070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bc

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe
Size

404KB
MD5

e5669981314e5efc3017bcd698d5c4f0
SHA1

c717074124e7065a5119e132c80b25b345ec2abb
SHA256

070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bc
SHA512

2ca6d38452a87de9d520b99d33978eb99999ea7471e0ee7f6e62701e56dd8703a1d741760290596a54dd5c6ac4dd546da4d4f21c24b56d7d894bea740b8eb4bb
SSDEEP

6144:6FLvp1IUwLENm+3Mpui6yYPaIGckfru5xyDpui6yYPaIGckSU05836S5:IDp1IU9wcMpV6yYP4rbpV6yYPg058KS

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eennefib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eilfldoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mjfoja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqdbfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aecbge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndhgie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbdano32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddhhbngi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fncbha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqbpahpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeneidji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjfmminc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ailabddb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpejlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlcmdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gjhonp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hcembe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Igneda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khonkogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akjgdjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmpfdhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pndhhnda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abdfkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afboah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aiqkmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emioab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hnhdjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjoeoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifaepolg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nalgbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fgjpfqpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfcdaehf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oajccgmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdbbfadn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fgfmeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdogjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malefbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akmjdpac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djbbhafj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkadoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqfcbahb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okpkgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecanojgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfemmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aokcjngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfljnejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fofdkcmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaijand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajaqjfbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifjoop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Inhmqlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lelajb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoafodd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckfofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbkeacqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fcbgfhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmkeekag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfilkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pacfjfej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfnnmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Blkgen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgkegn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Addhbo32.exe

Executes dropped EXE 64 IoCs

pid	Process
1628	Cdlhgpag.exe
1156	Cdnelpod.exe
1560	Cfmahknh.exe
1160	Clijablo.exe
1768	Dpgbgpbe.exe
4424	Dmkcpdao.exe
5112	Dgdgijhp.exe
5016	Ddhhbngi.exe
2088	Dmplkd32.exe
3180	Dmbiackg.exe
3248	Egknji32.exe
3788	Eennefib.exe
4440	Eiijfd32.exe
4840	Edoncm32.exe
1348	Ecanojgl.exe
4960	Eepkkefp.exe
928	Eilfldoi.exe
1404	Eljchpnl.exe
3848	Epeohn32.exe
5116	Ecdkdj32.exe
5060	Egpgehnb.exe
3232	Eebgqe32.exe
4616	Eincadmf.exe
3164	Emioab32.exe
4544	Ellpmolj.exe
3756	Edcgnmml.exe
4560	Egbdjhlp.exe
2084	Eeddfe32.exe
2132	Eippgckc.exe
1388	Elolco32.exe
2956	Edfddl32.exe
4676	Ecidpiad.exe
4220	Egdqph32.exe
228	Eibmlc32.exe
1248	Fnnimbaj.exe
4640	Fpmeimpn.exe
2040	Fdhail32.exe
3124	Fgfmeg32.exe
1004	Feimadoe.exe
4656	Fnqebaog.exe
1592	Flcfnn32.exe
2712	Fdjnolfd.exe
4036	Fcmnkh32.exe
4428	Feljgd32.exe
4900	Fncbha32.exe
2940	Flfbcndo.exe
3556	Fdmjdkda.exe
2884	Fcpkph32.exe
3540	Ffnglc32.exe
5136	Fneoma32.exe
5176	Flhoinbl.exe
5208	Fdogjk32.exe
5248	Fcbgfhii.exe
5288	Ffpcbchm.exe
5336	Fnglcqio.exe
5376	Fljlom32.exe
5412	Fpfholhc.exe
5456	Fcddkggf.exe
5496	Ffcpgcfj.exe
5528	Gjnlha32.exe
5568	Gnjhhpgl.exe
5608	Gphddlfp.exe
5648	Gddqejni.exe
5696	Ggbmafnm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hqmggi32.exe	Hnokjm32.exe
File opened for modification	C:\Windows\SysWOW64\Inagpm32.exe	Ijfkpnji.exe
File created	C:\Windows\SysWOW64\Khonkogj.exe	Jnfjbj32.exe
File opened for modification	C:\Windows\SysWOW64\Aokcjngj.exe	Agckiqgg.exe
File created	C:\Windows\SysWOW64\Jcihjl32.exe	Jcgldl32.exe
File created	C:\Windows\SysWOW64\Bflajb32.dll	Gfemmb32.exe
File created	C:\Windows\SysWOW64\Ljcihc32.dll	Gnckooob.exe
File opened for modification	C:\Windows\SysWOW64\Mgkjch32.exe	Maoakaip.exe
File opened for modification	C:\Windows\SysWOW64\Hjieii32.exe	Hgkimn32.exe
File opened for modification	C:\Windows\SysWOW64\Edcgnmml.exe	Ellpmolj.exe
File created	C:\Windows\SysWOW64\Gphddlfp.exe	Gnjhhpgl.exe
File created	C:\Windows\SysWOW64\Gcpcgfmi.exe	Gdmcki32.exe
File created	C:\Windows\SysWOW64\Dfcojl32.dll	Jfkhfmdm.exe
File created	C:\Windows\SysWOW64\Aqdbfa32.exe	Anffje32.exe
File created	C:\Windows\SysWOW64\Noabkh32.dll	Fdjnolfd.exe
File opened for modification	C:\Windows\SysWOW64\Hgkimn32.exe	Ghjhofjg.exe
File created	C:\Windows\SysWOW64\Dnjhjpin.dll	Kggjghkd.exe
File created	C:\Windows\SysWOW64\Jkkmgl32.dll	Ndhgie32.exe
File opened for modification	C:\Windows\SysWOW64\Bdnkhn32.exe	Bjhgke32.exe
File created	C:\Windows\SysWOW64\Hjoeoo32.exe	Hgpibdam.exe
File created	C:\Windows\SysWOW64\Jepplk32.dll	Hqimlihn.exe
File created	C:\Windows\SysWOW64\Oegicjdd.dll	Infqklol.exe
File opened for modification	C:\Windows\SysWOW64\Oalpigkb.exe	Ohdlpa32.exe
File created	C:\Windows\SysWOW64\Bkhceh32.exe	Bdnkhn32.exe
File opened for modification	C:\Windows\SysWOW64\Cejjdlap.exe	Cbknhqbl.exe
File created	C:\Windows\SysWOW64\Ebldam32.dll	Fncbha32.exe
File opened for modification	C:\Windows\SysWOW64\Eeddfe32.exe	Egbdjhlp.exe
File opened for modification	C:\Windows\SysWOW64\Gnlenp32.exe	Gfemmb32.exe
File created	C:\Windows\SysWOW64\Dejfbl32.dll	Gcpcgfmi.exe
File opened for modification	C:\Windows\SysWOW64\Hnokjm32.exe	Hjcojo32.exe
File created	C:\Windows\SysWOW64\Olpigmpg.dll	Agckiqgg.exe
File created	C:\Windows\SysWOW64\Heckkb32.dll	Nalgbi32.exe
File created	C:\Windows\SysWOW64\Nandhi32.exe	Ngipjp32.exe
File created	C:\Windows\SysWOW64\Bknappeg.dll	Dmplkd32.exe
File created	C:\Windows\SysWOW64\Aeohij32.dll	Bkadoo32.exe
File created	C:\Windows\SysWOW64\Hgkimn32.exe	Ghjhofjg.exe
File created	C:\Windows\SysWOW64\Oihlnd32.dll	Clijablo.exe
File created	C:\Windows\SysWOW64\Fclpgc32.dll	Feimadoe.exe
File opened for modification	C:\Windows\SysWOW64\Eljchpnl.exe	Eilfldoi.exe
File opened for modification	C:\Windows\SysWOW64\Gdfmkjlg.exe	Gloejmld.exe
File created	C:\Windows\SysWOW64\Pelkha32.dll	Kejeebpl.exe
File created	C:\Windows\SysWOW64\Hhljen32.dll	Khhaanop.exe
File created	C:\Windows\SysWOW64\Ohobebig.exe	Oinbgk32.exe
File created	C:\Windows\SysWOW64\Dmkcpdao.exe	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Fdgipm32.dll	Ecidpiad.exe
File created	C:\Windows\SysWOW64\Aaeekb32.dll	Hfamia32.exe
File created	C:\Windows\SysWOW64\Qodhmn32.dll	Hcgjhega.exe
File opened for modification	C:\Windows\SysWOW64\Okneldkf.exe	Oogdfc32.exe
File opened for modification	C:\Windows\SysWOW64\Bbkeacqo.exe	Bgeadjai.exe
File created	C:\Windows\SysWOW64\Aojmda32.dll	Eincadmf.exe
File opened for modification	C:\Windows\SysWOW64\Dpgbgpbe.exe	Clijablo.exe
File opened for modification	C:\Windows\SysWOW64\Pgeogb32.exe	Pojjcp32.exe
File created	C:\Windows\SysWOW64\Igpgak32.dll	Dnghhqdk.exe
File created	C:\Windows\SysWOW64\Ladlqj32.dll	070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe
File created	C:\Windows\SysWOW64\Lagqnoge.dll	Kidmcqeg.exe
File opened for modification	C:\Windows\SysWOW64\Ndomiddc.exe	Ngklppei.exe
File opened for modification	C:\Windows\SysWOW64\Ggbmafnm.exe	Gddqejni.exe
File opened for modification	C:\Windows\SysWOW64\Nkgoke32.exe	Nhffijdm.exe
File created	C:\Windows\SysWOW64\Chinkndp.exe	Cicqja32.exe
File created	C:\Windows\SysWOW64\Hqkefo32.dll	Hhckeeam.exe
File created	C:\Windows\SysWOW64\Knfaph32.dll	Nfaijand.exe
File opened for modification	C:\Windows\SysWOW64\Bkcjjhgp.exe	Bhennm32.exe
File created	C:\Windows\SysWOW64\Nambcd32.dll	Fnnimbaj.exe
File opened for modification	C:\Windows\SysWOW64\Kifjip32.exe	Kfhnme32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11228	11144	WerFault.exe	501

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnnimbaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnfjbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajaqjfbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cicjokll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdogjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gloejmld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gggfme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgbfhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljijci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijjnpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odaiodbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eennefib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfghlhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fochecog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cghgpgqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iebfmfdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Philfgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgkimn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhgie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oacmchcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ellpmolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iepihf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglnnkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkhceh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgebnc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maoakaip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofhcdlgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkadoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjcfcakn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hqmggi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jelhcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohdbkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cicqja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpejlc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hokgmpkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oileakbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhbhapha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkefphem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcembe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmdqbg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okneldkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afboah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpqklh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohaokbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eldlhckj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhgpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inhmqlmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnmglk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciogobcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkilbni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcbgfhii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Moiheebb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odifjipd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abdfkj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aecbge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icpecm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opjgidfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkjpkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flfbcndo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjnlha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqagkjne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loniiflo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgeogb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfcdaehf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kjfmminc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kaqejcep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Okneldkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afdkfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlqidj32.dll"	Bnppkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bgeadjai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ecdkdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Maoakaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgmknm.dll"	Jcgldl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mmpbkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkheeg32.dll"	Ajhndgjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Giboijgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jcoioabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdiqhf32.dll"	Ldckan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nkgoke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fnglcqio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcealh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pddokabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cqghcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdhiofpj.dll"	Cejjdlap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leahbp32.dll"	Odkcpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hnehdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hmhhpkcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qolmplcl.dll"	Okpkgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aglnnkid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ffnglc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inefak32.dll"	Janpnfee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ankgpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addnfnhd.dll"	Igqbiacj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gqmnpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olpigmpg.dll"	Agckiqgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnmebblf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Inkjfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clffalkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpedgghj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjigl32.dll"	Fdogjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oalpigkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fepmgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcijglg.dll"	Jjdgal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjfoja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndmpddfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anffje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clijablo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fneoma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdmikb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiipk32.dll"	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jnmglk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhpdkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hhckeeam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pdmikb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Egdqph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Igqbiacj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajmkad32.dll"	Oinbgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmbiackg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gnjhhpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofhcdlgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkcboj32.dll"	Gccmaack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ijedehgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nahakl32.dll"	Kanbjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njiccd32.dll"	Pgkegn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceeaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikmcpbbo.dll"	Edfddl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1628	1244	070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe	89
PID 1244 wrote to memory of 1628	1244	070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe	89
PID 1244 wrote to memory of 1628	1244	070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe	89
PID 1628 wrote to memory of 1156	1628	Cdlhgpag.exe	90
PID 1628 wrote to memory of 1156	1628	Cdlhgpag.exe	90
PID 1628 wrote to memory of 1156	1628	Cdlhgpag.exe	90
PID 1156 wrote to memory of 1560	1156	Cdnelpod.exe	91
PID 1156 wrote to memory of 1560	1156	Cdnelpod.exe	91
PID 1156 wrote to memory of 1560	1156	Cdnelpod.exe	91
PID 1560 wrote to memory of 1160	1560	Cfmahknh.exe	92
PID 1560 wrote to memory of 1160	1560	Cfmahknh.exe	92
PID 1560 wrote to memory of 1160	1560	Cfmahknh.exe	92
PID 1160 wrote to memory of 1768	1160	Clijablo.exe	93
PID 1160 wrote to memory of 1768	1160	Clijablo.exe	93
PID 1160 wrote to memory of 1768	1160	Clijablo.exe	93
PID 1768 wrote to memory of 4424	1768	Dpgbgpbe.exe	94
PID 1768 wrote to memory of 4424	1768	Dpgbgpbe.exe	94
PID 1768 wrote to memory of 4424	1768	Dpgbgpbe.exe	94
PID 4424 wrote to memory of 5112	4424	Dmkcpdao.exe	95
PID 4424 wrote to memory of 5112	4424	Dmkcpdao.exe	95
PID 4424 wrote to memory of 5112	4424	Dmkcpdao.exe	95
PID 5112 wrote to memory of 5016	5112	Dgdgijhp.exe	96
PID 5112 wrote to memory of 5016	5112	Dgdgijhp.exe	96
PID 5112 wrote to memory of 5016	5112	Dgdgijhp.exe	96
PID 5016 wrote to memory of 2088	5016	Ddhhbngi.exe	97
PID 5016 wrote to memory of 2088	5016	Ddhhbngi.exe	97
PID 5016 wrote to memory of 2088	5016	Ddhhbngi.exe	97
PID 2088 wrote to memory of 3180	2088	Dmplkd32.exe	98
PID 2088 wrote to memory of 3180	2088	Dmplkd32.exe	98
PID 2088 wrote to memory of 3180	2088	Dmplkd32.exe	98
PID 3180 wrote to memory of 3248	3180	Dmbiackg.exe	99
PID 3180 wrote to memory of 3248	3180	Dmbiackg.exe	99
PID 3180 wrote to memory of 3248	3180	Dmbiackg.exe	99
PID 3248 wrote to memory of 3788	3248	Egknji32.exe	100
PID 3248 wrote to memory of 3788	3248	Egknji32.exe	100
PID 3248 wrote to memory of 3788	3248	Egknji32.exe	100
PID 3788 wrote to memory of 4440	3788	Eennefib.exe	101
PID 3788 wrote to memory of 4440	3788	Eennefib.exe	101
PID 3788 wrote to memory of 4440	3788	Eennefib.exe	101
PID 4440 wrote to memory of 4840	4440	Eiijfd32.exe	102
PID 4440 wrote to memory of 4840	4440	Eiijfd32.exe	102
PID 4440 wrote to memory of 4840	4440	Eiijfd32.exe	102
PID 4840 wrote to memory of 1348	4840	Edoncm32.exe	103
PID 4840 wrote to memory of 1348	4840	Edoncm32.exe	103
PID 4840 wrote to memory of 1348	4840	Edoncm32.exe	103
PID 1348 wrote to memory of 4960	1348	Ecanojgl.exe	104
PID 1348 wrote to memory of 4960	1348	Ecanojgl.exe	104
PID 1348 wrote to memory of 4960	1348	Ecanojgl.exe	104
PID 4960 wrote to memory of 928	4960	Eepkkefp.exe	105
PID 4960 wrote to memory of 928	4960	Eepkkefp.exe	105
PID 4960 wrote to memory of 928	4960	Eepkkefp.exe	105
PID 928 wrote to memory of 1404	928	Eilfldoi.exe	106
PID 928 wrote to memory of 1404	928	Eilfldoi.exe	106
PID 928 wrote to memory of 1404	928	Eilfldoi.exe	106
PID 1404 wrote to memory of 3848	1404	Eljchpnl.exe	107
PID 1404 wrote to memory of 3848	1404	Eljchpnl.exe	107
PID 1404 wrote to memory of 3848	1404	Eljchpnl.exe	107
PID 3848 wrote to memory of 5116	3848	Epeohn32.exe	108
PID 3848 wrote to memory of 5116	3848	Epeohn32.exe	108
PID 3848 wrote to memory of 5116	3848	Epeohn32.exe	108
PID 5116 wrote to memory of 5060	5116	Ecdkdj32.exe	109
PID 5116 wrote to memory of 5060	5116	Ecdkdj32.exe	109
PID 5116 wrote to memory of 5060	5116	Ecdkdj32.exe	109
PID 5060 wrote to memory of 3232	5060	Egpgehnb.exe	110

C:\Users\Admin\AppData\Local\Temp\070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe
"C:\Users\Admin\AppData\Local\Temp\070c9f9b47538544a6604963dd65c5fd5ac96c516e2d14351fec6f958370c3bcN.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\Cdlhgpag.exe
  C:\Windows\system32\Cdlhgpag.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\Cdnelpod.exe
    C:\Windows\system32\Cdnelpod.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\SysWOW64\Cfmahknh.exe
      C:\Windows\system32\Cfmahknh.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1160
      - C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Dmplkd32.exe
        
        C:\Windows\system32\Dmplkd32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Egknji32.exe
        
        C:\Windows\system32\Egknji32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Eiijfd32.exe
        
        C:\Windows\system32\Eiijfd32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Ecanojgl.exe
        
        C:\Windows\system32\Ecanojgl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Eilfldoi.exe
        
        C:\Windows\system32\Eilfldoi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\Epeohn32.exe
        
        C:\Windows\system32\Epeohn32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\Ecdkdj32.exe
        
        C:\Windows\system32\Ecdkdj32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Eebgqe32.exe
        
        C:\Windows\system32\Eebgqe32.exe
        23⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4616
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Ellpmolj.exe
        
        C:\Windows\system32\Ellpmolj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\Edcgnmml.exe
        
        C:\Windows\system32\Edcgnmml.exe
        27⤵
        Executes dropped EXE
        
        PID:3756
        
        C:\Windows\SysWOW64\Egbdjhlp.exe
        
        C:\Windows\system32\Egbdjhlp.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4560
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        29⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        30⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        31⤵
        Executes dropped EXE
        
        PID:1388
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Ecidpiad.exe
        
        C:\Windows\system32\Ecidpiad.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Egdqph32.exe
        
        C:\Windows\system32\Egdqph32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Eibmlc32.exe
        
        C:\Windows\system32\Eibmlc32.exe
        35⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Fnnimbaj.exe
        
        C:\Windows\system32\Fnnimbaj.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1248
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        37⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Fdhail32.exe
        
        C:\Windows\system32\Fdhail32.exe
        38⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Fgfmeg32.exe
        
        C:\Windows\system32\Fgfmeg32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1004
        
        C:\Windows\SysWOW64\Fnqebaog.exe
        
        C:\Windows\system32\Fnqebaog.exe
        41⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        42⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2712
        
        C:\Windows\SysWOW64\Fcmnkh32.exe
        
        C:\Windows\system32\Fcmnkh32.exe
        44⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        45⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Windows\SysWOW64\Fdmjdkda.exe
        
        C:\Windows\system32\Fdmjdkda.exe
        48⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        49⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Ffnglc32.exe
        
        C:\Windows\system32\Ffnglc32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Fneoma32.exe
        
        C:\Windows\system32\Fneoma32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Flhoinbl.exe
        
        C:\Windows\system32\Flhoinbl.exe
        52⤵
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\SysWOW64\Ffpcbchm.exe
        
        C:\Windows\system32\Ffpcbchm.exe
        55⤵
        Executes dropped EXE
        
        PID:5288
        
        C:\Windows\SysWOW64\Fnglcqio.exe
        
        C:\Windows\system32\Fnglcqio.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Fljlom32.exe
        
        C:\Windows\system32\Fljlom32.exe
        57⤵
        Executes dropped EXE
        
        PID:5376
        
        C:\Windows\SysWOW64\Fpfholhc.exe
        
        C:\Windows\system32\Fpfholhc.exe
        58⤵
        Executes dropped EXE
        
        PID:5412
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        59⤵
        Executes dropped EXE
        
        PID:5456
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        60⤵
        Executes dropped EXE
        
        PID:5496
        
        C:\Windows\SysWOW64\Gjnlha32.exe
        
        C:\Windows\system32\Gjnlha32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Gnjhhpgl.exe
        
        C:\Windows\system32\Gnjhhpgl.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        63⤵
        Executes dropped EXE
        
        PID:5608
        
        C:\Windows\SysWOW64\Gddqejni.exe
        
        C:\Windows\system32\Gddqejni.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        65⤵
        Executes dropped EXE
        
        PID:5696
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Gnlenp32.exe
        
        C:\Windows\system32\Gnlenp32.exe
        67⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Gloejmld.exe
        
        C:\Windows\system32\Gloejmld.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        69⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        70⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        71⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        73⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        74⤵
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        75⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Windows\SysWOW64\Gfjfhbpb.exe
        
        C:\Windows\system32\Gfjfhbpb.exe
        77⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Gjebiq32.exe
        
        C:\Windows\system32\Gjebiq32.exe
        78⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        79⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1320
        
        C:\Windows\SysWOW64\Gnckooob.exe
        
        C:\Windows\system32\Gnckooob.exe
        81⤵
        Drops file in System32 directory
        
        PID:1144
        
        C:\Windows\SysWOW64\Gqagkjne.exe
        
        C:\Windows\system32\Gqagkjne.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        83⤵
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Gcpcgfmi.exe
        
        C:\Windows\system32\Gcpcgfmi.exe
        84⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Hfnpca32.exe
        
        C:\Windows\system32\Hfnpca32.exe
        85⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Hjjldpdf.exe
        
        C:\Windows\system32\Hjjldpdf.exe
        86⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        87⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Hmhhpkcj.exe
        
        C:\Windows\system32\Hmhhpkcj.exe
        88⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        89⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Hcbpme32.exe
        
        C:\Windows\system32\Hcbpme32.exe
        90⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        91⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:332
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Hdbmfhbi.exe
        
        C:\Windows\system32\Hdbmfhbi.exe
        95⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hcembe32.exe
        
        C:\Windows\system32\Hcembe32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\Hgpibdam.exe
        
        C:\Windows\system32\Hgpibdam.exe
        97⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Hjoeoo32.exe
        
        C:\Windows\system32\Hjoeoo32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        99⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Hqimlihn.exe
        
        C:\Windows\system32\Hqimlihn.exe
        100⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Hcgjhega.exe
        
        C:\Windows\system32\Hcgjhega.exe
        101⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Hgbfhc32.exe
        
        C:\Windows\system32\Hgbfhc32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Windows\SysWOW64\Hfefdpfe.exe
        
        C:\Windows\system32\Hfefdpfe.exe
        103⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Hnmnengg.exe
        
        C:\Windows\system32\Hnmnengg.exe
        104⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Hmpnqj32.exe
        
        C:\Windows\system32\Hmpnqj32.exe
        105⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        106⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        108⤵
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Hnokjm32.exe
        
        C:\Windows\system32\Hnokjm32.exe
        109⤵
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        111⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Hclccd32.exe
        
        C:\Windows\system32\Hclccd32.exe
        112⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Ifjoop32.exe
        
        C:\Windows\system32\Ifjoop32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Ijfkpnji.exe
        
        C:\Windows\system32\Ijfkpnji.exe
        114⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        115⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Iqpclh32.exe
        
        C:\Windows\system32\Iqpclh32.exe
        116⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Idkpmgjo.exe
        
        C:\Windows\system32\Idkpmgjo.exe
        117⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        118⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ifmldo32.exe
        
        C:\Windows\system32\Ifmldo32.exe
        119⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        120⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        121⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Iqbpahpc.exe
        
        C:\Windows\system32\Iqbpahpc.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        123⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Iglhob32.exe
        
        C:\Windows\system32\Iglhob32.exe
        124⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        125⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Infqklol.exe
        
        C:\Windows\system32\Infqklol.exe
        126⤵
        Drops file in System32 directory
        
        PID:3656
        
        C:\Windows\SysWOW64\Iqdmghnp.exe
        
        C:\Windows\system32\Iqdmghnp.exe
        127⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Iepihf32.exe
        
        C:\Windows\system32\Iepihf32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
        
        C:\Windows\SysWOW64\Igneda32.exe
        
        C:\Windows\system32\Igneda32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Ifaepolg.exe
        
        C:\Windows\system32\Ifaepolg.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Inhmqlmj.exe
        
        C:\Windows\system32\Inhmqlmj.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\Imknli32.exe
        
        C:\Windows\system32\Imknli32.exe
        132⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Iebfmfdg.exe
        
        C:\Windows\system32\Iebfmfdg.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        134⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        135⤵
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        136⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        137⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Imnjbhaa.exe
        
        C:\Windows\system32\Imnjbhaa.exe
        138⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Iedbcebd.exe
        
        C:\Windows\system32\Iedbcebd.exe
        139⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Jgcooaah.exe
        
        C:\Windows\system32\Jgcooaah.exe
        140⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Jffokn32.exe
        
        C:\Windows\system32\Jffokn32.exe
        141⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        142⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Jegohe32.exe
        
        C:\Windows\system32\Jegohe32.exe
        143⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        144⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Jjdgal32.exe
        
        C:\Windows\system32\Jjdgal32.exe
        145⤵
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        146⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        147⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        148⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Jfkhfmdm.exe
        
        C:\Windows\system32\Jfkhfmdm.exe
        149⤵
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Jnapgjdo.exe
        
        C:\Windows\system32\Jnapgjdo.exe
        150⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Jmdqbg32.exe
        
        C:\Windows\system32\Jmdqbg32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Jelhcd32.exe
        
        C:\Windows\system32\Jelhcd32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        153⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Jfmekm32.exe
        
        C:\Windows\system32\Jfmekm32.exe
        154⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Jmgmhgig.exe
        
        C:\Windows\system32\Jmgmhgig.exe
        155⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Jeneidji.exe
        
        C:\Windows\system32\Jeneidji.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7080
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        157⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        159⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        160⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Khfdlnab.exe
        
        C:\Windows\system32\Khfdlnab.exe
        161⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Knpmhh32.exe
        
        C:\Windows\system32\Knpmhh32.exe
        162⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        163⤵
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\SysWOW64\Khhaanop.exe
        
        C:\Windows\system32\Khhaanop.exe
        164⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        166⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        167⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Lelajb32.exe
        
        C:\Windows\system32\Lelajb32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3008
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
        
        C:\Windows\SysWOW64\Ldckan32.exe
        
        C:\Windows\system32\Ldckan32.exe
        171⤵
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Lmlpjdgo.exe
        
        C:\Windows\system32\Lmlpjdgo.exe
        172⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Leedqa32.exe
        
        C:\Windows\system32\Leedqa32.exe
        173⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Loniiflo.exe
        
        C:\Windows\system32\Loniiflo.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Windows\SysWOW64\Malefbkc.exe
        
        C:\Windows\system32\Malefbkc.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5220
        
        C:\Windows\SysWOW64\Maoakaip.exe
        
        C:\Windows\system32\Maoakaip.exe
        176⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Mgkjch32.exe
        
        C:\Windows\system32\Mgkjch32.exe
        177⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Mmebpbod.exe
        
        C:\Windows\system32\Mmebpbod.exe
        178⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        179⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mhppik32.exe
        
        C:\Windows\system32\Mhppik32.exe
        180⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Moiheebb.exe
        
        C:\Windows\system32\Moiheebb.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        182⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        183⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        184⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Nhffijdm.exe
        
        C:\Windows\system32\Nhffijdm.exe
        185⤵
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        186⤵
        Modifies registry class
        
        PID:5328
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        187⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Noehac32.exe
        
        C:\Windows\system32\Noehac32.exe
        188⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        189⤵
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\Okneldkf.exe
        
        C:\Windows\system32\Okneldkf.exe
        190⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        191⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Ohdbkh32.exe
        
        C:\Windows\system32\Ohdbkh32.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Windows\SysWOW64\Oookgbpj.exe
        
        C:\Windows\system32\Oookgbpj.exe
        194⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ofhcdlgg.exe
        
        C:\Windows\system32\Ofhcdlgg.exe
        195⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        196⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3332
        
        C:\Windows\SysWOW64\Philfgdh.exe
        
        C:\Windows\system32\Philfgdh.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Windows\SysWOW64\Pbapom32.exe
        
        C:\Windows\system32\Pbapom32.exe
        199⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Pkjegb32.exe
        
        C:\Windows\system32\Pkjegb32.exe
        200⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        201⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        202⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Pojjcp32.exe
        
        C:\Windows\system32\Pojjcp32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Qffoejkg.exe
        
        C:\Windows\system32\Qffoejkg.exe
        205⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        206⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Qfilkj32.exe
        
        C:\Windows\system32\Qfilkj32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7184
        
        C:\Windows\SysWOW64\Afkipi32.exe
        
        C:\Windows\system32\Afkipi32.exe
        208⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Agmehamp.exe
        
        C:\Windows\system32\Agmehamp.exe
        209⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7376
        
        C:\Windows\SysWOW64\Aecbge32.exe
        
        C:\Windows\system32\Aecbge32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7420
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        213⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Ankgpk32.exe
        
        C:\Windows\system32\Ankgpk32.exe
        215⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7652
        
        C:\Windows\SysWOW64\Aiqkmd32.exe
        
        C:\Windows\system32\Aiqkmd32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7700
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        218⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Aokcjngj.exe
        
        C:\Windows\system32\Aokcjngj.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        220⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        221⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        222⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Bkadoo32.exe
        
        C:\Windows\system32\Bkadoo32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8060
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        224⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Windows\SysWOW64\Bgkaip32.exe
        
        C:\Windows\system32\Bgkaip32.exe
        226⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Bgmnooom.exe
        
        C:\Windows\system32\Bgmnooom.exe
        227⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7284
        
        C:\Windows\SysWOW64\Blkgen32.exe
        
        C:\Windows\system32\Blkgen32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        231⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Cicqja32.exe
        
        C:\Windows\system32\Cicqja32.exe
        232⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7628
        
        C:\Windows\SysWOW64\Chinkndp.exe
        
        C:\Windows\system32\Chinkndp.exe
        233⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        234⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Clffalkf.exe
        
        C:\Windows\system32\Clffalkf.exe
        235⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4408
        
        C:\Windows\SysWOW64\Deokja32.exe
        
        C:\Windows\system32\Deokja32.exe
        237⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        238⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Dpihbjmg.exe
        
        C:\Windows\system32\Dpihbjmg.exe
        239⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Dfemdcba.exe
        
        C:\Windows\system32\Dfemdcba.exe
        240⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Eoconenj.exe
        
        C:\Windows\system32\Eoconenj.exe
        241⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ebagdddp.exe
        
        C:\Windows\system32\Ebagdddp.exe
        242⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        243⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        244⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Fefjanml.exe
        
        C:\Windows\system32\Fefjanml.exe
        245⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        246⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Flboch32.exe
        
        C:\Windows\system32\Flboch32.exe
        247⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
        
        C:\Windows\SysWOW64\Fgjpfqpi.exe
        
        C:\Windows\system32\Fgjpfqpi.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4252
        
        C:\Windows\SysWOW64\Fofdkcmd.exe
        
        C:\Windows\system32\Fofdkcmd.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2928
        
        C:\Windows\SysWOW64\Fepmgm32.exe
        
        C:\Windows\system32\Fepmgm32.exe
        251⤵
        Modifies registry class
        
        PID:4088
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        252⤵
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        253⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        254⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        255⤵
        Modifies registry class
        
        PID:7404
        
        C:\Windows\SysWOW64\Gjdknjep.exe
        
        C:\Windows\system32\Gjdknjep.exe
        256⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Ghjhofjg.exe
        
        C:\Windows\system32\Ghjhofjg.exe
        257⤵
        Drops file in System32 directory
        
        PID:764
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        258⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7312
        
        C:\Windows\SysWOW64\Hjieii32.exe
        
        C:\Windows\system32\Hjieii32.exe
        259⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Hpejlc32.exe
        
        C:\Windows\system32\Hpejlc32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8148
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Hgbonm32.exe
        
        C:\Windows\system32\Hgbonm32.exe
        262⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Hhckeeam.exe
        
        C:\Windows\system32\Hhckeeam.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        264⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        265⤵
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        266⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8452
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        270⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Jcgldl32.exe
        
        C:\Windows\system32\Jcgldl32.exe
        271⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8540
        
        C:\Windows\SysWOW64\Jcihjl32.exe
        
        C:\Windows\system32\Jcihjl32.exe
        272⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        273⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        274⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Jikjmbmb.exe
        
        C:\Windows\system32\Jikjmbmb.exe
        275⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Jpdbjleo.exe
        
        C:\Windows\system32\Jpdbjleo.exe
        276⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        277⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        278⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        279⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        281⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        283⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        284⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        285⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        286⤵
        Drops file in System32 directory
        
        PID:8260
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        287⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        288⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        289⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Kifjip32.exe
        
        C:\Windows\system32\Kifjip32.exe
        290⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        291⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        292⤵
        Drops file in System32 directory
        
        PID:8756
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        293⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Lmdbooik.exe
        
        C:\Windows\system32\Lmdbooik.exe
        294⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Lmfodn32.exe
        
        C:\Windows\system32\Lmfodn32.exe
        295⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        296⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        297⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        298⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        299⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Lcealh32.exe
        
        C:\Windows\system32\Lcealh32.exe
        300⤵
        Modifies registry class
        
        PID:8568
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        301⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Mmpbkm32.exe
        
        C:\Windows\system32\Mmpbkm32.exe
        302⤵
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Mfhgcbfo.exe
        
        C:\Windows\system32\Mfhgcbfo.exe
        303⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        304⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mpqklh32.exe
        
        C:\Windows\system32\Mpqklh32.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        307⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        308⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Mpedgghj.exe
        
        C:\Windows\system32\Mpedgghj.exe
        309⤵
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        310⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        311⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8704
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        313⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Nagngjmj.exe
        
        C:\Windows\system32\Nagngjmj.exe
        314⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Nfdfoala.exe
        
        C:\Windows\system32\Nfdfoala.exe
        315⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        316⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8336
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        318⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9228
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        320⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        321⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        322⤵
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Ngklppei.exe
        
        C:\Windows\system32\Ngklppei.exe
        323⤵
        Drops file in System32 directory
        
        PID:9408
        
        C:\Windows\SysWOW64\Ndomiddc.exe
        
        C:\Windows\system32\Ndomiddc.exe
        324⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Oileakbj.exe
        
        C:\Windows\system32\Oileakbj.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:9496
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:9540
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        327⤵
        System Location Discovery: System Language Discovery
        
        PID:9584
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9628
        
        C:\Windows\SysWOW64\Ohobebig.exe
        
        C:\Windows\system32\Ohobebig.exe
        329⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Oiqomj32.exe
        
        C:\Windows\system32\Oiqomj32.exe
        330⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:9760
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9848
        
        C:\Windows\SysWOW64\Oajccgmd.exe
        
        C:\Windows\system32\Oajccgmd.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9892
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9936
        
        C:\Windows\SysWOW64\Oalpigkb.exe
        
        C:\Windows\system32\Oalpigkb.exe
        336⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Phfhfa32.exe
        
        C:\Windows\system32\Phfhfa32.exe
        337⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Pjgemi32.exe
        
        C:\Windows\system32\Pjgemi32.exe
        338⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        339⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        340⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10200
        
        C:\Windows\SysWOW64\Pdofpb32.exe
        
        C:\Windows\system32\Pdofpb32.exe
        342⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        343⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Pacfjfej.exe
        
        C:\Windows\system32\Pacfjfej.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9352
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9420
        
        C:\Windows\SysWOW64\Pgpobmca.exe
        
        C:\Windows\system32\Pgpobmca.exe
        346⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        347⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        348⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Pnlcdg32.exe
        
        C:\Windows\system32\Pnlcdg32.exe
        349⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
        
        C:\Windows\SysWOW64\Qnopjfgi.exe
        
        C:\Windows\system32\Qnopjfgi.exe
        351⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        352⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Qjeaog32.exe
        
        C:\Windows\system32\Qjeaog32.exe
        353⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        354⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        355⤵
        Modifies registry class
        
        PID:10152
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        356⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        357⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        358⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9368
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9484
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4948
        
        C:\Windows\SysWOW64\Aqfolqna.exe
        
        C:\Windows\system32\Aqfolqna.exe
        361⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        362⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        363⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9884
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        366⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        367⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10196
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9332
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        369⤵
        Drops file in System32 directory
        
        PID:2552
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        370⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        371⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        372⤵
        System Location Discovery: System Language Discovery
        
        PID:9840
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        373⤵
        Drops file in System32 directory
        
        PID:10016
        
        C:\Windows\SysWOW64\Bdnkhn32.exe
        
        C:\Windows\system32\Bdnkhn32.exe
        374⤵
        Drops file in System32 directory
        
        PID:10140
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        375⤵
        System Location Discovery: System Language Discovery
        
        PID:9480
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        376⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        377⤵
        System Location Discovery: System Language Discovery
        
        PID:9844
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10080
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        379⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        380⤵
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Cinpdl32.exe
        
        C:\Windows\system32\Cinpdl32.exe
        381⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        382⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Cnkilbni.exe
        
        C:\Windows\system32\Cnkilbni.exe
        383⤵
        System Location Discovery: System Language Discovery
        
        PID:9220
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        384⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ceeaim32.exe
        
        C:\Windows\system32\Ceeaim32.exe
        385⤵
        Modifies registry class
        
        PID:9372
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        386⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        387⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        388⤵
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        389⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        390⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        391⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        392⤵
        Modifies registry class
        
        PID:10532
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        393⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        394⤵
        System Location Discovery: System Language Discovery
        
        PID:10612
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        395⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        396⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        397⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10800
        
        C:\Windows\SysWOW64\Dbphcpog.exe
        
        C:\Windows\system32\Dbphcpog.exe
        399⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        400⤵
        Drops file in System32 directory
        
        PID:10896
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        401⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10988
        
        C:\Windows\SysWOW64\Dlmegd32.exe
        
        C:\Windows\system32\Dlmegd32.exe
        403⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11072
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        405⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        406⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11144 -s 428
        407⤵
        Program crash
        
        PID:11228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4100,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
1⤵
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 11144 -ip 11144
1⤵
PID:11200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Addhbo32.exe

Filesize
404KB

MD5
191869f5d74fcdfe2d7d8dbb5d810f25

SHA1
e266e2c6498e30d50ec7fbbfce143e6b51a33e56

SHA256
798516e8ff808d4e151d28884dc27dc04f61aa6524e4caf6e82984e083830947

SHA512
c226910e9561cbbd4f43f5bcf35904a8535b6679b825352a21325050a94b2e7f69179f684f308c4d963d6c79657264ddb0e78ad7d87ad3522434f84aeaeab94a

Download Submit
C:\Windows\SysWOW64\Adkelplc.exe

Filesize
404KB

MD5
a37eeb6262b0d80286260b2f83d3d392

SHA1
b52144428cadbbf20e0fc7d676e14e53e34060c1

SHA256
295971a13d54808d1c4f48e9bca341567c815c55f290fa23425b920ec65e69cd

SHA512
9896bc92693dae90afc29fd3b1d36d64284dd9e18dc15b7aa51d7a88949256f5bb3d2d430d1b4c73f4252dc05aa94f6c3e16a33edef3af908c4daad37dca15ba

Download Submit
C:\Windows\SysWOW64\Akjgdjoj.exe

Filesize
404KB

MD5
7f97572e61d8e2f7d8969fa0dd82cf77

SHA1
de6b6e30503c98fba2bf72d49befecef8e9ad1c7

SHA256
0fd3038686042a318a6fb2f945b76efc94b7f4c22a962320ebddb0d4864ef0a4

SHA512
1621b66503aae37a618253aff7aee5010bfee34fc8b514e2d8c4998ad7ddd40324733418e0d04db2194705d18a7b40aabd497a6bd67a9a5f7786d2dc06321468

Download Submit
C:\Windows\SysWOW64\Bdnkhn32.exe

Filesize
404KB

MD5
2c3acf5c4a478a77e98ff4f0ba88d16f

SHA1
4e5e35ff6b7525d25eef270ed7038d8c641cdcdf

SHA256
c7eaa517c9960739dadfe63c35e6a5621016d698ac630cbcce15b8923628d6e0

SHA512
c79da2060d1b4d6c40d33188154c6b77648379ace877ae7c2a3dea2a482824303f173aa9893b4a91403e2d495e14855a3d3a97ea749d717f0b45aa4ad4049b82

Download Submit
C:\Windows\SysWOW64\Bfghlhmd.exe

Filesize
404KB

MD5
27cd8de72e2dd5b9e0d7cf42251c408c

SHA1
7df0a049fdeb50860a3a6987367e222753fbf8b9

SHA256
13b3f84502b2425bbf126691d12322521da0a992c7dd69cb1d1c30f594113683

SHA512
ee48111c8e3526078c7414d3a594c375193d10c154dab1f46c27c925e495047747cbea6f62dfb6d8a1ddc3b4cce790a8dccaf4ffea50c824249b87a711a2b37e

Download Submit
C:\Windows\SysWOW64\Bgeadjai.exe

Filesize
404KB

MD5
0af8f19d880a3d4092791479629e0abe

SHA1
b0615e23cafab2dc4143bb3d6e8cdd8fd8d25094

SHA256
15ba9d18d688ea4bc6a3e97deb33f172feeb055bb3bd67920d41e99ef8483bd8

SHA512
b5c19fcd51e6e321cbab513c6954fc0055c6ad7ee23f0ddfcbd0f9bc492f42896e6d4d6b29235bad542680f6cb853b71d6cd74e4c026154214ce171905b74c5c

Download Submit
C:\Windows\SysWOW64\Bqdlmo32.exe

Filesize
404KB

MD5
6f3055a7133fa415b42270c3c784b445

SHA1
a8ea3fbc8ee5bc3cdf9ea67bbfa7f59ce60f9480

SHA256
f6a82a615794e0d442d1bb62e3316b36bc3c999269e5128d092d378a175508dd

SHA512
8d4cdf55bece0ff79f864ee8028a3798ec3334ee93e39117799753510dcdd3f8c0958d34e41cee53d2cf39321b18e32b7c4341649c2598a3362fd7d4b0e5477d

Download Submit
C:\Windows\SysWOW64\Bqpbboeg.exe

Filesize
404KB

MD5
cf90bffd57ccad6ed59ee55e5d0ed882

SHA1
3fa1bed78e257abee3826a3a2b50e04b17276416

SHA256
3e93b7e6aecfa428e4c1e31e21b1ad55505fe0d31f8f800390d832895c95d125

SHA512
534dbb79c11e093a456dc4f197613725b3dde9ff2cfa3d79c54b93ac2298f340c51a8e990fd93dcb207fd5ab53973f3f39448fc088fb7684fe13eb3180308e15

Download Submit
C:\Windows\SysWOW64\Cdlhgpag.exe

Filesize
404KB

MD5
44d87c5d9af20fe6442746dcf1d7c3ca

SHA1
6ddd5a58e1cee9ea33ad08a808093004a79f7a4a

SHA256
0a73235a12d4ecd4faab988d8867fbc3a57ee0c39538e7b98ba526f0976096b1

SHA512
fba88916bf651d288b148620f5c16ce9c6198ca9bb1f896233ca872e15cf051e2936b1c94327c8436bd7ae4122177f3a485eae97cf81ff9f3e1bf4e60b2eadd2

Download Submit
C:\Windows\SysWOW64\Cdnelpod.exe

Filesize
404KB

MD5
ac0ee02d3c9224c075bebe08337c890c

SHA1
78a95d14ea1203248d7321256c4d6051686fba1f

SHA256
7705f4fa28497fb6c2b0f238e687b589106d56a7dffc8e6719b2118533b9e1a3

SHA512
dfbce0d01e552524dd329d183fbe03c44b5c3de2e96cbb1dfbe990bb86e27185fd98d1f2dcbdecd438089a10ca266864d18aaff46d5eb8dc8ecfd903417ff34a

Download Submit
C:\Windows\SysWOW64\Celgjlpn.exe

Filesize
404KB

MD5
3a1f7f81959fb5583c46293721264b2b

SHA1
a3781d9124616a68c72fd3e27ea4eccc13f6a05f

SHA256
f4ee0bea91797248ac06247d9ea98f166ba7ae468b52ea1e298fad931961a001

SHA512
38dac39a3ac0b08655f87c6ff6e76b3bfc3c3cd6fcd81245931489e69e17e56481a69d3bba872bbeaf287a728c0a98830a83ed81f15c8ea4d513c86bd261e8a7

Download Submit
C:\Windows\SysWOW64\Cfmahknh.exe

Filesize
404KB

MD5
8bf9911168489a2db022f86f65f48c05

SHA1
6f0811c5b1de62481cd206781c4a6c1a48c8de09

SHA256
d32f624344e13af0da7f49e231d4db7e20152d823767706f4c64ea557f28da8c

SHA512
337832e4c7e109874ae6333232d1803f22cad26289a2aae1f48c4da416d719a39dfdc687318c3358162b0d7f47347d5419abe2a55d14fce7d8012f52cb78e062

Download Submit
C:\Windows\SysWOW64\Clijablo.exe

Filesize
404KB

MD5
baf8b1e4c0993310617b7a23c6a5c2f9

SHA1
b7eba01a154d10df56fbe77d43d6bdd2ef2b58c8

SHA256
a017363290a9003110d4c2dbfe6c5ee41b7f1e7cf0fd48ef8d57e0872178df6c

SHA512
fecd3ecc7e4ef8407872657abad50ec0fd59078fedc0100e385fe3976d28db73646a9355b462c2b40a608cec4a590f9395e2eeb23cbe6474a8b26e1991779799

Download Submit
C:\Windows\SysWOW64\Ddhhbngi.exe

Filesize
404KB

MD5
3b871757ca75ce8b713f66916cacfb1b

SHA1
0b4971203d7c0ee683c50493357bba6476758505

SHA256
8e053297c0900a2a2eeebd665b790b1626feaacdbe52ad520343e14635aca57c

SHA512
81aef68f8ac8db8247de96374f31198482638fb7d195c04c5321cf71086edec7d99d4d7eb08fdad0ea8e85bc120431db8d3ca76f416135d58527f9696b81aac7

Download Submit
C:\Windows\SysWOW64\Dfemdcba.exe

Filesize
404KB

MD5
f680a4d06b714353c3c8af1076f360b4

SHA1
b87b12cf148e24509634bfd99e01c48f4ea0c996

SHA256
fa925a0b972cace273b8f7378f3202a4164f81e28b60b75fc172912a406ab261

SHA512
19b06a16e1686ea59ce4b9256dc4cf797ab3b7821766e654b55e062b34df54cc2e8bd45f26f79db9017a7c6b41c6aa94e8c9c9129f87acb7aed66df75f8965e4

Download Submit
C:\Windows\SysWOW64\Dgdgijhp.exe

Filesize
404KB

MD5
985926c28a861ca798176a726a2e8815

SHA1
6b5a8cc2b80c4b8c11355f97fcd34cc3839b209a

SHA256
bef05e3ae25ef56e3a896bb143c9f344bdc883bf8509b609d3720a99eb6b025d

SHA512
991feb1b831903118694f9d637b70762cdf0bd87788db23fec7abd32f033d19c1aa6ab6fbad53532e85ae417accedc5c7adfdec70923fcb7000a40194885f592

Download Submit
C:\Windows\SysWOW64\Dhpdkm32.exe

Filesize
404KB

MD5
c40d45fed8952695a81cf4989f8d8e08

SHA1
60ac3446632828321ccfbddb8230edb6a6e6222b

SHA256
1452d94850efd62815cdeab4ad64831ef607136eb804543f422b22d11880255c

SHA512
4b471db0a2fe0fb56b5fc785c5700b236652970eafdcf6373f8470b048ee378c20cff7c0759fe427fa6eb0acf9857a9edea716ef5075c7701098620b73ea4686

Download Submit
C:\Windows\SysWOW64\Dlmegd32.exe

Filesize
404KB

MD5
41cc3103f6a353545980080d8afc62a9

SHA1
81b4fad0e6d04f105b80d427d1884acee5444c6c

SHA256
0b95096d01ef4df5977b9c64b53d39cf26e90c549519061105f440d666e83450

SHA512
231088e00e640d225df76633fbdb54d2dd60e8b072cae7b3392db3c03d9374a705a2a1f70c37bd019c8cb8f60ce61e5fa7d948c18d935151c3562ef8f3feaccf

Download Submit
C:\Windows\SysWOW64\Dmbiackg.exe

Filesize
404KB

MD5
cc5b60b4cd43d4ab4c2ac5cf0d8fe087

SHA1
117580dbd1dd7b7c7d59d310415a87e8ffea0238

SHA256
5c575cd7e1624473a9778d325e896d61b852131d2776af3df3275f858ced6b5e

SHA512
47e5956f7fd0111df7e87eeae628363a3343bd13389c709e5d6ba84f49e5b9b13dba1a7e8c7d9613dbb7c0500e26e195bd9631d990019cbda66d05cd79a58006

Download Submit
C:\Windows\SysWOW64\Dmkcpdao.exe

Filesize
404KB

MD5
118d77f970960d97616287e81a21da50

SHA1
500e23f47a08ead45a142364448178047da1ca61

SHA256
1b49a46d9a47cbaf81f05a93aa9be0ec198864206c215973e175e36d1568c2ff

SHA512
0bfa104df22d80237bcc6ef426255f704c00b91cccdc9a9636c792119cba0c291e9595db0085e5091ee3f8976b623ea7255f9bc266fd70a9c08a8cdb84c9b686

Download Submit
C:\Windows\SysWOW64\Dmplkd32.exe

Filesize
404KB

MD5
6dc185a12938a6d806db8dbb46c67f2a

SHA1
d2e6ce46ab4a583ef5217fbca742f63aae323d8b

SHA256
b7a0b0fbe34b19903fb9f6e0060c2a09d03bc2dca50afb3ad2dcdf4ccc935d7f

SHA512
f84757be7585fca0b3c7012d594cf9ff5504d18d92bef994e8f4222da44876f0d8ab111520eb812d0193bed35d6e42e68db3069dca8a42d36e23ea6b5d9026f0

Download Submit
C:\Windows\SysWOW64\Dpgbgpbe.exe

Filesize
404KB

MD5
6bf0d686e4bcb4509bbc51f9e52a4f2a

SHA1
14c5fa7fdff6ea33354be2bd7c2257b836041b06

SHA256
520ac0b623f16504030e4d827bd9366c41dedb605dd4bc4da33805ee884ce0d1

SHA512
2621c6a82869fc341def8d75cb5d5c6aa79c4c3a6f3623e785739d427dbc14be5959ce89c99efeeef2cd90617df27d649b30d8ef1cf0bc3297fb20b4de62b54d

Download Submit
C:\Windows\SysWOW64\Ecanojgl.exe

Filesize
404KB

MD5
89accf909008be1c9ccffb5ed0de91b8

SHA1
28373bee727a24cbbd2755507484f715f80709a8

SHA256
26b695d17b3a6fa99f0e49494ed9ef0c01b4014be0ce6e8bc4d2ee6958d93377

SHA512
e5041e51cfe7e0135413564a98dc4afcedb37fc1732f034e7002e7610b311b425256daa4efa915e7ba74dc82753e16dd82087e56746a8ed6a77f1aae5d117c22

Download Submit
C:\Windows\SysWOW64\Ecdkdj32.exe

Filesize
404KB

MD5
8022e14f1415b0f226ca2af632eb6d2f

SHA1
4cadf1e9400eefccf69519a9ef045bb72ccb705e

SHA256
64dd0067344a843a09486fa111e4f5ad09b2c269eb99f2a0b3d5742c9fbd34e6

SHA512
b01c9398330922e6c2f49350486cd907e3cbc9d2c3ed69d38bcb428b75892df928c81b3652c0cedce00c5d90791101805db7832d945710f84926f73986dcfb84

Download Submit
C:\Windows\SysWOW64\Ecidpiad.exe

Filesize
404KB

MD5
64fa7d3a09d02e1ee3668c1b22a53fb1

SHA1
b4cecde167dfdaa7599660c4f038e9c811d6ee04

SHA256
2892456e01098cfa6d98875a35800d88ff8fb42dd4b7f3ba04fa7ab86ed00234

SHA512
220601b77a1219d9382d9c0c8d32a88098886a08fa2db1ab80ab28049fa6855e6c9de11204491b164b231aa043c4ec891b9bdc994b1995563e468e841c6449b1

Download Submit
C:\Windows\SysWOW64\Edcgnmml.exe

Filesize
404KB

MD5
703956797b79633e3d83cccee5d1d93b

SHA1
e161e4647f6b68cda8554e4fa324dcb206152475

SHA256
699851f45d759d720d837172b3a8ae23fa44e0d906a4a31e6712d15d665bbc08

SHA512
f786b5de6fe013c35b076e24b3060149851fdf9dd38351b27218209429e34964955b7f2bf3bb24888a0697a7264a800b526102b32c0475f3c839149d37b37874

Download Submit
C:\Windows\SysWOW64\Edfddl32.exe

Filesize
404KB

MD5
c8ffcbd7eb6a82a1ddea831a8ed70a1b

SHA1
a672ddba2e3b21a1635ecb079a5fd2c1f5b65f79

SHA256
c06bd42d23b94b9bdf6f1f513da9a545ad451da9b3264628524e2f833dd09e1a

SHA512
3ccbbd93c90707154a5c6e9308a5739baf55edcddb321c8d6076209981681e1a1e8d7c9bf541e2376d9c316db2314c421f2f5b3cce1ee89f4592ffc5ea97cea4

Download Submit
C:\Windows\SysWOW64\Edoncm32.exe

Filesize
404KB

MD5
6262b2088c1989f50e408fd772e9c900

SHA1
321fcfd4eb4b4724e5b19e8ebb75aceac5dfcbbc

SHA256
0ffed4cb6b43120fc7b03edf4cbe27b44b403238e02e7f63cba6eaead00b85f4

SHA512
4de987d6d3ef40b47a7cc5a9f6e64a2b6150f167e67a6a822993f17ee390a8ee77c10658a1bcb829f9b930751e99e83f9708647be5bfa91fd523d85ba82a6b36

Download Submit
C:\Windows\SysWOW64\Eebgqe32.exe

Filesize
404KB

MD5
a803776279fa9c2bb24ad3f0b94a4d03

SHA1
8658ad3c09a60a3aa412bd8e1cbba5902e1106b7

SHA256
0cce16903d7f74828ffab02d5d8d8623905ca39660a6df57e0322a4511393220

SHA512
95a25a800f3abe0fe008049c83891762a7986dbe4d2d63ea7c1be87e4bcd416fa7d72c90bb6a34b79c1c94c860c787afb098bdbe71dafc78b003602ac0fee09e

Download Submit
C:\Windows\SysWOW64\Eeddfe32.exe

Filesize
404KB

MD5
c39bba50d8b48f2860e53d07017c28e2

SHA1
52f60ff34db904643b9bc1c6ec5535344803652b

SHA256
d9ea0bde164a22225c4f1ccf530d2d05f369691f188d89d3845daba291bcc41a

SHA512
82eaf08528e25fd6fa79f199adb95217567cff51b0f217a09069c7c711110ce9b3b6c92e9bfe8954a706d6c38126ff31f3f9a17e7c4342a6132a7d5578920836

Download Submit
C:\Windows\SysWOW64\Eennefib.exe

Filesize
404KB

MD5
9f5c3a4b046768ff1904079ba8d1db47

SHA1
48da1c3459e4f848d65bb1c48c93e01d339a6609

SHA256
a662a2ddd997ace654f852001e1f889e4d957f9b246e4821d6d91d01c3c65275

SHA512
27addc84ab9b08f1e22ab0030456744700bb5846cc467cf4d9567864f8e2e7a5ea85e815627b102f98cd0db0608f4a9b437945bafffab4da1b1a6353f64765fe

Download Submit
C:\Windows\SysWOW64\Eepkkefp.exe

Filesize
404KB

MD5
711ee631fe9375b283d9f2af9703410f

SHA1
81d6fb42d18b3f57410e7eae80bf7d9d0e40c906

SHA256
02f686f6d0b3c6f037cbf91179f24b67d06b8d2389c042303c1a2151b901ea54

SHA512
177dd08f2a145dbc4499a6c7c036c95a1c86ef27eeee2d6d27ee2d3bfdf83639b1a63c6ecd044b3d19ab84873be0fc2eda710d1d37fecd694087d6c974de5045

Download Submit
C:\Windows\SysWOW64\Egbdjhlp.exe

Filesize
404KB

MD5
1e1bd07e182c8619864b8ba3c2d550a0

SHA1
b848a4cec65284db8cac93fee939bc5cb29342bb

SHA256
bd643dac113441bc5fe7588d2f943fe98d8715f42e9a9a2525e1a54f7489f324

SHA512
557f558ce54bc7c9630db53d8fef1502287772bae4ffae87ca5e58ce764e2f0b9bce4eccc99756ad0f395952ee3702d63c8980489dfb6808001b5de5c09b489b

Download Submit
C:\Windows\SysWOW64\Egknji32.exe

Filesize
404KB

MD5
78d507445d52762405de669f68907d64

SHA1
79d0ffb51fffc218c0b8b414e99672d9ba51745d

SHA256
42638b7eaa72a0815a4dbd0640d207a1b4d1808f3cc7deec1d8e7439b63a204d

SHA512
1aed6a6c61c46ed6955d32606ee66bd50ce17366f49c2f0d78d72347949ece5e86c9b8d9880b6fdc3422ad313b64d40fc2c7adaafe95a8269336ef8472ed23f4

Download Submit
C:\Windows\SysWOW64\Egpgehnb.exe

Filesize
404KB

MD5
6b92f1f79cd5d852982ac7d89d88d192

SHA1
a8982c253a850822d1f4cb1d178353a1673a9bec

SHA256
03780dc28175529ffe74dabb24eb3ac92de3a57e0bb9cc0329118d256a57bd0a

SHA512
afa420e3afbff792c7222105cfaa136abbe78fd4fa988657bf32e153de9703adf023dc34cc413a05b7e08da8be386e89ed8855db69df6f0c93ccac2e39c2d087

Download Submit
C:\Windows\SysWOW64\Eiijfd32.exe

Filesize
404KB

MD5
d7a9d9d5aa469da0c344dce5beea4386

SHA1
034c75e886e2bab47412ca1ca9dcec6531679238

SHA256
fc81bb8d4497e462b1ea0afd4ab6a9c1684f50e9c9ef0612a32a1cd716ec0901

SHA512
b931f852c47d904adff84063ee4886c6b2319f5e103ef8f7e90785ddd53a052d09cac42d79f46700b8adfa3c11090ff7bdfb4ddf5c655dd606aa1d64bc9eb01f

Download Submit
C:\Windows\SysWOW64\Eilfldoi.exe

Filesize
404KB

MD5
008d02005aac40e0856b011c81431352

SHA1
5c14ee113d3f0cc395718a51837b204aaf1741df

SHA256
9b2e1a3868eb866b6aa681e7bdfd72ec4f4b7b821760460a300049010a20773a

SHA512
8fd7050db79a471d0de1408880bef566f316c3e3b08b6495a9005751233fce1eaa275c9b945466dec81c7a4283f7dcf87feea70aa59c18a4cc9e6b27b935bca3

Download Submit
C:\Windows\SysWOW64\Eincadmf.exe

Filesize
404KB

MD5
0d82199a346b0221ea95e339f505f856

SHA1
7a439bd47fbe7c014bb626e762598d32aadeac1c

SHA256
39e4d8316f03ece296a4a175871dbd6a03b4d6e531797f812e48cfdacd3a76c0

SHA512
e24f7653180eb753ed5ec32d985d9e84f62237b07c7f5151ee35ab11ea42d4337daf68b595cff2ef58110d842a6e38b8ff3c4057ec67315036e07061b7463512

Download Submit
C:\Windows\SysWOW64\Eippgckc.exe

Filesize
404KB

MD5
559aebcc2947729dd44fc0b1574870ce

SHA1
482f729b6ab32e7a9b1ff8987c9e519e7be24e4f

SHA256
341527ab7e95be8782c78d26208f07a6c2b0a441cbdea13a295604ad041b0f1c

SHA512
bd7debe5b56cfcb96bf02a82da79c65b4f937842a28276dba1ec31c8d6fae5bc3ba65242f2f0f995f4aa0a468d5f309f17fff3992a2cff3cd8bb4ea9e2b43752

Download Submit
C:\Windows\SysWOW64\Eljchpnl.exe

Filesize
404KB

MD5
1e63b6287cca4254a6baf88657ffb29a

SHA1
4785725659ed3f77b29da1d1ed979bc37514cf87

SHA256
3094d73567f30050a5cf1930483ca35c4a12f570b7f3880e91f75f18780c4646

SHA512
1cacab00410c7923b2aaa9e3c81a3c93983d1ae2e352ace388189eebfdf232989deb3d019c9c983f71c5ad892fb5fcf9ec3bc9013eb5ebfd86565118a0bd2250

Download Submit
C:\Windows\SysWOW64\Ellpmolj.exe

Filesize
404KB

MD5
4044fed01681990af383f9ef948a4d4a

SHA1
53bf58b8c32fceb59d6647e363f869c398cfde11

SHA256
a0ab32bef80d5cf75e3aee70275bdcf6e63410f0368dd8e5394247ef390f6e91

SHA512
8dc2508430687ca0f33da7e2d154d8ff47f3e8894f1227dd2df8f0afa60dff4dbff435c07cca7a03e489295cfce93db805e77e750259ec4e6356304e43328036

Download Submit
C:\Windows\SysWOW64\Elolco32.exe

Filesize
404KB

MD5
ec67735913757796bf38182a9fdc0e1c

SHA1
7df546ee8655691ee229107f8e31c59da1e7d916

SHA256
c9c7904c727401acf65ed3301c9d51e871076b70d551206f4073a1f643048fa7

SHA512
fddb78897c479280adceb039345e05304c4d911de6f9761a5c2a78d2cf6f213e90e408ffdf246be124102123fe013353d6e9bad30feb55ec502e6b85382f037b

Download Submit
C:\Windows\SysWOW64\Emioab32.exe

Filesize
404KB

MD5
cb0d05c2e97dec1c9a1fd1cfc32359da

SHA1
8b6cdc3b22e44b3b9d82a122f86ac4b523a42ddb

SHA256
1bedce4d63bad3837e1f7ad8f9a6faa9b32d194e53c953e10b0b524860db127b

SHA512
f413c6a8aa6fd7282ec9782454e1d98aa95def48d7052f708fe250ba712670a9b0ffee1a5d668e4da4a61db7ad5aea77ea3f328b2c1aaf5b15ba3003f2ce42b4

Download Submit
C:\Windows\SysWOW64\Eoladdeo.exe

Filesize
404KB

MD5
8a631881679dc04ef475b7f61f5ec39e

SHA1
6ca0967edb667248eb76610d2535fcdbafb4b644

SHA256
6cb2fb7b31dfbc8d5afbff6bd463a43046410172fc0db1d5fcf08f7ad26cbe2d

SHA512
31ed64dd3a2ab6f343347c00438d6b8cdbe2c7ba2d82216964b894d17079d8a36b19d5b93f0e444fe20a9659fdb08310c4eb4b6df377c9335d0c7e14e2425d73

Download Submit
C:\Windows\SysWOW64\Epeohn32.exe

Filesize
404KB

MD5
b454e4876bb28e9bba929f5e1e4f591a

SHA1
a9294a19e9f647c5e079cdf9de00ea942c294510

SHA256
b3e8e38708cafbcf698f8381101844aff9f7593163c54897748c3158c5345f66

SHA512
a8629df5c3f6bf5aa571b29b9cb34accf2677898d93573e112fd57debe35bf6e35dba1122fded1bb7dc0d5286bd7d7de0b6487473d838616abd87218b3455d91

Download Submit
C:\Windows\SysWOW64\Fepmgm32.exe

Filesize
404KB

MD5
f5d168499084bbb318a47dbef1bf6e53

SHA1
60fa7d795a05956540729c673797d2cc52c82f35

SHA256
9b93f466fab44573356c5d4293f28a56be37b96f7eb1088c9f74be949d1cc3ea

SHA512
07b9a5b2188a7a47dd07808767db08faa5d96054ca8f01b2125207f4d75aa8a3d98ec5c2fd0ce321f9cac81b13dd41d1d4694ca53c914ee2b1adc68e6c34237c

Download Submit
C:\Windows\SysWOW64\Flboch32.exe

Filesize
404KB

MD5
8df489b87db65db88cdfd41dfce91c4e

SHA1
88da3498f927d392f77bc46702c8526686d0f037

SHA256
a289e8127e99dadcf6cfe0bce54fdd24f731d4b2a720da3130542939080817b7

SHA512
c8bae134bfb707025865d10b55e67b0496f65f224bd6b055b2e3d6fca7fed82bc14311b565038455b272e965fea54313422d01479dd8373657a22dbbf26932a8

Download Submit
C:\Windows\SysWOW64\Ghqeihbb.exe

Filesize
404KB

MD5
458260e4bc472815e57c628c4a9fec46

SHA1
4e1c92dcccd71fca53cf890f18eb799fe33a80ee

SHA256
548f80ae1f2508d0ad788d40e7ba2e4346116facecfbdfb0a68ceb188f904241

SHA512
ee1229126dd007dacb0bc943d90dd99a639e424d0f768dd7a0d0ea624302b8c1f2f78e7e2b67dff300931d1c8e83e58ba883aec1ae45fbdfd8a6b539df212623

Download Submit
C:\Windows\SysWOW64\Giboijgb.exe

Filesize
404KB

MD5
c58828d2d1baaeaf4ff8670c47b784ed

SHA1
dd7e316825e5748daa42509146cc7756b7c7f2b8

SHA256
1b3e05a3f8d89e88c06a0e8019102648d517df75ca5163ae7a3f9c76ac2c91ef

SHA512
1964a218f85a5c078be4b5670055c948a3961eb7dc87a55c16fd0d136eb9e71bb919f1218b655c8b3cc43a6aeac761c2a66cd2c048ee46c5339a834dce8b8aef

Download Submit
C:\Windows\SysWOW64\Hhckeeam.exe

Filesize
404KB

MD5
f552449b09a28f093057ef4d12d9d298

SHA1
e0751272e8f37aa57eed432fcfa195e8865e436d

SHA256
cea0fd5e114e9c4bf4ae89bc2636bba0882ee38c4bbc6c32f126e6a17006c43d

SHA512
94033425cbaad4e2246284661fbf293839f84719363595ed772fdaa665379ee7ef53845d55be0150106daa3673bbfac2b3aafa9252ed604564bb011139f989dd

Download Submit
C:\Windows\SysWOW64\Hjieii32.exe

Filesize
404KB

MD5
6c6a2f111c063fb925db0ea864b227ee

SHA1
c8c89ce19ade68e9abaa24ef551578ba07ac77b5

SHA256
aa4498e9eef0d7d954bced3bfa606d3cf83dafb47b6cba62be2271150a8cf3c8

SHA512
09d145f29381e0d63ace39983ced9fb8308ef6adb668677b68c79df7b73bde1e907e579fff1181020ed96237cf58e82a44894f20ba77faebb636f49e54de0102

Download Submit
C:\Windows\SysWOW64\Ijedehgm.exe

Filesize
404KB

MD5
28d0d32f3f435c2c29a92b5dad59330a

SHA1
efb96ad2fc5e810970f28b7b015bc7c40b61dbdd

SHA256
b67cde42d2d99e0b0f5ba4ce3e196d2c22000c10fbab5959671b2c666904100a

SHA512
faf7a5268e581d8f8989c5c974164da43fc1ae3b307eaebd0b1f1d25bbb480774144346aa4fb29c4ced62ca373e6afbffd3bb84e53aebbdae627c4fb4019b236

Download Submit
C:\Windows\SysWOW64\Ijngkf32.exe

Filesize
404KB

MD5
0146e39724ab21ae9d054310e7d0eed1

SHA1
29916ffa13b1c6582c8ff50bc909e88f1aff701e

SHA256
a35453869c4046409f989f3b768a9835b2bdccac4c28fa306bdd5e5711502409

SHA512
db2a64d4264d501d976e18f2272e19ed1d951fca9a78bd98fcf41fe4d6e3759087d34cdfe3a57c72d8527351c4e33c3e79cc61f873af0987a345ab97c9ffd4a3

Download Submit
C:\Windows\SysWOW64\Jcnbekok.exe

Filesize
404KB

MD5
f373563f49692b07d8a06559af262dca

SHA1
9e5d48769fc3442422d3c7a44450ba9e68960a98

SHA256
436bfb6a45efe7e6df99e7dd09c1ccad1b1423c76f8b47dfd0526e4076ee4026

SHA512
48cfffb301a67535862874068d33ab7c86cea6e8c0e0fe79ef0dbc28a87eea82dcb2bcd87dc7dc4bfdc23007678061523f5d0eb37207db27b6ff2f83d3c8d7b1

Download Submit
C:\Windows\SysWOW64\Jmgmhgig.exe

Filesize
404KB

MD5
19ff2f3fcc80767fcdbfd2a0cc49a5cc

SHA1
36f7e5dedb0df41857104ecac6274035945b84da

SHA256
67ef7c079831fc8f0f58502e437a1e06ca3446aab81588dbaea95fae32e8b067

SHA512
6125ae2c83f62ee1ff28b65db576eb94993781dd55640400a74b465787af709317cf3a4a050f2aa21ab72e133c7994d00e625734734b17bafebeea2f98484884

Download Submit
C:\Windows\SysWOW64\Jopiom32.exe

Filesize
404KB

MD5
6f4a6ff4b441f811df9f000193485759

SHA1
d6fd9a1477318f86eb6b56f71d234c0e876b5460

SHA256
1874dc5af5dadcd64e52c1bb67b531ffebd6b9a82c2f07ae072457122049eebd

SHA512
d62e032596bc069939f528d496c7552a6e3394312ce7e498645303f8245bc44a2ed759fce67c59f35fca1bc52fdbec7432cf70f9863f1b569d717bee860bb126

Download Submit
C:\Windows\SysWOW64\Kciaqi32.exe

Filesize
404KB

MD5
0c1039428f95042d277b8140e3ff135c

SHA1
446b58d197159ca17316c3a0aad99866563a8c60

SHA256
a406edbb070a7a8a0648319daa6688d0ee7b781168393e44545d21ce9ee53da9

SHA512
df5b484b1ffec8c2c079f0375b487b9ecd18deeafa41a01a384bc529b8901be97dc1b6d522c45b5356798d11b34a62231be11295094a09d49a2b285d5cbe92f7

Download Submit
C:\Windows\SysWOW64\Kfcdaehf.exe

Filesize
404KB

MD5
9929ceb036aa5c7255e25547d516c0dc

SHA1
923742ec04b928c73fe21568da89565bbbacd8a1

SHA256
21457181c1a1fb3012fb9f285efc166d2a7d30d9ca537c60dc14bbe430753ab0

SHA512
6bc1c7d7adc160701dfcddcfe7f11e27ba1c7eaf67b99c1bbc799d4cf7727e8cacae1366f29dc3b6b9f096fea49ed8fd2f1f8557200127461c44ebb02afae362

Download Submit
C:\Windows\SysWOW64\Kmkpipaf.exe

Filesize
404KB

MD5
a5b66c3213519a34a956923ca62557e3

SHA1
59c5b3fba056eaf8bd95bfc060de02b2837c36a0

SHA256
425a4d36f8740e94e892b25cb2fb90411ba962f7cc40b586113033f778891441

SHA512
ec7283e3ac3a6e350e916b50a69c048fdbb4db307402468cbfaaf25a2fbeea3f4eab22353c7a368cbac5ee9a61c0deb03d68c4a320cd08e49ac66c1b957ef08e

Download Submit
C:\Windows\SysWOW64\Lcealh32.exe

Filesize
404KB

MD5
d0847a21ac067c0ccc406ec90b324fd3

SHA1
84952dfd9693675c5ca98206174fc1851aa2e799

SHA256
bb4c4e53f5ee1bfc6d7165ce0dcc6521597a2b5d8fa1d45d4f00d568020acb9f

SHA512
b59860fcbd41e4cc7abbfff01e8df818bbd57bd3f7535c8e754c4041eec3556ac4630ecedc297c871800d1d3dae6185f38c98bdbc599339e478a873b3033f0ff

Download Submit
C:\Windows\SysWOW64\Leedqa32.exe

Filesize
404KB

MD5
0204c0705c0e2508063c04067ddb0712

SHA1
de94db1d485dee360ca4b81f058c900b2238c2cf

SHA256
0d1ea67e56e6b3710dfbd9856366cd25be16c0682896471b41859eeca1aef85b

SHA512
ffe874bfc82a42fc1cb34503284524ce4ecd460f4e3a6b74fe732a72371c80188a1ee4200f78b2b13c9b44a3b74f8f0ecee8c89d696d04adc495278792060d79

Download Submit
C:\Windows\SysWOW64\Ljmmcbdp.exe

Filesize
404KB

MD5
c6758da3dca7d59fa2d37d88dd6dfd7a

SHA1
5c5bcc191b85889bfae8260a2d14126868866559

SHA256
a8022c23953f8c9f9ad69dd252434ac68db9a79b7072062ba072cf17c7c5fa49

SHA512
e2925e420ff8dc9a82fdcf08f2e0f6fd4fb40524c28fde05ec5d83d9a45043ecb962a3dd8fc2bda1c91763b1f07e3b9433d784e580545ac38fe29d761f287620

Download Submit
C:\Windows\SysWOW64\Lmdbooik.exe

Filesize
404KB

MD5
87a2c47c9a214b6e99ee1bd08edb922a

SHA1
31e447d01dd3ffbe487103c7cca46d6149ac260d

SHA256
034d177a57d10f419bb21d51b092ae1360594644492c1ab225eb59075e7eb9ee

SHA512
2adf06492db85f1e7377c962a510eedd732489b102120c54743d52a3f45336e60d58e610af0f13dcaec2c5e6e5347ecdee77731e54d16fde9c692ef52c1dfeb7

Download Submit
C:\Windows\SysWOW64\Mdodbf32.exe

Filesize
404KB

MD5
2f9c5e595720d8fceb4b0537e8e59ac2

SHA1
1d7333423bcbca781b0e7fd78ee5b85ce3a25aca

SHA256
b5ab914a621d2a642cf30d540a5127e06c183792f159b542e3d5d6722070969d

SHA512
87534e7af981633c445c97a0620271f8b0a1140416c9872b070ff488c7adec53e38a9057503bb5083e34572a80d9eb461092517cab75c5ac5d1b3b2164ddcc06

Download Submit
C:\Windows\SysWOW64\Mmpbkm32.exe

Filesize
404KB

MD5
fe42e5608701a2bef0802927ca3b77c4

SHA1
61a351abc3c60cfa9768ed2887d74025f1903efc

SHA256
382938f99017cd29f8df2146091cacd399b7fcc8d8d90519b0051604aa5ea620

SHA512
fd07afef58c320fb3859c8db57fa7c250db04b46fe68903efe136d1e84b2e516c3f2a72f4e2f4f5efa8969ff9150306e285257375cd81cb152d6b6b1dfa8f15e

Download Submit
C:\Windows\SysWOW64\Moiheebb.exe

Filesize
404KB

MD5
502fd22bdc04e6d1ee78ac462710082f

SHA1
ae1d9bffa97229020dcac94d81fd9b0d7fe887f3

SHA256
00d36dc347edc6664f14841765baac3ccf650369ece48426432b33ef4fddcc9f

SHA512
2045668ad9fdb6f805e18bfb25263d9d8919b9a95fa6e649e958e5359e2695f27fa6528a585c83003641f046525c5da5ec26561b3c0407ba7556a8450ae2cdf1

Download Submit
C:\Windows\SysWOW64\Mpedgghj.exe

Filesize
404KB

MD5
ffee09849d995f4367aceb0551ff7ebf

SHA1
04fffa41acefcc16b927da014a1be021fd02f412

SHA256
d8b4f0cea6ca9a871c58dfac87a79a3f7321f1a768cc05e3dc9a0feec21f4d4a

SHA512
8d6ece684b948bc60efe11172e3a8700c68a28afce7c0803f483ad51dfda56e47f940e577c5529a7c28fb2c66c5aabd487da1117ef9dc6d595433e136197bd99

Download Submit
C:\Windows\SysWOW64\Namnmp32.exe

Filesize
404KB

MD5
9f2e790a2e680732ed9c1c1f98ad5ffe

SHA1
88827d2a6b48c927bac43a89127f23d173d4072b

SHA256
52e17e7bba581b157bfca0d72ccdc4d90a00bc6f99b3659454ba1570efbc1f1b

SHA512
7ec6ccb112194d12ce7bf0bbf3583725afbde5f7d441aa715c311a43d60bc056c70d4324eb7401dab3d7236bef41d6d7645074bfb893eac2726ff0f252b68bf1

Download Submit
C:\Windows\SysWOW64\Ngipjp32.exe

Filesize
404KB

MD5
e9942b3decfd0ef5a7366de7342aba9f

SHA1
a6ff0e4512efe746123993283c12fc6d782534c3

SHA256
b5470355fdd6fe72f1d4e0f52c30a4786c9a34c2e9de2dcec6eeb1a7c5386ff9

SHA512
8fbae6897465c6b7e67fc3e49be93bf0fd97b251bbd1f97910eaa67c89016661d00c9700b9cf674e514841300d83fd85e8a3f0b63b8f05db0d69f6a48b2215cb

Download Submit
C:\Windows\SysWOW64\Ngklppei.exe

Filesize
404KB

MD5
8911da4d75e67899ea5d4510173af12a

SHA1
1b0cb188582f37b4db6b0487b7c76a2eb86e1f2a

SHA256
9bc8b7ca0456dbf85f0a04c4982f22c867998df2b714bae134b76e2a7da8cf99

SHA512
eca1b6f3e475f7bb63fe795a15a16f916998dbd3054f000f5bb02af142d4fcb3f651d3ab0729129b78e2b759469c9c13e9b21947399be3974fa2997744e8e677

Download Submit
C:\Windows\SysWOW64\Ohdbkh32.exe

Filesize
404KB

MD5
b349acc6e650cdc3cf35fa1ff6a50f98

SHA1
970c946ab024ffba853a3df4478f7b981f06c5fd

SHA256
2844b79fc39b27ff04b41dc0d60b1f05420caf1e8c58823260522b9197494a93

SHA512
5aeecf43cbfe9960db2efc14dd3009e3da053826858057bdb1e57b3cf162789f948a870c873440dd13f7c210f9821a5431f06290c45f2976b6ebf0d208862b0d

Download Submit
C:\Windows\SysWOW64\Ohdlpa32.exe

Filesize
404KB

MD5
1499156bcbd55b7aad3b9e0a46e8b6c4

SHA1
83c4a5816643062d37ea7ce1b0c0a1acbe00aa01

SHA256
0dbcd57eff9e7c5bf8ffebc8212012c324c9ee06edd5904c09e5b5b823ddd10c

SHA512
bfee956cbabce7b4103bce3523ac6f296104f8558fe40562d03b0e0b186da527007619f77fa63968072e1af17934947388df9c91797b1a004c6a73e0026ad306

Download Submit
C:\Windows\SysWOW64\Oihlnd32.dll

Filesize
7KB

MD5
40ec7e22ee079759afd120dd402c27c5

SHA1
1c1a6b5151114109b5729c06b97f81d8cb63329e

SHA256
a7f50ab2bc50368f67408ede37373b1dec1310a1b9b4599964d0560b03ee5a4e

SHA512
95af88d34a42f0a825774ad717200df5f62ad5db6d978f685f533d55b365379cd43dfed7bccaa76d6f3aaf8b7554a3ddd4de2871e05856b36e4af356e6f0b43e

Download Submit
C:\Windows\SysWOW64\Oinbgk32.exe

Filesize
404KB

MD5
4a790793f4aca3a2a7306eff2977503e

SHA1
e1188e043bf9f75ba5ac82a7f4576be7dc09e2f1

SHA256
02524f391fa4ca3624c96e43b137bf5a76c560d99a94f796faace73f05e24f08

SHA512
13c97ea91d9dd4b5affa33b2cc0a37f52b66bda41cc8fe44baaed695b35420724184e347a8ba71dfc6eff4b4c686b3ee1fe2ca4bfd8c2ffcea3a740c76d4ab2e

Download Submit
C:\Windows\SysWOW64\Oogdfc32.exe

Filesize
404KB

MD5
1a0548b07635151ae225e68c98b93ad7

SHA1
df2e52243863d6c647d0a9c9c571f7fa3e198763

SHA256
31e384d94d3e9d6efd2c43c953e8daa7686d83ffa4998f20193d9a95c341b0e6

SHA512
4f41d48fe9f2f9700dd2f4ea15f0a6d14804e09ae5316aa2a93901e1cdc29ec3f91f6fb6dfad06aa5384517f94b6a6c6ba1e1976b73ba3a2da637c84ed181295

Download Submit
C:\Windows\SysWOW64\Pgkegn32.exe

Filesize
404KB

MD5
3468f7c28f03495076da615d1e21125c

SHA1
f2ccb6b454f25effafa09ba2756234d50f8de27e

SHA256
206ac3185fbb18b4f6448fb117fb31a507022295c6fd5219b280e371804db026

SHA512
f34afc26f0d8b1095043c79db9625416457530ab9387f85e90d9191900c21d9882cdf29db99ca8d187ffe2b369939fc81636ccd0885b710ff62423ec2bd6f158

Download Submit
C:\Windows\SysWOW64\Pgpobmca.exe

Filesize
404KB

MD5
ee1ad11919f4884f179eef0cbf35d7bb

SHA1
3496715fbdeff4c87dc395b8b9d871b4763b3c4d

SHA256
e2947f504f93c6f3b7da2cdfe1d5dfdecf0a0cc6abb8cea68813bc755fb57b9d

SHA512
a1f6426380796acd613ecc39403eff2e7b3b92a8baf244f9ebc0b394de751253df2d6f0b0cd88f249f837381799047aa6fbdb559704154ce43b27d91cdea01cb

Download Submit
C:\Windows\SysWOW64\Philfgdh.exe

Filesize
404KB

MD5
efdc335eb71ea15cb0130344501f54e4

SHA1
473d57d86afdb78b1e5b20d33c964bfd560c873d

SHA256
8591464f81cbb056db1318f64581e52a2d8df26d75a75163a170529bd62ac49d

SHA512
5b3b69e3f06b4ecafe484bcd9cb5ec229ee0a482dc5a89cf2672a0828c7b97b9c0c5d05ba65b00af41f8d3c6c75009e7d1c6fd31939d3e88e72ab4698cb7734a

Download Submit
C:\Windows\SysWOW64\Pkjegb32.exe

Filesize
404KB

MD5
99a7a684c382683c6635a4d779b60eb5

SHA1
ee3df45d032012c9e017f20d290d29e465a6e43a

SHA256
6f50c1c1490f23b8524854217cbaa68893589b21ba60c1e516efccd935ce5b1a

SHA512
6e8e0110d9d183a5d7c5dc9cb3c29ae7f35618d6d27e9eace402e167cb040099457905f90dc73423247897928940e39ad68039f1bbf4e983ff5c0207d11925e6

Download Submit
C:\Windows\SysWOW64\Pndhhnda.exe

Filesize
404KB

MD5
92d8ff217ae25217577fdb654cd2a3ae

SHA1
a9514ca579287f06b40061a1927299cd0dcae68e

SHA256
10b8b4e87d57d994e95210adb9e8618e6ac75f8a7e70143d6d8e5a25a2393d30

SHA512
2f9c47ade3ad5bed6ac60d82ddd05150dd96867be24c1c7a1d58aa2cceffe420cb6648c1b015f76dafa702012a78efb940e776967482a3b239eb89d71370d082

Download Submit
C:\Windows\SysWOW64\Pnknim32.exe

Filesize
404KB

MD5
98d046635b50954e4133898eb7a97f60

SHA1
5ae0be7773d71a73ca5eb7322780407e33e35240

SHA256
ca7aed333051b01d8023edbe16fcc21ac4581c05c7430d0d218401c58f0fce85

SHA512
31468367cffd79267b1cc4049955dec3f9e113ae3eaccd964435f206a0323ce63a0fb03864511b6e1de08aaa467d4bcd5c1393d695d6a766b919b7c771d92259

Download Submit
C:\Windows\SysWOW64\Qffoejkg.exe

Filesize
404KB

MD5
a4b0668eb0332ee0562a22cb347ec3df

SHA1
e9c11307ca2edd681f6cfc60c5a501b6eda7fb9a

SHA256
9875c09ceeaeed600efaf8369420e8698c90355e6ca8d2de991a55287c919d4e

SHA512
ba07032d56f3c369906fc492f8cec426639f7b32c7e753faf8af345b00bb0a27fdc77d5cde2e5d64fdca85dac00a0e818af655f3d980fae995a90525b1df5080

Download Submit
C:\Windows\SysWOW64\Qhddgofo.exe

Filesize
404KB

MD5
791ee447859a6cc0faa6bdb1394b37c7

SHA1
e855141cea5ddd0ddd1e7f462789abba13d4f17f

SHA256
ba133fe1c89c2622ec537855330d65794341168c0f2873e1153ce4805cd6debf

SHA512
d574de9a25453be1ca375d27aedec06b234d5e3f0438a1836a75bcc7d9c0ecdcfbd15499b1d0fff87303cb4953ed84df15294041ea4b9cb1b8242b551b4ff3e8

Download Submit
C:\Windows\SysWOW64\Qnopjfgi.exe

Filesize
404KB

MD5
5cd0b07fd2022a6f35783c582dfd771e

SHA1
9b1906b4b7be36e58da41d0459fedcff74f630db

SHA256
74cfa9bad64414252ca05c6b2c3f45fc4a834722c3ae8d8ab02dd17e3e2f3494

SHA512
918b54627eceae28e260388d1ed8f5ccf9316e7cd3d6d04d2fc2a88cedfe7678472b9df34af98a6d286eaf54a6c90672be7bf6158c751892851805928fd6dfc7

Download Submit
memory/228-284-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/928-149-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1004-315-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1116-567-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1144-561-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1156-101-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1156-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1160-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1160-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1212-537-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1244-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1244-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1248-291-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1320-555-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1348-131-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1388-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1404-157-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-111-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1592-327-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1628-93-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1628-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1768-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1768-39-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-542-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-302-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2084-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2088-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2088-166-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2132-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2496-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-332-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2884-369-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2940-357-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2956-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3124-308-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3164-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3180-175-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3232-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3248-94-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3540-374-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3556-362-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3756-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3788-102-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3788-191-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3848-167-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4036-338-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4220-279-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4424-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4424-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4428-345-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4440-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4544-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4560-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4616-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4640-297-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4656-321-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4676-272-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4840-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4900-350-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4960-139-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-156-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-183-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5072-549-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-148-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5136-380-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5152-579-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5176-387-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5208-393-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5248-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5288-404-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5336-410-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5376-416-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5412-422-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5456-428-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5496-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5528-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5568-447-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5608-453-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5648-458-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5696-465-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5728-470-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5776-477-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5808-482-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5856-489-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5888-494-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5936-500-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5976-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6008-513-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6048-519-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6088-524-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/6136-530-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads