to memory of 3840	2416	Ggnlobej.exe	105
PID 2416 wrote to memory of 3840	2416	Ggnlobej.exe	105
PID 2416 wrote to memory of 3840	2416	Ggnlobej.exe	105
PID 3840 wrote to memory of 4984	3840	Gohaeo32.exe	106
PID 3840 wrote to memory of 4984	3840	Gohaeo32.exe	106
PID 3840 wrote to memory of 4984	3840	Gohaeo32.exe	106
PID 4984 wrote to memory of 3360	4984	Gkobjpin.exe	107
PID 4984 wrote to memory of 3360	4984	Gkobjpin.exe	107
PID 4984 wrote to memory of 3360	4984	Gkobjpin.exe	107
PID 3360 wrote to memory of 3920	3360	Ghbbcd32.exe	108
PID 3360 wrote to memory of 3920	3360	Ghbbcd32.exe	108
PID 3360 wrote to memory of 3920	3360	Ghbbcd32.exe	108
PID 3920 wrote to memory of 2112	3920	Hakgmjoh.exe	109

C:\Users\Admin\AppData\Local\Temp\a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b.exe
"C:\Users\Admin\AppData\Local\Temp\a74ae090f1da42d39a40da3d12722679440a33e25db92400ae216ff65efc439b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\Pflplnlg.exe
  C:\Windows\system32\Pflplnlg.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\Pnfdcjkg.exe
    C:\Windows\system32\Pnfdcjkg.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Windows\SysWOW64\Qmkadgpo.exe
      C:\Windows\system32\Qmkadgpo.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        23⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2684
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        25⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        26⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        28⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2528
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        30⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        31⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        32⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        33⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        35⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        36⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        38⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        39⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        40⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        41⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4248
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        44⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        46⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        47⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        48⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        49⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        50⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        51⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        52⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        53⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        54⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        55⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        56⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1800
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        58⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        59⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        60⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        61⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        63⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        64⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        65⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        67⤵
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        68⤵
        Drops file in System32 directory
        
        PID:1268
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        69⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        70⤵
        Drops file in System32 directory
        
        PID:5024
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        72⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        73⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        74⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3404
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        77⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        78⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2716
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        80⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        81⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        82⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        84⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        85⤵
        
        PID:796
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        86⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        87⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        88⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        90⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        91⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        92⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        93⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        94⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        95⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        96⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        97⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        98⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        99⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        100⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        101⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        103⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        104⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        105⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        106⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        107⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        108⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        109⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        110⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        111⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        113⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        115⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        116⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        117⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        118⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        119⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        120⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        121⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        122⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        125⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        126⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        127⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        129⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        130⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        131⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        133⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        135⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        137⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        138⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        139⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        140⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        141⤵
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        142⤵
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        143⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        144⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        146⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        147⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        148⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        149⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        150⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        151⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        152⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        153⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        155⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        156⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        157⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        158⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        159⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        160⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        161⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        162⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        163⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        164⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        165⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        166⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        167⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        169⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        171⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        172⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        174⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        175⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        176⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        177⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        178⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        179⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        180⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        181⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        182⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        183⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        184⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        185⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        186⤵
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        187⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6464
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        189⤵
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        190⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        191⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        192⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        193⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        194⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        195⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        198⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        199⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        200⤵
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        202⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        203⤵
        Drops file in System32 directory
        
        PID:6640
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        204⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        205⤵
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        206⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        207⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        208⤵
        Drops file in System32 directory
        
        PID:7324
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        209⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        211⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        212⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        213⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        215⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        216⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        217⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        218⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        219⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        220⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        221⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        222⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        223⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:8080
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        225⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        226⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        227⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        228⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        229⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        231⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        232⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        233⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        235⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        237⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        238⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        239⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        240⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        241⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        242⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        243⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        244⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        245⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        246⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        247⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        248⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        249⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        250⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        252⤵
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3488
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        254⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        255⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        256⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        257⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        258⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        259⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        260⤵
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        261⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        262⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        263⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        264⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7644
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        266⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        267⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        268⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        269⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        270⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        271⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2660
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        273⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        274⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        275⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        276⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:8220
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8288
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        279⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        280⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        281⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        282⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        283⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8616
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        285⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        286⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        288⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        289⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        290⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        292⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        293⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        294⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        295⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        296⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        298⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        299⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        300⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        301⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        302⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        303⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        304⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        305⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        306⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        307⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        308⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        309⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        310⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        311⤵
        Drops file in System32 directory
        
        PID:9196
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        312⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        313⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8432
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        316⤵
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        317⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        318⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        319⤵
        System Location Discovery: System Language Discovery
        
        PID:2108
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        320⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        321⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        322⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        323⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        324⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        325⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        327⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        328⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        329⤵
        
        PID:660
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        330⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        331⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        332⤵
        Modifies registry class
        
        PID:4308
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        333⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        334⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        335⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        336⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        337⤵
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        338⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2408
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1840
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        343⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        344⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        345⤵
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        346⤵
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        347⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        348⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        349⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        350⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        351⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        352⤵
        
        PID:516
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        353⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        354⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        355⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        356⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        358⤵
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:9044
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        360⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        361⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        362⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        363⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        364⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        365⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        366⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        367⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        368⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        369⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        370⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        371⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        372⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        373⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        374⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        375⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        376⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        377⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        378⤵
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        379⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        380⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        381⤵
        Modifies registry class
        
        PID:3856
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2204
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        383⤵
        Drops file in System32 directory
        
        PID:8548
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        384⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        385⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        387⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        388⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        389⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        390⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        391⤵
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        392⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        393⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        394⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        395⤵
        System Location Discovery: System Language Discovery
        
        PID:8308
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        396⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        397⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        398⤵
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        399⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        400⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        401⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        402⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        403⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        404⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        405⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        406⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        407⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        408⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        409⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        410⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        411⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        413⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        414⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        415⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        416⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        417⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        418⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        419⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        420⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        421⤵
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        422⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        423⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        424⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        425⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        426⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        427⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        428⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        431⤵
        System Location Discovery: System Language Discovery
        
        PID:384
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        432⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        433⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        434⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        435⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        436⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        437⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        438⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        439⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        440⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        441⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        442⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        443⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        444⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        446⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        447⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        448⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        449⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        451⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        452⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        453⤵
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        454⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        455⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        456⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        457⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        458⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        460⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        462⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        463⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        464⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        465⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        468⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        469⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        470⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        471⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        472⤵
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        473⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        474⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        475⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        476⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        477⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        478⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        479⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        480⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        481⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        482⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        483⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        484⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        486⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        487⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        488⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        489⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        490⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        491⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        492⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        493⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        494⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        495⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Gcqjal32.exe
        
        C:\Windows\system32\Gcqjal32.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        497⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        498⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        499⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        501⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        502⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        503⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        506⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        507⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        508⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        509⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        510⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        511⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        512⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        513⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        514⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        515⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        516⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        517⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        518⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        519⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6832
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        521⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        522⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        523⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        524⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        525⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        526⤵
        Modifies registry class
        
        PID:9204
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        527⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Mcoepkdo.exe
        
        C:\Windows\system32\Mcoepkdo.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        529⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        530⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        531⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        532⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        533⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        534⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        535⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        537⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        538⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        539⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        540⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        541⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        542⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        544⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        545⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        546⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        547⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        548⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        549⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        550⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        551⤵
        Drops file in System32 directory
        
        PID:7816
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        552⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        553⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        554⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        555⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        556⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        557⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        558⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Bifkcioc.exe
        
        C:\Windows\system32\Bifkcioc.exe
        559⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7840
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        560⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        561⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        562⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        563⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        564⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Cfcoblfb.exe
        
        C:\Windows\system32\Cfcoblfb.exe
        565⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        566⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        567⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7584
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7236
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        570⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        571⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7688
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        573⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        574⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        575⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Deidjf32.exe
        
        C:\Windows\system32\Deidjf32.exe
        576⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        577⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Eleimp32.exe
        
        C:\Windows\system32\Eleimp32.exe
        578⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Ecoaijio.exe
        
        C:\Windows\system32\Ecoaijio.exe
        579⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        580⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        581⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Ecdkdj32.exe
        
        C:\Windows\system32\Ecdkdj32.exe
        582⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Egbdjhlp.exe
        
        C:\Windows\system32\Egbdjhlp.exe
        583⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        584⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Flaiho32.exe
        
        C:\Windows\system32\Flaiho32.exe
        585⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        586⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Ffnglc32.exe
        
        C:\Windows\system32\Ffnglc32.exe
        587⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        588⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Gjqinamq.exe
        
        C:\Windows\system32\Gjqinamq.exe
        589⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        591⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        593⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        594⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        595⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        596⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        597⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        598⤵
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        599⤵
        Modifies registry class
        
        PID:664
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        600⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Ienlbf32.exe
        
        C:\Windows\system32\Ienlbf32.exe
        601⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Infqklol.exe
        
        C:\Windows\system32\Infqklol.exe
        602⤵
        Modifies registry class
        
        PID:7732
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        603⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        604⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Iedbcebd.exe
        
        C:\Windows\system32\Iedbcebd.exe
        605⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        606⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Jgekdq32.exe
        
        C:\Windows\system32\Jgekdq32.exe
        607⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        608⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        609⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        610⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        611⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        612⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        613⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
        
        C:\Windows\SysWOW64\Kallod32.exe
        
        C:\Windows\system32\Kallod32.exe
        614⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Kanidd32.exe
        
        C:\Windows\system32\Kanidd32.exe
        615⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Kmeiie32.exe
        
        C:\Windows\system32\Kmeiie32.exe
        616⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        617⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ldanloba.exe
        
        C:\Windows\system32\Ldanloba.exe
        618⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Leqkeajd.exe
        
        C:\Windows\system32\Leqkeajd.exe
        619⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        620⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        621⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Leedqa32.exe
        
        C:\Windows\system32\Leedqa32.exe
        622⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Lmqiec32.exe
        
        C:\Windows\system32\Lmqiec32.exe
        623⤵
        System Location Discovery: System Language Discovery
        
        PID:8472
        
        C:\Windows\SysWOW64\Mopeofjl.exe
        
        C:\Windows\system32\Mopeofjl.exe
        624⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        625⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Mdokmm32.exe
        
        C:\Windows\system32\Mdokmm32.exe
        626⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Mgngih32.exe
        
        C:\Windows\system32\Mgngih32.exe
        627⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        628⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        629⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        630⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        631⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        632⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Naokbokn.exe
        
        C:\Windows\system32\Naokbokn.exe
        633⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        634⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Odbpij32.exe
        
        C:\Windows\system32\Odbpij32.exe
        635⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4712
        
        C:\Windows\SysWOW64\Oafacn32.exe
        
        C:\Windows\system32\Oafacn32.exe
        636⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Oahnhncc.exe
        
        C:\Windows\system32\Oahnhncc.exe
        637⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        638⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        639⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        640⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Poeahaib.exe
        
        C:\Windows\system32\Poeahaib.exe
        641⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Pbdmdlie.exe
        
        C:\Windows\system32\Pbdmdlie.exe
        642⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        643⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        644⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        645⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        646⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Qdllffpo.exe
        
        C:\Windows\system32\Qdllffpo.exe
        647⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Afkipi32.exe
        
        C:\Windows\system32\Afkipi32.exe
        648⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        649⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        650⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Aecbge32.exe
        
        C:\Windows\system32\Aecbge32.exe
        651⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        652⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Aiqkmd32.exe
        
        C:\Windows\system32\Aiqkmd32.exe
        653⤵
        System Location Discovery: System Language Discovery
        
        PID:8600
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        654⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Bbklli32.exe
        
        C:\Windows\system32\Bbklli32.exe
        655⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Bfieagka.exe
        
        C:\Windows\system32\Bfieagka.exe
        656⤵
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Bndjfjhl.exe
        
        C:\Windows\system32\Bndjfjhl.exe
        657⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Bkhjpn32.exe
        
        C:\Windows\system32\Bkhjpn32.exe
        658⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Biljib32.exe
        
        C:\Windows\system32\Biljib32.exe
        659⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Blkgen32.exe
        
        C:\Windows\system32\Blkgen32.exe
        660⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        661⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        662⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        663⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        664⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        665⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        666⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        667⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        668⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Dlkplk32.exe
        
        C:\Windows\system32\Dlkplk32.exe
        669⤵
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        670⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Dbjade32.exe
        
        C:\Windows\system32\Dbjade32.exe
        671⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        672⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        673⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Efjgpc32.exe
        
        C:\Windows\system32\Efjgpc32.exe
        674⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        675⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Elilmi32.exe
        
        C:\Windows\system32\Elilmi32.exe
        676⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        677⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        678⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        679⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        680⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Flboch32.exe
        
        C:\Windows\system32\Flboch32.exe
        681⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3384
        
        C:\Windows\SysWOW64\Fhiphi32.exe
        
        C:\Windows\system32\Fhiphi32.exe
        682⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        683⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        684⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Gebimmco.exe
        
        C:\Windows\system32\Gebimmco.exe
        685⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        686⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7480
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        687⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        688⤵
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        689⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Glchjedc.exe
        
        C:\Windows\system32\Glchjedc.exe
        690⤵
        Drops file in System32 directory
        
        PID:1528
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        691⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Gledpe32.exe
        
        C:\Windows\system32\Gledpe32.exe
        692⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Hpcmfchg.exe
        
        C:\Windows\system32\Hpcmfchg.exe
        693⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Hfpenj32.exe
        
        C:\Windows\system32\Hfpenj32.exe
        694⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Hpejlc32.exe
        
        C:\Windows\system32\Hpejlc32.exe
        695⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        696⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Hgbonm32.exe
        
        C:\Windows\system32\Hgbonm32.exe
        697⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Hqjcgbbo.exe
        
        C:\Windows\system32\Hqjcgbbo.exe
        698⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        699⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        700⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        701⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        702⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Ihjafd32.exe
        
        C:\Windows\system32\Ihjafd32.exe
        703⤵
        Drops file in System32 directory
        
        PID:916
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        704⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        705⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        706⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        707⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        708⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        709⤵
        
        PID:324
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        710⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        711⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Jonlimkg.exe
        
        C:\Windows\system32\Jonlimkg.exe
        712⤵
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        713⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        714⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        715⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Jqbbno32.exe
        
        C:\Windows\system32\Jqbbno32.exe
        716⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Jglkkiea.exe
        
        C:\Windows\system32\Jglkkiea.exe
        717⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        718⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        719⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        720⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Kjamhd32.exe
        
        C:\Windows\system32\Kjamhd32.exe
        721⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        722⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        723⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Lapopm32.exe
        
        C:\Windows\system32\Lapopm32.exe
        724⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        725⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        726⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        727⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        728⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        729⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2700
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        730⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        731⤵
        System Location Discovery: System Language Discovery
        
        PID:8988
        
        C:\Windows\SysWOW64\Mankaked.exe
        
        C:\Windows\system32\Mankaked.exe
        732⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        733⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        734⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5024
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        735⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Mjkiephp.exe
        
        C:\Windows\system32\Mjkiephp.exe
        736⤵
        System Location Discovery: System Language Discovery
        
        PID:4156
        
        C:\Windows\SysWOW64\Nipffmmg.exe
        
        C:\Windows\system32\Nipffmmg.exe
        737⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        738⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        739⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        740⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        741⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Nmedmj32.exe
        
        C:\Windows\system32\Nmedmj32.exe
        742⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\Ogmiepcf.exe
        
        C:\Windows\system32\Ogmiepcf.exe
        743⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        744⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        745⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        746⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        747⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        748⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        749⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        750⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        751⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        752⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        753⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        754⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        755⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        756⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        757⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Agiahlkf.exe
        
        C:\Windows\system32\Agiahlkf.exe
        758⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        759⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        760⤵
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        761⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        762⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        763⤵
        
        PID:336
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        764⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        765⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        766⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        767⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        768⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        769⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        770⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        771⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ceeaim32.exe
        
        C:\Windows\system32\Ceeaim32.exe
        772⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6164
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        773⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        774⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        775⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        776⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        777⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        778⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        779⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        780⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        781⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        782⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        783⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Eliecc32.exe
        
        C:\Windows\system32\Eliecc32.exe
        784⤵
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        785⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Eecfah32.exe
        
        C:\Windows\system32\Eecfah32.exe
        786⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8648
        
        C:\Windows\SysWOW64\Folkjnbc.exe
        
        C:\Windows\system32\Folkjnbc.exe
        787⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Fefcgh32.exe
        
        C:\Windows\system32\Fefcgh32.exe
        788⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Fkbkoo32.exe
        
        C:\Windows\system32\Fkbkoo32.exe
        789⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Fkehdnee.exe
        
        C:\Windows\system32\Fkehdnee.exe
        790⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Focakm32.exe
        
        C:\Windows\system32\Focakm32.exe
        791⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fhkecb32.exe
        
        C:\Windows\system32\Fhkecb32.exe
        792⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Fbqiak32.exe
        
        C:\Windows\system32\Fbqiak32.exe
        793⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        794⤵
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        795⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Glngep32.exe
        
        C:\Windows\system32\Glngep32.exe
        796⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Geflne32.exe
        
        C:\Windows\system32\Geflne32.exe
        797⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Gehice32.exe
        
        C:\Windows\system32\Gehice32.exe
        798⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        799⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        800⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        801⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        802⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        803⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Hhbdko32.exe
        
        C:\Windows\system32\Hhbdko32.exe
        804⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Ilcjgm32.exe
        
        C:\Windows\system32\Ilcjgm32.exe
        805⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ileflmpb.exe
        
        C:\Windows\system32\Ileflmpb.exe
        806⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ifnkeb32.exe
        
        C:\Windows\system32\Ifnkeb32.exe
        807⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Ijkdkq32.exe
        
        C:\Windows\system32\Ijkdkq32.exe
        808⤵
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Ikmpcicg.exe
        
        C:\Windows\system32\Ikmpcicg.exe
        809⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Jokiig32.exe
        
        C:\Windows\system32\Jokiig32.exe
        810⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Jbkbkbfo.exe
        
        C:\Windows\system32\Jbkbkbfo.exe
        811⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Jjefao32.exe
        
        C:\Windows\system32\Jjefao32.exe
        812⤵
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\Jbpkfa32.exe
        
        C:\Windows\system32\Jbpkfa32.exe
        813⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Jkhpogij.exe
        
        C:\Windows\system32\Jkhpogij.exe
        814⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        815⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        816⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Kjnihnmd.exe
        
        C:\Windows\system32\Kjnihnmd.exe
        817⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Kbinlp32.exe
        
        C:\Windows\system32\Kbinlp32.exe
        818⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        819⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        820⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
        
        C:\Windows\SysWOW64\Lfjchn32.exe
        
        C:\Windows\system32\Lfjchn32.exe
        821⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Lbqdmodg.exe
        
        C:\Windows\system32\Lbqdmodg.exe
        822⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        823⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        824⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        825⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        826⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        827⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        828⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:384
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        829⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 432
        830⤵
        Program crash
        
        PID:6512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:7104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6732 -ip 6732
  2⤵
  PID:6476

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:6520

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acbmjcgd.exe

Filesize
63KB

MD5
d2c70dda17b8e70f11105fdbbee2c23d

SHA1
78b4f8f457062bcb2496a7d633f1297d443e647d

SHA256
5ac1f6e2e2520386f34c3f67f2c134723ebb134de3e3b2841acfb8aa7e081c5e

SHA512
17ed3dcbe536f1364cb231fd669af4c59a1ea04be33831f19488623ecc8713c47b9bf8e13c955af3e43349c509fcfb1ba508556ef18da63a665e798896178205

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
63KB

MD5
4cd967b7e8ba438e11d01f7edbca4f75

SHA1
4577f0b484261b4af3f75c0af3ced70194cd940e

SHA256
7abe8ef979f1f21d0690aebc42a6823f17fa5bf51128f655d8ce32c1d89e8fd0

SHA512
66faa21506098696f1e55435938bf852bebeb4375cf7bfce16e75b95849ca2c7b07a168049dccf15e9dffa43443b14cf0887b0c252f218b91987415aa2fd88df

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
63KB

MD5
305438a09a8e3adc69db9da165db8d99

SHA1
ae4c9d22edbdfdda5a3533c078ee120395f2924d

SHA256
493c0dd0e6d064f5d8ce91f5bbe7b774c1986ed1e81b8b76fd5868dde0ab0947

SHA512
091e72b2c49d053a534a07db968322dfcec3369cb210714be4ed638c3a106135415014aff83059f28f2d9bd24dcb9fb6e656a51ceacf578c1a05f6d0bcbe4d09

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
63KB

MD5
ded384479a111ded7c93e9440e4f0d5d

SHA1
0a9bba481ec619eba01ea6dbf3505778322563c3

SHA256
100f7b0fb4e946ced9f6edcbc818b92b88375fe6aa840d96846b6eb54ab15c59

SHA512
0e03ca00c127aa1ab345d596c11a8edac0a52a07d465d25885fdbf7c4bd96b39647e1deb9d99d8dc470af90436b88c8772e59d578db38968f3aa8f1eae413845

Download Submit
C:\Windows\SysWOW64\Afpjel32.exe

Filesize
63KB

MD5
c2ad50ec21faf7035ef5dffdc7715909

SHA1
63c70c402a1100c58744820156c9b3067f6834ac

SHA256
a376196c82d4b35068af9494ed1e66bd145ff4148290f86b4f801094212e1074

SHA512
ac596e8614a47355aa96f03cfc2feff292e1646c62a1521ebf4104bc72cc6addee8e58a12f947c6ea89b19ef7b7dc830df6624cc4b41e520630397ccbf18ed27

Download Submit
C:\Windows\SysWOW64\Aklciimh.exe

Filesize
63KB

MD5
ed3cab4a09d37ca09dcd4f35459618be

SHA1
1e99dfad29c1554e0c5c6d29410f9d3c9fbbd05d

SHA256
74bb4104d0b09db44cbf98de535f93e548de6be948c18e597a8176766b2e8f0c

SHA512
4d89d5926fb83a54e645560725c2cf03d5e844c13c2b79a8f195f9c48378690550759559a12188bbbe06306b53ee801e6c334edfc5d6f226cd05e4059a7e5982

Download Submit
C:\Windows\SysWOW64\Albpkc32.exe

Filesize
63KB

MD5
2caaff0c15d7ac397b30b99a265e9503

SHA1
3ebad526145a0de7f7297c739d97d366f54fa2b9

SHA256
7117924529f000aefcbb6934383e6334b021fbb7f6574017b4098f4f38314a3e

SHA512
30a7b1e3f68280a240c138de541facf01db5e708df898a6c21a6666ef36a832c5aaeda14cda841454512a6cbac9c4705f97ba7506fcb1b7b2449ea168f6ca15a

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
63KB

MD5
5555d9201e4f7c9c066fbe66264e795f

SHA1
5377d3686fddbeedec722034f44382f96377d66c

SHA256
dd90aaeb96636db5cf6509305aa8578831a84987fe779f936cf962973fd72872

SHA512
4034635d8007f7b16e4e789b1aefa507b80b2fba54e3554bb20f8adad5d0715c7b79455a2fdab0be503f5313f768bc7e64ffe6426d84182d5fb31bcd97c32182

Download Submit
C:\Windows\SysWOW64\Aobilkcl.exe

Filesize
63KB

MD5
d98d8dc6b6040ad5c16cbc20ba9e4745

SHA1
ff68a48f7675c5f4a39a1201a6b4570f21e679a3

SHA256
c3734a03438a545c0417e11406cf477683c259fa4a4e97507149a7e69c4997f3

SHA512
761095307c9c5fbb9b10909515ac7a1b4758b93f1b50ee55bf7301ca4e751a13d1eb85645ef509bef26448b9a69932fa17c2b8a8c75150d183692ea5ac63d8f4

Download Submit
C:\Windows\SysWOW64\Bagmdllg.exe

Filesize
63KB

MD5
81cc53835592f459ae1d3e1ef068c558

SHA1
9e48b1dccf4fbaeddadb2844894d2516b30cc2fc

SHA256
0abcbe7c501013475ce68de7692d56d58d77f3dcfbd8a70ddcb643d9ba42f208

SHA512
23766309a1ccca8bd7f111bdb27ee2ea29e16f5d190caeee90ca20bb02bc557a2a024595b8ed6ff093600e8e805a7cd1e48ce938e48edafbfc12f5837ee5c144

Download Submit
C:\Windows\SysWOW64\Bkhjpn32.exe

Filesize
63KB

MD5
ca19d5dccaba4ddf2c19c4a817bf2e43

SHA1
da5297c8f169aa450ca138cf439e41e056a2ae73

SHA256
b59d0f8c0054c1423822d2aa8f8e5f96d4b1deb1f728e2eb2187bd002f880468

SHA512
310f253121bebf93cfceada8dc4412889b7e7553270e780ba9f66977de8567cceaad72359c79b7f9f42f7a2c07ac698eaba7612fa98c104ed5d0c43604a4d404

Download Submit
C:\Windows\SysWOW64\Bmmpfn32.exe

Filesize
63KB

MD5
f25fd2bf84397480821da1160cc08f1a

SHA1
b4343e6c28b13ec3923040589f2bedc45c1e2d19

SHA256
fca60ab09dd716f3b235891a7152114b7281fa8555681b7a5e2af0fb533a8c03

SHA512
4ba088850f7ee7eb72b6e6ca14e4aff933b43971777e9a8f1f893f7595836fe2fdaf76a95f012d5243edaad8823eb3f219a565229086a49ec7ab06b642f8af7e

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
63KB

MD5
2aa4260dcea3cbc727789d8bb9790f1c

SHA1
09d612a20d5cab1374469ea7a4811c58d345e75e

SHA256
58a5a1a4bea7f7720efd9f87de57d70ed5413ec60964fa56eb90950306f70392

SHA512
73f849ef217657ce5879bfb3755385ac85228e49090681761538728876a412ff4b5f248105e0922382cee417570f2d068603dcb858aaf866d39052652a12158b

Download Submit
C:\Windows\SysWOW64\Ccppmc32.exe

Filesize
63KB

MD5
868021d9de3237916b82867723d70d33

SHA1
ce9908c79c8018b96b187fd4c9ff1fc14a333c82

SHA256
2d05cf689bd1e35c39ca64e482d2bcdcea4fe7d34152bdb80c2eaa1af0f25200

SHA512
26bdf079488c1d932f4d6e7353a7619b5bbfe113a4279fabb8118d19546e62e9d89c1874454e4ee3b0d78471dfdf875f22ad17ae0c7e1fdb2e9939523036eb7e

Download Submit
C:\Windows\SysWOW64\Cejaobel.exe

Filesize
63KB

MD5
43e55769b72e9c0948f2b57f0595cfb7

SHA1
919054c6b529107bf449d6f4263ff99e16d7bc99

SHA256
04b621699e13fbc6f5a15e921a34fc3777a76e4c791a1f32d6cdb7922e91d820

SHA512
5ac4cdbd4ff329882a17de440dcb3bb213bc787d6695a1328d51e120ce7ca94fa6c9a968328a47ab8e56a3e5b0ba5be2894b4d3a862a8227aad79e5012423616

Download Submit
C:\Windows\SysWOW64\Chddpn32.exe

Filesize
63KB

MD5
c716e27ad77af34f1e6461d896ae343d

SHA1
caa181cb576e1a1f2ecfddc40894d714741442c2

SHA256
3939ad7a4e80fb5d358e73ff8b480fce4c068447293e3a7fd5700fe585944ec3

SHA512
3b631af88f8c53bc05f1fa0ad6fc5e56e13c7724ab01d2532a0f1038f3f62a8d63520482432930a89ba659234e40b5b850f19e18a04dfe316bc34b6545ab108b

Download Submit
C:\Windows\SysWOW64\Chglab32.exe

Filesize
63KB

MD5
0c6cdbff7d4a5e3f3508c82ffd483c2d

SHA1
546248d8ea3d1df1fe37d3fd739f6f0e06c86acf

SHA256
b7ce18c247b68f219066cf097c8c3324731e2521b7c21e16ef468368ae745ee0

SHA512
eeadbd2f343f740573c61479cc64e1ae084df36dca599abaf6830701c21573a4e79148433046bab1377aecff832d8e724d80b73314b6ed0b898f830f87d8ea15

Download Submit
C:\Windows\SysWOW64\Dfdpad32.exe

Filesize
63KB

MD5
cf33c32ff456557888c25b026ca3a5e1

SHA1
abe4c1e79821b3e1fc7bc8f8fca670ea2077ed8e

SHA256
46ba854278995cf70c1b8b87a1d8b5ed63aac2625ac79eb6404b03b9c1e64aa6

SHA512
62314a121ef16a1b98dd0272896f34ab10dc3149677a87974e7f84dee08f3cc362f2d763f05fa6c4395a0abe91ab951aea3205e2ca6fb80c81141098d2a7ab0f

Download Submit
C:\Windows\SysWOW64\Dghadidj.exe

Filesize
63KB

MD5
5d71a92aae767eb503111f0594c1def4

SHA1
d817651e765cef831b292259ecc3b3c0963be105

SHA256
bc31c420f349450f16251698175a4bbce7d83ee04f9a15d010dd2af89da85257

SHA512
14632fdc847a53477c161814e9bf63bda20553b049b58e0e7e051b144df33f0f133abea04f6c13bcf0fbcf44779aee2bc9612b4f679b1b7551c3fbc3ec58ad61

Download Submit
C:\Windows\SysWOW64\Dknnoofg.exe

Filesize
63KB

MD5
ea5ce8880f594056796cdb5c75d61e0b

SHA1
54b33c4ef93f93cf5129bad48aec319ec133d4bf

SHA256
0d177c79bd8f28536c121442d27bcfeb77a1ed77f0f752522f155ca4c649ae1c

SHA512
dc5d2e598fc729488f609c37525c35dfe5d0b57395dea12094fa4de94ca566bcc354fde0d3074f5e317f7eed2eb08db0ecabcf4805e8deaeb0197c9c4ac24a8f

Download Submit
C:\Windows\SysWOW64\Dndgfpbo.exe

Filesize
63KB

MD5
39040a35bc1679a9d320e42a8c98465e

SHA1
6d599be1a58f683cfd29415b50dae4d9e8040297

SHA256
10d09e2193a2ac68849e1abb73d05ec5d68964d62dd8aaf300cdbe289bc3b1e4

SHA512
7f35bde087b53cda88f31a26de4f2a17a0e1a4849fc5c8812a81d961caa902327dc82d16d93cbd319b1102c5518e11ef0e978d808893e0b5b1e94f18d7d148d3

Download Submit
C:\Windows\SysWOW64\Ecbeip32.exe

Filesize
63KB

MD5
9e755a1018421015891ed49a1a281e2f

SHA1
8dbaa2a34e3c6701c466d4a9238a11eb7855d3a5

SHA256
e0f5aa5b0f68e6b3dcc4678cd646826e6dd57260c5e0dc2df8203b18e762f910

SHA512
442759cc28af6abc85f27ddba0a21a393bacfc815303c7b5d2e8635d87d43f6df358b8069056a002a7ff31c937b8deff0a6fdd37f26a33b01662daf241525131

Download Submit
C:\Windows\SysWOW64\Edfddl32.exe

Filesize
63KB

MD5
4ca2678a7d93fe555ca2ba8cd786d6e8

SHA1
4991d68ed4498cdced6bc01a64de6b98e123b765

SHA256
147794748567f75ce0d8da4f5f454338c83b1267ce6f0124e4f20cfeba8ff4e8

SHA512
251fda2dfbe93932ed270341f57b42165e23b2e43cbc1f66e70dfee8dcdca0351a9db868d3fde0fbe1233f0b6e7a74138edaa63fefa4e9649c4e3dcb72e02c8a

Download Submit
C:\Windows\SysWOW64\Edknqiho.exe

Filesize
63KB

MD5
522053780f8c4b955bef413c41347e09

SHA1
e0731cccc96775d0f029c661329a44a10e74736f

SHA256
4c267fb7f9857a0ce18705a8ce2135dd87875c722b968fc4c7ce6bbbbfc28693

SHA512
a05f6fedda93d826d4cbb52212b236b637abfce5d77dff51efd7d6aea035dfb72af63cac8953663ae9c6f62bab47b84e7cb49471be53b1d2004d69a149f9534f

Download Submit
C:\Windows\SysWOW64\Efepbi32.exe

Filesize
63KB

MD5
2c21ee877beb10240f094f690c47db56

SHA1
7796cd6694e19945d675559e926e1cc4ed74c3ec

SHA256
265bb9c7f3110695f4d1dd8bc2e87714b42f9af111dbef4a003255084c18d1a9

SHA512
02c73f453cb35462f9756db24cf9ad4e0697b9987420bb65c41e3989246e84b292ed9147b3cd24f4f9f20e05a77cde65a14b5c364f271b007ab620ccb2dee1a9

Download Submit
C:\Windows\SysWOW64\Eggmge32.exe

Filesize
63KB

MD5
e71bf3127d65a93033c6292705ff1b3c

SHA1
6c136f031790d36078323c0ce3c017cf30924983

SHA256
552fb69f6237883809623f3ba65e199d8325d14fb0755d71a49ba86fd18e906e

SHA512
8bd15cf948ccceecab1fe582408ba8db3bec25c115abcca7512bb1bee073a29299434b60bae3080156ac479244d042cf317fcc5052da4b1c53d3d62bdde915ad

Download Submit
C:\Windows\SysWOW64\Emhldnkj.exe

Filesize
63KB

MD5
985c140d613244c69c477bfa9cb7adc9

SHA1
a79fbc4175b26df861b0443510a4e8420ecc226b

SHA256
015068b3942c9e568673dca81509abc712716c784b3259f90a74b26a793430bc

SHA512
88d62f3e4006274ce70a7ac4bcd707ff467bf9adc647fd902be6a1a71ba3840beb448e353687429e2a5177eb9f87e77a0923650cb61c6e234171ca411071e23f

Download Submit
C:\Windows\SysWOW64\Eobocb32.exe

Filesize
63KB

MD5
9042a6bde129b4eabeb9186a9ce213cf

SHA1
1b70398edd8e691e7e4a5fecb1fa44b1c27d24fd

SHA256
02d0ab4481e6bfef7f7112dcd760b5f1af31b608e6c7b2e1fe9a0f8d0906aae0

SHA512
3d7db83d695f0e619f450e709f991f52c3c6eb13ba12e5dbb09f762e7b1fe8fc6323b93b549293cfc86156c59678af068c2da76ae46877e71b4ad0bcaddb95e5

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
63KB

MD5
d9b6f5fb983e66b10301f44bce9998bc

SHA1
214a4bf274520bb60c980b7fc5c53b9bda750894

SHA256
27ca11304f481ef38786964b63d3ff4f5ebeaf1c80032958420684ad989cefe7

SHA512
07e8de894757253a3075d72adff860657c1a5da89a0f8c1e1fa46d876dd444846d9fe1bf7da58228ce8c6e3be043590cb1b0fe919114578d16a10f971f685146

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
63KB

MD5
2db45a83c59e9fd641962aa4651ceba9

SHA1
eeadc31d34d8bdec834581e825c1b63f61b93f0f

SHA256
0089003748cb2f0388bd30e9c2fc60cc05e69c125c27625bdf43cda1f1fc6e07

SHA512
aad1e5eb042534d18ed813a23eabc656baa542f1fde2a0899634b497135a98620ba073fe4a64798485ed979cfdb41137dce464aad0f12807ead1e52fb13e4eb8

Download Submit
C:\Windows\SysWOW64\Fcddkggf.exe

Filesize
63KB

MD5
245ae2b142feede94eecabc6674ea87b

SHA1
4ee89ec27c2dd7a48ff742b969ebe14083edcd0d

SHA256
964c8fdf5bd197be0702d8313547e2497c3f5d30192e1ca21441d742caf2b8cf

SHA512
1a24f854f466837c2b42ba4396116f0092f5cb4dd0fc2e75173d99dca36dfda1b8b05f74bb8f9d6676ab4aa4abfe5cd74c134456d2474b1bfc6bfb18598a70b6

Download Submit
C:\Windows\SysWOW64\Feapkk32.exe

Filesize
63KB

MD5
67809dbae7deae852a1df3be4c3dac0d

SHA1
501c4858d60a2ebfd2865892d9a30d07fd730a33

SHA256
2713c0f41afcb45421b5a1bee2dbaf35228618f4da2e2ca6c3aff1cedd71f6d0

SHA512
fef979e8c979eacffbc3de60c4f8234bb68e69955b23891fb9320d87809dcc97df0d54e42131440301af5862b753c6e8a6e467b33616c60c5d15bae97be089a5

Download Submit
C:\Windows\SysWOW64\Fgjccb32.exe

Filesize
63KB

MD5
2354ef1d1b5006f3e4845c5dcb88a30f

SHA1
fc2f9cc9e2d5313a5ec9775cb676634908277a2f

SHA256
2fd54e3f727e1ca085f061640a7b2db0958c7efc305a1f2783ba617b4b575ab6

SHA512
f10e843f626a4ec4f8efe3a4e20cc942bf29220a931658a9e0a5ed5315a18a609b00e9babf32c025b012eec3fa9e373bc718c7547a6139e68901c47716b43582

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
63KB

MD5
02532c5e40274b371da9456971f46263

SHA1
8e993bd806cf3143a29210bdd4cbfdcaa707d67c

SHA256
6526569abeb0e006d1db630225f4f0ef0f91328f5a7030988027d2427d88d3e0

SHA512
ec39d83f70a1dbc982ff47f7956973275d7ae5d6db015af806cc22c72bb4f82dd6e3fac81da87cc60c5e2c42096ef18394699682147f59248565c054f01aa4ec

Download Submit
C:\Windows\SysWOW64\Fjohde32.exe

Filesize
63KB

MD5
61396966c3fa1deedf19037d3e473eda

SHA1
80de077ceadbdf6d49cb63599bc0b9e37ff0d4a6

SHA256
50c636fd4c6c88129ff94edfa4f6e82ddc50de1e5da9874dbb6326100246d5ab

SHA512
63f13143c8f516c6fe2d0f1e33e0a256dd83b78070382dde65d24058bf4c653dd8815c51acae92a8f58c1cf7d58388cfece2d487f03300d067d9aa88bcdcd115

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
63KB

MD5
34397143f4e7ddecaf8c27f446b7b11c

SHA1
c64afac0287cae61e0dfa6801dacfcc2a985c21e

SHA256
b010ecb54ed00b18377873822cf6127a5e09ab31d0d9853354c2527cb36cd55d

SHA512
7ce13e7d1989a96afa160591cfaef689fefccf082cd35ca0fc0962e0fe53560c8e960a87002d4f187b20bbbed44e671cbf9ec61907692639ebfebf3ec9326dd0

Download Submit
C:\Windows\SysWOW64\Fkqeib32.exe

Filesize
63KB

MD5
f55c89cdf5e5d6b4311549434beeac24

SHA1
ae8966beeb2094c751bd5ef70eb956856664c8fa

SHA256
2ef84b2fbb39bd8b056608ce94dcb7f960cb959d2a0f74d3d1151025f30dccd1

SHA512
393c1dc369788bad2a1ee4864f362401773eb0ba177d86a4b7fdfcd1ac05d7d6aa5bdbe0d9664bec565b50afed083bbc5744e002efced9027865766e9ffac0b8

Download Submit
C:\Windows\SysWOW64\Flfbcndo.exe

Filesize
63KB

MD5
e838645faa7687e41ea077365c55352b

SHA1
91906d0e748df2b0d500527cdf951f7b2a428a59

SHA256
946d2a7728907a33fa987192d2ad3e2a7afcce485db2081c30f9f2217e2641ac

SHA512
dcdeecea296ec28b8c8ce28b6f9be84d4957a6f50d657c392ae4a12b0a3334fe4202e201dbcbb04d7ed2e0655ce4c54f426778bc11361faec5fe71474ecfaf2e

Download Submit
C:\Windows\SysWOW64\Gdhjpjjd.exe

Filesize
63KB

MD5
f406d95a98835cf7b14e6ef40bdd91f6

SHA1
c0bb697708cd446b1fc52aa60c92ec5586913015

SHA256
cd9a70dc0782454bf7a469b058c6539e09b24ce121fe0f7d84b701a993831f58

SHA512
34adae9596deedd82d762d658117dace54463c3f81394b40713daf040bb403b3773de6408073192debd65cf7e3eadc8d7b261946463f5e27177179a4599b2acf

Download Submit
C:\Windows\SysWOW64\Gebimmco.exe

Filesize
63KB

MD5
01492cef4d903849a4524c7fbb22c66e

SHA1
f9451af24d617c2612055f59824f23acc9e86a8a

SHA256
a4ef506a0209749163195940ed8c3a29562f4c8011dbf08deab9d8d14ce31f85

SHA512
31a751c92f83d5e4e5224bc3da662fe3c3e76d9cfe514d5744a8a0989a4e3bab8d5603c4b670ab91184850b9b0ecf69fef3dbcdd2b71dd00a374605931bef770

Download Submit
C:\Windows\SysWOW64\Ggnlobej.exe

Filesize
63KB

MD5
cce2614f77511967508ac93481d7ecb6

SHA1
2ecca4090b2d9ec8e5f1fa99b2c61f186f1261fd

SHA256
e8cea24dc76c18ea567d3ccf5bb276264d2af2900f0d3738fd10bec4de5f58cf

SHA512
46ffdc32052232b0a3bf1682971ef91beae920b6df87c49f1d8fcd2662e3b514d331a04b99b786b98e7e17c25f1281f5d2198fc01cbc86ef829ce1ce846b845b

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
63KB

MD5
b42f3144d3b1d20c8edc8a5278229a30

SHA1
c2f7a98a748cfd2b2e2e7c40c77e08dc6b8db3d4

SHA256
e798f15331760f82f9ef662e0f1e8c8911bb7b566dc049b44143e369ea859fc4

SHA512
8c884100b850d5ec010a1c68467b340800586690123da35024f898cdddb9f3648155c323b9d7c4ba6be23619d867f491565409238dae6ba57194af62b2404e53

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
63KB

MD5
91198b746817c0b85d2eaa67d258b788

SHA1
66135543021553bca80cdee19dffd8e3d5bfa02d

SHA256
244f44f8f6112fb0129d3b60c76fbdb882123275cc48007d616e4cbbddc4ed88

SHA512
45293fd23def259fec7022e8fb6871c2bfaed43eaa1cc1a6b6fd1e70bc348c1b2bbdbcf4120963feba0da5caef9a6ecb7441678d744d4a7a21b590938b314691

Download Submit
C:\Windows\SysWOW64\Gkobjpin.exe

Filesize
63KB

MD5
aad77df89b57bc53465f42527c63a216

SHA1
f5975c80c26035706ff2f90cc08454a03a5797ec

SHA256
f75e8aff052b7bc94e3b411f7e656760670569db841344a86e1167d89c5e9437

SHA512
b8e9738dd47e9ed7cf99344ad71a0355c484fd9549a64a2dcaf393ae3046f43cbbd79e19cd851d870c994eb9561f4c2fa03bc15e3c4712a25bd973b8e3223ed2

Download Submit
C:\Windows\SysWOW64\Gohaeo32.exe

Filesize
63KB

MD5
51bfb2943c16097061ed658c71fe309d

SHA1
3b24a660da07c0e5cf539af13a7d7380c72c2d2b

SHA256
d7f4eb5277a95605c48e7e61c356721b0d82451cde4d368df03b4cf15a0755da

SHA512
eb84cfedde441e8f68f8b606fc5faaba15f3469392f1dc29a2ad23e00ffb601104b4e4272d7318f71df804880d4d6cdbaeafc7383db3d044b4aa025b9f522e40

Download Submit
C:\Windows\SysWOW64\Hakgmjoh.exe

Filesize
63KB

MD5
bea1e7b8fad0186e2220d61459f14e55

SHA1
d2b53a32885cb39dbc0f652de635575369ed2b0e

SHA256
60f199e4154bc9974caae67a7f444d4fccc8b1e4461c0ec4ea2597b4eb33aab4

SHA512
6130ad837203104c3543481817058446290056886c75a7c29f9e977f03127f6bbf4a46594ff137b27707fda75e80b84717bf6869767979e0b8948a966cb48306

Download Submit
C:\Windows\SysWOW64\Hegmlnbp.exe

Filesize
63KB

MD5
b03051556a4d0e896964c31d7674f4bd

SHA1
72450276e48e4d526885d3709e465f4ba67445ae

SHA256
28fcc7dfe8822d062ee09af9a9aa1a6d57cf1c2b2c6d9aa6ced78e07436da033

SHA512
e1f568ae8679b47cf3e2a5e70b61d0d36a7f9f8c60a3cf69634c10daa205459e5fab7aeb2b43fb87aa44a1c7cfab384bf8f54eac3d742e3787e4bd1480c54938

Download Submit
C:\Windows\SysWOW64\Hfipbh32.exe

Filesize
63KB

MD5
db660087e7d5244927e641e2852e6268

SHA1
996da4418f380ad669f12952dc15c2515fbcdaf8

SHA256
675f58f267ed733f3a650a41f544397a85166c57b270fbbb4a56fb0ceeec13d5

SHA512
a1f899e32a1e06976ea44bb74f9e17cbce498307f9aa26111363ff8ac3327d8f6e59872f90a4799a21ef2d9c95eb021d6ee82689fdb4609c4c0a32b3b7860bc5

Download Submit
C:\Windows\SysWOW64\Hgjljpkm.exe

Filesize
63KB

MD5
41f463d9ba0ddb19675df66eab5e30f5

SHA1
80f6bb6a292da7e4388ad2fe6b03142a11ced3ad

SHA256
b4cb9902ed4cbbae596cd65936f0abf3ca15e0a715eb6f8355d46784a7703ab5

SHA512
f010e9771eb03892a07a002c69fd50be3c4563960b4a1fba0e613911d389e7711d383423eac80a7867cad7638eeb170ffb32e3e738331fddd351b4c801f5d3d1

Download Submit
C:\Windows\SysWOW64\Hhlejcpm.exe

Filesize
63KB

MD5
b7a5ae5429ceb169ab4fdafe8f44914e

SHA1
079063c6f3e684be52bd1d7ff6c0735ad5bae5cd

SHA256
e5b19c41d4dd5026b17b240a16069515190c58d44713294458385b7a545b6825

SHA512
3ad9370fddacacda82e9531e882da9e0244efbe3df15e8ed7b11dce138cbd1587167bef7a1f68f1a2f3f4dcc2c70eda817245a1e4d0877021e69ed41b63b32b1

Download Submit
C:\Windows\SysWOW64\Hkmnln32.exe

Filesize
63KB

MD5
b438e5039eb24fc2d4ceea016617b8d5

SHA1
e5d8def11a5c385da6b527d2bebd3001da7905af

SHA256
427e14ee6bf11733424df85e463fa9e4af2b847b441418fc4d0ae9d01991aa36

SHA512
a1fba55499d3af37f01031c14b7fef6939774656fb75f963bfc884fc8c1fa9ec3f783511d4201d46d8db87014d189c24ef1fa5564f0084608184094fc315a082

Download Submit
C:\Windows\SysWOW64\Hligqnjp.exe

Filesize
63KB

MD5
e5afc4efef72b76b7bb8f3853aca04f0

SHA1
6b193ecfd6b9da3fdae0eca00517681c6370f9a1

SHA256
7b0fb9eb61dadbc8151aa1a1817f0c94f7c424e6488c3e607ebc598ddeac2829

SHA512
e6bac8bb7a42cf0d3a857d5947707e0558807163529b1376ce60d8da88bf1043343b18100e954bd859eb12c660aab8b31eb117f6bda9f34557723fe62b9759f9

Download Submit
C:\Windows\SysWOW64\Hqjcgbbo.exe

Filesize
63KB

MD5
3eef7374abd1e606b7f64794061378f4

SHA1
5dfdf8e28127150ccbc6ef47f268063c14d166e9

SHA256
2ec0ac0ed71284d3b8ac78387d2986272148a9a37ecdc399c900dd7cd6134204

SHA512
5677381e2ee93080de34488f223ca2f45cc7313d2a028c65ef2b8bef7148ec0ddfc724289e912a23534b7f76ac41c49dec748113788f43ad2fdd33a08b27b8c7

Download Submit
C:\Windows\SysWOW64\Icklhnop.exe

Filesize
63KB

MD5
0cb30f4dc552511e53a13b2f8a7f2784

SHA1
0f54756ecb64440c9cd739c7a952606f5cc24e3e

SHA256
2cea271e8146dcf27d3b63e733fb8455ca82a0a7518790130accee4ac3821e63

SHA512
149c1130c7583ab50a59ab38eadef4ae11a17c8775e811b309ff77cb6d96de29299b9be206171d3913393bb646f066de66330a1d3960a915c39fc9e0af6cbd5b

Download Submit
C:\Windows\SysWOW64\Ieidhh32.exe

Filesize
63KB

MD5
5eac883efc385797701b4e7a9c3082c8

SHA1
f483a33a791a301dc709c806fbe9bff43b0e985f

SHA256
9d696fa06467860daf9631edf429f34e1bcfb8443abf26342ba7298cf5b9fbce

SHA512
bdf703330c97eb7d02180c1c26e18f40687bc03c2e54902d8cf77a259b86eb82512746ed93cfdedf953a1b8202a8e967b6e5e9889f29e4dc5dc757f9da275aa5

Download Submit
C:\Windows\SysWOW64\Igcoqocb.exe

Filesize
63KB

MD5
54ed211f087ac9f87505d968a25530c1

SHA1
8b097e0e132d7e63ce1be7ef60604d1edff4a6e5

SHA256
04fc49123ad4179f2ea219e6295ccba2171a03b2834b597143139a67980ba407

SHA512
3382b0682cf6cdd3b8da62294749c7ef0249b85cbbcb7c93ae94838e47987155b70503b1f38c182407b9667f4bb42b71a10b2e86400b11484a4ad499ffab788e

Download Submit
C:\Windows\SysWOW64\Igkadlcd.exe

Filesize
63KB

MD5
ebaa12b882b29e7ec2cbf30d1624343d

SHA1
2954b27514d2f1e8295b8d8d26bc6ed272549daa

SHA256
c873481611a751092f0a0d7907227e76e42c91b6353ff5ba59708b78dcf3e758

SHA512
fb462eb108c3c77c0d16d84977436e81e42cfdbceecabdf28a206915487c33b130b0c6af8f62afee054aa43bd7c1c2438164c6e704206326294235904ab1089d

Download Submit
C:\Windows\SysWOW64\Iickkbje.exe

Filesize
63KB

MD5
e0f9e57a4fc967208cbaba39eaa4cb07

SHA1
b87bb6f7eb39f7b507e5aa8202ed855c27c9afc9

SHA256
b57cfaef4ebef342f01c64eb4a02a04ecfaa5d0a7569d3ef43d01f692deae687

SHA512
a419f8f840e42b66896075bfd7a2053e609c957a67d7422d424f4f9156cfedfea9d90ce53da36b7a65493f6400e37e2a60da1e42df6b9d60de2401132548a164

Download Submit
C:\Windows\SysWOW64\Ikfabm32.exe

Filesize
63KB

MD5
e5b40b825f6cdba4a07ff83c4bc34576

SHA1
76658bd93c3d55e3c5f346e1298d56cce7863293

SHA256
5c601699c5c1055fc026db58162ef168d68f87726929df844b5d5d0bc73c5329

SHA512
a03bf18aa148edfa7c70d8da3f67ccf04f250842c84d31ffbc749e71f6477f83bab36be30bdfc67614ff7bf55c935875335b99c5cba452c54a2b3bb61e474fc6

Download Submit
C:\Windows\SysWOW64\Ileflmpb.exe

Filesize
63KB

MD5
3c678bf8242ef1a9ba520e37504822d2

SHA1
ca81ee0a9de7bb032fa4549dfda63cc32e1d500d

SHA256
cb811f088e1c6e38a5762eb761cea823d8eeb19146ab1b01c70061a9ca2915a5

SHA512
3bd072b040a1c174666e68cfbe726c80134a1e882eff7cbda05d6ee6934d34a7623e7489f5408e4a0086c5bc85062ccee2397e84387352cb5a87903a5d327127

Download Submit
C:\Windows\SysWOW64\Jacpcl32.exe

Filesize
63KB

MD5
7c6c36f29ac081884c8c3b714239d69b

SHA1
409212544894fe6b124922e0532e865e62d236e4

SHA256
66a9d282f3650dd716ac0cd50b8916614364634fe304683870bc788fe547f200

SHA512
ab9438bf53ca101c9e10e4a8433d7f0da59ca2f064d1073aea75febbfba615f45d19b2e4a2befb329d8fc66041365a4294888decefd3fa5801fb24c6d42f3382

Download Submit
C:\Windows\SysWOW64\Jaemilci.exe

Filesize
63KB

MD5
22e758fa67ca47ce2aba5cb6e43be39c

SHA1
ef596b36a896dc136d1b0b3407d9b15486d72b06

SHA256
f367148d289280b8d5e1b68f29b445276a799ba753ef6dfd96d2cb0713c11605

SHA512
1216933424631cd1a05b0f6a50ca552d8a5be227a9125477216e2ec57b679fb8330b38550452ef4afe52db363553f972f7d8ef7d0cf75348afae6be6bffbd201

Download Submit
C:\Windows\SysWOW64\Jbkbkbfo.exe

Filesize
63KB

MD5
bcab73ef99663446fda288a0c2c2403c

SHA1
362b24d288d03a25335ee2033febcef749cd66a2

SHA256
08d6cd3c3556e01869486f9552825e8c5d3e0720d71a513fd0ebbddf0b7b658a

SHA512
e79dd70b210cb129cd60f0e6b2461e49dd1660b9dc1fa9aa6cc4b76daaf6e9d22f0f76e7f6c77ed9223d2bdbc267a27e311fe7d1a494ab975c6e146e2064c9bc

Download Submit
C:\Windows\SysWOW64\Jbpkfa32.exe

Filesize
63KB

MD5
b53564c6d13fa461f755d67a06e74840

SHA1
30be24ba6b94ab142d2ca81a583e157894b11240

SHA256
6545b90c449da80523c5a85b236b50c60ac2a4980670634ca622de0459147001

SHA512
92e0e3c58b4b77dc3a63a9904266caafbf0a4eabf1ae46a3f135ca0c76360ecc229bd19da60b76515ecefc4a90ef4d13ec70955d0ec57db884565344fc41c8d0

Download Submit
C:\Windows\SysWOW64\Jehfcl32.exe

Filesize
63KB

MD5
f7b6d5d7ea1609f069045b1bc98dee97

SHA1
7012c54c216b58e4a47ef09c9df1b1e25dce876f

SHA256
5e9e0f798c01d6c70c1773cd67c1a125a6f73d39d206bb8a174fd436e66e79a6

SHA512
bfc6821fcf2d41699e6819ae50bf75ca5be22393f86cd62e7c1ed3b971241ec99cacf0c3d9b016adb8a3816db1a762dc1e54ed0bcba1769a1098181cfbc8f641

Download Submit
C:\Windows\SysWOW64\Jfpojead.exe

Filesize
63KB

MD5
966b4159f85dbf346e83afdcfc3c275b

SHA1
f9aae829d399f00382b585a587f893d04bc2b5e7

SHA256
1fbcf500b3586ef53494404b48ece76b46390549fd4cdcdbc030ee3ede670bb1

SHA512
81782fc793ab5f1a1197e43575e0743e5bf80e0524563527947cc84274d247fbf2714cb9687367ece6172bda149af01ae506e368d3bf625c2002798557e510dd

Download Submit
C:\Windows\SysWOW64\Jgdhgmep.exe

Filesize
63KB

MD5
7bd51585fa3987b1e49349fe89802696

SHA1
e5fea1b9af3d9e6fecd341e5c800d997f386cdcd

SHA256
4a0375e76c4745c4bdf25ad05ba42401edab72172ae7c9866f0a6133a11b69ac

SHA512
93ba537c6913a01378aa15e15ce50d1317a525005b94882c43ecff50958ec0d652dcaa9cc0415de873fc21372a4148a18d3d1cf817f6780ae0d45649f8212507

Download Submit
C:\Windows\SysWOW64\Jilnqqbj.exe

Filesize
63KB

MD5
184afc32b51b9e8152e5ba5f76ccc4c1

SHA1
4a4a2518fd92fc0604ccb2a85403c58cadceff8a

SHA256
b119b2fc0c67a9dc065a9ece89836811bc0c270cfda16e58068df447b85c6c49

SHA512
26865b2f8e25f884a59e3c9bb198ade2f4bfba4bba86f59b6460022b424034be39ef2cda1f9d0fc571cf060bedb7741994234c05b1a1d9d70d8f0bcc028e3d4b

Download Submit
C:\Windows\SysWOW64\Jjjpnlbd.exe

Filesize
63KB

MD5
ea44d285ec8c562b1557a1c383f70094

SHA1
af0f8a42a993260f85ca7a17725f4dd70d035068

SHA256
8933ca59265e11e6029ca8aaeee3ca4a72622cef3e9d572ca18bbe5b0ed92566

SHA512
5e4c4016ae8de301b9c3738a517068131a9d854ce1f34fad322cfadea0ab83a0cb951edf36ca382f3617803423696fbb9669785eafb16c24ec25aa57241bd2e5

Download Submit
C:\Windows\SysWOW64\Jpmlnjco.exe

Filesize
63KB

MD5
13b19e24377caf3d898596296e53f591

SHA1
5999bdb140de83b95c52e28487d468592bbeea74

SHA256
28f84ebef08fc76a614d356a5b25ebb0f0768ec1b7dd5af628dc0136cd5fe0ed

SHA512
239b80cb0661927e0a3408dd2f1da91b0cf1c0cba0ba981b74707667610c9c7c8ef72094dec6c7e44ae9ecb7db167369bc8044163144c27664157ccf894a5ca9

Download Submit
C:\Windows\SysWOW64\Kbgfhnhi.exe

Filesize
63KB

MD5
49c2da0cabaf66d64de8715ce7febd48

SHA1
4b321af223be01c1d49488b1bf0a44d6f025b18b

SHA256
c6e758c62ed3eac48be613caa81a25c08ea48e8761a380d317a2fb5155d1c870

SHA512
8f150de3dc6020089aa9f46d0523950b6481fba37a6e5491f1ffbe2c23ae6c1b19f0da427b6146483752f827be351530bf3ef7b978eda06aa7def91009a64c9e

Download Submit
C:\Windows\SysWOW64\Klbgfc32.exe

Filesize
63KB

MD5
f3ba592097c1dd6e85a5373ad294f3c0

SHA1
a284bc3082a50834d4e602ce9e2290b9f182d820

SHA256
598f642ceee518c7418af0c2ea49e3de2fff69650de94479d676af7431ffea78

SHA512
3d3b07933eaaf2ae96f6b8f3e11a4c439790d99082465906ffce8bfd100ddcc9854a94efe16662a3870f0c76f201fd91681a80dc040bc2a6824cdd5cde91df72

Download Submit
C:\Windows\SysWOW64\Knkcmild.exe

Filesize
63KB

MD5
4c384e31584f2e6fd2dd741f649fe2e8

SHA1
34a2dd5837f2cfeff3ce33c97baed15a52c61add

SHA256
43bcd5edbe98addeb46c3cb45c29157e4231a17cfd5cbe9d9e77bb30d7527e71

SHA512
e4528142d29a4f73f66d5bcfb10456bf603c480293e4d4e4f488bc48a2f0699fbdd00a927e3641af0ea91e52fc06a1c0b336d45f2d038ed035329a7a9a8be8a7

Download Submit
C:\Windows\SysWOW64\Kqbdldnq.exe

Filesize
63KB

MD5
45c56dc7cf83038f1d1d79cd60872e0e

SHA1
2eefd8d83a43714e7c8b05ddf44a73c62d5edbb8

SHA256
aed5126cff1fe6ffdc30b899fa70f0b268ebe93263681eb477ac95af0815a6b8

SHA512
7c4c977863f9ccff7a18a1340bc82906ecb52c4e6b4231fabe8ae59138a229be0318a25e4fec08bfb9c72c5c03b6d98b6031db223aa917ad3d6c745c3dc17226

Download Submit
C:\Windows\SysWOW64\Ldanloba.exe

Filesize
63KB

MD5
578c123cdc40b602165b4eb381749181

SHA1
cb987ed72c1c84dac7f4a0f398984397072d3baa

SHA256
cb3749db6b94a9f9d5bb6ca0a7444a41f1a2b4f4644f771c9117cc349903b620

SHA512
db2a41453941c7ed3a6bf5cdabc494d1a43e0d4e3abbf7305ce584c89e35a3e1d981284666c6b45d94d4e21f047be181d508f9b4e3351d209bbaa63d7efc2242

Download Submit
C:\Windows\SysWOW64\Lfqjhmhk.exe

Filesize
63KB

MD5
19748ec9d941ed787a1dc613d4cdf364

SHA1
fb691573d1b450b311b3b226203ed4707a7143b1

SHA256
c576a16b3da256479b02238f6e19df718340631556dc58bb5fc9d8d54cd4d969

SHA512
ccc08205bf50f3eb7cda2377ac7155623b61885e1837b964abb2ed1678f538d0fbf773b06b6d2a7e657d666550d6f40c40981087dfeaf36e444c776eaba6b149

Download Submit
C:\Windows\SysWOW64\Likcdpop.exe

Filesize
63KB

MD5
ef9f4266cbaa7846b6b5a009e1ec085f

SHA1
284615e9573959abf822e60caa444f397695c2e0

SHA256
763270e0a68342117ef4862185d993732f1030aa90accc4d0db5deba86e62d20

SHA512
78b6e91902fdfb0d9e74b97235ce63a0981528c94db90f200231d1c52561c20901deddeca2a68c11c531d563fa6ac88cc757a64a80a723a623b540ac7b18e5f7

Download Submit
C:\Windows\SysWOW64\Lqkqhm32.exe

Filesize
63KB

MD5
29a61b9b88cb8200956965c34585d00d

SHA1
b290b223a4d080584f0ee66321fadcf48a6aa5cd

SHA256
7bb70dbef278d653eb65bc92928ed58ffcbee1eac76910b7ed1c3e99917921a2

SHA512
2f8187c2623a1de5e5b634a86904a9e2a96139bac5ba9fe2c0dfb2c4d2b4ecaea50605b37a770ae939de61abcb1dec8706faf8220124a478b5e368a13149585f

Download Submit
C:\Windows\SysWOW64\Mdmngm32.exe

Filesize
63KB

MD5
9d67ddcc24422075330598590e813d1f

SHA1
d3e9aea13b5eb8f210547dcd2e114163c58c2ec0

SHA256
77cb5cd660c6cca24276072afa925834c3101eb7f6efab6c6a18f0429899c468

SHA512
e9e319578ed00b3e9f217a360fc20c4331c0f58520c16858af862c8510ccdb97db6f081859c3caa0b5300619aadc3f5180ee0f5806d7b772609b0d0b7206676f

Download Submit
C:\Windows\SysWOW64\Mklpof32.exe

Filesize
63KB

MD5
b2c0d6ad9fc50bc6325bd60ca0130e11

SHA1
f8296292282d0e6187dbfc5ffb62ee7ce02d1d39

SHA256
70ee7d4c286c55dbaa91f10d257dbd03d49207796ed32b9623fbacbb4f0bef44

SHA512
afa4fe3ddf0f7213793378494dc7153b4a8d706ba46a9edec361b2ca879d66cdda07434eab5c34f7fbc8a003aabc1d4f0b97be75a11463836aafed35d73b5d51

Download Submit
C:\Windows\SysWOW64\Mnhdgpii.exe

Filesize
63KB

MD5
4ed6992a576c4ac5bbca0be19a3e0603

SHA1
a31c9891a6e70fcd9f8866b372b47f4f40b1dd3a

SHA256
9d00a82668d15c436f090d986dae3994835ede3b2cadacb72a789d1a17609b9c

SHA512
aa0cc48a0c166cf8ece0ff03fd06cdbc197f30aa9f983eb7f01827e614602f27ea74d5f15c814060c6886334ff73b662ea1a37af18a43bdf962c8f11dbbbebc2

Download Submit
C:\Windows\SysWOW64\Naaghoik.exe

Filesize
63KB

MD5
b42a65793e4c565cd2f08b7bf6aabf3e

SHA1
c8f80646985981831dc9960ac9ad098d6cff580b

SHA256
ba4acca05b9884199ba609c9b643e0c62d919c5e9637903fc4d2d96d03560ce0

SHA512
7ce288ba8674b38eb6d1a851a20c1aa800c1155ce9ccb834d2fb1db361a2fec6117767fe7ec88ccd4596783fa523d05bdc993ed64f3e3408f1282cfc5b9b347e

Download Submit
C:\Windows\SysWOW64\Ncjdki32.exe

Filesize
63KB

MD5
39fedcb61b517a86052683a7b9232507

SHA1
01d7e7c71b53adff1e010a5b1cc559423a7ec72e

SHA256
ebff66a41c68270d374bd86df85c7ec5b45296ca35127275900288914e78afd9

SHA512
e98fc628f967978ed2bc735dadc9fe54f2f47a402f8a67379669efcbdf772f2a3a873dd3c110be6bed0b39ff5238c4ae419babb8eb0cd24f8b6fbf364bc78112

Download Submit
C:\Windows\SysWOW64\Nhkikq32.exe

Filesize
63KB

MD5
39b9d9bd25de83489a6e08161b3fa22d

SHA1
48f4a59eded748b1a80d0b82c2f83d22e7bf2beb

SHA256
13320d84b3e4ebacaeebfa9c1c2c0804890bc20b7edde1716e3d31773c988c75

SHA512
0390b33280260ae6549129790eed4bc6144cf2093c9238ff22a42cece93dbccd5d3a89c84b119b9c9451a3e8855602da155df7b7c085bd8a3d66bd12b5c050e4

Download Submit
C:\Windows\SysWOW64\Njkkbehl.exe

Filesize
63KB

MD5
bc08d620f9afd1d091d8e47d781d4286

SHA1
1bf60dccde6acc96f5c02319c4c014d009600e12

SHA256
12bdd49a41f6206c537cba726fc29734211d453a1aca7c65c619fb4bfe0fd52f

SHA512
03f510942b0a743f2c6a45d8562427a995c6c2da3f816f1ec2d005af53724b9f8e5132ea8c34259fffd1e42d491aa76ccf5df56174e81255b9e6e45624d38925

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
63KB

MD5
afac980c2c26c555158a4967af118de4

SHA1
9332dc5c554829c211a796d80f9a20d2bf902d1c

SHA256
3c37d58479635c309e14ae804efcbfbb4e4a568ff9e399af745c64684f8b3ffb

SHA512
bc483c0e08b569c0caeee1e50004562bab5e21789987716523b04c48e1cc72e3fb0e48a4b57750e46dcbd8ffef1a22708bca8bd816fb4716e834dec704f29f7b

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
63KB

MD5
6c9800548f6ea87d226806f4afecedd2

SHA1
64168a00709ae27136369a85d31711336b1a8947

SHA256
dee09671bad50e4cd0b16308698247c17922099b8490f7237e9b5ae66ae78c67

SHA512
a0a96c11738bb906d3e958c32c3393a9a2b2d47e7ae829d11e432d015ae6e1e686cfc46f8c8694dc6fbabbd460d9ac643d6bd11f17f08dcb875c19ed2e3c6da7

Download Submit
C:\Windows\SysWOW64\Oafacn32.exe

Filesize
63KB

MD5
b1c38019c506726633c232dfbd877ab5

SHA1
0dda70285e8474e73f648e6588d8049eaf64239b

SHA256
ec087bb0625f16aaf274ffcc95ff5ba397e3d45e4fbef2a01deedb363ce3106f

SHA512
76a4ee6d664ddb6c93a1b24c3e0d88d20d32c4dd18d3049c089b6bf3f5106aeaf5a10ff0340bdbae91d423a48ae951da826568af29886f2a0be5addb31bd65b7

Download Submit
C:\Windows\SysWOW64\Ochamg32.exe

Filesize
63KB

MD5
9cd540dc1719d3e661f5371123d56c7e

SHA1
bd5cd2bafed186e6fd7a096de0348b80c5a7bd7e

SHA256
0fcfc9223c9e49c10801fc62cae3361bedb2ccf542c60875d3260fd6915e9ac8

SHA512
1153e6bb086112c5096d6c5afdd6ddde7ef354b2b58d53430f34b014265409eac9b3c6b3e36c2073e71947bdcaa07d63e002dcc9f3aee360d7f3abb19bba1e05

Download Submit
C:\Windows\SysWOW64\Ofhknodl.exe

Filesize
63KB

MD5
a2743eab9e0a83cd217a04db5f4ef633

SHA1
ae117c6665859fd0b0daeb62547b699f6b354e2a

SHA256
c6572647f03f987fbc601a1883be8ff2946490a11dd3bf56cb80551a712b4a6d

SHA512
e884559019bd183410369f7c544d0e0bdfe42dbeffe0b67f7164ea5eaa50492fc543a41065a24bfa69ff2802061876d10d7a6739d236fab4d0b04ef2366c435f

Download Submit
C:\Windows\SysWOW64\Ohqpjo32.exe

Filesize
63KB

MD5
f59c1578412ce0fe013766e33410c2a5

SHA1
1d5622ec592173a4c9356e975dd11e921caefae3

SHA256
164c3157ab63942e75c0c30bbe482432dec244375ae6e7d6cea263c37a1630e9

SHA512
3e8219a7d11319b812b0b5c466a44f271b34429248ec2b47b4ca6a451184c305da64198118ee76bd9d8e1ce37f607620a3bd23afa4baac5d1af7c333f058dfb6

Download Submit
C:\Windows\SysWOW64\Pdgckg32.exe

Filesize
63KB

MD5
59b2bb76605cf305cc4fd46ab4b7be5a

SHA1
2eb88f6914804fd58c691477b5a2b9e254d77ae0

SHA256
10bc9c5ffb000e36eeba266f247d07779a9f23b385afa19b4030ed96278e97a6

SHA512
7735d4e8ec7b53529fe9c66a1a5acba405a86dddb0a2e5c516b6518a2f9bbc4e58bea027aa74bf0f8fe66ef78c11200357442fc15f8cb0d558149343d0644ec0

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
63KB

MD5
1e28f021d24b2dbc4db762d1dafbaa10

SHA1
95537fca30cd96ed212545246ac15a648b8bdd41

SHA256
56abf9ab4437696df27efcfa39608dfb387e654b203204ce13cc06bdb488ba2b

SHA512
ca80cfc4116f785fecb7a9ccf28583859695eaffc62bf7c918df7eac642a469c703a453d9587a67355b13bbc8907c00dd925a3a1f65bb1f292cdf64691103789

Download Submit
C:\Windows\SysWOW64\Piphgq32.exe

Filesize
63KB

MD5
21001be012be02a0754e43a97bddb231

SHA1
67863b88afeb01cc8cd6aeba7fa9b2f394ed279d

SHA256
1be907894599587627da01df935015b9f4c54f8260905bfc0ce7ea882f4ca5b4

SHA512
9a0ee995c2e1b0816e9a7015f3aa3d48876d7afd0212dc9bcc8b856ef7bb0ab8d4a3e18756ab3e916ddfef88978e7d232062c7a6ac3dbb312f707e221730ee8d

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
63KB

MD5
9310fe518058c2b6755e3d424b51b2d0

SHA1
67e83fe973850ff3cc95a38602697a02e74ab887

SHA256
2f29240dc460e877dcd2f6bfc75139923a29dbdb704ba6f6e9ae27d9b804f1fc

SHA512
56c219b203fbf1457fd06b660ecc55adf6b145cdc2891ff9cb2dd686bb652ce1c10b7dbdb4a08b73da41a93bac588ce49a5039e1546d9bbea01ee497514da407

Download Submit
C:\Windows\SysWOW64\Pomncfge.exe

Filesize
63KB

MD5
aa68b26a382281445ac80da97901c44e

SHA1
3bd3f807393e8ca6040fe3744f5e4418aaa6ba43

SHA256
0b315b6e39c8433d6f9921008e6e84cc700d11161dc7d1aa9f03a1b411367db9

SHA512
67378856c4b87042f9fcb55522a6d3eb06c79f8c62ecc5df6102fe64d697812415b47ec0e6edb98fc4edfa84933c48ed898e0ef8aa4d2e3d03b5f4ebe4dcbbbc

Download Submit
C:\Windows\SysWOW64\Qaalblgi.exe

Filesize
63KB

MD5
1845f5273249c082d47e69ed29c1d369

SHA1
def9682529c28f9841211b54be1e3a34b7f155a5

SHA256
60839b4f316ff359a6ddc4acaf8042fec3e06af25399deb569b200bd32c97b92

SHA512
8533a102aabe7afed3bf6ffb01ea200a05a4ea13557409240a442c7c8f858458464ee648fb93621cf7ac4b1e20d36b1364e72dc8fb7e0a9c4286231709cee986

Download Submit
C:\Windows\SysWOW64\Qfjcep32.exe

Filesize
63KB

MD5
af8c2db782e80bc3893f1416c7cadfc4

SHA1
a0b29f3c766858ece7b425af6b76382e5d634170

SHA256
d22b7874ae0f12567b937422db2a5e254531d5c0ccfd4fe8f30ea1ef08a42ccd

SHA512
f00a94c1642f9c20cb6afcc8f30024afabff0f0beea016ce413cfc6df1655564ff0985b5866842c764c7b2a845787b63ce6c317bc56277f45c845fe2f30cab8d

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
63KB

MD5
672be7c26a3780ef9dc4b99a5a320365

SHA1
156c0abb46df7fa293f6d761682256ff05d9bb55

SHA256
b0c3d3379cde03a9cacf2d9fe23366ed285ad61c075f4cb8a98a45ab6b069522

SHA512
f7ce6b59439a0a22efa0795bd2a1143f4a13d030552b88c7a307459cd4323e6b3faad8f7f1c172222c03d6b5bd1603ce022f010c92581bb9cb79b0627b7d7405

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
63KB

MD5
7194e695d88c923367bfb5a66c8b8007

SHA1
5c6cba48edb8557d665b1729c8e8ac3c45dbaf47

SHA256
4be43ce1e1d653d26e750b44e8438a5ccb581618257c43f0a886553085e0570b

SHA512
ae8060b2f4e9dfc6732b551ccc4b0ccf2a1e3599fcf6ba19af8247a987f801b72705eae8a8c5e1d500303b2f03ea4a254901ba3d8a743c5e1f30b257928fd27a

Download Submit
memory/400-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/548-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/796-577-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/916-432-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1044-602-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1044-73-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1048-414-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1228-49-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1228-479-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1268-473-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1348-575-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1420-287-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1476-329-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1660-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1800-402-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1804-429-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1920-493-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1964-547-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2044-372-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2112-181-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2124-499-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2144-261-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2196-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2196-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2228-299-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2268-201-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2320-113-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2320-643-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2416-137-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2456-445-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2488-465-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2528-225-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2652-459-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2684-185-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2684-709-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2716-541-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2776-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2776-635-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2808-41-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2808-472-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2928-267-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2992-565-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3056-101-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3092-336-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3208-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3208-451-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3220-241-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3248-305-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3276-342-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3320-249-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3360-161-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3404-521-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3444-269-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3600-509-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3664-396-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3672-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3724-81-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3724-603-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3840-145-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3880-408-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3900-25-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3900-457-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3920-169-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3924-513-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3928-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3928-1-0x0000000000434000-0x0000000000435000-memory.dmp

Filesize
4KB

Download
memory/3928-335-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3980-586-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4012-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4232-523-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4248-311-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4252-238-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4300-458-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4332-389-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4348-129-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4436-363-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4464-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4464-589-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4468-212-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4500-93-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4528-354-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4540-533-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4548-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4548-471-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4552-275-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4612-553-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4780-535-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4816-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4868-281-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4912-485-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4928-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4984-153-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4988-216-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4992-390-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5000-323-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5024-487-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5072-317-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5080-559-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5108-444-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5108-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5132-590-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5180-600-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5220-604-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5268-610-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5308-616-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5364-629-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5404-636-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5444-637-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads