afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05

Analysis

max time kernel
140s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe
Size

67KB
MD5

a4d8fc1d0f7d7a3fdbedff301d10961f
SHA1

8d91c028ad5ff9d96d8450152fa825fcc4b93244
SHA256

afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05
SHA512

3473956defc9cbba80445fe957dd6a675d28aa79959e616021fcd8cb30e23014592301b62f6ba8297c5690d23b8bc292cd9f92003e5dd3c3648f0d0cf0dfef61
SSDEEP

1536:C9Wft3InepQ4fy8GXHbZyokjPQ+FzBveEk8OS5w1cgCe8uC:LJInEyPVD+vVk85wugCe8uC

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iohjlmeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eclmamod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enmjlojd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nookip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djhimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhkmec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emkndc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lblaabdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emmdom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhfaddk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikndgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjjpnlbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldgccb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohpkmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmdkcnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljehpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kngkqbgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ompfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifgldfio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmjaphek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmcolgbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmlpaoaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbjnbqhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcpojd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbdiknlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbncapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoogfnnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbiado32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknifq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbcke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aobilkcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eicedn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hehdfdek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpdhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kclgmq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbcke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibcjqgnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iohjlmeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idbodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pidabppl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpbfii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poodpmca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likhem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olijhmgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbabigfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efepbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okkdic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkkhbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ollnhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhndljll.exe

Executes dropped EXE 64 IoCs

pid	Process
4736	Ngpccdlj.exe
2296	Ndhmhh32.exe
4532	Oponmilc.exe
1776	Olfobjbg.exe
2860	Opdghh32.exe
4820	Ocdqjceo.exe
2120	Ofeilobp.exe
4552	Pgefeajb.exe
3320	Pnakhkol.exe
3664	Pqbdjfln.exe
1340	Pnfdcjkg.exe
1912	Qqfmde32.exe
3396	Qgcbgo32.exe
1980	Ambgef32.exe
3288	Aeklkchg.exe
2560	Acqimo32.exe
3796	Dfnjafap.exe
2524	Dogogcpo.exe
3384	Egdqae32.exe
2128	Emaedo32.exe
1256	Eopbnbhd.exe
5036	Eaakpm32.exe
4964	Emhldnkj.exe
4840	Fknicb32.exe
2340	Fajnfl32.exe
4308	Fggfnc32.exe
2516	Gochjpho.exe
4044	Gadqlkep.exe
3864	Ghpendjj.exe
804	Gkaopp32.exe
4380	Hoogfnnb.exe
1756	Hnddgjbj.exe
392	Hnfamjqg.exe
2708	Iohjlmeg.exe
4512	Iokgal32.exe
372	Igfkfo32.exe
4416	Ifgldfio.exe
2172	Igjeanmj.exe
4144	Ibpiogmp.exe
2632	Jfnbdecg.exe
4396	Jfpojead.exe
664	Jbgoof32.exe
1584	Jbileede.exe
1824	Jejefqaf.exe
4988	Kpbfii32.exe
3476	Kfnkkb32.exe
4352	Kiodmn32.exe
2028	Llpmoiof.exe
1304	Lehaho32.exe
4660	Lblaabdp.exe
2872	Lfjjga32.exe
3532	Likcilhh.exe
1944	Lfodbqfa.exe
2892	Mpghkf32.exe
4392	Mhdjehhj.exe
5080	Mbjnbqhp.exe
4356	Mpnnle32.exe
4188	Mpqkad32.exe
2228	Npchgdcd.exe
1956	Nlihle32.exe
4456	Nedjjj32.exe
2416	Nookip32.exe
4424	Oghppm32.exe
2580	Opcqnb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cnfkdb32.exe	Chiblk32.exe
File created	C:\Windows\SysWOW64\Ehpadhll.exe	Eqiibjlj.exe
File opened for modification	C:\Windows\SysWOW64\Pgefeajb.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Iokgal32.exe	Iohjlmeg.exe
File created	C:\Windows\SysWOW64\Pnakhkol.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Ggpbjkpl.exe	Gdoihpbk.exe
File created	C:\Windows\SysWOW64\Elkalfog.dll	Hnddgjbj.exe
File opened for modification	C:\Windows\SysWOW64\Inebjihf.exe	Hihibbjo.exe
File created	C:\Windows\SysWOW64\Fpenlneh.dll	Nhhdnf32.exe
File created	C:\Windows\SysWOW64\Bfhadc32.exe	Bjaqpbkh.exe
File created	C:\Windows\SysWOW64\Cqglioac.dll	Nghekkmn.exe
File created	C:\Windows\SysWOW64\Eieijp32.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Bmjkic32.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Qlggjk32.exe	Pkhjph32.exe
File created	C:\Windows\SysWOW64\Paplcg32.dll	Emkndc32.exe
File created	C:\Windows\SysWOW64\Igfkfo32.exe	Iokgal32.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe
File opened for modification	C:\Windows\SysWOW64\Likcilhh.exe	Lfjjga32.exe
File opened for modification	C:\Windows\SysWOW64\Ppjgoaoj.exe	Ollnhb32.exe
File opened for modification	C:\Windows\SysWOW64\Aonoao32.exe	Aolblopj.exe
File created	C:\Windows\SysWOW64\Jjoiil32.exe	Jjlmclqa.exe
File created	C:\Windows\SysWOW64\Fmlbhekk.dll	Fngcmcfe.exe
File opened for modification	C:\Windows\SysWOW64\Iefphb32.exe	Iolhkh32.exe
File created	C:\Windows\SysWOW64\Bcghdkpf.dll	Igfclkdj.exe
File created	C:\Windows\SysWOW64\Nobdka32.dll	Gadqlkep.exe
File created	C:\Windows\SysWOW64\Elkllcbh.dll	Dijbno32.exe
File created	C:\Windows\SysWOW64\Cfbcke32.exe	Chnbbqpn.exe
File created	C:\Windows\SysWOW64\Gkgmdnki.dll	Ddgplado.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Dmoohe32.exe	Ciafbg32.exe
File opened for modification	C:\Windows\SysWOW64\Fpejlmcf.exe	Fcniglmb.exe
File created	C:\Windows\SysWOW64\Inmdohhp.dll	Koajmepf.exe
File created	C:\Windows\SysWOW64\Iohjlmeg.exe	Hnfamjqg.exe
File created	C:\Windows\SysWOW64\Godcje32.dll	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Caojpaij.exe	Cponen32.exe
File opened for modification	C:\Windows\SysWOW64\Ofmdio32.exe	Ojfcdnjc.exe
File created	C:\Windows\SysWOW64\Palklf32.exe	Paiogf32.exe
File created	C:\Windows\SysWOW64\Ooqqdi32.exe	Oampjeml.exe
File opened for modification	C:\Windows\SysWOW64\Eofgpikj.exe	Deqcbpld.exe
File created	C:\Windows\SysWOW64\Ejljgqdp.dll	Jknfcofa.exe
File created	C:\Windows\SysWOW64\Kiodmn32.exe	Kfnkkb32.exe
File created	C:\Windows\SysWOW64\Mlljnf32.exe	Mohidbkl.exe
File opened for modification	C:\Windows\SysWOW64\Caqpkjcl.exe	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Jjjpnlbd.exe	Jcphab32.exe
File created	C:\Windows\SysWOW64\Blielbfi.exe	Bhkmec32.exe
File created	C:\Windows\SysWOW64\Pakdbp32.exe	Paihlpfi.exe
File opened for modification	C:\Windows\SysWOW64\Geoapenf.exe	Gndick32.exe
File created	C:\Windows\SysWOW64\Pdbeojmh.dll	Mcelpggq.exe
File created	C:\Windows\SysWOW64\Kfnkkb32.exe	Kpbfii32.exe
File opened for modification	C:\Windows\SysWOW64\Jkomneim.exe	Jhndljll.exe
File created	C:\Windows\SysWOW64\Nfohgqlg.exe	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Boldhf32.exe	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Ioqgiibk.dll	Hcpojd32.exe
File created	C:\Windows\SysWOW64\Hiacacpg.exe	Hbgkei32.exe
File opened for modification	C:\Windows\SysWOW64\Lblaabdp.exe	Lehaho32.exe
File created	C:\Windows\SysWOW64\Gfameb32.dll	Mpnnle32.exe
File created	C:\Windows\SysWOW64\Cgjjdf32.exe	Bggnof32.exe
File opened for modification	C:\Windows\SysWOW64\Kngkqbgl.exe	Knenkbio.exe
File created	C:\Windows\SysWOW64\Mlofcf32.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Liqihglg.exe	Kgamnded.exe
File opened for modification	C:\Windows\SysWOW64\Pkhjph32.exe	Pcmeke32.exe
File created	C:\Windows\SysWOW64\Paoollik.exe	Pehngkcg.exe
File opened for modification	C:\Windows\SysWOW64\Eeelnp32.exe	Emjgim32.exe
File created	C:\Windows\SysWOW64\Ejdocm32.exe	Ejbbmnnb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7040	10056	WerFault.exe	612

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckilmcgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekbjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgpoihnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jekjcaef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oihmedma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Majjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmdhcddh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnahdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejhef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hginecde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibcjqgnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dinael32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibhkfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llodgnja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkhpfbce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iojkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppamophb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlbcnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbhgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fggfnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plkpcfal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gflhoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddnobj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddcebe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jibmgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleegp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkhgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaqhjggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgbld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcapicdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lehaho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpqkad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gigheh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnbbqpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pakdbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfodbqfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ackigjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdinljnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidabppl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcnmin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofmdio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbnkonbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjoiil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifomll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofjqihnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eaakpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkaopp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olijhmgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnpdegjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giljfddl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Likhem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omopjcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iokgal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajbmdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lenicahg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmoohe32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljgmjm32.dll"	Oihmedma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfcqpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iknmla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefchq32.dll"	Hlambk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfohgqlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhhdnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdhlclpe.dll"	Jbepme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhhdnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amkhmoap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghjnkpdc.dll"	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkaokcqj.dll"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inbpkjag.dll"	Bjlgdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejlkojm.dll"	Bfngdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbileede.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmhbagkn.dll"	Mpqkad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdohflaf.dll"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ooibkpmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgjjdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncgjgp32.dll"	Dpdaepai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gppcmeem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnpamkc.dll"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmhlgmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Likcilhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipmbjgpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oaqbkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbepme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndbpeal.dll"	Glfmgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pedlgbkh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmhand32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhjnfdhk.dll"	Gojiiafp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdbeojmh.dll"	Mcelpggq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpdhkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpajnp32.dll"	Jjmcnbdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkomneim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nefped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhffmd32.dll"	Ncabfkqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmbekjjm.dll"	Gochjpho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddfioo32.dll"	Ppjgoaoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehpadhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akcjcnpe.dll"	Enmjlojd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ackbmcjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkgmdnki.dll"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggpbjkpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aloccc32.dll"	Bjaqpbkh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnibokbd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4736	832	afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe	87
PID 832 wrote to memory of 4736	832	afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe	87
PID 832 wrote to memory of 4736	832	afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe	87
PID 4736 wrote to memory of 2296	4736	Ngpccdlj.exe	88
PID 4736 wrote to memory of 2296	4736	Ngpccdlj.exe	88
PID 4736 wrote to memory of 2296	4736	Ngpccdlj.exe	88
PID 2296 wrote to memory of 4532	2296	Ndhmhh32.exe	89
PID 2296 wrote to memory of 4532	2296	Ndhmhh32.exe	89
PID 2296 wrote to memory of 4532	2296	Ndhmhh32.exe	89
PID 4532 wrote to memory of 1776	4532	Oponmilc.exe	90
PID 4532 wrote to memory of 1776	4532	Oponmilc.exe	90
PID 4532 wrote to memory of 1776	4532	Oponmilc.exe	90
PID 1776 wrote to memory of 2860	1776	Olfobjbg.exe	91
PID 1776 wrote to memory of 2860	1776	Olfobjbg.exe	91
PID 1776 wrote to memory of 2860	1776	Olfobjbg.exe	91
PID 2860 wrote to memory of 4820	2860	Opdghh32.exe	92
PID 2860 wrote to memory of 4820	2860	Opdghh32.exe	92
PID 2860 wrote to memory of 4820	2860	Opdghh32.exe	92
PID 4820 wrote to memory of 2120	4820	Ocdqjceo.exe	93
PID 4820 wrote to memory of 2120	4820	Ocdqjceo.exe	93
PID 4820 wrote to memory of 2120	4820	Ocdqjceo.exe	93
PID 2120 wrote to memory of 4552	2120	Ofeilobp.exe	94
PID 2120 wrote to memory of 4552	2120	Ofeilobp.exe	94
PID 2120 wrote to memory of 4552	2120	Ofeilobp.exe	94
PID 4552 wrote to memory of 3320	4552	Pgefeajb.exe	95
PID 4552 wrote to memory of 3320	4552	Pgefeajb.exe	95
PID 4552 wrote to memory of 3320	4552	Pgefeajb.exe	95
PID 3320 wrote to memory of 3664	3320	Pnakhkol.exe	96
PID 3320 wrote to memory of 3664	3320	Pnakhkol.exe	96
PID 3320 wrote to memory of 3664	3320	Pnakhkol.exe	96
PID 3664 wrote to memory of 1340	3664	Pqbdjfln.exe	97
PID 3664 wrote to memory of 1340	3664	Pqbdjfln.exe	97
PID 3664 wrote to memory of 1340	3664	Pqbdjfln.exe	97
PID 1340 wrote to memory of 1912	1340	Pnfdcjkg.exe	98
PID 1340 wrote to memory of 1912	1340	Pnfdcjkg.exe	98
PID 1340 wrote to memory of 1912	1340	Pnfdcjkg.exe	98
PID 1912 wrote to memory of 3396	1912	Qqfmde32.exe	99
PID 1912 wrote to memory of 3396	1912	Qqfmde32.exe	99
PID 1912 wrote to memory of 3396	1912	Qqfmde32.exe	99
PID 3396 wrote to memory of 1980	3396	Qgcbgo32.exe	100
PID 3396 wrote to memory of 1980	3396	Qgcbgo32.exe	100
PID 3396 wrote to memory of 1980	3396	Qgcbgo32.exe	100
PID 1980 wrote to memory of 3288	1980	Ambgef32.exe	101
PID 1980 wrote to memory of 3288	1980	Ambgef32.exe	101
PID 1980 wrote to memory of 3288	1980	Ambgef32.exe	101
PID 3288 wrote to memory of 2560	3288	Aeklkchg.exe	102
PID 3288 wrote to memory of 2560	3288	Aeklkchg.exe	102
PID 3288 wrote to memory of 2560	3288	Aeklkchg.exe	102
PID 2560 wrote to memory of 3796	2560	Acqimo32.exe	103
PID 2560 wrote to memory of 3796	2560	Acqimo32.exe	103
PID 2560 wrote to memory of 3796	2560	Acqimo32.exe	103
PID 3796 wrote to memory of 2524	3796	Dfnjafap.exe	104
PID 3796 wrote to memory of 2524	3796	Dfnjafap.exe	104
PID 3796 wrote to memory of 2524	3796	Dfnjafap.exe	104
PID 2524 wrote to memory of 3384	2524	Dogogcpo.exe	105
PID 2524 wrote to memory of 3384	2524	Dogogcpo.exe	105
PID 2524 wrote to memory of 3384	2524	Dogogcpo.exe	105
PID 3384 wrote to memory of 2128	3384	Egdqae32.exe	106
PID 3384 wrote to memory of 2128	3384	Egdqae32.exe	106
PID 3384 wrote to memory of 2128	3384	Egdqae32.exe	106
PID 2128 wrote to memory of 1256	2128	Emaedo32.exe	107
PID 2128 wrote to memory of 1256	2128	Emaedo32.exe	107
PID 2128 wrote to memory of 1256	2128	Emaedo32.exe	107
PID 1256 wrote to memory of 5036	1256	Eopbnbhd.exe	108

C:\Users\Admin\AppData\Local\Temp\afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe
"C:\Users\Admin\AppData\Local\Temp\afd469dce0b4b97a38ddb5671989292e7edfa66b3d9972c4eb10743b6f267a05.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\Ngpccdlj.exe
  C:\Windows\system32\Ngpccdlj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\Ndhmhh32.exe
    C:\Windows\system32\Ndhmhh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\SysWOW64\Oponmilc.exe
      C:\Windows\system32\Oponmilc.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4532
    - - C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        24⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        25⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        26⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        30⤵
        Executes dropped EXE
        
        PID:3864
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:804
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1756
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:392
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4512
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        37⤵
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        39⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        40⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        41⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        42⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        43⤵
        Executes dropped EXE
        
        PID:664
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        45⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3476
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        48⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        49⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1304
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1944
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        55⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        56⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4356
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        60⤵
        Executes dropped EXE
        
        PID:2228
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        61⤵
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        62⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        64⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        65⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        66⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        67⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2024
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        69⤵
        Modifies registry class
        
        PID:3504
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:64
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        71⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        73⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        74⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        75⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3240
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        78⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        79⤵
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        80⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        82⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        83⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        84⤵
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        85⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        86⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        87⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        88⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        89⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        90⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        91⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        92⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        93⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        94⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        95⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        96⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        98⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        99⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        101⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        102⤵
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        103⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        104⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        105⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        106⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        107⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        108⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        109⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        112⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        113⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        114⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        115⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        117⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        120⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        121⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        122⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        123⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        124⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        125⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        126⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        127⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        128⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        129⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        130⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        131⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        133⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        134⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        135⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        136⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        137⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        138⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        139⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        140⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        141⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        142⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        143⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6740
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        146⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        147⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        151⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        152⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        153⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        154⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        155⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        156⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        158⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        159⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        160⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        161⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        162⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        163⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        164⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        166⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        169⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        171⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        172⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        173⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        176⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        179⤵
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        180⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        182⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        183⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        185⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        187⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        188⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        189⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        190⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        191⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        192⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        193⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        194⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        196⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        197⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7660
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        199⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        200⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        201⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:7832
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        204⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        205⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        206⤵
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        207⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        208⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        209⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        210⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        211⤵
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:536
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        214⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        215⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        216⤵
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        217⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        219⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        220⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        221⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        222⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        223⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8036
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        225⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        226⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7200
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:2132
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        229⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        230⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        231⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        232⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        233⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        234⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        235⤵
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        236⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        237⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        238⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        239⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        240⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        241⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        242⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7656
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7812
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        245⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        246⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        247⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        248⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        249⤵
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        250⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        251⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        253⤵
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        254⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:348
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        257⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        258⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        259⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        260⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        261⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        262⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        264⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        266⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        267⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8000
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1284
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        269⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:8140
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        271⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8216
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        274⤵
        Drops file in System32 directory
        
        PID:8304
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        275⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        276⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        277⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        278⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        280⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        282⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        283⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        284⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        285⤵
        Drops file in System32 directory
        
        PID:8784
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        286⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        287⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        288⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        290⤵
        Modifies registry class
        
        PID:9012
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        291⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        292⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        293⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        294⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        295⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        296⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        297⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        298⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        299⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        300⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        301⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:8504
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        303⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        304⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        305⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        306⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        307⤵
        Drops file in System32 directory
        
        PID:8768
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        308⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        310⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        311⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        312⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        313⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        314⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        315⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        316⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        317⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        318⤵
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        319⤵
        Drops file in System32 directory
        
        PID:2956
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3864
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        324⤵
        
        PID:516
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        325⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        326⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        327⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        328⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        329⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        330⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        331⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        332⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        333⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        334⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        335⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        336⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        337⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        338⤵
        Drops file in System32 directory
        
        PID:8292
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        339⤵
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        340⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        341⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:8484
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9008
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        344⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        345⤵
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        346⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        347⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        348⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        349⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        350⤵
        Drops file in System32 directory
        
        PID:1040
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        351⤵
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        352⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        353⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        354⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        355⤵
        
        PID:620
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        356⤵
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        357⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        359⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        360⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        361⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        362⤵
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        363⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        364⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        365⤵
        Modifies registry class
        
        PID:784
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        366⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        367⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        368⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        369⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        370⤵
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        371⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1732
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        373⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        375⤵
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        376⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        377⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3152
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        378⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        379⤵
        Drops file in System32 directory
        
        PID:8900
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        380⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        381⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        382⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        383⤵
        
        PID:664
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        384⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        385⤵
        
        PID:944
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        386⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        387⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        388⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        389⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        390⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        392⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        393⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        394⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        396⤵
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        398⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        399⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        400⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        401⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        402⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        403⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        404⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        405⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        406⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        407⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        408⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        409⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        410⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        411⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        412⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        414⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        415⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        416⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        417⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        418⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        419⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        420⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        421⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        422⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        424⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        425⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        426⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        427⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        428⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        429⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        430⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5136
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        432⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        433⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        434⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        435⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        436⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        437⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        438⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        440⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        441⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        442⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        443⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        444⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        445⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        446⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        447⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        448⤵
        Drops file in System32 directory
        
        PID:9264
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        450⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        451⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:9412
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9448
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        454⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        455⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        456⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        457⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        458⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        459⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        460⤵
        Modifies registry class
        
        PID:9700
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        461⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        463⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        464⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        465⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        466⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        467⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        468⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        469⤵
        Modifies registry class
        
        PID:10028
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        470⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        471⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        472⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        473⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        474⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        475⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        476⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        477⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        479⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        480⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        481⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        482⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        483⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        484⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        485⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        486⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        487⤵
        Drops file in System32 directory
        
        PID:9724
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        488⤵
        System Location Discovery: System Language Discovery
        
        PID:9760
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        489⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        490⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        491⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        492⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        493⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        494⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        495⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        496⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        497⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        498⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        499⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        500⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9256
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        502⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9384
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        504⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        506⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        507⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6676
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        510⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        511⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        512⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        513⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        514⤵
        Modifies registry class
        
        PID:9912
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        515⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        516⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        517⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10056 -s 412
        518⤵
        Program crash
        
        PID:7040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10056 -ip 10056
1⤵
PID:7000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aalmimfd.exe

Filesize
67KB

MD5
87f8c2fc70152f57cc12412e719fd057

SHA1
003e775c74cd961992af0b0047ad469c73161179

SHA256
196f9f36434b0f59834504c06dca78c63f94a6563c8e659061602afe093ed150

SHA512
fc1de03402272fbf8b3099a887a676321bb66e89031782160a688883e50939e2c14a6572e5f2c10e20b58cbc5e82b19ed284473a6d4417a0fc47bfc50c240df9

Download Submit
C:\Windows\SysWOW64\Abhqefpg.exe

Filesize
67KB

MD5
6ef8567504932eb00e833cbc2fd1f8ef

SHA1
70ddd68251adb308e644f9fcc9f719ee99abd34f

SHA256
0272d09b56f945d1f774bc12cc12d8cf48693258e3217889c5f2cad67fecacdb

SHA512
c86216ee620b6e2d384e062969485fae0c8761deae1fa8318ff71f3c09ef85124a90dc79af9f93f533de8359bc8dd8f962598ff98fbafe09594078863d77a8fb

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
67KB

MD5
cffadf1dad1bf4360c53f36704100af8

SHA1
06d266ba7eac556b1212884b384593fc32092509

SHA256
b39885b51060de89e75c69f416e56047af1b7de6bb497cb16578fb43074e93d9

SHA512
320409b7fd2be4b36e36e390505db51599a41cf9b06052549bfc2157417c0231c75f2597bab96071642b9ff73f5946906bc183da89d77a4382b75f947a2376db

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
67KB

MD5
4620174e1c5c45405dbb27d7016c79a7

SHA1
1a76a6cf25b3aee7aa037efc9762566f706a396a

SHA256
a55dacfb699305a9f4585337340687934299f1d225546cbfe06bc0bc54061356

SHA512
01b72f3e675979f0b58a0902d1195dc813c9bf6fdfb849790acae37420b8642400b8b935971998e3c5a65491b0c34c17810767a26dbb0599238d67e871b239d0

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
67KB

MD5
f94f6cba22a0338b11451b92af7151f8

SHA1
7a8c8a5398313006e8568c820fdf2920e70df922

SHA256
cd1afc7a50bcb4738f20cd6c7249117eb6d1e2ad8defb5b54855ca8d3bf0d9f6

SHA512
66748bec478b42b758b657e4ea48d969089ebe5d3615e7d0f1aa38e1021d9dda81f12ca2adacf229705b0bff7251e33225eba7216ec3258aebc4b58ba6ed065a

Download Submit
C:\Windows\SysWOW64\Aolblopj.exe

Filesize
67KB

MD5
01719e1024087a7f701af9e3b073b642

SHA1
492bee6db505ed051decd3db1dede36b19bc45b0

SHA256
b8d04390f9db8b2a8fdf12bd4127a56735e25de63bd3b4d3dad2643ccaea36a7

SHA512
2f86ce03ab74418dbcace959e60ae0628b76428fccbdc6e6dd9593037ea3e5ab8b9ae7bd7e9c5e8b498ce6d0ea13b662dda93e37f6ca46b4420da237c2a82ff2

Download Submit
C:\Windows\SysWOW64\Apeknk32.exe

Filesize
67KB

MD5
bec303542fd8c856a693a9781bdfae2b

SHA1
330657e543d36fe2f72b3d65e650bb9491115c57

SHA256
4a6a2eadebae8ee6af78427b7f7f3d8d46f86bf709f4d5e9c5560d1ef5e0ee13

SHA512
600eef8e2ba02e5ba377cef96bd1ecd47da4bbdfeacf02ad30bb624a26a06d3ec51a1cbcb0a5ce3c638cc575c481f32e981e30697997a4bf9a432e84e956ce58

Download Submit
C:\Windows\SysWOW64\Bbiado32.exe

Filesize
67KB

MD5
29f2e79e6b6661334ea75fa55f43f72a

SHA1
c3ab3ff71ac3ea02bb5d7a2412c44a04467bfac8

SHA256
b9d0c7a8d43ba029b3b9f7f793fd878c4a2604097eae794ab3fc182a35fddbbd

SHA512
dceb8961f0b8f7f2e639446004093e7b32cf0d4cb339955a2965e7fde7d9235f1985e8bff794e62f35a54c13a96b2d4543ee7cbef6d796598f05509738e5a6eb

Download Submit
C:\Windows\SysWOW64\Bgpcliao.exe

Filesize
67KB

MD5
b36309299c6cfb980fed58419fbc8892

SHA1
ee463d98113a415317ee97dfedf8cf3f508057b0

SHA256
209eb79011e32704c9c34c96df0d7109876b82a3009c6a827ad0f2f024880b5e

SHA512
52a03631495bbd08d2fe09b928a1779976ae18a9766d4b095f6ebd82286791c824fb9982443fe3427cc0e1c5de2458b8dfa93569655fc543611f240bfcc630a7

Download Submit
C:\Windows\SysWOW64\Bmdkcnie.exe

Filesize
67KB

MD5
1ff7cde8236dea2f9cdba0d24463aeb0

SHA1
e0255bfc8171b4de4ff974c516a8fe10054b2832

SHA256
ff0c47398377711eb8a7f87a055d1fc9886b93170481005024e4393ff29ac667

SHA512
76f2827c6fd8323aa61f449f3dc9d830b052423c8a7053b0ab79bcdf079960568b483f246d2b69ecf867a530cd84adde735f499d2290fb07df7feafa6ede4e0a

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
67KB

MD5
b843e091ce5f52a1f9606e46ff4c6bcf

SHA1
f00893dbabf4693a5e61ec7e46bc495821b0431b

SHA256
ed58f2f73e8da01b854e359ef73e053e7d9ae7b8138fcee3941566d293c55682

SHA512
f42c21ef24ed8d4dc31c2d2334f797e1e8927ee8a526b7e0bcce2356c93bfa407c3e2ba8d69e7e448a347401cedbbe39b8415c661cfb7fe90708e5c8c055d38a

Download Submit
C:\Windows\SysWOW64\Cgiohbfi.exe

Filesize
67KB

MD5
ca33edaf51d92c1935413dc6277d3af8

SHA1
2ef506822d9cba9715148e5990a5c44819bdd3b7

SHA256
7be745c703bea03ad753405a8d5db81cfc12ee7faadd06dc909873000ebe8512

SHA512
38ac3707cc357dab2f169435fe341bb47dd3a219d879be96d63a825a92be95e4dd145502a88c1397650f929ce8aa9076757d49a7994a96d3839a31dae3c54f70

Download Submit
C:\Windows\SysWOW64\Cildom32.exe

Filesize
67KB

MD5
4f4bb5d5179348d571155b9a5cbf3c9f

SHA1
06bddc4566960ddfaab70a64dad6234068284880

SHA256
4f28c8c4f0bc0f0d593b9dc5c85fd9e3881cb2626b940b6f931f9cea02e25130

SHA512
34450f648456ceb81787731b7834e5169d828118ea4144b846c4f2e2010018272959cae98183be623573b6d900e636287c049aa326a184c265a1cbee8415b912

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
67KB

MD5
331e51c65f093001a0bf069eb47673d7

SHA1
b59d4b5355df0f31a114d573ac060fb7ab065e29

SHA256
6ba25952757097c909a9bf389fa6b98254dce44c1bdc910a50ec7a285882047c

SHA512
a1e29e00dde61b5033e7ae4daf43f24c442ec1b07bf7976ae768a081cce32c669c130ab40905ada9a6124a330d980f9b469e748dedaf9c4aacb7c6bb667b6c63

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
67KB

MD5
4ee0709a1f5c1243f3bb1bc50f21dff0

SHA1
3900b3fa9399ca859079a55dd4cd698af38d7eb9

SHA256
30248bd723d463af809baeea7025e09ebe577270e0a46797ddc2cda7ff05aa59

SHA512
34be8025dfb14a19ea2b0ba3de92ec75b9e07a678de6b27a6d7414abee6c299175b78f61ac6a677c9608e78cd8980c868e7fdc1cab1174d1692c2ddfa69d5104

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
67KB

MD5
f51200389357009d748e15faaed28010

SHA1
77be0178590e2ad460cd6ee75e54151d11f24906

SHA256
39a730975d725cff137b9bb2ef99c86217440b739dd8c8415223611b1af3fc22

SHA512
a5874ade5eb1cdfc0430f0371f0688e4f4b4177e8c7ea1c8659bd78dc0745a09ff371332c64135328e1fd534773c6023a25945b73d42f46ded3bce38dcaf9574

Download Submit
C:\Windows\SysWOW64\Eclmamod.exe

Filesize
67KB

MD5
5418dc2c02427f906ac68830a179f3e0

SHA1
aa37aae3fb032ed762ca7323a820196d247b401b

SHA256
b9f5d2c2304c066a1a29a9fcb509538f1c77e2dd55959488a1520ecdf94f19bf

SHA512
0b37c91ed5c1103f3e3e356ee49aae8115faebaaf3bdacdcd900146070e5ba374655ff551e3aa0333700d41a189cef2fbea8342c2f38eeacae6e710fb677aa36

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
67KB

MD5
90b16b1e228adaab3e222b26f78ac514

SHA1
a7b1ecd45916ceb8c193f49a7a248f41998eebc5

SHA256
0e6069e0b2e09aa552e097fa20ce396e7ad29b303476c0323ce04e2e3f9ffaea

SHA512
c1c831d927f5b935e4d82ddd01d2d91f0ba656a691e6be2ff58432b7b65876e21f4735e3c529557593b49a90ffa7d4c3b353a74328d0dc3975bb68aabb53a83b

Download Submit
C:\Windows\SysWOW64\Egdqae32.exe

Filesize
67KB

MD5
5bc9a78ac468b2f0035b81d76d715dfd

SHA1
9095738870dd25cfecaf068b14a936462c94a740

SHA256
ded893b55698f85730258cf134bc7592830295c8c0c219226c874d6774d992e7

SHA512
7467fdbdee9b541ba8a2b85a6b74f30f4cf242dfff538ee07af832cb656e1f057a0c6752a92c5960f691aa2fa3cb7a2f629a8766b5dcbc884c2988ec648354d1

Download Submit
C:\Windows\SysWOW64\Emaedo32.exe

Filesize
67KB

MD5
84b11922c7e4a21c04339add531791b7

SHA1
36dd43918719e783b525ab3e9c174c550edfb976

SHA256
d521fbcbafbfe22189e823949022dbc452523c3c9366e14f0981dc282d9a77f5

SHA512
6e7c40062f5f39e158147721bff15d936cc0414cb83fd7bb4e10bf66be9c4fc51c0088c30185edd73d3a8ff87b8ab0e8365b1bb2ab31ff2ea77e8067c8447237

Download Submit
C:\Windows\SysWOW64\Emhldnkj.exe

Filesize
67KB

MD5
fe40f7b1a8a8ebbbdfc7d6ee62f7951d

SHA1
75d9da50acf3f0bab712c940d2e2a53d1dfd8033

SHA256
d1b5fc43aecbf69cdc30035a237e635669651647d85228bb37aa9dc0ad89f7c9

SHA512
5e4c110e524b1886819b6bb0b98c4247ce65bcf0e9ce072afdfe8bb654a0123747d7adddd7e34779d04602377b9446d8d7c099c004cfc9360826b84cd5b0930f

Download Submit
C:\Windows\SysWOW64\Ennqfenp.exe

Filesize
67KB

MD5
bdcfc1b2dd7c1c7e6c9ec0885b4c9be0

SHA1
aae1510845e2e079a6dde1cd9597a913c7ca406e

SHA256
5d8be1c3000d461044721644a386645a79950ce0db109f3474c1728a0dbaa506

SHA512
43b2bd9fe862aa9c428ad9ea259d00ab47a046b17b3486d33d12a5fdcccb810f16bad27ec34443fec6e50547c652b3410c7caa1118d0b3e167e783df420ca27b

Download Submit
C:\Windows\SysWOW64\Eopbnbhd.exe

Filesize
67KB

MD5
e98ba1dc04331a9701ba51bcd9b90787

SHA1
3c428082ecb82be6786aea5b3f6a4d6597d7ed29

SHA256
c786af4dd8e446b23f1c0e3d276301cb0f5cc348bbecb86b594c63a7ef63e320

SHA512
1c0301f31e9fbf21b9c7f07eeb45b1675fae6873bd7554f9f1a399e27474993d8d21aff2aa664fcd8c33362cd9fd0f13503d34b471ee27a880ade8db26d43ec7

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
67KB

MD5
3fae114d01b339beacff55d86021c1a0

SHA1
62c5aa4652f6373ba7e802f199462cef88244261

SHA256
9bc466b38ba8e4cbe8144ab9bfd825052b378dde3b20082e259518a30a8da7a2

SHA512
7f87f6ec7428d9f6e3cb1282c877b26f798921e372e61666e5d47c6eca380af0c85a2043e39e21e88c9c9d7bc41bfffb79e1dd086b715036805bd2802df83b28

Download Submit
C:\Windows\SysWOW64\Fdnhih32.exe

Filesize
67KB

MD5
73acb11f381954e3728775eb0244e27d

SHA1
a334c932bef000600efb1595df52ca4c3fd9995f

SHA256
0778b2e6e06a49a9975061c5f12e6cba105284ef0b89793f132f3fd3a2d26ac4

SHA512
a7c1b517eb786594a7c9f520ee80d841783aee3a1c4b2c539c399c44d94300d77f4f21b687eb1fcde885c4720afa342981ca440f8df39daeb412f1684f5ea02b

Download Submit
C:\Windows\SysWOW64\Fecadghc.exe

Filesize
67KB

MD5
2b0228347da223f28c6f2c8ac97b2a80

SHA1
6393350646deaad6b450d93e3463b6a0a6dde0cb

SHA256
19c9553179a2cbf23410b34a0628c69bab6f7e68c52ed77e6201c80cbde2796a

SHA512
d41837cda5cbb08d8e6da2aa5697744390c3f6450d1612f52d9f0273f61c3ab2623ced2e37380fcf7c69e268d19a7d9568b06d162e7726dc44edec6f2ec77295

Download Submit
C:\Windows\SysWOW64\Fggfnc32.exe

Filesize
67KB

MD5
ed82e8a90f59a21e093478e50fd870ab

SHA1
dd22bbfe5aede38f67dce6dc61d1881a681a962f

SHA256
08af6dc260ab42a5bedf2d70821a441e934deb20b802c218d857dc6fae0e6503

SHA512
b01bafd889ba006a574338bf8954d6557e005d0951d6c8bb2943160e7dba1d831e1f244278cd91971ed8016b4356173ff17b6e7e9b87e14bf846dbe046673d8d

Download Submit
C:\Windows\SysWOW64\Fgjhpcmo.exe

Filesize
67KB

MD5
c336c5dc051a9dc52cd276294ce74743

SHA1
53961a709ee811e08267821ee339b3d64e5f2e44

SHA256
8ea26fd0d18b52411bf81d81f47e42891e3aec3532b5b95d51545b49bd2a09d7

SHA512
c3e1bd26078036d4ae5a54842f771f5a0a2316360e2a3711010e7b92212e6e94bfc0b12860dcb7829567137f5f4d92c70e9191651a1a84bcbe6256120939cb1f

Download Submit
C:\Windows\SysWOW64\Fknicb32.exe

Filesize
67KB

MD5
b24d49de79dd1f401dcde92cc9823d8e

SHA1
ce563595ee1059772d0d6455e8cf5c74eae8ec67

SHA256
544384c16a192af770b55cc87fccde5a5b3b619c6d1c562811cdf6278f4c0f93

SHA512
4b88e44b4e6bc110b2eabf4c802bd9b841d289f2fba8cb071be2209806d9ba8305afa8ce71af57b83f233c5dba788ff23d54563bb87f5e4fcd1c1a991a549621

Download Submit
C:\Windows\SysWOW64\Gadqlkep.exe

Filesize
67KB

MD5
a9dedb330d9b40e17ef3249a3a4ebfa3

SHA1
4ed91ddbb692550ed67ded70a99083d4e5f36b52

SHA256
970b91e7112b8f282b8874afc99f3d6227c239a70c887cf6c24ad9bc97e8309f

SHA512
eae7ad8d96f427393575b2fbeb8829e28425fa9391402bbdc4a0394da18f03be36416a61ed273e593b6021d5ef99aaeb5d924a87a8fbae5e587cb48e9054b4fe

Download Submit
C:\Windows\SysWOW64\Ghpendjj.exe

Filesize
67KB

MD5
c14d3406aa43ff7562ac4a06093141dc

SHA1
a44c8a61a84f91982323ef935d9f0b68e9b2ef56

SHA256
a15d28c2965483137cb1fa3e5b3091c808512d25a89f13acac64edd0a1abe5e3

SHA512
b2cc31302df995a26f1ff23ff8cea1237706994e5238944b10841d9275e7a56d90eebb7a7a33a69af46ceca88617d24eade8ed83fb447a5674dd4a80f0141c41

Download Submit
C:\Windows\SysWOW64\Gigaka32.exe

Filesize
67KB

MD5
0d86e569ad1bf40004aff16b7765246e

SHA1
c6ec74666974566e9224a60904a50010bd18cc87

SHA256
565fb37423ded07b7eaeb5069c2b2b4674ac05a351ae762c54a85c30824ca6f9

SHA512
fe7645faf11189051334c76e57000cf686d9939bfdaab0840366d34447870757cbf62b70a7db9a84a54afd5d57b2ef7b58ff68cf93c1f1fa0db28ae991f35bc0

Download Submit
C:\Windows\SysWOW64\Gigheh32.exe

Filesize
67KB

MD5
134043bb69c6bb14c4b6146701f7c717

SHA1
6ef735ab13724237636bbed76a8d88ca3a8c0a9f

SHA256
3fd9bcc232c862d47f8c27267b82bf8e0a2ba59b2f9a1efbd98f2402080d70fc

SHA512
a7a3495b2b2104517ad46167b5f5ecb245ef3b67ccf117bd6af3c3548be17f90c270fc73d643174cf7d6b76dc5d2a99ed704cdc0a94a2fc99b7af4510be664bb

Download Submit
C:\Windows\SysWOW64\Gkaopp32.exe

Filesize
67KB

MD5
ff2b4db083e2a1fdd10a024d762011ec

SHA1
b8307688d8205846cdf4ec9b0758bfa708bfaa85

SHA256
e326ba4ae772598ade8ec6f2939b446c30565f5b363d418fe58384cff839bc2a

SHA512
17882ac787770cfe12d82557b58515ef6eaff0ecbc31775f0261f0974119c92f76802080a8d7f4f89a9e063873348a1ed1a9d8fcf01d0408fffd964fa3596043

Download Submit
C:\Windows\SysWOW64\Gochjpho.exe

Filesize
67KB

MD5
fb3b4364c962dae591d30ba67a2bfa4e

SHA1
d3fc9d4b23e60b962aedaf0d91741c01e0290265

SHA256
4a9569d203c98556bd127799f17f7615a36bedcf40c7b67adca81547aaeb5b08

SHA512
85e4db4f03f716bb4a0af4f670c899d36ad711901f02f5cb58e54cae1e014477706885e8b0688ad5527969bc766b6c534bbfdd66c1558e3a31e1df0fa185ec9e

Download Submit
C:\Windows\SysWOW64\Gpecbk32.exe

Filesize
67KB

MD5
023f6f6e42c2521db91cf88cce500488

SHA1
30725f5b8ecdbfe7e23a07fa77c66002e55b8e09

SHA256
43eb638af527e294b64874b5eafedb0d87cd2afd8092daa04fbaa855582c0834

SHA512
ab14984eb3d499e9449bd5fa0d66370e94f8a4239fe551de4a256f7a55b4e7e11e15ca0955ab67dddb90a78c2ce0595a714b5ed88a866b6005524bdb8ae146f1

Download Submit
C:\Windows\SysWOW64\Hbgkei32.exe

Filesize
64KB

MD5
49f48805d93bc721184de4c3b31fb18d

SHA1
dd616c3bd3f0545c41ec3d4f6c2a6df373f374b1

SHA256
6cd994178265b4181d7e97fcef7419e3f8b8e2d8f1f67a242f1ddffba671697a

SHA512
e226ff8cdc039cb5a34df529e8686c56be15a9c372b2f3e83ce293aa9e64eefed9d3c89e5288418c3c2ac19ccd21a8c31062834c12c6fbcf20051160e20d094c

Download Submit
C:\Windows\SysWOW64\Hcpojd32.exe

Filesize
67KB

MD5
4dcd0cdc7711a87ad25d7835e50d872c

SHA1
042cd563deeaf80e617d2e5e0cf8e3afa00783bd

SHA256
ebcd3202f6146de93a2956b0a019829c48dbb83ccc64c7c1a7414b04e31cd7eb

SHA512
ce69d7a01192adf2a6d89b0850107a675f7ee02faf47f18039137de3c5a4b081e0fca54685f4047132fe05bd0c77d52e06f7dcdfac9deb51b57b6e8c3a796f9e

Download Submit
C:\Windows\SysWOW64\Hehdfdek.exe

Filesize
67KB

MD5
61f1343310033fabc1df9ab0f97b86f6

SHA1
1f4af68ac725f08c3d8d6bda26ea5157ce9e4cf5

SHA256
63901eb7609285dc7d64afc3f009c5dec96dd59afc36704c85d04787e2074cb8

SHA512
205a86905b2229e95ffe88836d38ce013596abbcb0370d0ad4d2957f91968d6151b6e2b84b44c95788a7742953a2f647bae8c92da35c30f0acb5e9622a5a4be8

Download Submit
C:\Windows\SysWOW64\Hnddgjbj.exe

Filesize
67KB

MD5
41f474029589068e1a1a8946f5110139

SHA1
11d78accd5352b3e4db32ecf5a3b59274529dcef

SHA256
49a00b3a095b1785877bd575a5191c995bd8a119c00344a529c4f9a6e29bd36f

SHA512
afd7eb71a4d95c4327eae1ab43d0b410968d5bd94219dbd39406b5fab7aff5e6622fe7194bccdb8be7baf474c41852f27f1037a00e987d8cf4f2ae537914d70a

Download Submit
C:\Windows\SysWOW64\Hoogfnnb.exe

Filesize
67KB

MD5
2716ecdc4078a448794dce817a500dbc

SHA1
c0a70ab5dc671cc8502267219c424418fe40d610

SHA256
ad2ed9664718020a74800589340a2e2be46be03e988c4099d5bb9e8371f62f1a

SHA512
d33251cbcc2033287b9d64ee312e5fe151fffe152ced856a0d88d318ff5d5bbbd24c80bf6e35440379816fc5beef0c66e4a9f5cb411616b11612e2334179e711

Download Submit
C:\Windows\SysWOW64\Idfaefkd.exe

Filesize
67KB

MD5
1442d6fdc50cb84b3de19fd96faa523a

SHA1
969b88bc00533cadce44becfd24816af2c17f833

SHA256
ac4f143bd1d62f2b1cc86b1ace4800684deefb2fd96f1c7f95ebba43e9e9e505

SHA512
fe8995c7d94e07c7db36fba077e2df0bfe0902f6746e59140846c27743144f04c48da49460bd412ef29fdb2b3bcfcaa802b6fbff82718650bad17ef6e0bcc48c

Download Submit
C:\Windows\SysWOW64\Ikqqlgem.exe

Filesize
67KB

MD5
5d4a9ba73e8facd3eacc57b73b9e8c30

SHA1
ace8c4656de037afbee43406a5bf9777fd762d54

SHA256
003c799811eb4ed37d948297b4d47e4e32a18eacfee52bc8445aa0b82b8247b4

SHA512
00f10304c9653a7237e8ffe1760f5755a22b8b5000997b91e34142acdce1a5eecc8bd177b26b54342ec8660bbf8e9bc01d3c4bd5f540cdd889bfb7bcdd3ae95f

Download Submit
C:\Windows\SysWOW64\Iolhkh32.exe

Filesize
67KB

MD5
7eeabfa731f734c0d01e253d0fb8add1

SHA1
ce708fc985c3be876995af7b04eb2b0c51468353

SHA256
3efe381e0904bbbdb31a618fdf075e17a2edd61723d888721f7e79c9d6910286

SHA512
08f781d12a13de6531bc58df3fbe090ba047ec8c10022d1ec107eb6abda51bff2715b70447418c6de17291533361d600f7a0cccbf90dfb640f8c8fd5abf154b0

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
67KB

MD5
84dae3b7b020cd1b9425d56eaf10daeb

SHA1
38505dba00fc237d7d2bf50a5f8d6e442c57e871

SHA256
f927d93c043caea558a809fb0c34e35e19766bb78182c6465819d38226a073dc

SHA512
ba04a67a0fb59e968e25c5f282e1eada1bfff656691e54fb17ead08ed913b29f5872a3fd83e0feb4f9cf112080eecb87ed1402d6d013ac1df70be782d4b48385

Download Submit
C:\Windows\SysWOW64\Kfnkkb32.exe

Filesize
67KB

MD5
873aa5f95e35f695e8591d21655f2f10

SHA1
0f82a0403161261b8f93d46381dbf08bc86093a7

SHA256
082d3e1e29ef07d97f9cbf85bc128ddf65ab2d70e40a5cf49222f39a90f1c034

SHA512
91528dae58eb1ae39bfd4b03c89c8d502b2b96f38ebbf4d5cdd43ed9e1ff007440015081ccfff3db5039bdd923e54a708e076bc70b457bb68ba05bb596b44ae8

Download Submit
C:\Windows\SysWOW64\Kgamnded.exe

Filesize
67KB

MD5
dd9f00e2e94d701682b5c1dd272545de

SHA1
af4f63a7c5ed7ff39eaf1a9a6d6fad8d4f514b3f

SHA256
cfbc058be90db17838de3baec34075e38991ef9ff90ce76d1f0287bc6a9c7d0b

SHA512
622b43cfb089f21c6817dc6194e5ada1b03c2f14457b8cc2782ca68e0538ef1a7add75595c121302656201d1b6675453ba8885ffe9bf2c3309d627cc010c8c04

Download Submit
C:\Windows\SysWOW64\Kiikpnmj.exe

Filesize
67KB

MD5
e82e5aa3e28477a67a5a52032452d1d3

SHA1
120115963f3f2b1ed96018d55cebe751924f2810

SHA256
52db8bbd4e0dfab0ad1a5274309da298554aec0c44bee761da04e92f1eaf6151

SHA512
7c7de907b0dd98f5f1e2cf3e9b82715e20f84d1176f6e94809c8b9fefec7781f0d31ea62bf83468478ca1461cab379862643f3b49e7ca59b821289300d139e39

Download Submit
C:\Windows\SysWOW64\Kncaec32.exe

Filesize
67KB

MD5
c07ea13be0641506199086d497ac0420

SHA1
189f5adc4228024db57b2cd99e6bc528f1e2655c

SHA256
18915d169e6b20d542e847ce9c061e58c08422335ad47d3f3e5e7b6a802d6be2

SHA512
740b1274aa1b24c23b8fa85403ab53a5ac9a0e7a3bbfc88fd8509c5d1808702d7196f90b71f2866ffd7ffbd6384c00d667828552f18a17d5aba3e6f0c49fa68b

Download Submit
C:\Windows\SysWOW64\Lafmjp32.exe

Filesize
67KB

MD5
609fa9cbe7e2a31aede4ed6b7dd6f9ff

SHA1
e03f8e23e610fff0a94144c82ed4953f8178258b

SHA256
fba79c1942ff8290596b0205417db2490214752987730f4cf2d270f55091ee6b

SHA512
a792ec30ddc99e82eca6a2ec71ebdf605c712c936761bf682b2380d4b6b13281c2283914bf3123e4e9b2b85cdf7b72b46f8a503aa3db22538e79794b0d7af615

Download Submit
C:\Windows\SysWOW64\Lpjjmg32.exe

Filesize
67KB

MD5
36e45368ee49adba79a926bc007254cd

SHA1
3a5eae6ceba6ea61beee1dc637fa076baea26ecc

SHA256
1205597700174a148886ab53c5b60bf52e3e44a2ee61c4117ea49d9de064c0fe

SHA512
4edcea463f7a0b7f96b04b5153a2ebdeff467a111ae56abb259357bed9ae310e966ec3ab14c9cbf8dfb60a3b7767b8b939e12ddad14fb2c97cf308a53b940917

Download Submit
C:\Windows\SysWOW64\Maeachag.exe

Filesize
67KB

MD5
b48869a046ce62c80afc5b4d4dd44f30

SHA1
8e3e1903197c5b5942742de7beb590a87ab2ce7c

SHA256
e34ae358ec8457eabf99d7739bf6c522a8d05188e5784ae232b02409a084cfa2

SHA512
8abfe785529c1090ee19942af1d2626ada78cf518141246a15f5f6532c2a95573108ea5296f2a7d9d4ffa0fc849620c3c985ff3822facd4d4a0bc831f54b9165

Download Submit
C:\Windows\SysWOW64\Majjng32.exe

Filesize
67KB

MD5
9edf0651381f4aae764f021e169b4e04

SHA1
407be35fba98d0fdb730af5401e06286fab892c1

SHA256
20b1d35abf73b8f655d1fb54bf528b5d8614af9045ed1459d9a5e44d8b88e275

SHA512
0ccb13f535918dbe5aaeb9637c087e8e13353e5e664441a7e5d450526aae98266b020c4d5a9d5b58a74b04fbc6fcbaf5ae0bab295267c8da49152bd530ab61b3

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
67KB

MD5
4a0e5b235ff7593bead1fd647f4bc877

SHA1
0338625e1d948db2040d455940689e6e50de9087

SHA256
88433dcc707cca72047d6316fff29918e509e7be96fee6b5a51630148175c1e1

SHA512
92899737fa6547147639c6c65b90d3152fde762d72a2b4e4ccdd497b766b9a6abf78e744e94f75d84d6f9198a627da9513b1ce7c84b075a463cfb02e2f6a7058

Download Submit
C:\Windows\SysWOW64\Mccfdmmo.exe

Filesize
67KB

MD5
2adabf64b3274b6984523848095d2947

SHA1
6a101f4d14d1cc8553622a4334ef1e342bb1a6c4

SHA256
ee46867a4cfcd36be67d46295b0995ab6e52ec0c3c5b5fec281fbac6a0712b06

SHA512
a16a48cb77818aea654338dfb990aa21084f74d5a835f98283091e8852068e47951769a0e9fec87ffb00f570a145a063fe3bc4bbf962275c99e4dbd5cb79decf

Download Submit
C:\Windows\SysWOW64\Mjggal32.exe

Filesize
67KB

MD5
e2cd1a17cdfc4696eac625724e5a16b5

SHA1
336e2b812521ad33f24bc72dcd90ad914d058c99

SHA256
e1a6f1608500147533e019b168b77246bf6192473247e0338aba32bc6aa02bf7

SHA512
3a6e1e5cc1c1ff61c404bdbc99283467102a1df76f0c8991f9070f595a286f0fbc4cd35979a48d491175c6c399425c5c701c875d3038a213dc580b157d886250

Download Submit
C:\Windows\SysWOW64\Nbebbk32.exe

Filesize
67KB

MD5
0ddde93365679ab00a9a0ebc207a8e10

SHA1
2efa7f5f2434accd8204c8b7c684c87d2795f2b2

SHA256
5d1b798fd7b7100d91bbe10f32a5c755b61f2a68a56d35cda947205d01fc79d2

SHA512
c7685cb04480c75f27e0b292c9e4d454cd555b0c29af28011964736fd32bf69eff4fb99d870846436f093a87406010a38a150aeca57bfa56d9f0e04bae86b8b2

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
67KB

MD5
366428f56d2561407161af9e239ee849

SHA1
2a39c3cf6d41c8735f117922f1c17a9d8c45d9b7

SHA256
fae606619b99a9c655e895a368e4a80a41da2029054deb9cc5f8f5668344a88e

SHA512
56781c5ef16d5049bc4bf33659e4f5d929d4f678a9cd89e945d3321e31b3ea2b79aca5a172554ff88ab409998d72c710a0334b9719a61b440e82495063c0e1d4

Download Submit
C:\Windows\SysWOW64\Nfcabp32.exe

Filesize
67KB

MD5
f05fc44cb1bd5476bd872e4708535854

SHA1
d813116d383cfcdc9d09829bd6ff80814f607ecd

SHA256
e82fb525f56719c1f0f47d4d1e0198cd2269ecbd5b950c1e6914aa7c64a3fb1c

SHA512
d3fda0bd7f6f972f56c413f242f59762b39079abdb78142574b0387e131d57b18d93d3cfa43244c01e80e2fd09972aa560f912eb554f0e5392807d2970a0dc1e

Download Submit
C:\Windows\SysWOW64\Nfohgqlg.exe

Filesize
67KB

MD5
6196cad55407cf842d71d402cb72ce8a

SHA1
4123e20c27660d7fabf45767799f9a1cb5e4838a

SHA256
1b1cbbf0ada6fac220f96a0ce7d6c5489ccc5cd5db7d419c68a9b197a7492968

SHA512
a8dc3471d64a9d32e4feb5a006d57ee0e4f330706116290e3a3e582514beb3e1dc32fc6444e1796ba833b5354042a86815cab632c6f5225fff2d38e983edbdf5

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
67KB

MD5
92f9483a16566c040914773d33f2d6c4

SHA1
fb4c49a1a9cc63357c0910b103883e9afbbb413c

SHA256
9c9321136d73959d24d729a8d3b9a1d4ed41d62b51ce11fe7f38fa400a79820f

SHA512
096773da3108e1b35addaf74a161eb695ee2b526552cb3e8797e5adc00ea0e943e8fa817e01e327334e4f8c750b8dc4c41062ca8eed040471ac77ab9dd9bd345

Download Submit
C:\Windows\SysWOW64\Nopfpgip.exe

Filesize
67KB

MD5
95cf765164b223ee3e7179d6f7cc3458

SHA1
006a5d659503c96165232c32e79eb240826eb99b

SHA256
e94b1b959a259f7a6002c399d06d5641adce6c34660facdc6d6d8fd92a54f78e

SHA512
c1e56750e154161db1c603ee5301417f7f726cbda38554590e8ef1c99bf73c4ec190d2da1c09b65d19ac52087be834802f916be36214fe7a3c0a25c5814f2774

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
67KB

MD5
b58c3b51351b8fb1a6e3cf483b4708ee

SHA1
b2a63ec569a757c9da1f078cb0e1f4b2e26cfa8f

SHA256
32f995dd0e45d8ba73f9f99e055d1eb17fcd76a4ac8fa7cc844c76f3f35acb55

SHA512
dd5b39b3707723bfaf86c0c42143f51a1eb450f11022cf24f1ce3ef2254c186cd5bdabba43564610acbdf2b7ebfc4d4442d621d5d2fc31f43dcd789019231cee

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
67KB

MD5
becb4e14e13bfb39c250456ab5cc3441

SHA1
c1d5151ff2cfe59d9d66cfa479c4f14eb9aaeba9

SHA256
535742ee018f292cf563440d6d0c5d224f1955080d8ab2cefa1ea19f56e47e1d

SHA512
c852531e3c029eac7987e9a644d2e246357e110f42dee27cb9954892ee05116680f416a5c7030c854f1c4d7fb8c217aa39c3b07b16346c7b23f390a1409f2906

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
67KB

MD5
3851be12a9016aac7e5ab04d80493c2d

SHA1
ef23cbc203d9fc159f63e9bbbde5e687710ec77a

SHA256
1b98111392d6b8dacb9a46e2884bd06699f5dbf9db6a691ef82f24a0b1592574

SHA512
607c8aceb7b708cedf8a89e8110d184ef790d7e1c6185cf41fc5362f0c6b1a0fc587294558bdc5bffde1f9eff804f475fb6d2e2787b7a4a2aff31e06b799dd22

Download Submit
C:\Windows\SysWOW64\Olijhmgj.exe

Filesize
67KB

MD5
4eeeb5db7da2ae970c64b3454b9d011e

SHA1
af5852fcfeb3092c04b8481334803ff804af401e

SHA256
c6379165266f47daf2d678a54949c0c35ed76d03e1698f205b67f3628b0c8d90

SHA512
8a72d2c8cf0dc7297819bd1746f83a1396557fc468e987f5bb623ea4610a21a9060325b1548931ddb3096c6f082a1e4f0347113b2b48f4181f48e4159d743bee

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
67KB

MD5
3f3820cedd38d61f452b3bb04fca0dab

SHA1
0e207bf9184df3957cfb5cb4c758beec41b9defd

SHA256
e4fe655c2c427d785308a8ab27ef754eae09b4ea6981ca94938a82f3728b4c83

SHA512
d42dcff4e18f5f87ea9b6248778b0151fedea9dc261c15b4a0ef07a393a4c69c45f7d2db2f304d584e9654bcd5b3b4da1cb5059f79f090c625fdd766961f75c2

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
67KB

MD5
2f11a5b12f3717f2468d9a2f6e2314e8

SHA1
a633885ea4390e906e752bfa261c300439aef695

SHA256
c582301f5e2a374ba4a21bdea91f013dc9bc8e550075ae93891d7a5a770f0721

SHA512
141d6df23e9f6eab220848ca48740d28c360cd95cab91f06e96cb463de1a647ba30ccdf0a80ca55ccabc5a5e87ff77e721d8e8e2719d95848fc1b2d2ab49621b

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
67KB

MD5
3fa6257f71e962cc0aa46f9c99641bd5

SHA1
3c6cec61de1cd3584ee8777788e4d5e1f88590d8

SHA256
86fe6ed127dbdc197a553ba031986b248d0a71adb72204499d1d9b4e0f2ee143

SHA512
2ee5924357033b09e81c348694955b44a730f60ce7bcedb617c5fc83837337ea1c004fe3d5d79988dda95cfaca964438d86151ec63b05953001efa811da195f5

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
67KB

MD5
30e7905837ca4430435d764413a039cc

SHA1
fc7c18e478a458630c8b12bf6abc645236798927

SHA256
12bfa7850b89487372db1fcf4d4abf751f68bb0bcef55c9aee1b5376534f96e0

SHA512
6f5a146e1be2e17e928d082b662b90997bde0b943776a81da601a5b954507f42cc30f1d5edd2e6d695a3fe6291aba70b70b9f96747480b0e2b9cdef99b5338d6

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
67KB

MD5
e1b49c20e541752dc1ad30e02fbc4758

SHA1
8d6c4ac9a55e115dee8cd7e25114e8feed598571

SHA256
fd2c3084432d873afe00b3823414be8e2c46ca9707d7ad49b8233978ae5f7a2d

SHA512
8d7686cd51483b9af30399ed2b2148377b68c3298d1d418b461aa463f8e29771c5b223489d5273f9341735b31eca7394ab3d8285797f69ae377595c91d9b2070

Download Submit
C:\Windows\SysWOW64\Pqbala32.exe

Filesize
67KB

MD5
63267d706978153e09ce4bb13479ea1e

SHA1
f26bfe7345ad9b8efb2e304d40a1cd1828b74c08

SHA256
cbcd354591527a05044791c1bde1efdf94a8ac1227be32b7e6be12c87b025a70

SHA512
51628b10d8424bf3157101a19074ae6c6cdbb60e7b8bd63b82ead0915c1896a9c989a4565ebfbf53e2375d72dc5875d3313aaeda130f4a18a21c5bcc64b201e3

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
67KB

MD5
42536055f739d9f9c6fbb8b4fcd2723f

SHA1
35dcf01856dd7e4665838da1ed519bad1c0edd40

SHA256
b807092fba835339f612a37dfadebcec630d85def71f436ce75ae9048d981443

SHA512
01cbc9edc5b0db45cd8960cfcc3580b5ab36510d059bb2fb47c7c89a5c5da9f93457b30256d9498d57a9782d059db6aaa4e363eaacffad3809918cac38980f1f

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
67KB

MD5
51a8ce25637f647d70eff028bd241fa2

SHA1
fd0089fb6739b465bd14414cc495b6c0bb5d264f

SHA256
50616da85f7c556f6ffaee578aa492036cafbd117489d431dce8acde910d1964

SHA512
4d0bc8685590891f8b7e1314313e014a06af94fdf4124fd6a5bb997113795d54aa6addaf515f81ab9d2cd23cd37c4021196cba3ab1165c6d7839e2e854b2f15b

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
67KB

MD5
451a790a54e81b566aed229991d2da1b

SHA1
3f2dc7a419b05babec808cd268476bb92df28be7

SHA256
6fafb836f3da9ab48397c244675ca71006e827b60e4200119767a834f198b5ff

SHA512
b53cb65c583754a4bc1c0fdaf9da2358ee08b82e409f637180fa0eeed66444b9f86f7dcd73e9bd59219ae40aa2f58d8857bf626cadff7fda8b40c2d244537a72

Download Submit
memory/64-479-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/372-281-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/392-263-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/664-320-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/804-245-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/832-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/832-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/832-539-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1256-173-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1304-363-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1340-88-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-540-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1584-323-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1632-501-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1756-256-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1776-32-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1776-573-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1824-329-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-97-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1944-383-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1956-425-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1980-112-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2024-471-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2028-357-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2120-594-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2120-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2128-160-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2172-297-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2228-419-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2296-563-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2296-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2340-201-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2416-441-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2516-217-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2524-145-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2552-494-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2560-129-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2580-454-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2632-305-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2672-489-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2708-269-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2800-459-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2860-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2860-580-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2872-371-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2892-389-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2992-520-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3144-503-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3240-521-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3288-123-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3320-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3384-152-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3396-105-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3420-551-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3476-345-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3504-473-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3532-381-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3664-81-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3796-136-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3864-233-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4044-225-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4144-299-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4188-413-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4280-527-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4308-208-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4352-347-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4356-407-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4380-253-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4392-399-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4396-311-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4416-291-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4424-447-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4456-435-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4512-275-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4532-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4532-566-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4552-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4560-533-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4660-365-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4736-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4736-552-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4772-514-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4820-52-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4820-587-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4840-193-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4856-466-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4964-185-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4988-335-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5036-177-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5080-405-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5136-553-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5196-565-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5240-571-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5288-579-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5332-585-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5380-588-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads