b24d8669ec73d9c9bf6ccab82b721eee7f60bdd12820a33fafc9cf2327019c16

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Virus.Hijack.ATA_virussign.com_b3b3db16b34ab828616b4854e7de9275.exe
Size

1.5MB
MD5

b3b3db16b34ab828616b4854e7de9275
SHA1

4a8687b453a5537a3e68ed48cdd4b8daa150926a
SHA256

b24d8669ec73d9c9bf6ccab82b721eee7f60bdd12820a33fafc9cf2327019c16
SHA512

4873a89b45af4eeded34b290694382a4028256c3b8496c646d46b1a24e05c6b8929fd8a36df9035b50a5615809745c7d510f71d735968410392ac6518a168540
SSDEEP

24576:fuz0T4Ph2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWtec+fwv4cXl:2pbazR0vKLXZnec+Yv4cXcy6l6mFndwn

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jibmgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpnmbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bepmoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmeapmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmcolgbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgnqgqan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omegjomb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiildio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlmbfqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peahgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cklhcfle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njiegl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjicdmmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmjemflb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpanan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igjngh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbenmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Meiioonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anaomkdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fiaael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmblagmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlieda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fmikeaap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnjejjgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilnbicff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Moipoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkipkani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chiigadc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lokdnjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nemmoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coiaiakf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpabni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idhnkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okkdic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfnfjehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdgnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmhigf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onapdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhpbfpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgnqgqan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moipoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbgjbkfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjbogmdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ooqqdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnmdme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chglab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miaboe32.exe

Executes dropped EXE 64 IoCs

pid	Process
4244	Idieem32.exe
3336	Igjngh32.exe
2452	Iqbbpm32.exe
2028	Jjjghcfp.exe
4500	Jhlgfj32.exe
2060	Jibmgi32.exe
1372	Jbkbpoog.exe
1648	Kelkaj32.exe
528	Kkfcndce.exe
4652	Knflpoqf.exe
3300	Keqdmihc.exe
5004	Kageaj32.exe
1328	Lbgalmej.exe
2520	Ljbfpo32.exe
1304	Legjmh32.exe
2000	Lkabjbih.exe
4284	Lejgch32.exe
3928	Lghcocol.exe
2248	Ljgpkonp.exe
2444	Laqhhi32.exe
4992	Llflea32.exe
1856	Lndham32.exe
756	Lacdmh32.exe
4692	Lijlof32.exe
3772	Ljkifn32.exe
1900	Maeachag.exe
1860	Milidebi.exe
3852	Mlkepaam.exe
2224	Mbenmk32.exe
4812	Mlmbfqoj.exe
3896	Mbgjbkfg.exe
224	Miaboe32.exe
1496	Mbighjdd.exe
1908	Mhfppabl.exe
4748	Mnphmkji.exe
3208	Mejpje32.exe
3276	Mldhfpib.exe
764	Nobdbkhf.exe
2812	Nemmoe32.exe
3584	Njiegl32.exe
3028	Nacmdf32.exe
3888	Nhmeapmd.exe
4924	Nognnj32.exe
4848	Neafjdkn.exe
1020	Nhpbfpka.exe
3680	Nojjcj32.exe
2536	Neccpd32.exe
2208	Nhbolp32.exe
3724	Nolgijpk.exe
4568	Nefped32.exe
1492	Nlphbnoe.exe
4028	Objpoh32.exe
4072	Oidhlb32.exe
692	Ooqqdi32.exe
228	Oifeab32.exe
3980	Okgaijaj.exe
2652	Oaajed32.exe
2916	Ohkbbn32.exe
1260	Ooejohhq.exe
3828	Oadfkdgd.exe
3808	Ohnohn32.exe
3080	Obcceg32.exe
4216	Oeaoab32.exe
4252	Pllgnl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kjccdkki.exe	Jgeghp32.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Jlolpq32.exe
File opened for modification	C:\Windows\SysWOW64\Mjodla32.exe	Mgphpe32.exe
File created	C:\Windows\SysWOW64\Dbkqfe32.exe	Domdjj32.exe
File opened for modification	C:\Windows\SysWOW64\Fiodpl32.exe	Fbelcblk.exe
File created	C:\Windows\SysWOW64\Kbjodaqj.dll	Fiaael32.exe
File created	C:\Windows\SysWOW64\Hahohdla.dll	Neccpd32.exe
File opened for modification	C:\Windows\SysWOW64\Lncjlq32.exe	Ljhnlb32.exe
File created	C:\Windows\SysWOW64\Njiegl32.exe	Nemmoe32.exe
File created	C:\Windows\SysWOW64\Fkngke32.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Fboqkn32.dll	Lgibpf32.exe
File created	C:\Windows\SysWOW64\Fomnhddq.dll	Cnhgjaml.exe
File opened for modification	C:\Windows\SysWOW64\Palbgl32.exe	Ponfka32.exe
File created	C:\Windows\SysWOW64\Ldjcfk32.dll	Klcekpdo.exe
File created	C:\Windows\SysWOW64\Nbbond32.dll	Mlkepaam.exe
File created	C:\Windows\SysWOW64\Odalmibl.exe	Oacoqnci.exe
File created	C:\Windows\SysWOW64\Ckeimm32.exe	Chglab32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhiemoj.exe	Aaoaic32.exe
File created	C:\Windows\SysWOW64\Kqmkae32.exe	Kjccdkki.exe
File created	C:\Windows\SysWOW64\Ppcbba32.dll	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Jcebldil.dll	Neafjdkn.exe
File opened for modification	C:\Windows\SysWOW64\Pdenmbkk.exe	Pagbaglh.exe
File opened for modification	C:\Windows\SysWOW64\Bdagpnbk.exe	Bacjdbch.exe
File created	C:\Windows\SysWOW64\Kkfcndce.exe	Kelkaj32.exe
File created	C:\Windows\SysWOW64\Jbqaei32.dll	Dihlbf32.exe
File opened for modification	C:\Windows\SysWOW64\Omegjomb.exe	Onpjichj.exe
File opened for modification	C:\Windows\SysWOW64\Pknqoc32.exe	Phodcg32.exe
File opened for modification	C:\Windows\SysWOW64\Efgemb32.exe	Epmmqheb.exe
File created	C:\Windows\SysWOW64\Jcmdaljn.exe	Ipoheakj.exe
File opened for modification	C:\Windows\SysWOW64\Pdjgha32.exe	Palklf32.exe
File opened for modification	C:\Windows\SysWOW64\Keqdmihc.exe	Knflpoqf.exe
File opened for modification	C:\Windows\SysWOW64\Oacoqnci.exe	Omgcpokp.exe
File created	C:\Windows\SysWOW64\Onpjichj.exe	Olanmgig.exe
File created	C:\Windows\SysWOW64\Blgifbil.exe	Bemqih32.exe
File created	C:\Windows\SysWOW64\Nlnhqepf.dll	Efgemb32.exe
File created	C:\Windows\SysWOW64\Fmfgek32.exe	Fflohaij.exe
File created	C:\Windows\SysWOW64\Eanmnefk.dll	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Cnaaib32.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Lghcocol.exe	Lejgch32.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Ddgibkpc.exe
File created	C:\Windows\SysWOW64\Lghcocol.exe	Lejgch32.exe
File created	C:\Windows\SysWOW64\Okbcgopo.dll	Idhnkf32.exe
File created	C:\Windows\SysWOW64\Aqhblk32.dll	Pknqoc32.exe
File opened for modification	C:\Windows\SysWOW64\Aogbfi32.exe	Afpjel32.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	Dojqjdbl.exe
File opened for modification	C:\Windows\SysWOW64\Efccmidp.exe	Ecefqnel.exe
File created	C:\Windows\SysWOW64\Eleepoob.exe	Ejchhgid.exe
File opened for modification	C:\Windows\SysWOW64\Mcqjon32.exe	Lkeekk32.exe
File opened for modification	C:\Windows\SysWOW64\Fpkibf32.exe	Fiaael32.exe
File opened for modification	C:\Windows\SysWOW64\Ckilmcgb.exe	Cjgpfk32.exe
File opened for modification	C:\Windows\SysWOW64\Dihlbf32.exe	Dbndfl32.exe
File opened for modification	C:\Windows\SysWOW64\Ipgbdbqb.exe	Imiehfao.exe
File opened for modification	C:\Windows\SysWOW64\Akblfj32.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Hhfjcdon.dll	Afkknogn.exe
File created	C:\Windows\SysWOW64\Gpelhd32.exe	Gmfplibd.exe
File created	C:\Windows\SysWOW64\Hccdbf32.dll	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Qaqegecm.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Fjjnifbl.exe	Fdqfll32.exe
File created	C:\Windows\SysWOW64\Lejomj32.dll	Glengm32.exe
File opened for modification	C:\Windows\SysWOW64\Nmnqjp32.exe	Ndflak32.exe
File created	C:\Windows\SysWOW64\Ompfej32.exe	Ojajin32.exe
File created	C:\Windows\SysWOW64\Lijlof32.exe	Lacdmh32.exe
File created	C:\Windows\SysWOW64\Angdnk32.dll	Dmohno32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13272	13004	WerFault.exe	673

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgnbaeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bochmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmblagmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlmbfqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nognnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknojl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloidijb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piijno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjmkoeqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laqhhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nolgijpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdpmbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Digehphc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacdmh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plmmif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahgcjddh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eifaim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bphgeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gihgfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiipmhmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nagiji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjgpfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjjkaabc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmkdcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coknoaic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gflhoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdenmbkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfefkkqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hplbickp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ponfka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fflohaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpgind32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfohgqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Objpoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhamkipi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqmmmmph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgloefco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afinioip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcinna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Higjaoci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbpjaeoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knenkbio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkmdecbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqfngd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omjpeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmhpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdjgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kncaec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obcceg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efccmidp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmikeaap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikkpgafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlgepanl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qkipkani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiabl32.dll"	Mkhapk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmfhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibdlakbf.dll"	Hffken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahaceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aokkdnic.dll"	Igjngh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klkfenfk.dll"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilchfdgp.dll"	Digehphc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljkifn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cponen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbnnbmfj.dll"	Ooqqdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lebcnn32.dll"	Omegjomb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clahmb32.dll"	Lobjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddmgi32.dll"	Hloqml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hpofii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmeoam32.dll"	Kkjeomld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imnocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakdmb32.dll"	Gpnmbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omegjomb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aaoaic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nognnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okkdic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Onapdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlhljhbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kadcjkfm.dll"	Ccpdoqgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Flmqlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jibmgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aphblj32.dll"	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbbnpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eiobceef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbjmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfhpakim.dll"	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lielhgaa.dll"	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bkkple32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpfepf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hifcgion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hpqldc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnahhegq.dll"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fideeaco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oeheqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dempqa32.dll"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobifpp.dll"	Chfegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mebcop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndoell32.dll"	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Idkkpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onahgf32.dll"	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bakgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnadagbm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Idfaefkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjijkmod.dll"	Nmnqjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqhfnd32.dll"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lblldc32.dll"	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmdgikhi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 4244	3900	Virus.Hijack.ATA_virussign.com_b3b3db16b34ab828616b4854e7de9275.exe	85
PID 3900 wrote to memory of 4244	3900	Virus.Hijack.ATA_virussign.com_b3b3db16b34ab828616b4854e7de9275.exe	85
PID 3900 wrote to memory of 4244	3900	Virus.Hijack.ATA_virussign.com_b3b3db16b34ab828616b4854e7de9275.exe	85
PID 4244 wrote to memory of 3336	4244	Idieem32.exe	86
PID 4244 wrote to memory of 3336	4244	Idieem32.exe	86
PID 4244 wrote to memory of 3336	4244	Idieem32.exe	86
PID 3336 wrote to memory of 2452	3336	Igjngh32.exe	87
PID 3336 wrote to memory of 2452	3336	Igjngh32.exe	87
PID 3336 wrote to memory of 2452	3336	Igjngh32.exe	87
PID 2452 wrote to memory of 2028	2452	Iqbbpm32.exe	88
PID 2452 wrote to memory of 2028	2452	Iqbbpm32.exe	88
PID 2452 wrote to memory of 2028	2452	Iqbbpm32.exe	88
PID 2028 wrote to memory of 4500	2028	Jjjghcfp.exe	91
PID 2028 wrote to memory of 4500	2028	Jjjghcfp.exe	91
PID 2028 wrote to memory of 4500	2028	Jjjghcfp.exe	91
PID 4500 wrote to memory of 2060	4500	Jhlgfj32.exe	93
PID 4500 wrote to memory of 2060	4500	Jhlgfj32.exe	93
PID 4500 wrote to memory of 2060	4500	Jhlgfj32.exe	93
PID 2060 wrote to memory of 1372	2060	Jibmgi32.exe	94
PID 2060 wrote to memory of 1372	2060	Jibmgi32.exe	94
PID 2060 wrote to memory of 1372	2060	Jibmgi32.exe	94
PID 1372 wrote to memory of 1648	1372	Jbkbpoog.exe	95
PID 1372 wrote to memory of 1648	1372	Jbkbpoog.exe	95
PID 1372 wrote to memory of 1648	1372	Jbkbpoog.exe	95
PID 1648 wrote to memory of 528	1648	Kelkaj32.exe	96
PID 1648 wrote to memory of 528	1648	Kelkaj32.exe	96
PID 1648 wrote to memory of 528	1648	Kelkaj32.exe	96
PID 528 wrote to memory of 4652	528	Kkfcndce.exe	97
PID 528 wrote to memory of 4652	528	Kkfcndce.exe	97
PID 528 wrote to memory of 4652	528	Kkfcndce.exe	97
PID 4652 wrote to memory of 3300	4652	Knflpoqf.exe	98
PID 4652 wrote to memory of 3300	4652	Knflpoqf.exe	98
PID 4652 wrote to memory of 3300	4652	Knflpoqf.exe	98
PID 3300 wrote to memory of 5004	3300	Keqdmihc.exe	99
PID 3300 wrote to memory of 5004	3300	Keqdmihc.exe	99
PID 3300 wrote to memory of 5004	3300	Keqdmihc.exe	99
PID 5004 wrote to memory of 1328	5004	Kageaj32.exe	100
PID 5004 wrote to memory of 1328	5004	Kageaj32.exe	100
PID 5004 wrote to memory of 1328	5004	Kageaj32.exe	100
PID 1328 wrote to memory of 2520	1328	Lbgalmej.exe	101
PID 1328 wrote to memory of 2520	1328	Lbgalmej.exe	101
PID 1328 wrote to memory of 2520	1328	Lbgalmej.exe	101
PID 2520 wrote to memory of 1304	2520	Ljbfpo32.exe	102
PID 2520 wrote to memory of 1304	2520	Ljbfpo32.exe	102
PID 2520 wrote to memory of 1304	2520	Ljbfpo32.exe	102
PID 1304 wrote to memory of 2000	1304	Legjmh32.exe	103
PID 1304 wrote to memory of 2000	1304	Legjmh32.exe	103
PID 1304 wrote to memory of 2000	1304	Legjmh32.exe	103
PID 2000 wrote to memory of 4284	2000	Lkabjbih.exe	104
PID 2000 wrote to memory of 4284	2000	Lkabjbih.exe	104
PID 2000 wrote to memory of 4284	2000	Lkabjbih.exe	104
PID 4284 wrote to memory of 3928	4284	Lejgch32.exe	105
PID 4284 wrote to memory of 3928	4284	Lejgch32.exe	105
PID 4284 wrote to memory of 3928	4284	Lejgch32.exe	105
PID 3928 wrote to memory of 2248	3928	Lghcocol.exe	106
PID 3928 wrote to memory of 2248	3928	Lghcocol.exe	106
PID 3928 wrote to memory of 2248	3928	Lghcocol.exe	106
PID 2248 wrote to memory of 2444	2248	Ljgpkonp.exe	107
PID 2248 wrote to memory of 2444	2248	Ljgpkonp.exe	107
PID 2248 wrote to memory of 2444	2248	Ljgpkonp.exe	107
PID 2444 wrote to memory of 4992	2444	Laqhhi32.exe	108
PID 2444 wrote to memory of 4992	2444	Laqhhi32.exe	108
PID 2444 wrote to memory of 4992	2444	Laqhhi32.exe	108
PID 4992 wrote to memory of 1856	4992	Llflea32.exe	109

C:\Users\Admin\AppData\Local\Temp\Virus.Hijack.ATA_virussign.com_b3b3db16b34ab828616b4854e7de9275.exe
"C:\Users\Admin\AppData\Local\Temp\Virus.Hijack.ATA_virussign.com_b3b3db16b34ab828616b4854e7de9275.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\Idieem32.exe
  C:\Windows\system32\Idieem32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\Igjngh32.exe
    C:\Windows\system32\Igjngh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\Iqbbpm32.exe
      C:\Windows\system32\Iqbbpm32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2452
    - - C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2028
      - C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        23⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:756
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        25⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        27⤵
        Executes dropped EXE
        
        PID:1900
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        28⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3896
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3860
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        35⤵
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        36⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        37⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        38⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        39⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        40⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2812
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3584
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        43⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        48⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        50⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        52⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        53⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4028
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        55⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:692
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        57⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        58⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        59⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        60⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        61⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        62⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        63⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3080
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        65⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        66⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        67⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        68⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        69⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        70⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        71⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        72⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        74⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        76⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        77⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        78⤵
        Drops file in System32 directory
        
        PID:4300
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        79⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        80⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3952
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        82⤵
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        83⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        84⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        85⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        87⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        89⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        90⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        91⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4956
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        93⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        94⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        95⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        96⤵
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        97⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3052
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        99⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        100⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        101⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        104⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        105⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        108⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        109⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        110⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        111⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        112⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        115⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        116⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        118⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        119⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        120⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        121⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        122⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        124⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        125⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        126⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        127⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        128⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        129⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        130⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        131⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        132⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        133⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        135⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        136⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        138⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5420
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        140⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        142⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        143⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        144⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        145⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        147⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        149⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        151⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        152⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        153⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        154⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        155⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        156⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        158⤵
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        159⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        160⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        161⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        162⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        163⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        164⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        165⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        166⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        169⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        170⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        171⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        172⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        173⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        174⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        175⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        176⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        178⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        179⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        180⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        181⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        183⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        184⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        185⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        186⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        188⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        189⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        190⤵
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        191⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        192⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        193⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        194⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        195⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        196⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        197⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        199⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        200⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        201⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        204⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        205⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        206⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        207⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        208⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        209⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        210⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        212⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        213⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        214⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        215⤵
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        216⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7200
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        218⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        219⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        220⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        222⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        223⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        224⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        225⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        226⤵
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        227⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7684
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        229⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        230⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        231⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        232⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        233⤵
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        234⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        236⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        238⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        239⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        240⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        241⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        242⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        243⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        244⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        246⤵
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        247⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        248⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        249⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        250⤵
        Drops file in System32 directory
        
        PID:7900
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        252⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        253⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        254⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        255⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        256⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        258⤵
        System Location Discovery: System Language Discovery
        
        PID:7572
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7680
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        260⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        261⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        262⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        263⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        265⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        266⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        267⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        268⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        269⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        270⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        271⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        272⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        273⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        274⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        275⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        277⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        278⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        279⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        280⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        281⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        282⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        283⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        284⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:8768
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        287⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        288⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        291⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        292⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        294⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        295⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        296⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        297⤵
        Modifies registry class
        
        PID:8256
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        298⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        299⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        300⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        301⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        304⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        306⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        307⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        308⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        309⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        310⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        311⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        312⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        313⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        314⤵
        System Location Discovery: System Language Discovery
        
        PID:8608
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        315⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        316⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        318⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        319⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        320⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        323⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        325⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        326⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        327⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        328⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        329⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        330⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        331⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        332⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        333⤵
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        334⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        335⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        336⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        337⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        338⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        339⤵
        Drops file in System32 directory
        
        PID:9392
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        340⤵
        Drops file in System32 directory
        
        PID:9436
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:9480
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        342⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        343⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        344⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        345⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        346⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9700
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        347⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        348⤵
        Drops file in System32 directory
        
        PID:9788
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        349⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        350⤵
        Modifies registry class
        
        PID:9896
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        351⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9988
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10032
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        354⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        355⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        356⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        357⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        358⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        359⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        360⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        361⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        362⤵
        System Location Discovery: System Language Discovery
        
        PID:9404
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        363⤵
        Drops file in System32 directory
        
        PID:9496
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9564
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        365⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        366⤵
        Modifies registry class
        
        PID:9716
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9776
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        368⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        369⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        370⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        371⤵
        Modifies registry class
        
        PID:10088
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:10156
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        373⤵
        Modifies registry class
        
        PID:10220
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        374⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        375⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        376⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        377⤵
        Modifies registry class
        
        PID:9544
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        378⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        379⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        380⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9904
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        381⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        382⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        383⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        384⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        385⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        386⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        387⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        389⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        391⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        392⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        393⤵
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        394⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        395⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        396⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        397⤵
        Drops file in System32 directory
        
        PID:9332
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        398⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        399⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        400⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        401⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        402⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        403⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        404⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        405⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        406⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        407⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        408⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        409⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10632
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        411⤵
        Modifies registry class
        
        PID:10676
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        412⤵
        Drops file in System32 directory
        
        PID:10720
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        413⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        414⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        415⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        416⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        417⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10984
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        419⤵
        Drops file in System32 directory
        
        PID:11028
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        420⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        421⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        422⤵
        System Location Discovery: System Language Discovery
        
        PID:11156
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11200
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        424⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10268
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        426⤵
        System Location Discovery: System Language Discovery
        
        PID:10340
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        427⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        428⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        429⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        430⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        431⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        432⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10784
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        434⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10928
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        436⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        437⤵
        Drops file in System32 directory
        
        PID:11064
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        438⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        439⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        440⤵
        System Location Discovery: System Language Discovery
        
        PID:11256
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        441⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        442⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        443⤵
        Modifies registry class
        
        PID:10524
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        444⤵
        Drops file in System32 directory
        
        PID:10640
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        445⤵
        Drops file in System32 directory
        
        PID:10756
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        446⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        447⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        448⤵
        System Location Discovery: System Language Discovery
        
        PID:11060
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        449⤵
        System Location Discovery: System Language Discovery
        
        PID:11184
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        450⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        451⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        452⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        453⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        454⤵
        System Location Discovery: System Language Discovery
        
        PID:10936
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11104
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        456⤵
        Drops file in System32 directory
        
        PID:10284
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        457⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        458⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        459⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        460⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        461⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        462⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        463⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        465⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11152
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        467⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        468⤵
        Modifies registry class
        
        PID:11344
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        469⤵
        Modifies registry class
        
        PID:11388
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        470⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        471⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        472⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        473⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        474⤵
        System Location Discovery: System Language Discovery
        
        PID:11608
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        475⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        476⤵
        System Location Discovery: System Language Discovery
        
        PID:11696
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        477⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        478⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        479⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11868
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        481⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        482⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        483⤵
        System Location Discovery: System Language Discovery
        
        PID:11976
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        484⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        485⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        486⤵
        Drops file in System32 directory
        
        PID:12084
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        487⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        488⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        489⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12228
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        491⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        492⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        493⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11396
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        495⤵
        Modifies registry class
        
        PID:11452
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        496⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        497⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        498⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        499⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        500⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        501⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        502⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        503⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        504⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        505⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        506⤵
        Drops file in System32 directory
        
        PID:12104
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        507⤵
        System Location Discovery: System Language Discovery
        
        PID:12164
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        508⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        509⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        510⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        511⤵
        Drops file in System32 directory
        
        PID:9312
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        512⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        513⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:11684
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        514⤵
        System Location Discovery: System Language Discovery
        
        PID:11776
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        515⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12008
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        517⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        518⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        519⤵
        Drops file in System32 directory
        
        PID:11376
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11556
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        521⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        522⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        523⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        524⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        525⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        526⤵
        Drops file in System32 directory
        
        PID:12092
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        527⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        528⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        529⤵
        System Location Discovery: System Language Discovery
        
        PID:12080
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        530⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        531⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        532⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        533⤵
        Modifies registry class
        
        PID:12404
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        534⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        535⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        536⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        537⤵
        Drops file in System32 directory
        
        PID:12548
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        538⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        539⤵
        Modifies registry class
        
        PID:12624
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        540⤵
        Modifies registry class
        
        PID:12660
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        541⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        542⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12732
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        543⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12768
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        544⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        545⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        546⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        547⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        548⤵
        System Location Discovery: System Language Discovery
        
        PID:12948
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        549⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        550⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:13020
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        551⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        552⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        553⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        554⤵
        System Location Discovery: System Language Discovery
        
        PID:13168
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        555⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        556⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        557⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        558⤵
        System Location Discovery: System Language Discovery
        
        PID:11660
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        559⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12412
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        561⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        562⤵
        Drops file in System32 directory
        
        PID:12544
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        563⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        564⤵
        Modifies registry class
        
        PID:12684
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        565⤵
        Modifies registry class
        
        PID:12752
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        566⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        567⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        568⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        569⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:13008
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        570⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        571⤵
        Drops file in System32 directory
        
        PID:13140
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        572⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        573⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13264
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        574⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        575⤵
        Drops file in System32 directory
        
        PID:12428
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        576⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        577⤵
        Drops file in System32 directory
        
        PID:12668
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        578⤵
        System Location Discovery: System Language Discovery
        
        PID:12792
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        579⤵
        Drops file in System32 directory
        
        PID:12896
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        580⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13004 -s 412
        581⤵
        Program crash
        
        PID:13272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 13004 -ip 13004
1⤵
PID:13200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acokhc32.exe

Filesize
1.5MB

MD5
f68592a830f3fb8ae0df4b627f55927e

SHA1
fab58873fb407764897ce37a8fbc4d5957a7c468

SHA256
5ac61363462afe05546b2a40a1e1bab117438bead06d1dae814d28db21ae3e80

SHA512
dfd0fb23b32a9d564679316803fb2064349368483c8902d4d6c8f52049978944df4f343e5126b0fbfb07e481028c3d8f71c6972f09b71b771831e43b4b5a4788

Download Submit
C:\Windows\SysWOW64\Adkqoohc.exe

Filesize
1.5MB

MD5
d265545a9d473543b05e45e151566bba

SHA1
e8d97869a4417b138e8ee8de4d9a6d81cc52c234

SHA256
c391c574dc19149296f1422bcb493b7dfe4a38b564b9d4b123c015e9586fe27a

SHA512
228067a582bf8536a8e2d8590517499670c017b740f6f75c6a2ed8180ec0a827497dde46b8f8bf677992ecf20be9a5ddb1469f16a49bb97c07e3248a3b3140d2

Download Submit
C:\Windows\SysWOW64\Ahgjejhd.exe

Filesize
1.5MB

MD5
b74618aefdf7e93ce3888d3d0acbc3f0

SHA1
a7c3f8b9144f61f43552e3750f0d6792de24bca8

SHA256
b6eca99214d99bd3f4de12199494498578aae724c15740345eec4d2b9d305966

SHA512
6232b06b72b7307a84b46c9af3e43c628fb752bdbb7e8adb739c774170a35c2f48fd6fb64e33e895d309c5312451a8d63b80a71fbc76949df8c58d05faa94725

Download Submit
C:\Windows\SysWOW64\Ahippdbe.exe

Filesize
1.5MB

MD5
e6af507a8628b2db11c5b99f11458bcf

SHA1
309fe88b119e4580c8729ca9f1c6baafdeb79a59

SHA256
224411bc9a125d45826560ced6576f835defe8bd797ab530c84c25734d1c49f6

SHA512
4b765a44aa4a22d11e6e01a2c0d714886bf110608eac443ad1f265469bdeba5d6b413b3cf8eb9e68e20b4be559bb2061342612522fe221b988e9444d91e61a11

Download Submit
C:\Windows\SysWOW64\Aoalgn32.exe

Filesize
1.5MB

MD5
0c60f2d3fad2a2a36eeadbe6ecabf434

SHA1
96dc2d65411b75ca34a8eea7bb0591eb3fcb12a0

SHA256
b83b0d9ccc8a09f89979554497252887484114788a46e1de3233393fdab25fb6

SHA512
fdf336ae1930eee227a8fc187acf67baa7b266e72470c6a5a9a0deb2aa8e55cc2dabc82c7f229edb459f566253480b04f964c1593beafa6227f82fd7df497c04

Download Submit
C:\Windows\SysWOW64\Bcddcbab.exe

Filesize
1.5MB

MD5
0728d2ff2b2a63eafa3290ef6d533257

SHA1
2ea89b99031df74fe946b84542a9c84e44bdbd7d

SHA256
704642b9d21d42f898fcc849b2a24859bbf35a78fdb3ef81440037e4685bb841

SHA512
1709b59a2998f5a996126b4d86ce4bbb7cfc4e9fbed9834d23bbe7a3e94ef4a42c02d65ad6ef62492bb4f18c63eac34f4ba1669122fc49e7b8ef17be89035071

Download Submit
C:\Windows\SysWOW64\Bhbcfbjk.exe

Filesize
1.5MB

MD5
a54733312075f269190ef5630857fdd5

SHA1
a8174a1ec8d0c57b7879785b69f4cee05c94ca0b

SHA256
534e246ee85fc30b5116c42f9f8134df420e38b04bbd61d2dc8b785fe79c9d3d

SHA512
51126139f754f95f66e3300a31b8d4fc92167818dea3914fd8f09ca89e6cfceb8e8fdbcc196fb70901f11cfddd2f504b3e6f73e60ee7b4fb718c4e6191d7d109

Download Submit
C:\Windows\SysWOW64\Bjbfklei.exe

Filesize
1.5MB

MD5
41a62a46f7b63e98475d4a03662f4522

SHA1
2bdd4200d57a4e59618457490586bd188b982a29

SHA256
69661780e028f5b3bb670659a816003c69353a9807d42fc99267ddd51b6ce656

SHA512
ca58c8323260ae2f23215dd3f235aacd0387d24d4abeda038cfe6986e41aa2926cb9b769b9111abd8032a30eda2d40e3910c9372f1215016b3972d7bba91f1f4

Download Submit
C:\Windows\SysWOW64\Bkkple32.exe

Filesize
1.5MB

MD5
bb4dc1290ece78f9323fa8ba5fc4294a

SHA1
b07ea875e6fdf4a25a7c792c4fdf230f69945109

SHA256
6e0f7f9fd2565cc83d92c89e1eee26bd7366bb1739d6aa1af340c63dbe835e8a

SHA512
4a631e95041dd699b6897f230da7355db6971777a8de189c6f94449aafaac343262f33cdeaa79f89bd998a62ba57ad364209da96eb7e47acf3202728b6ad7f38

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
64KB

MD5
865694baef42e9806f6239c91876cd47

SHA1
a25b298d22d9ca3f2e29b708750d31197081d9c6

SHA256
75bc3aac69ca0a29f679932ce383c1f226b47b7e15b9a3984caa1d1a59452fc2

SHA512
a9f51f3184f2fdcefb65f9e266f7106964d52096e9095e5927009aae67441f8339782dc1955dc5f59fe9d02893400eb434fc2da83d79a291b68fc0a6e27480db

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
1.5MB

MD5
25ad9e992907624cb06873cd5bb68dca

SHA1
5a7c6fa4d42914b9d4ecd0a3c41f66ce00e798b5

SHA256
4b7b51452e918e5c1dcf8b2201a309f0c74e9355f5cafcb52e406052d6ebbab5

SHA512
3e487c6bef5f63e57eafc67690e19dbef8b038ebc37085a7d75325acc4de4d3a57f0977a3550518c21ba91bdd3e4114a62f9cfaa191d74e6a40ab1f9b57cb1f8

Download Submit
C:\Windows\SysWOW64\Cfkmkf32.exe

Filesize
1.5MB

MD5
990f44f5b4620e76d0a3e1d583a8ef17

SHA1
19df4555ccd088f376d18f5d1a306914dce2b2e4

SHA256
a9aa1e060b28acc3657155500dc91fc14ff17b99e76e15f38a32ae34ea5916b6

SHA512
20b8defa4e635fc0fe4ac5530b9f964a16fb2519dfeeac090beb175c281b1d5bc000664e548d225392f4a4102b1367658fa21d4c1beffcda1595db3d40c565ad

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
1.5MB

MD5
52420052f4cf996e7ed364fb7bc6b62f

SHA1
ac589a14916d31319581e8c61a55125abcbdca5d

SHA256
2524ce467a27f00448a7de3b0c8b0c5463802fc92a23609da39eedbbcb5e03c2

SHA512
0f0f712d6d09e014c54ad63aa014d4a58c8ca39af3737b3fd5ff83e28ebad8ba69f3b90c8e7460ee515d6b348e4de0e33a3458caf9f967929d866512056a78ef

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
1.5MB

MD5
b9150c52acb362f9a55a6efb92754000

SHA1
9e0c221070e82c7c8ad8273e9eb4b890c7144627

SHA256
04d0dc02479b7a9024b7436fe882731f909d47b7ab899e19eebce7cd8257c19c

SHA512
f4b8dafaaafcded12ad97a58b583b921fcb8c6b469f38d3f1e3507fa5c9295824715fd26a8d945add97a6ef5635e682eb63e43d9b476a23ad444493f1ed85b29

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
1.5MB

MD5
9cc6531388ef3a84a4e202347743eaae

SHA1
bfd7d4ad464fee84a7ce9ead1096f35e13895e85

SHA256
5f6914a1bf2baa7ece509f38e4a6ee3e89b84c56ce8120686e88e3137555fe2a

SHA512
f77972eb25c52fe47cff33dd28c4fff0bbe71a276db6acbb1f9cf7914e44f1518f7a41ef6515f1bcb6e5942238553f0387ac0671a927c2235d75b4a1ac8403ad

Download Submit
C:\Windows\SysWOW64\Cmmbbejp.exe

Filesize
1.5MB

MD5
19c7b09b0a58438bf12249a8f849a9ac

SHA1
31b545ba68d7d5be0851bc0d57bc65ca404de30b

SHA256
b70b5d8f402e1fc4d661304fa7bd84c2fd696a2de9e0acfe32c4dba0d90f6e3a

SHA512
241929a3ca9482e1c81082f2d3c1d822809ae53572171ba632557f00282e033962f76a359b9b77ba4abcb34e454362c4906cc4bc0b5b4028c6d02bb84f362cbb

Download Submit
C:\Windows\SysWOW64\Cnhgjaml.exe

Filesize
1.5MB

MD5
9eb59ba58a57328f5ab19a474148f8a1

SHA1
97a4dca3a1e3c6141aa8551e118d013abd26dcac

SHA256
b955c62debeebb2063ff81ce60b316df77a0ce1be3aedeb54b20f2b25065bf9b

SHA512
4d7fcb0d815f7fd8e2419ca3e9b96c04cf087257fbb2e1200fae137aaa7cef0b6c2212c759e4329d43b052f08d9aa93e4d8695d752073eb029afa23bbf4b2905

Download Submit
C:\Windows\SysWOW64\Cocacl32.exe

Filesize
1.5MB

MD5
f3a8dd0e40656adb7b3df054d3ef658f

SHA1
12472f550c9b75b353a6b76e5906a19bf4014392

SHA256
8c6686e482cbc3ffd08c05476456849c7c626ef5cfad66a02e75568687de7f25

SHA512
8f79cef9f290690a317aae090ef616b2d78c18de79a37313183ccc90814dc2cd6a169a4a7d046e23b4637db4e950707651967c975c44abb95118d1fbdd4d7ee8

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
1.5MB

MD5
c8483315b7734e42dc1cea411ac9bcb4

SHA1
d4db4f84964c8ca386296792a31e1a8d795074e0

SHA256
eddd2c14f30ea8c29d87df68a1d6a717dcef682bdfc29f4050a29c0fc83484eb

SHA512
d8cc4431d4b4a2db096fc375ba713b65c35487c84b16d237e38a766c1922a03284359be416d3694740d4c306ce884fb272a838a06e77a65b46bd615156b2ed4f

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
1.5MB

MD5
a4d28c0db3ff6646601159134b3d6e87

SHA1
19f198e2c934ef9ad4b87a34829b35e83c90f61a

SHA256
183cad13a44b9c6cbf0d5241c2f2927c8fcbb9e9d1e3854d66aa46933f0ca103

SHA512
88136d850f44d221e9536a0fb8d34e6720178f108bfe868287adbf214fc062f398134baba11662c12e416427e0b1cec4456119756927ad63449cab410d8c64b8

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
1.5MB

MD5
c14d86b2370d43f40aa59481415f7e45

SHA1
f3fcdab560a51a1309536090ecbe04dacd64895b

SHA256
8f19d19b599a1aa47d115d57e806c51c788826122bc86f393e9f1301a8a61324

SHA512
4460af777109bca7421a0e77ebfbc617ee38efb3e6f6f4d0a34c43333437c5756348448119fc676028ba28018bb94c24740abeacd81def495cb022a70124785d

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
1.5MB

MD5
fb7c1ba17a6d5181f190d404df1677f9

SHA1
75da25d44fd8a19412a544439f68a0525b0c4ab5

SHA256
9c7b657bc3e8972a8765bfa499d2b91a96190aba53ab9c696ef47d87fea53a9d

SHA512
3919e5f7fe36d6b1a6cd5fdfa25f522aa5d69bc3d0b8e99d69d29c12238fe81b4c54f4193bee87e92389cd34d5e4cb81b2c9722556ae935df148e6281d18cf4d

Download Submit
C:\Windows\SysWOW64\Efjbcakl.exe

Filesize
1.5MB

MD5
88ecc3524c0cb8e99281a8d2259bbfdd

SHA1
406b072da6f4326832410e9da44de77031fc51be

SHA256
ff751da6fb5217251930e6e780f39de28e78396b13b2389da74a3657ccad7fa2

SHA512
c9449c9c05de7e1a281a6fa91c650dd50d717757edf2eda107ab5b737fd7dc3f21f23524ffaf40f99bcfb2612af7066edcafc7de1caad677748d53031a15dfe1

Download Submit
C:\Windows\SysWOW64\Eifaim32.exe

Filesize
1.5MB

MD5
8e0bb3193c6795fe99bf61a1e4fd3f15

SHA1
4b20de448a2413346adfab07dac9db3c02d24973

SHA256
72bdfb81bc30aa3bdb39bc09d2b81220e33b3678309be2e7acbe7c33b94f97dd

SHA512
d3e35c7abd185f0a299afc5f2bff63b2a2d4e1bf7ef4353541419eb7a6f802d28b46114f157523e4345ddd1869f372b1da05b661ed4b824ad709601cee8e2e9b

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
1.5MB

MD5
79d67a586c8174c5cfbf9fa9158c36c0

SHA1
c966f6d891575f709424f67b2541c288668901ad

SHA256
862adba0916b46ec20dd06fe1aadb92ac7ed4c50555ad363f3363ba9eef6c913

SHA512
52f7dce650944557494536b858be32131d23a607f3354a242779da0c0fd375a57ce5ce01fd3221a24e5b9431d9d50acbd8f3bd4764593b227108cab6974e4ffb

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
1.5MB

MD5
3e6503ee0ceae4d4cb1e46cf57c09407

SHA1
d6fd4326579ad8e52e29372d3fdcadb6358f61dc

SHA256
4deef384c13da7dabd31e28dfaf48816656c01d902a95503aae83d762d32a721

SHA512
21f8f2bf0b42a6ef32332b3071b5c28d823fde85c35a72f4ecd6469418c4c7c14b4addbaa2184f5a083d5b77c6cb933c5f1150210a3bd2e471977cb03fa3f91f

Download Submit
C:\Windows\SysWOW64\Eplgeokq.exe

Filesize
1.5MB

MD5
d5f58c4af8545dba4ea45c650185c978

SHA1
81746b03612a49560ca148fdb39e4099f423b946

SHA256
2b1c9d4fed0ff5c708d3023e7c725d8379b37e19a3bd6a5294f08fd0c71b40fb

SHA512
34adec2c268a5460018c4a2f2d412a37a5babd4962a20a317c124d0f05936eec1d3267f9d0c2357460ed3ca5e83c44d9c355094fbf9ff413b6eaa49d26892973

Download Submit
C:\Windows\SysWOW64\Fbajbi32.exe

Filesize
1.5MB

MD5
3298ecaf70b664fac01d7ac070341742

SHA1
561b12d9dd047b0bd2828152a721695f260b1bc5

SHA256
42aed16128f811a078acd0a365933af14507d472f8f6aa1b9b3974bd4b437422

SHA512
0e920c06a0bef025def039ac9f590c3ce4af229cf8b919e6793ee69161661695813301fcbcf97f9bc784b874730dfbfd29f1335868c548201677166db4d44620

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
1.5MB

MD5
cdcd38a385ca68aa793f73581da4fd0e

SHA1
4e2e29731297b52238f95ac33211a644e10c979e

SHA256
df91aec07450d2f38540679d2935ce1c0638d6fb521cc54b1167fa7d69e2eaac

SHA512
d7b49a830f39db7d693d8c3c107c8b8415d591f15dff5ce77c1ae898948e0f72cc319fb309af722ab237d4edb9942196e77d133505cdd9561b000d94e23b563a

Download Submit
C:\Windows\SysWOW64\Fpbflg32.exe

Filesize
1.5MB

MD5
281e64bebc80112904b21456e7f89bb5

SHA1
1474aa6a47ae53e411da0ccd14e670b69ce916fe

SHA256
83953cba28b91384d393f69dc2f13f8ca77d766e2f2ee1b837f7f196ca0da46f

SHA512
e1e705ea05f70fa01e4bb8df1038553d2d3224c4b529608ac36cb4e032644f5d51b260da921c0f2c94e4eae7fa8744564936ad3d09dafbfa056d812072869e04

Download Submit
C:\Windows\SysWOW64\Fpbfpack.dll

Filesize
7KB

MD5
52b6433296c5c00d22dcbfdafae3d2df

SHA1
1eddf928df3d784b0f9bccc45cefc00ea1445e40

SHA256
a3567f40b088a530c400035cc7caa36145feacbf3af28c323d2f35e6462fe194

SHA512
a29d0531a0147215940e4026e0c552e2b0b80b8599fd81b8de876cb69170c5894af1c4191a9aa26432c3d1e2833f7f4addbae50af6a1efb5b93a736bac3cdb36

Download Submit
C:\Windows\SysWOW64\Fpkibf32.exe

Filesize
1.5MB

MD5
81ecae846d86670c01b0fe2d04ad73de

SHA1
995aaca3f8b3f9ca9ccbc91e5940830fd346ebf4

SHA256
89c9534acfda2adde99e87d602cc41f8885d01f14c5679b88376101eee35a8a7

SHA512
fc78056068b81fa343e3e218b70665303c813dcadecefbcb2ccda9e65cd8bc4d997d1c07b3148749497badd6d4d0212e35f4daa64c7f1986736fb5e4e41fc08b

Download Submit
C:\Windows\SysWOW64\Gflhoo32.exe

Filesize
1.5MB

MD5
d5a1652c141806bf9a3156d1a72b40b6

SHA1
0c11d3c293b679e31681a2f7e57c368cb4f130ff

SHA256
8509dc7ad4354bb161a3c7f92c53a7beedbcd027f2ed5ff905c88d98dae48db4

SHA512
94cec60d59545fbe9ceb389eea533107a6baf5a1c856b5f1df6ce31fdbf7ce047c5e129327120cdd82ca7a88725947ee3213f1c0fc7b04e1d69bdf045767cca0

Download Submit
C:\Windows\SysWOW64\Gjdaodja.exe

Filesize
1.5MB

MD5
7ddb6f2a088e0b8282a3d05e96f7bb67

SHA1
7a859de85dd706274d4d9519732cddef1958c406

SHA256
0c71ec203abb3b3649a5f70ae386c796eacc0b87377d4ba5bdd7c3f3848ee946

SHA512
631f9318057c8182f07d40efc25e197346fc97a7bd4cad9d5e0116753e95ad3854527d765b9855cdc758113d9988357fdb0c105ec88a42c8d451e0d2c9b08547

Download Submit
C:\Windows\SysWOW64\Gmdjapgb.exe

Filesize
1.5MB

MD5
43576a1e1285e7d9648d1cb7e4bbfd95

SHA1
fb16d2d244c7f053b278abbf17122da22cd44ecb

SHA256
e5e41a1f0af7c2755d62c8dbc5738db83d9f54c405d379e4298c6afca14765f3

SHA512
b56a8b4a2de194e51cad8d21a7c5994540858f3ce8f5a236ab9f1ad4933aef74136ad6091103dc65ebc66a0ea9c25fa0691130897a1c27f42f555f600dc39f0d

Download Submit
C:\Windows\SysWOW64\Gpbpbecj.exe

Filesize
1.5MB

MD5
46d4e5791e331d5c20d1c07a8ef4f58a

SHA1
d1ac54c81c4cdf2f8e2ff47ccea7ea3cffe39394

SHA256
30da42b4fd954ce01ffbe8b9e7f739b6feda1b63ed67df83163f2a645b947afe

SHA512
84ea43c16d8e26a09d25b242a5a5549ef47ad3f24b43512c452df5854d889622080f110e379fdece94afa8d9a12d1e2b05722b056ef3ed3ec56bbc99b5a58d6d

Download Submit
C:\Windows\SysWOW64\Hiiggoaf.exe

Filesize
1.5MB

MD5
ec9f20a44d0c5bdae6035cc8d7b9163a

SHA1
1e225afcde39a36eba546dc2cb0f7908cce78bdd

SHA256
bed5522a8a5f39b21f4ff2102936353f6d5e44f5bc5cfa5763b2c529f2652865

SHA512
b5b6e073cc0c9bd3ea34eeb3435dad63a4d54279ab2ad04e1025e4213857b2848e11e8980fa1ca121b2540fc3c2ed8609086b7488b5fd545f15dca7fd9191ef3

Download Submit
C:\Windows\SysWOW64\Hlhccj32.exe

Filesize
1.5MB

MD5
0414fc3284d65a8dece3265845912e2d

SHA1
d9249ed16db4818bba6a258c7a0d12af0c86f089

SHA256
952ebf572c373e1992521f06befc89abbf72ae7196fd221211df10eb24724074

SHA512
7e67cc6c878f3108e7e1d3bd199a850385389c5054de0d6be07544970b568c7f0299179c4e7ba16df100e0ac27ffd5ea2eecff6317baedbfa08e14729aedee5a

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
1.5MB

MD5
24cafeed4573000739f66fc4af07915d

SHA1
bf930625c1dd4397ebaa0d6ace277b996e2a344f

SHA256
98ac4c6eb68bd9f39a2073b67023046f9a5800d6a6215fa510a53ec7da7a69e1

SHA512
e1ed5cc58439857a6688fdbce8eb86cda966f6b944b88c6a9cde29aace2cf909a00423fed4f13f75bcb15bc4ff088d29dfbc3ef1626f5a5eaa69337d8aeacb63

Download Submit
C:\Windows\SysWOW64\Igjngh32.exe

Filesize
1.5MB

MD5
2509ffb5ff935ea33732c39da950fffe

SHA1
4c6c5f0ba12de9f9a2048bdc47c6e7b6ac546eb0

SHA256
a4f99fd11c54d23b184a369f50587afbe62c246a8c59e0b08c95354ddfc9d2f6

SHA512
e3f670f029f522a26168e00376c60adb1b6bd0f1612fa3cf50057462ce72a73fd2f670cc6ab6105d6d01457a9c7bf7350a0ae21cadb142fd04b9548e0b29ea65

Download Submit
C:\Windows\SysWOW64\Iqbbpm32.exe

Filesize
1.5MB

MD5
85cac9eb42a59c2ad602e93ca63086e7

SHA1
7ba13f6c8ee796558ad020c8eaf2adeb0c65e3fb

SHA256
9a7c3828c506f7a5165971a0fc1a90b76b523c4fe8cb4230557755bf0cf35a9e

SHA512
63b28bc9b4ceccc70b7ce9fa40dd414858b4cd1c49211e572d813098f3f19719ba13b937e0f3462226cd46658d254090af5c616f4a7d4d3dc8c5806cb6890f9f

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
1.5MB

MD5
f8d355a0dafdc1745a4342e3c1f804e3

SHA1
8a9445df263aa522fd43228d72da90da98f04b7c

SHA256
3708d3cb7cba88354349b1cb81fd6b888f03984518d0bac792d3d486d2e660c7

SHA512
97603e78d856cc1509dc55489c0710e2bfba78b8fdaa6b351006ec3c26f38557754fe7716ff18c71b2a169ef0d8b3e144301af2cd466caa1fbe12b0cdd585a47

Download Submit
C:\Windows\SysWOW64\Jhlgfj32.exe

Filesize
1.5MB

MD5
40fdbdea8704fa34c25f922815c6ba23

SHA1
6bb2e656ad6bba635635fce8af50c7282adaa6ce

SHA256
eb31334e68bcb4038a7f9fd656506c68685c6462481bb854e8f630062336b9d9

SHA512
1bf4b646ceed60b81c548f1cd6b69aeab1c75dae0774992022e765843012c1fd9396efa97f4c8d8ac805546f69ce73059111b0f0c2e2172c5f7421a6c8aabe22

Download Submit
C:\Windows\SysWOW64\Jibmgi32.exe

Filesize
1.5MB

MD5
b48e75e225d5c323eb91f86db1bff84d

SHA1
7c37b20c6ff4836d284a21b65827658b37b86f0b

SHA256
c86fa687c9df9d7bb26a9f9ee5764e83bf6f8591af46263241bc6cb5fe5d9c47

SHA512
9e1a188bb37f0dd69222c5e47bd2b38bb873494075ea97ca40d4b477a9b4f87969601ef8e493c8ff7a902d2e43d7ab18bc05253368ebecea7fb27c07f613f650

Download Submit
C:\Windows\SysWOW64\Jjjghcfp.exe

Filesize
1.5MB

MD5
fed4ca99eb1203051e987d743eb71e09

SHA1
1942e95ca00dc36d1baedf85369c94bedaebad39

SHA256
f10e2c2d921ca26cd6d5e97950da826e148e73270004d8b825a092a2cf685e08

SHA512
ee65e34ca6efc5abd33e50b69f19ffb30fa622bb4cdfd4276d1544747ce316ac851f298c2ae950c65514c3489dd821d06299d89f7968dda3fb01a6984b01e304

Download Submit
C:\Windows\SysWOW64\Jjlmclqa.exe

Filesize
1.5MB

MD5
f77ff3ffd4c2e1a33da0fb126bddc729

SHA1
a73c6e2740552e9d63b9601088bc98e5180a9932

SHA256
eda1f0538a8be9149668172f63d313afb911d74bff9d7931e0dd1a618afd2fc7

SHA512
7bf44ad71d7a5fa53569b31241104a7e87e6291452b9054d40e6072975ac40220e3ce88c685dc9bdff022c00473946a520a2e576f6acd20914da3960fcc3c4db

Download Submit
C:\Windows\SysWOW64\Jnjejjgh.exe

Filesize
1.5MB

MD5
c522412676728254a3e1718ac6c3cc31

SHA1
d7f431aa2bb75374d07b75bbc145b08823244275

SHA256
f5801f7a44c4acc7581fb6f18a19e58e42358ce434f0a520661c7ccdb927619d

SHA512
b93beb2b679991431e78807a871160f2945c3fe79615dd1a47ac1158125acf8fae94e475e4cf3e3e7d3798ba00fbd3dab3be641730d8492150166c640fabb294

Download Submit
C:\Windows\SysWOW64\Kageaj32.exe

Filesize
1.5MB

MD5
3634e1088038c124f7c7f99657bdb730

SHA1
935e939bb5661d1ad97f477e4dace3bccef0c0ac

SHA256
b52a19b67ff03329b0c689eaaec4e606e510e190d91fcdcd8bc92fb32a5d3815

SHA512
2cd5d27161b809f0a38407b8a407e458525b8e7fe750a347fb6d74d7d7ac7173c2c3151b91e2f43ee6c4f7e190998fd0ba4bd6f77168d912d3931486f0a0d1ce

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
1.5MB

MD5
257851ab7d5c2e9b2ffeebd54cbd1f6c

SHA1
2776383dd891b9fadcd91aa6d806f5cf53114e89

SHA256
2b87c55a7172d1b3f8ddf3cd85de3b611eaad4cfe407f19839ee82419780610e

SHA512
81bfe7a5900cad6c77c0a2ef3027370a2d7536dae002135ecc95758d8146ec02ae72bc31f4848fb034b4df011f32c83a9f766bed103493a34efca49a8a1c3770

Download Submit
C:\Windows\SysWOW64\Keqdmihc.exe

Filesize
1.5MB

MD5
c3bd4b09e15d866fe7f20b3002d30e15

SHA1
b0d98de9abd37de9bcfd9c1e4df971315ce69815

SHA256
8f9a8932acbd8cdf77b9139fccb68d8cab51ed8e30b893ac2feb64c845f738a8

SHA512
060eb399fa703f03abd39b6c96027eec34978eadb84bc8704acbc13a8c66b17c0fd821c5b96d521dbc7fa6ababbd71d736d09e9cb954eedc448ddb6a4d2536ae

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
1.5MB

MD5
fea8fed07231f183850e3d0857f3ddfa

SHA1
033eb458d20a51e00262d47ce9cbf6787a2196e3

SHA256
194696fcf9b453826e7d548bda36ca3968728a991c11d5a5e3bbac25d77a6a6a

SHA512
7bce21fdac6156b9d9d3137ff804c6498e57a2eae267a6c9cb688d44e6fc34ff914604063805ccb59ff02d3f9fe38ab8ba484125b71d7b5bf6ea42f2144363ed

Download Submit
C:\Windows\SysWOW64\Kkfcndce.exe

Filesize
1.5MB

MD5
fe7c2c09cfc565093e6838b2ce99bc06

SHA1
7e941e57c051ba7ead960e2abc9380da4ce6d310

SHA256
12b4974cc8c31e85e812065cc0590a8ec2bd50ffe75076d424b4c90220ba891f

SHA512
1fa60c66de24ce459a4cc6c508e3d049d2b2a49469db69de9a219dea40276a136863efd4b0f153e7be89f0c24cdfaa0d3eea777fa18537623c7c94a0aafc3a17

Download Submit
C:\Windows\SysWOW64\Knflpoqf.exe

Filesize
1.5MB

MD5
0093db7988e8623a51897f55f079499a

SHA1
460ec3f3c1fea03f88be54b61ab33f194e1c1498

SHA256
667831b817f3a5a5f5fdd7da572ac3a0c435e12e8791107a7de98c094cba1add

SHA512
f0da7ca7b567222212ec730e2c2cd20f62e52cedc19c77368fefc7b3a823c10e5d625551af9890a9ea2af2edcaefc61c11e801328dbd611fd3f5d4a5b749b31d

Download Submit
C:\Windows\SysWOW64\Koodbl32.exe

Filesize
1.5MB

MD5
549063d0c8057c3bd182415e0cfbed31

SHA1
4d4cbab85766d48c92c1c7c17a559300ce25573a

SHA256
42e6c9ead0380b7ce57b6b9d851e19038b382715861ede8f7b0760dc83ab4153

SHA512
b6413c0b3ad3787d6ab013a5c65074a0dcae18a9599b078c43306ef8679ff73f0cae1f430f304e344ebf9ca871593d6a7e8eeb0bda5dcdfec22a242e922a9fe5

Download Submit
C:\Windows\SysWOW64\Lacdmh32.exe

Filesize
1.5MB

MD5
73c70cf2a0e39c72dec0d3ee0fbfb777

SHA1
8b4c3075d5a9f6f115d41605738531ef889e2e3a

SHA256
bc8243abaf55827d5b5b16a35ace3378015e05c6d4a61b1827b6d13b7062d5a3

SHA512
72d0bc32faae8f85f8600157372f28ec7409acdb1c63181a145c68a6bb933abc2547e48a8811fbc54efbbe5b2e2c99fa3109484a72dd71ea98d587b0f6c26441

Download Submit
C:\Windows\SysWOW64\Laqhhi32.exe

Filesize
1.5MB

MD5
56b66c7e86c31992dec541896833c51d

SHA1
4d39059a25c0fd88d5eb3c92a9038644490c7ac4

SHA256
0d946b9b13a436ac22fa8fd4ff3a08b534b1ba9a767376c7ae1136b514829c15

SHA512
835f387256378c7c527ace463f45b4ba6656adea34da401d98d80f16ddb4b1afa61ecd823f0f59ebe215e8e90d85ccf7cbc8685ae96ae35ca47356119840a80b

Download Submit
C:\Windows\SysWOW64\Lbgalmej.exe

Filesize
1.5MB

MD5
084b148ee2faf7f364287a038ac1d878

SHA1
db015c04bb4c1167675ff1096df5ee028c9e2b33

SHA256
8a816b3ccb5f157c58b67ebfa5c31a6a8ede45ab226cd831a4425aa5b1124254

SHA512
4e6b7da2a7fec960a6507311af099249c68ec07f215470d4017d002e60259e65749907b3524663b84ee92c149f596c1a3b9b4628ecb1f765cd29e4235294fdf0

Download Submit
C:\Windows\SysWOW64\Legjmh32.exe

Filesize
1.5MB

MD5
8be9a77640681dc9ddfe56cf9bed9314

SHA1
cb1d12add99a525bb082e6ffac12d3ffa1fc809f

SHA256
3d7d2497941af99527e26d4fef51aafc7d3dfca96145a2222d6a33282c5bd78c

SHA512
eddb7903c3f6e8f1ce7fa693e086d758cd5c89dcab808fa27ab321cf6952be046251d9de54f06485f0806770e05df4fb6b0c1da7826e5870958c8bbf5ac3f2a4

Download Submit
C:\Windows\SysWOW64\Lejgch32.exe

Filesize
1.5MB

MD5
7b928c31a272e53b4d1d9ec5b4ecdf8e

SHA1
e9432cb5a4131a5c85c688f62582815fa06ba349

SHA256
2298fda5fab5644afa153d900e0d287f846c21d906132ef014f9addb388783f4

SHA512
f104a1201ade938f6f0e5cbd43e71fa52b7945cf03fd57149278fd7e06fd919939af52c164c7be3728e55e52052b346cbcbef1e88ac535788cbaf332cbb9b8c3

Download Submit
C:\Windows\SysWOW64\Lghcocol.exe

Filesize
1.5MB

MD5
a1f7f9a643e98d39b6c2f283e8aa9ecb

SHA1
ae69b0d30fc2e4d4a2b7271a661636863c783d62

SHA256
9e31cb6890a22f3c0a5918259e1c002c9b64f850f0dbf0722608154471874b4f

SHA512
b6fbb721d8af76359bee56395ab9f0392f26219b2ddc33c0f346e3b83522a5c005b634767bc5af06180f728255b6272603323dccb5341ba0a0846aac7862635c

Download Submit
C:\Windows\SysWOW64\Lijlof32.exe

Filesize
1.5MB

MD5
ed97a6e1255de078bdb64b04a16c36ad

SHA1
f245cba3713bd73b977c7a58a601c9dbf788e245

SHA256
e258accbb38399ce27bf076a2c4f98c21a083d39ba88f90d6b0bb0a80058da5f

SHA512
8ba153f7fba41b87e74cfd46b6da3841d290189771d62c1f947147b8304a8a684ed400eb9f2e7d5a3d8fbe7bba6f6bc514c202d610fd8cc077aa971578b70e11

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
1.5MB

MD5
e74d68cdd4e7d8934027a70ad5386032

SHA1
5ab8c9da79982ce59c314960dbc978f5be868693

SHA256
2ac18e6044983520043b78f45cf00bfd1a94d9a99f8293b7425b8a6c8c9b6b09

SHA512
b46004b6dfcb9ecc4bf11d28197e0c83bd477aac3981897385517795ffc510d408585c7f7e2dd80685b24effa46f341d27750f097d093e6e106c51d383a10edf

Download Submit
C:\Windows\SysWOW64\Ljgpkonp.exe

Filesize
1.5MB

MD5
27bad75f048e939b502118becefc6849

SHA1
325dc1b6ea15f92d8e1e43c271f40e495291ee56

SHA256
eaacaeb7bf11163689f67497fbe630db55e85410514c8298c0d71e3ec9274905

SHA512
68a5b25862a19589b7874fd1bcdb0409dee6169f461364c08f7436a8840d7c4ef10ef7858f6508c427ec15e95943068048cb415d1909c21088cbbd244560d5cf

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
1.5MB

MD5
0b817e8e43b6514a1a03f9ae6792f84c

SHA1
0b78d767c7aa08ac8e7924be1e1904f37f8d694a

SHA256
6b47fb0f92a23b35566caca7e05c84a22300843648561a3bf2692b8716b7b380

SHA512
1336f70dc2a2db6963171dd473b5d69fb7a3a9d941a140a694c76c3d4a463b149d72d468bd4e702b98f9a1484469e57e161fcf42c3ebe38b29b50d1ec09a8a67

Download Submit
C:\Windows\SysWOW64\Lkabjbih.exe

Filesize
1.5MB

MD5
aef0854690d095bf0b25905065abcf1c

SHA1
81531f98eef228da6e7eede1b63ece42dd6a1fde

SHA256
049ed9bde74bc8648e5ff5a9b72e77e12f0076335206e0e327bf70e7beb03e3c

SHA512
0e625553501cd4e777bf41c576f4e17588730e66e2508236cdfe3ba2197353f32964f21a03d802613aca24df299bf0cb9a98881309a2c90c1bcdfb629379a1d0

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
1.5MB

MD5
c8e5ceddc9cdab83616e75370c248e4e

SHA1
172e302fc5ff42168a599d4a628d7b0c1825e980

SHA256
e65c429339b035069bbb786a0db90f20e5f9f6a611190d92d89d5078b37ab35f

SHA512
c8274820929b2c427d90e904d026a62b126d92db0160168767cb626e640d639f2172f3e9c734e72f6d102205485e7f8d0d5d3496e9e4a9f39694e69dd61ba19f

Download Submit
C:\Windows\SysWOW64\Llflea32.exe

Filesize
1.5MB

MD5
3bff1930738f97bf347713cb6d038731

SHA1
673e5ac3c3723acc28850b004bd70f3845ff5cc0

SHA256
86bb4277ffd26edab18a40a25f5cb67bab8ec44cac086c355f578aa8631d19b5

SHA512
95141d3478b9ac9a9fe1d0a45a1878c9f5136020f4cace23c74274e48b174ee718d0405c20339640bd1d44055037a0e483978474ef3409e8d6d54b7e5fb401ba

Download Submit
C:\Windows\SysWOW64\Lndham32.exe

Filesize
1.5MB

MD5
cd4448cb68da99a814902623b64ba03e

SHA1
f1bc2e9279d081fa0613767e06759242888ed715

SHA256
0c22e08a2443d6505d2c90463fe9e12b0d1cdb1a6dadda6cf54d9c05b4eb84c4

SHA512
d7388362eb4245cfd5dd6c160e5a7126228b7850a402875406f3f39560909555b0731447e1073e886d8ae31998b8429ca22e62e904629b77c5e5c5128d35a353

Download Submit
C:\Windows\SysWOW64\Lnjnqh32.exe

Filesize
1.5MB

MD5
6fb028325f0ac366d7f28da63745513c

SHA1
d46639f1cbac5f7c54178b709c8f7438427de342

SHA256
113a449055f28209688b7bad1511ddcaac5777d44cb1a024e9c8fd925a7129a7

SHA512
427561e1c6cbf1976b35a92824575a1ddb9c1714e10be73a826cd2117884c00f17753a92d3ae9b30436a15e6c4320756c152861c38f023988d9d328b3359ff89

Download Submit
C:\Windows\SysWOW64\Lqndhcdc.exe

Filesize
1.5MB

MD5
db3e3d5ca29358788fd2e90d113083b8

SHA1
acc22ca9cbc2d314f4045612d8db9e03f3304e71

SHA256
5312f35bb3559852ea00041928ab0235b6cc3136e379c713aecf4e374fc533fd

SHA512
26c1a4824380c90915f2fc0a6500d9ae70a0841cb7cf56097ce7bc29696094cbb68a191a3dadf1b7fa5349a854fa06ec794a1904d03e7d5bfeea0e638ab61c2e

Download Submit
C:\Windows\SysWOW64\Maeachag.exe

Filesize
1.5MB

MD5
da856da78a2156d6d193015a4e1e2065

SHA1
4b3735c350711c252df2d4840ab117b49ee7bdbb

SHA256
f7f5caf24dba75598dd4d914300fb1e8f0f94161fe05f4bae005396ebaf9b7bc

SHA512
3791802b20b870bbaf0a27a504d5d60107d849eb5548f362f85c4bfe9e706e07df684b5cb5fb53af387b413e659e878ad8d84e205c73910ff8f4be4f2d558af9

Download Submit
C:\Windows\SysWOW64\Mbenmk32.exe

Filesize
1.5MB

MD5
b752880eb8ed31c59609313533b6df2d

SHA1
61f5a413abc50a4dc4dd43ee766e61d502ae902d

SHA256
daebc171e52d8c47e8c6db36c7a1c708a793fe5a7765fc2ad2971791ca276ef2

SHA512
e140a65eeb0839062dca645bf78e5f7e120a8862810b815cd541ad149bcd09cd8a53fe0e70a63210b7dd66f60c05323aca12839d0268d8fd5707aafadcc7fc04

Download Submit
C:\Windows\SysWOW64\Mbgjbkfg.exe

Filesize
1.5MB

MD5
2833dac206103711f57bd68577c8f507

SHA1
bed34b83de0fd83907fb59df5a03a7f73044d8d5

SHA256
68a95be8eb29b36d99e0fc0db6d8d47f8a3983c897f29d381cd2959a512ba5ab

SHA512
7257b2f1452237eff3f22b9cdf3cffa70bfc74c795fb62276c7571fcc8d0e084eb4153fd66a13657a9dda4cb166d4fcd93656a762ffe491916e0b1d1933fc5a0

Download Submit
C:\Windows\SysWOW64\Mbighjdd.exe

Filesize
1.5MB

MD5
93cd50ec0403364f3b68438ed02096f3

SHA1
ff49c250cffb5264a80034d8ec756bef497671df

SHA256
9a206c219312d13d068b54ecb41c7674fb2a4f78447a8fc94858edc8fc477238

SHA512
75d7037e5c81912f39b8d5d116ac67df71d3a39638c266393be63c8ceb1d5aa0455f26479fdabe6906ca96985476ecb372030a653176052511ad968dc4920d49

Download Submit
C:\Windows\SysWOW64\Miaboe32.exe

Filesize
1.5MB

MD5
a0ead1df662fc111af3df47f10150dee

SHA1
6b3a948e23db991b773530519250a60f068ef90c

SHA256
3319fd62e73083503e58c94b26641e8c8ec9af77cdd44a322c3dee24fcea75bb

SHA512
80918a89146df3a47b2c6656c62032f04b65471b08332ba4871f361ee435bdb954806bbfd8405f6932ed8bb09e608ab788c69c887ffd406c228ae0d18e44ba45

Download Submit
C:\Windows\SysWOW64\Milidebi.exe

Filesize
1.5MB

MD5
bbfafab1a426e4dcbba5204a1985fc4c

SHA1
c767e8efc3e4d3c22263098d4105dc062f0ddaf0

SHA256
189eaa00e5e070a1a95bf466e915e83e638c62f8c929eebef3d78248882523b1

SHA512
c0d949d9d916b6eff642b47f55e71dab6857243d51be5f78739c2c114c632dd8cb43ca6f73a4524ee29dc30e476b6763ce6df580a89ece6bb434e5598180cf2d

Download Submit
C:\Windows\SysWOW64\Mlkepaam.exe

Filesize
1.5MB

MD5
07be04d0a0566ccc980157f917b545c8

SHA1
a31d3c0a9d3407d37bc5c64eb46b4ea68e0ba4e5

SHA256
d72a642fe76284710166bb7fc03ed92672f384c544a97aab86f44ff1da1a6237

SHA512
6e3cfcab7e0077ec3cb2119b49e0e030b3115fddb4392ad304a47729d35c98a1456a795f93aceaf0aa92d4e8aae8199599990fe30d9786398871389094047d2f

Download Submit
C:\Windows\SysWOW64\Mlmbfqoj.exe

Filesize
1.5MB

MD5
902673984e880234c798a79ee7f4ebff

SHA1
023c6be592974703a6ac71ac9166e83397da05ee

SHA256
657ac40d62fc8242ce26f2b41d07cea7ab338afbf7ab4b8a5a6ce46bfb045a63

SHA512
28b8ffe21ff28710d9cd6624a038d6b9663f89357bf7588d1f921afd1ac735d966a74a11b1d1ec814268e74c3c31cac7260bb5c6a082f713ed8bcb3abe0f8e0e

Download Submit
C:\Windows\SysWOW64\Njkkbehl.exe

Filesize
1.5MB

MD5
a25315eb8eae99af10f59a60c384607e

SHA1
51b81b489c209e7b075b0b5b3833ed58086b32fb

SHA256
4208d5df932a58c506f81e0f626d61cde0d52025c79d3617e94070811d56b2cf

SHA512
afb7b175b28ddc98d029364d44a92808d117911dc4a79d63350fd4e73de0cadda62e8d9e7d786c1537944f9276315916c03a8b3547374d8a2a6eeddd8b15da6f

Download Submit
C:\Windows\SysWOW64\Ojbacd32.exe

Filesize
1.5MB

MD5
729dad9290916068fe346a1b3796cbd9

SHA1
170c48c7b0c1e2cadb5ee24290f048277120b1ea

SHA256
71edbdcb5df98d72f1567bffba93e87c9d712fcf75385483e85c58d9cbc53570

SHA512
a2fac2e9ea4a974f1dbde9928a0f27b28f785ac29da695c27dfd318e332f36e3bbffd191025fc2d9f13a01a31589d7369216c3609298d04b88ad26e60dd63513

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
1.5MB

MD5
0d20346ca17761256f9484947099e149

SHA1
b7d103e100c7d7be8277bcdf85153354638c8811

SHA256
bb1591b819f6322989ee4a77b6f4b05066573a97e518fb8bc3b21ed1b31be6ca

SHA512
c431e45b054c09c8f35ab83764a7c21969c4ff8f723b923f8c57cc07b5dd379c4f677a5a7e777e92d2764b6f421cc31b6e176cd971e49abcd5f093cf85ee446a

Download Submit
C:\Windows\SysWOW64\Pjbcplpe.exe

Filesize
1.5MB

MD5
420f65be3262eb36f3ca43244a7388cf

SHA1
2eba1176e1f9e827775d56ab17c098c66d6571c7

SHA256
6ff884abfeafe7d32397ecbf94c982cc93a61cf1dc034e40142549483b1ec1ca

SHA512
ec86e3c54341b5ffc23e34cf69839a27dc68f246dd574e938322fa4211efcd02819897f1b1253c771f8f2861ae02561f66c8475519dc9f56537c97b8632fae76

Download Submit
C:\Windows\SysWOW64\Pkegpb32.exe

Filesize
1.5MB

MD5
47ee18c6d890249510735ff537bb339a

SHA1
1bb81fbe208769f9d35ae637cf09da17a5170ae0

SHA256
4897328a81197f7e1a8a2d01da2303f32541210cbe21e30a7bc0cd9dd7c3b4b5

SHA512
4c44a123009ebabacb30ddf1481202070585b0edf865cd5489447a300f32bbc08eaa25609af031edecbda18d7b9e4c85e6cdc81904d6f13094e5b1db33fe5b6c

Download Submit
C:\Windows\SysWOW64\Qlimed32.exe

Filesize
1.5MB

MD5
d8498ee50cc7333794dbcf9177bf6c42

SHA1
7745d6450492d68e9bab7202566b102a1dee2edd

SHA256
ea1ffc92305fb37c14895742ab7c11da9f4b465484bc228eb8613532d329b2e0

SHA512
57cbaddefe89deaf74340b1a2146850691ec4b403aebf1899969df7c898d91ea122efe156df21f0b6ecadee6576089ca7155a5ad3b9396e5cd2945ffe2fab264

Download Submit
memory/224-255-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/228-400-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/528-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/692-394-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/744-497-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/756-189-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/764-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1020-340-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1128-535-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1260-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1304-124-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1328-104-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1372-588-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1372-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1408-509-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1492-376-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1496-268-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1648-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1652-570-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1856-181-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1860-221-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1900-213-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1908-274-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2000-133-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2028-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2028-567-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2032-503-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2060-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2060-581-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2208-358-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2224-237-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2244-515-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2248-157-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2428-561-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2444-165-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2452-560-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2452-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2520-117-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2536-352-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2652-412-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2656-554-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2812-303-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2828-483-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2916-418-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2944-466-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3028-316-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3080-442-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3208-286-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3276-292-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3300-87-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3336-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3336-553-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3532-583-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3564-527-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3584-310-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3680-346-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3724-364-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3772-205-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3808-436-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3828-430-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3836-485-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3840-472-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3852-228-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3860-261-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3872-575-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3888-322-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3896-253-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3900-539-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3900-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3928-149-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3952-540-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3980-406-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4028-382-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4072-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4216-448-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4244-546-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4244-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4252-454-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4284-141-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4300-521-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4500-574-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4500-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4548-491-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4568-370-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4652-79-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4672-547-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4692-197-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4748-280-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4772-460-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4812-245-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4848-334-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4924-328-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4944-477-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4972-589-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4992-173-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5004-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads