berbew | 241d5e932144d6bf59010cad15af1524ea22da9152d3ab6f1639a8d47be28000

Analysis

max time kernel
146s
max time network
171s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250207-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10/02/2025, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusSign.2023.11.29/03ceea0ec59f89c49ba4357a83738d9d.exe
Size

1.9MB
MD5

03ceea0ec59f89c49ba4357a83738d9d
SHA1

7851ca7fd0ead9363ab894060eb13a83e9001755
SHA256

7254af0b6420ae255900a85f566cf246de688254bff23ff4e9c9c9fbef0919ad
SHA512

a66548485186be305d1ae1f967e4acedd4bcfb55eea409ce0cd5972ccb96f7f36de0e95aecac7991a29ded5890f4a29cb6f90532d67ef27a177bfd5dabac004f
SSDEEP

24576:YNIVyeNIVy2jUKaNIVyeNIVy2jUtc9uO2NIVyeNIVy2jUKaNIVyeNIVy2jUO:3yj1yj3uOpyj1yjH

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgloefco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geldkfpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbdgec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iajmmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqeioiam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icachjbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hajkqfoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjidgkog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bboffejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjgim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flfkkhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poimpapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaemilci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilibdmgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebijnak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbnlaldg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abmjqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjolie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiaael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjblje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkmeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmlkfjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdmqmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdecgbfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nglhld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giecfejd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iolhkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lakfeodm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Halaloif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dijbno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cammjakm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jihbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibeoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpqggh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idcepgmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ganldgib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpaekqhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhgonidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epdime32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilcldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jngbjd32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Downloads MZ/PE file 1 IoCs

flow	pid	Process
38	11652	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
3424	Idcepgmg.exe
2324	Ipjedh32.exe
5028	Ilccoh32.exe
1464	Jcbdgb32.exe
2764	Jnjejjgh.exe
816	Kjccdkki.exe
956	Kqmkae32.exe
3224	Kdmqmc32.exe
3364	Lgqfdnah.exe
3304	Ljaoeini.exe
420	Lqndhcdc.exe
4004	Lgjijmin.exe
4468	Mminhceb.exe
4404	Mjokgg32.exe
3904	Mjahlgpf.exe
2084	Mkadfj32.exe
3996	Manmoq32.exe
2056	Njfagf32.exe
2032	Nmlddqem.exe
1124	Oloahhki.exe
3336	Onpjichj.exe
3724	Odoogi32.exe
404	Okkdic32.exe
4828	Poimpapp.exe
4492	Pkpmdbfd.exe
2384	Phfjcf32.exe
2284	Pocpfphe.exe
940	Qoelkp32.exe
4464	Aafemk32.exe
2608	Aednci32.exe
1068	Akepfpcl.exe
4668	Aaohcj32.exe
1008	Bdbnjdfg.exe
1516	Bnkbcj32.exe
2432	Bebjdgmj.exe
4812	Bkobmnka.exe
3552	Bedgjgkg.exe
1704	Bhbcfbjk.exe
2200	Bakgoh32.exe
984	Bdickcpo.exe
4412	Blqllqqa.exe
2880	Camddhoi.exe
3720	Chglab32.exe
4564	Coadnlnb.exe
4524	Cdnmfclj.exe
1400	Ckhecmcf.exe
2972	Cnfaohbj.exe
2584	Clgbmp32.exe
1712	Cnindhpg.exe
4008	Chnbbqpn.exe
4440	Cohkokgj.exe
3368	Cdecgbfa.exe
4272	Dokgdkeh.exe
1584	Dbicpfdk.exe
2668	Domdjj32.exe
1876	Dfglfdkb.exe
1588	Dkceokii.exe
4016	Dbnmke32.exe
1772	Dkfadkgf.exe
3348	Dndnpf32.exe
1700	Dijbno32.exe
3096	Dkhnjk32.exe
4288	Dngjff32.exe
3020	Ekkkoj32.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nagiji32.exe	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Gflonn32.dll	Ofjqihnn.exe
File opened for modification	C:\Windows\SysWOW64\Fngcmcfe.exe	Feoodn32.exe
File created	C:\Windows\SysWOW64\Akkffkhk.exe	Qdaniq32.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Aogbfi32.exe
File created	C:\Windows\SysWOW64\Cammjakm.exe	Ckbemgcp.exe
File opened for modification	C:\Windows\SysWOW64\Fijdjfdb.exe	Fqbliicp.exe
File created	C:\Windows\SysWOW64\Fngcmcfe.exe	Feoodn32.exe
File created	C:\Windows\SysWOW64\Chglab32.exe	Camddhoi.exe
File created	C:\Windows\SysWOW64\Ipgijcij.dll	Lcdciiec.exe
File created	C:\Windows\SysWOW64\Figfoijn.dll	Mokmdh32.exe
File created	C:\Windows\SysWOW64\Panlem32.dll	Hldiinke.exe
File created	C:\Windows\SysWOW64\Gdqeooaa.dll	Jeolckne.exe
File created	C:\Windows\SysWOW64\Afeknhab.dll	Hehkajig.exe
File created	C:\Windows\SysWOW64\Damfao32.exe	Dkcndeen.exe
File created	C:\Windows\SysWOW64\Dfbjkg32.dll	Ajdbac32.exe
File opened for modification	C:\Windows\SysWOW64\Omopjcjp.exe	Ofegni32.exe
File created	C:\Windows\SysWOW64\Mbibld32.dll	Clgbmp32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Bpfljc32.dll	Fohfbpgi.exe
File opened for modification	C:\Windows\SysWOW64\Kibeoo32.exe	Kbhmbdle.exe
File opened for modification	C:\Windows\SysWOW64\Fdpnda32.exe	Fnffhgon.exe
File opened for modification	C:\Windows\SysWOW64\Bdickcpo.exe	Bakgoh32.exe
File created	C:\Windows\SysWOW64\Bpldbefn.dll	Oiagde32.exe
File created	C:\Windows\SysWOW64\Khkdad32.exe	Kaaldjil.exe
File opened for modification	C:\Windows\SysWOW64\Jcfggkac.exe	Jllokajf.exe
File opened for modification	C:\Windows\SysWOW64\Oonlfo32.exe	Omopjcjp.exe
File created	C:\Windows\SysWOW64\Odoogi32.exe	Onpjichj.exe
File opened for modification	C:\Windows\SysWOW64\Efblbbqd.exe	Emjgim32.exe
File created	C:\Windows\SysWOW64\Ocjoadei.exe	Oakbehfe.exe
File opened for modification	C:\Windows\SysWOW64\Egpnooan.exe	Edaaccbj.exe
File created	C:\Windows\SysWOW64\Ahfmjddg.dll	Kofdhd32.exe
File created	C:\Windows\SysWOW64\Fgoakc32.exe	Fqeioiam.exe
File opened for modification	C:\Windows\SysWOW64\Ncmhko32.exe	Nqoloc32.exe
File created	C:\Windows\SysWOW64\Jnblgj32.dll	Cancekeo.exe
File opened for modification	C:\Windows\SysWOW64\Cildom32.exe	Cgmhcaac.exe
File created	C:\Windows\SysWOW64\Obcckehh.dll	Iagqgn32.exe
File opened for modification	C:\Windows\SysWOW64\Jnedgq32.exe	Jhkljfok.exe
File opened for modification	C:\Windows\SysWOW64\Jcbdgb32.exe	Ilccoh32.exe
File created	C:\Windows\SysWOW64\Llgmeiqa.dll	Mjokgg32.exe
File created	C:\Windows\SysWOW64\Olieecnn.dll	Jcdjbk32.exe
File created	C:\Windows\SysWOW64\Nbjnhape.dll	Hpmhdmea.exe
File created	C:\Windows\SysWOW64\Mjggal32.exe	Lcmodajm.exe
File created	C:\Windows\SysWOW64\Debcil32.dll	Nqmojd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddcebe32.exe	Dinael32.exe
File created	C:\Windows\SysWOW64\Edaaccbj.exe	Enhifi32.exe
File created	C:\Windows\SysWOW64\Eilbckfb.dll	Khkdad32.exe
File created	C:\Windows\SysWOW64\Mklbeh32.dll	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Lblldc32.dll	Ifomll32.exe
File opened for modification	C:\Windows\SysWOW64\Laiipofp.exe	Lhqefjpo.exe
File created	C:\Windows\SysWOW64\Nqmojd32.exe	Njbgmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Ccdihbgg.exe	Cpfmlghd.exe
File created	C:\Windows\SysWOW64\Gnfooe32.exe	Gglfbkin.exe
File created	C:\Windows\SysWOW64\Kfbdfl32.dll	Emmdom32.exe
File created	C:\Windows\SysWOW64\Fqeioiam.exe	Foclgq32.exe
File opened for modification	C:\Windows\SysWOW64\Iogopi32.exe	Ilibdmgp.exe
File opened for modification	C:\Windows\SysWOW64\Kbjbnnfg.exe	Kkbkmqed.exe
File opened for modification	C:\Windows\SysWOW64\Mcaipa32.exe	Mlhqcgnk.exe
File opened for modification	C:\Windows\SysWOW64\Ifomll32.exe	Iohejo32.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Eqncnj32.exe
File created	C:\Windows\SysWOW64\Lncmdghm.dll	Cgmhcaac.exe
File created	C:\Windows\SysWOW64\Eemeqinf.dll	Dgdncplk.exe
File created	C:\Windows\SysWOW64\Felbnn32.exe	Enbjad32.exe
File opened for modification	C:\Windows\SysWOW64\Phfcipoo.exe	Palklf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	12484	WerFault.exe	701

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fngcmcfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqncnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfiokmkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjolie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijkled32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkadfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkbkmqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phonha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgfhnhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcedmkmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjahlgpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfpcoefj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehpadhll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fooclapd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaiqcnhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Biklho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdnjfojj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjfbjdnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iccpniqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjnaaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bakgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgkfnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdaniq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilfennic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieagmcmq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khbiello.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbhgoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdbnjdfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggnadib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibbcfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlnjbedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiagde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piapkbeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qikbaaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jedccfqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knqepc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkekjdck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpmhdmea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmfefni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mminhceb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chglab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eokqkh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaifpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omdppiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddifgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abhqefpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhbcfbjk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dngjff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmimai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojajin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijiopd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnonkq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqhfoebo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aiplmq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqbeoc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqimikfj.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4960	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egacbb32.dll"	Ipjedh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkoafbld.dll"	Ljceqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjehdpem.dll"	Hpkknmgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmlephen.dll"	Coadnlnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpmhdmea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjcmngnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eloeba32.dll"	Jaemilci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Foclgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enalem32.dll"	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dblamanm.dll"	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnjejjgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiljgf32.dll"	Cdecgbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjlhgaqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egpnooan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjekja32.dll"	Hccggl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcdjbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcbfe32.dll"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nohjfifo.dll"	Pplhhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajaelc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epdime32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbdadm32.dll"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iccpniqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idhiii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljcpchlo.dll"	Ieidhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekjded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojgljk32.dll"	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eahobg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idcepgmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jedccfqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqlfhjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejimf32.dll"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmnhl32.dll"	Lcnfohmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgjhpcmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qfmfefni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmpjoloh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gclafmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlglidlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbgfhnhi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoclopne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjblje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddcebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijpepcfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcbdgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iikikigb.dll"	Cnindhpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgeaknci.dll"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Koonge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lalceb32.dll"	Bfmolc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okkdic32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	10260	firefox.exe
Token: SeDebugPrivilege	10260	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe
10260	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
10260	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 3424	3712	03ceea0ec59f89c49ba4357a83738d9d.exe	87
PID 3712 wrote to memory of 3424	3712	03ceea0ec59f89c49ba4357a83738d9d.exe	87
PID 3712 wrote to memory of 3424	3712	03ceea0ec59f89c49ba4357a83738d9d.exe	87
PID 3424 wrote to memory of 2324	3424	Idcepgmg.exe	88
PID 3424 wrote to memory of 2324	3424	Idcepgmg.exe	88
PID 3424 wrote to memory of 2324	3424	Idcepgmg.exe	88
PID 2324 wrote to memory of 5028	2324	Ipjedh32.exe	89
PID 2324 wrote to memory of 5028	2324	Ipjedh32.exe	89
PID 2324 wrote to memory of 5028	2324	Ipjedh32.exe	89
PID 5028 wrote to memory of 1464	5028	Ilccoh32.exe	90
PID 5028 wrote to memory of 1464	5028	Ilccoh32.exe	90
PID 5028 wrote to memory of 1464	5028	Ilccoh32.exe	90
PID 1464 wrote to memory of 2764	1464	Jcbdgb32.exe	91
PID 1464 wrote to memory of 2764	1464	Jcbdgb32.exe	91
PID 1464 wrote to memory of 2764	1464	Jcbdgb32.exe	91
PID 2764 wrote to memory of 816	2764	Jnjejjgh.exe	92
PID 2764 wrote to memory of 816	2764	Jnjejjgh.exe	92
PID 2764 wrote to memory of 816	2764	Jnjejjgh.exe	92
PID 816 wrote to memory of 956	816	Kjccdkki.exe	93
PID 816 wrote to memory of 956	816	Kjccdkki.exe	93
PID 816 wrote to memory of 956	816	Kjccdkki.exe	93
PID 956 wrote to memory of 3224	956	Kqmkae32.exe	94
PID 956 wrote to memory of 3224	956	Kqmkae32.exe	94
PID 956 wrote to memory of 3224	956	Kqmkae32.exe	94
PID 3224 wrote to memory of 3364	3224	Kdmqmc32.exe	95
PID 3224 wrote to memory of 3364	3224	Kdmqmc32.exe	95
PID 3224 wrote to memory of 3364	3224	Kdmqmc32.exe	95
PID 3364 wrote to memory of 3304	3364	Lgqfdnah.exe	96
PID 3364 wrote to memory of 3304	3364	Lgqfdnah.exe	96
PID 3364 wrote to memory of 3304	3364	Lgqfdnah.exe	96
PID 3304 wrote to memory of 420	3304	Ljaoeini.exe	97
PID 3304 wrote to memory of 420	3304	Ljaoeini.exe	97
PID 3304 wrote to memory of 420	3304	Ljaoeini.exe	97
PID 420 wrote to memory of 4004	420	Lqndhcdc.exe	98
PID 420 wrote to memory of 4004	420	Lqndhcdc.exe	98
PID 420 wrote to memory of 4004	420	Lqndhcdc.exe	98
PID 4004 wrote to memory of 4468	4004	Lgjijmin.exe	99
PID 4004 wrote to memory of 4468	4004	Lgjijmin.exe	99
PID 4004 wrote to memory of 4468	4004	Lgjijmin.exe	99
PID 4468 wrote to memory of 4404	4468	Mminhceb.exe	100
PID 4468 wrote to memory of 4404	4468	Mminhceb.exe	100
PID 4468 wrote to memory of 4404	4468	Mminhceb.exe	100
PID 4404 wrote to memory of 3904	4404	Mjokgg32.exe	101
PID 4404 wrote to memory of 3904	4404	Mjokgg32.exe	101
PID 4404 wrote to memory of 3904	4404	Mjokgg32.exe	101
PID 3904 wrote to memory of 2084	3904	Mjahlgpf.exe	102
PID 3904 wrote to memory of 2084	3904	Mjahlgpf.exe	102
PID 3904 wrote to memory of 2084	3904	Mjahlgpf.exe	102
PID 2084 wrote to memory of 3996	2084	Mkadfj32.exe	103
PID 2084 wrote to memory of 3996	2084	Mkadfj32.exe	103
PID 2084 wrote to memory of 3996	2084	Mkadfj32.exe	103
PID 3996 wrote to memory of 2056	3996	Manmoq32.exe	104
PID 3996 wrote to memory of 2056	3996	Manmoq32.exe	104
PID 3996 wrote to memory of 2056	3996	Manmoq32.exe	104
PID 2056 wrote to memory of 2032	2056	Njfagf32.exe	105
PID 2056 wrote to memory of 2032	2056	Njfagf32.exe	105
PID 2056 wrote to memory of 2032	2056	Njfagf32.exe	105
PID 2032 wrote to memory of 1124	2032	Nmlddqem.exe	106
PID 2032 wrote to memory of 1124	2032	Nmlddqem.exe	106
PID 2032 wrote to memory of 1124	2032	Nmlddqem.exe	106
PID 1124 wrote to memory of 3336	1124	Oloahhki.exe	107
PID 1124 wrote to memory of 3336	1124	Oloahhki.exe	107
PID 1124 wrote to memory of 3336	1124	Oloahhki.exe	107
PID 3336 wrote to memory of 3724	3336	Onpjichj.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VirusSign.2023.11.29\03ceea0ec59f89c49ba4357a83738d9d.exe
"C:\Users\Admin\AppData\Local\Temp\VirusSign.2023.11.29\03ceea0ec59f89c49ba4357a83738d9d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\SysWOW64\Idcepgmg.exe
  C:\Windows\system32\Idcepgmg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\Ipjedh32.exe
    C:\Windows\system32\Ipjedh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\Ilccoh32.exe
      C:\Windows\system32\Ilccoh32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1464
      - C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:420
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        23⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        26⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        27⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        28⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        29⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        30⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        31⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        32⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        35⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        36⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        37⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        38⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:984
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        42⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2880
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        46⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        47⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2584
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        51⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        52⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        54⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        55⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        56⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        57⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        58⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        59⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        60⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1700
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        65⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        66⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        68⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        69⤵
        Drops file in System32 directory
        
        PID:2492
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        71⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        72⤵
        
        PID:732
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        73⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        74⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        75⤵
        Drops file in System32 directory
        
        PID:644
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        76⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1532
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        78⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        79⤵
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        81⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        82⤵
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        83⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        84⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        85⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:796
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        87⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        88⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        89⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        90⤵
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        91⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        92⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        93⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        94⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        95⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        96⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        98⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        99⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        101⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        102⤵
        
        PID:472
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        104⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        105⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        106⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        107⤵
        Drops file in System32 directory
        
        PID:2576
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        108⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        109⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        110⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        111⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        112⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        113⤵
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        114⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        116⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        119⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        120⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        121⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        122⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        123⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        124⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        125⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        127⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        128⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        130⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        131⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        132⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6020
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        135⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        137⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        138⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        139⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        140⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        142⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        144⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        145⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        146⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        148⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        149⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        151⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        152⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        153⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5328
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        155⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        156⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        157⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        158⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        159⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        160⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        161⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        162⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        163⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        164⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        165⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6124
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        167⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        168⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        169⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        170⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        171⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        172⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        173⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        176⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        177⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        178⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        179⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        180⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        182⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        183⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        184⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        185⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        187⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        188⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        189⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        191⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        192⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6952
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        195⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        198⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        199⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        200⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        201⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        203⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        204⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        205⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        206⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        207⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        210⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        211⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        212⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        213⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        214⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        215⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        216⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        217⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        218⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        220⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        221⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        222⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        225⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        226⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        227⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        228⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        229⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        231⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        232⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        233⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        234⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        235⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        236⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        237⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        238⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        239⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        240⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        241⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        242⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        243⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        244⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        245⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        246⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        247⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        248⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        249⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        250⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        251⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        252⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        254⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        255⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7900
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        257⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7972
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        259⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        260⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        261⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        262⤵
        System Location Discovery: System Language Discovery
        
        PID:8116
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        263⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        264⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        265⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        266⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        267⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        268⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        269⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        271⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:7716
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        274⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        275⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        278⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        279⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        280⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7228
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        282⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        283⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        284⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        285⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        286⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        287⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:8064
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        289⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        290⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        291⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        292⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        293⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7968
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        294⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        296⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        297⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        298⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        299⤵
        Drops file in System32 directory
        
        PID:8076
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        300⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        301⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        304⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        305⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        306⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        307⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        308⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        309⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        310⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        311⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        312⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        313⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        314⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        317⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        320⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        321⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        322⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        323⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        324⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        325⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        326⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        327⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        328⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        329⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8904
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        331⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        332⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        333⤵
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        334⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        335⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        336⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        337⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        339⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        340⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        341⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        342⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        343⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        344⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        346⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        347⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        348⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        349⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        350⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        351⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        352⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        353⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        354⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9452
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        356⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        358⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        360⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        361⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        362⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        363⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        364⤵
        System Location Discovery: System Language Discovery
        
        PID:9788
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        365⤵
        Drops file in System32 directory
        
        PID:9824
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        367⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        368⤵
        Modifies registry class
        
        PID:9936
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        369⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        370⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        371⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        372⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10136
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        374⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        375⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        376⤵
        Drops file in System32 directory
        
        PID:2532
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        377⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        378⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        379⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9484
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        381⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        382⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        383⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9764
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9832
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        386⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        387⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:10032
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        389⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        390⤵
        Drops file in System32 directory
        
        PID:10168
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        391⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        392⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        393⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9524
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        395⤵
        Drops file in System32 directory
        
        PID:9552
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        396⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        397⤵
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        398⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        399⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        400⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        401⤵
        System Location Discovery: System Language Discovery
        
        PID:656
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        402⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        403⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        404⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        405⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        406⤵
        Drops file in System32 directory
        
        PID:10116
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        407⤵
        Drops file in System32 directory
        
        PID:9312
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        409⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        410⤵
        Drops file in System32 directory
        
        PID:9368
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        411⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        412⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        413⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        414⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        415⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        416⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        417⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        418⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        419⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        420⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:10488
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        421⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        422⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        423⤵
        Drops file in System32 directory
        
        PID:10600
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        424⤵
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        425⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        426⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        427⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        428⤵
        Drops file in System32 directory
        
        PID:10784
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        429⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        430⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        431⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        432⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        433⤵
        Modifies registry class
        
        PID:10968
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11008
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        435⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        436⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        437⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        438⤵
        Modifies registry class
        
        PID:11156
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        439⤵
        System Location Discovery: System Language Discovery
        
        PID:11192
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        440⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        441⤵
        Modifies registry class
        
        PID:10224
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        442⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        443⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        444⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        445⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        446⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        447⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        448⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        449⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        450⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        451⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:10964
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        453⤵
        System Location Discovery: System Language Discovery
        
        PID:11028
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        454⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        455⤵
        System Location Discovery: System Language Discovery
        
        PID:11176
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        456⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        457⤵
        System Location Discovery: System Language Discovery
        
        PID:10288
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        458⤵
        Modifies registry class
        
        PID:10408
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        459⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10648
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        461⤵
        Drops file in System32 directory
        
        PID:10740
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        462⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10976
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        464⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        465⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        466⤵
        Modifies registry class
        
        PID:10320
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        467⤵
        System Location Discovery: System Language Discovery
        
        PID:10504
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        468⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        469⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        470⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        471⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10664
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        473⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        474⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        475⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        476⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        477⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        478⤵
        Modifies registry class
        
        PID:11296
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        479⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        480⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        481⤵
        Drops file in System32 directory
        
        PID:11404
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        482⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        483⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        484⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        485⤵
        Drops file in System32 directory
        
        PID:11548
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        486⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        487⤵
        Drops file in System32 directory
        
        PID:11620
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        488⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        489⤵
        Drops file in System32 directory
        
        PID:11692
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        490⤵
        Modifies registry class
        
        PID:11728
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        491⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        492⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        493⤵
        Drops file in System32 directory
        
        PID:11836
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        494⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        495⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        496⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        497⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        498⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        499⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        500⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        501⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        502⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12196
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        504⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        505⤵
        Drops file in System32 directory
        
        PID:12268
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        506⤵
        Drops file in System32 directory
        
        PID:11292
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        507⤵
        Modifies registry class
        
        PID:11360
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        508⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        509⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        510⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        511⤵
        Modifies registry class
        
        PID:11556
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        512⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        513⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        514⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        515⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        516⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        517⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        518⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        519⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        520⤵
        System Location Discovery: System Language Discovery
        
        PID:12008
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        521⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        522⤵
        Drops file in System32 directory
        
        PID:12108
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        523⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        524⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        525⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        526⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        527⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        528⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        529⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Gkoplk32.exe
        
        C:\Windows\system32\Gkoplk32.exe
        530⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        531⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        532⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        533⤵
        Modifies registry class
        
        PID:12120
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        534⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        535⤵
        Modifies registry class
        
        PID:11380
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        536⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        537⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Ggjjlk32.exe
        
        C:\Windows\system32\Ggjjlk32.exe
        538⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        539⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        540⤵
        System Location Discovery: System Language Discovery
        
        PID:12276
        
        C:\Windows\SysWOW64\Gglfbkin.exe
        
        C:\Windows\system32\Gglfbkin.exe
        541⤵
        Drops file in System32 directory
        
        PID:12152
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        542⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        543⤵
        Modifies registry class
        
        PID:12348
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        544⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        545⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12404
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        546⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:12460
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        548⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        549⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        550⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12572
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        552⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        553⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        554⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        555⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        556⤵
        System Location Discovery: System Language Discovery
        
        PID:12716
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        557⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Icogcjde.exe
        
        C:\Windows\system32\Icogcjde.exe
        558⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        559⤵
        System Location Discovery: System Language Discovery
        
        PID:12808
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        560⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12864
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        562⤵
        System Location Discovery: System Language Discovery
        
        PID:12892
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        563⤵
        System Location Discovery: System Language Discovery
        
        PID:12920
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        564⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12948
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        565⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        566⤵
        Drops file in System32 directory
        
        PID:13004
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        567⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        568⤵
        Modifies registry class
        
        PID:13060
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13088
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        570⤵
        Modifies registry class
        
        PID:13116
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        571⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13172
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        573⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        574⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        575⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        576⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        577⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12428
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        579⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        580⤵
        Drops file in System32 directory
        
        PID:12568
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        581⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        582⤵
        Drops file in System32 directory
        
        PID:12696
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        583⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        584⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12884
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        586⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        587⤵
        System Location Discovery: System Language Discovery
        
        PID:13012
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        588⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        589⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        590⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        591⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8604
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        592⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        593⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:12328
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        594⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        595⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        596⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        597⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1092
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        599⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        600⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        601⤵
        Drops file in System32 directory
        
        PID:13152
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        602⤵
        Drops file in System32 directory
        
        PID:13256
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        603⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        604⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        605⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        606⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        607⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        608⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        609⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        610⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        611⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        612⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12484 -s 436
        613⤵
        Program crash
        
        PID:4140

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0Y1NjJBNkMtMkUzRi00NzI5LUFGMDgtMTU3QkJFRUYyMTFFfSIgdXNlcmlkPSJ7RTg1QjIwQjItNkUwNy00RDBDLUJENjEtNDdBNDYyOERDOEU0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MkM2Q0Q2N0MtMEMyOC00QUJCLTkyQUMtQzBFMTEzMzVEQTUyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NDQ4IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NDg5OTIwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEzNjIzNTkwOSIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 12484 -ip 12484
1⤵
PID:460

C:\Program Files\Mozilla Firefox\private_browsing.exe
"C:\Program Files\Mozilla Firefox\private_browsing.exe"
1⤵
PID:11420
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
  2⤵
  PID:14016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:10260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1916 -prefsLen 27207 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbc43543-6d17-4e9e-a909-8cfcffa291d8} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" gpu
      4⤵
      PID:14064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 27243 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddee8382-79a3-4d26-ad8c-9fae83436733} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" socket
      4⤵
      PID:11220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2876 -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3044 -prefsLen 28192 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcccc50f-af16-4209-ae8e-a0b81f8029dd} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" tab
      4⤵
      PID:10352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3812 -childID 2 -isForBrowser -prefsHandle 3800 -prefMapHandle 3796 -prefsLen 32541 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93232e90-7de7-42dc-84fa-6d34a03552f2} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" tab
      4⤵
      PID:10760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5116 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5044 -prefMapHandle 5052 -prefsLen 32597 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5196c828-f668-4994-8002-37d2a667e322} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" utility
      4⤵
      Checks processor information in registry
      PID:10148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 4784 -prefsLen 27010 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c06ad420-0618-45e3-8f3a-d6075f8fde90} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" tab
      4⤵
      PID:9576
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 27010 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d30dbb6-cab4-4992-8a8a-3f3ac09a8a06} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" tab
      4⤵
      PID:13372
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5728 -prefsLen 27010 -prefMapSize 244658 -jsInitHandle 1188 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b4c8c44-3820-4370-a0df-d2e276e74f2f} 10260 "\\.\pipe\gecko-crash-server-pipe.10260" tab
      4⤵
      PID:9748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
PID:9432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0he194a1.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
9620f1968d51752e664ef6abffc732a7

SHA1
c8ea36a382df44ae8fe0b737f8d3f585ecacf707

SHA256
2c583bc8b529942519a0de07c0741382dba880778959aa956f5e5f3e6858196a

SHA512
3441fc2231a4eabc0ef1ab59b04a55c31949668557e9d89cdd738332df8bc74f0c458a33e55eb0035696db09f4018cfc3a446f2587de4b6665f636768b78c5e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
db0873f154beffa94875c51f8b4bab92

SHA1
25dc0981c08448f65b4efb601aaefaa9c5391576

SHA256
20cb1d21e23c6e90d6da049b6daea83f7481928c144f387c561067ce4f023a85

SHA512
09aaac3b65f0c331af2084aae2820725c5c5846eea1c1a06cea9777e4123ea35b6cca0f76d266beb365cf3d540e462f6a90097dc8e3b48e573764718d43d2b1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a0acbda04e9a1daffcce4eba2dec9f57

SHA1
52f3e34a2d986a5accbd179502f6ea4b0294e6be

SHA256
cfeb8e68e54f016f26c661205e54192a3f8975213eecc20393381a711ecef1f8

SHA512
8e1c41c17375403417a7d346f835d8452e03b11e306eb07ae26d3a07ab62c009cd1b61535904a0a97e5af6961a9a8340c897a994bbd8a56a1f8b80f6de618a39

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\datareporting\glean\pending_pings\14bb5363-ceb8-4d0c-9be6-9b4326d7ec2b

Filesize
671B

MD5
917edfbccc33b724b3b7400528b23767

SHA1
e361c4d629a3d2ff011adfb0aca2f48bf77f90cd

SHA256
c3615532d5aee2e998d858387001dbb6a410f526f71ad9c62e182481f2006ba5

SHA512
e067a687a5868714be0efd8209abe16b58ad14765e2ffc04aa5635ff7a7e9c0e34bbf7f6ca3ead9c9fc14d351e6c3065cbb913cf41b06d7f43c563d9b495471d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\datareporting\glean\pending_pings\25119c62-f516-4e82-aeff-74424f25f2ad

Filesize
26KB

MD5
2d20970651d43e24e126ec1501a7b215

SHA1
a3ec4a30b836dbbc74b24ed65083a424a8b7c464

SHA256
72b35ff27152b321a24adaaceaf7588227bc49427ec133c00f080de4fc7fbccb

SHA512
749723372931cb82217771161b5e06de872b7662c70537af8c140430b051eaffab609bb901834a95dabb1278314a882ab4a76c551730d2d64961bfd4762645f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\datareporting\glean\pending_pings\4fbb6a42-9d0f-4e1d-8586-a75d65e7a0f9

Filesize
982B

MD5
947a1bc8c2ad64163024e5104fb6ffad

SHA1
731bccd389840fff25712bed7ee96696e7e7a3f1

SHA256
936b023139d272a048d0b5129265fe080634cfaa230d6e7bb5612259013ccf25

SHA512
098bad425e6677e95c99dc143d316c4c9b1202a1646e8b6e2eb1d8ee8f9fd9ca73de9af808f1da9ad0155ef63c483a975498d4315e077dbf70bf7101e03cae50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\prefs.js

Filesize
10KB

MD5
c25f172919b61e6476a31338f79ba8ae

SHA1
5b7824a9f0fdfd18475ffac5040999d88d293624

SHA256
3f35ab7b934edb76fe3f233d3b03da8c2b96644e7abef7db3a720740cfd0c460

SHA512
69a14a2c9371c5aecffde78592f76b1f11a723f5e519c41c28ad3262a82d3e3b4647da34c1c98c68b7c40021feb3b3fc7f8a6562573a57bda3adc60f722d8611

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0he194a1.default-release\prefs.js

Filesize
9KB

MD5
b64f7d3912dbd14a2e72462a51688906

SHA1
e52b144cc54df769e62c445929d4a21177c5f263

SHA256
1ded01796e40273457ff86681f19ee942fdc68ac72d0bc13bc2b4b4b4372eae6

SHA512
5c13e6c9164ea75e2f358871815e8126fb0024d01a7b14c849164070becf5ce3b199103b79fd3bcd79bc33aa5079ad9e8358aca5b0a0f467c819bb3f0fa33094

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
C:\Windows\SysWOW64\Aafemk32.exe

Filesize
1.9MB

MD5
f7e3b23b7b5dfd3fbe7cf50d6c876310

SHA1
7ce8c5cf23cbf14454082b414bf2838702a811bc

SHA256
c6ff304c9162b350ca81fd76b1a344118d679735ed3b6700c4021acc1fe1200a

SHA512
fa8f1acf763f5041262d4a19ebb39748315a92848a314a0d54b4ab16f9283e8c2c18b277e7fadd205c38786c7a4daea966fec30409a90c5534688a08b1dda521

Download Submit
C:\Windows\SysWOW64\Aaohcj32.exe

Filesize
1.9MB

MD5
8be209899ee9d67c08b8776e3411bb37

SHA1
6d8450bad686b5b0be3041c3b5e1c2ff039a65d0

SHA256
8666ac64c1ea22686c51ff25edaa3a1bdd7fe1d3e55f69873fdf36d0c90c42b5

SHA512
1143e8bf9470a94d5797ccbbbb72e64da683234313952cdef83d8888703df7ccff9eb4b91b63a20b4020b70208817dd147c02b2866f3cc3a8df4f4c95e7ae1ba

Download Submit
C:\Windows\SysWOW64\Aednci32.exe

Filesize
1.9MB

MD5
71a20313ff493d3ba6395b968d8a79e3

SHA1
6f062fd4f3e6a995803504a5f0b1fdac470a8614

SHA256
97f54696d046332e3d88266bf522cb8d828b4d49d3b2cf85c1d748cd0c3c6cc4

SHA512
72ef3248a99418014c9614ba4ae89a6e307367a4e90197cf1cd375427d2a0f0c05901f1f98db71cc2bf2c62fee4449f2e692842bd2f974114e7452f56ce04a7b

Download Submit
C:\Windows\SysWOW64\Akepfpcl.exe

Filesize
1.9MB

MD5
e44f4f3c2b47709c1a3f9790afe652e0

SHA1
690d3fa11c7a767722af8c3d514c221fd381aa85

SHA256
52b711e9b298042ed39292d17cec948e068a7d68ad9db060f2f657d8346a1401

SHA512
77f85951dc1ba8c60ef410668b96647fad61a4415b01a82687a0023d01d752fe62a3228c59cafba7cf688bf6d3963faa99361fee61818906836eb3926f744baf

Download Submit
C:\Windows\SysWOW64\Idcepgmg.exe

Filesize
1.9MB

MD5
ec29d861d5417fd9b15d2455d9605ffb

SHA1
d958d2cbaf15467394bbfc1031ded7d63897802a

SHA256
1bc717c478a5ce10e100fb03cf755598380d3252af6193cc3c4c35aa588d987a

SHA512
86782b08495b202853761a1fe3cd295b7fbd18a8b6358d2a7f5f5fbfd936d6b487aa92ed471a19867504165e8337b40e3f71b97a30b811b896b43b13b78e10c4

Download Submit
C:\Windows\SysWOW64\Ilccoh32.exe

Filesize
1.9MB

MD5
7aada98da1b37b8d088b334e37129d18

SHA1
d3c0b77bbe792e45b6351ef7d49b1bffca4a9f1b

SHA256
007f791d9e939f1cab571776238c4aff79c834fe46ddd952fdae55dfbae9020f

SHA512
5135f1527efc996b26dba8f3e66e6534cd28c2a1ee062c57d68f7fc4a2570676d7f0ecf7a5a6e543ba4dbbec6d019d4a63c28782e60172bd5fd6897f1e0b25c1

Download Submit
C:\Windows\SysWOW64\Ipjedh32.exe

Filesize
1.9MB

MD5
29911e26cc8098862f0c9c13bb2eb2e9

SHA1
e7933443ed80dcad11561828e93403d3ebe5a562

SHA256
fd26637ffc8d964af68bc1b43b6c2ad72d9ff90e3283c3b1a14fad230a4ed09b

SHA512
1113f8147b1ce6b598f66d73a05db29e834a9c5d2ded7b2b8c33066655eae59571417eadf22670cd4ff59579637de79dd088a1814673628ef4c414e8d49ede07

Download Submit
C:\Windows\SysWOW64\Jcbdgb32.exe

Filesize
1.9MB

MD5
30b23719eda8f391f8465c24cb2c322b

SHA1
45511a537cf8c659c16f408a1c0817a1b15ae751

SHA256
88118576185e134a6cea41109f941b294c9718f4a0fbc88f58fc56b1eccbba7f

SHA512
c44294f44620e62e01e4e4360c684579d831e87730710087b6bc150b3bfd40d60cd8e29927b59ae82fb84203021b0f521b00bea4908d698812d1a8fbdc6a51c8

Download Submit
C:\Windows\SysWOW64\Jnjejjgh.exe

Filesize
1.9MB

MD5
ff33f71abc7e4c1f815009ebfde8c940

SHA1
6a57360364bf24dc4978b217a8dd70c26b9380b7

SHA256
7630e28a98caf89eb9de788ac91b40b977df966604fe86747ab43b0c71f958d6

SHA512
168ed11f7c6c12b714e376eec7cb87c651a1239e6241533f9a91d0ff3ce0a9d324d8ec298a7fdf9361dd326ee3cb4b36eb9dc87139ecdc1134847159c7dc5180

Download Submit
C:\Windows\SysWOW64\Kdmqmc32.exe

Filesize
1.9MB

MD5
20ed0d68a0d030ac7ab5a84650ce4bd4

SHA1
f1b3499f4d0f9bd231b00b0e934a899b6c8be4a0

SHA256
c93ebbb15a70f66024168ee7c0f068f8f89c1f80f8c4509b26e840bf7877428b

SHA512
813b536f8452450a80c8f71f931fb951f3285db19da515aab1e407a7dae874c61cd05b8f5c414154d51c61188d5c774a42bdeb4e256817cfbb7e05ab5af2671b

Download Submit
C:\Windows\SysWOW64\Kjccdkki.exe

Filesize
1.9MB

MD5
f1edc479204eb90d3ba47a111e65d8ba

SHA1
3624f01e54bfb7e0638f0e91c88b983d52c12c1c

SHA256
6d8f0822ccf098eb8af9400163713ba2ae53636df2554801a9685125f7fa41df

SHA512
77b340d455167c1e34b8525403adfefa4e101a9b056e90c68921f409139df4d581980fffa7b87f95791fa485b06f2f7e989bd76555203d295fc346dc1d74868f

Download Submit
C:\Windows\SysWOW64\Kqmkae32.exe

Filesize
1.9MB

MD5
f7e5e2d2ecfa1f484e726acfb74da67a

SHA1
c74ee1b3c2f346a393ca15a5810ad722676ef98a

SHA256
3359c5aabb420966fc30c6c249f95a6cbf0f9434182590d73abdbd49da4a9438

SHA512
cd23b039f069f16341cdbb415994e5b9f7b363586c09cd1729b1cc8595c9c333e7f4708b9671e89f6bc72546b2d7b7b559ebf5c2e0f4ad82eb5e278ebeb3e6cd

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
1.9MB

MD5
16b6f3bccb73ae863dab5ec43c43a6ee

SHA1
af1e6535065806975e1e6908afb72f58c4a561e6

SHA256
126175afaaf8b5b135a0182c7445b99c6695ecb9e48a50a848db4171c6c77290

SHA512
b8d1917527844b2ad08c88be3e5c1f070332fe1addd49ff2810edb6a43a297b3db7aeed4846752917cdd6782b5d30c6be38156301ad1ce2ec6ed4b2fe8b3733e

Download Submit
C:\Windows\SysWOW64\Lgqfdnah.exe

Filesize
1.9MB

MD5
8035d0602ad5bc8ed2dcb83b71fad58d

SHA1
4a604dc1473e4e45acd6180623582f263e3be36e

SHA256
6ae6ad2f21d14c6b37ed39ead08297d9474267a0d3a8ef663d0da138a2150b0c

SHA512
cc579e843437f8ce622eb35c450e28a1441ed3746f95aa95a0d94e591334fb4be2d6a2fda440bf6c2b15fb2d9908b041f9a6aa38575018a7d8fe761a670adfab

Download Submit
C:\Windows\SysWOW64\Ljaoeini.exe

Filesize
1.9MB

MD5
f0db666271494a4938ec2f19f1841a98

SHA1
e817af4d22d25fc54bbb1d0b523a704a27d28653

SHA256
cd90736252f72cacee28c85d77231a09fde27d785e6eb784e60f6932f96c6ab6

SHA512
cda9ed50de793617be01e7a251b8c424b179d5bb3a4ab71950fd425d03b831a076005cca2f7abfc861f88f6919a679877126b29f45bed57188684eeacdda13c8

Download Submit
C:\Windows\SysWOW64\Lqndhcdc.exe

Filesize
1.9MB

MD5
a81e2c2c917e42547e32ad463c8c03f9

SHA1
63a3c44a1b02d464741415fa7b6b64184ac67c8f

SHA256
ec4e039e132c47852e2ebc6189975627aae22133bafc5bc385e247f8007e9e06

SHA512
0615e963c64cd06593450513b6eb817d3cddcdffca6543dab28a24c2ee145832e2b0fa4d31fe707da42e1449960909ea659b403afb9451c94ee2598bce9fb765

Download Submit
C:\Windows\SysWOW64\Manmoq32.exe

Filesize
1.9MB

MD5
2831e8c25a913ac2a135c2bc85bfbae7

SHA1
1dfe1b02896a190bf5ff4169fb50c23cec6b22b3

SHA256
4e5f2cde77ee7f948fced18e1f14403729ddce967d88003a945fbca3f789f5be

SHA512
0369f121f940d9f047da87afca1366e836c084793931820fff7fa6c47e687998c9c190ba674957172c25d7f9a7ac2a340abba4a621cd52e52b3a260562925156

Download Submit
C:\Windows\SysWOW64\Mjahlgpf.exe

Filesize
1.9MB

MD5
50c1315418854e18cd9811bf0696b2e0

SHA1
98c6a5d9ce5835eb39b72923174da624c198923d

SHA256
c9c5d18288693094f175ad955f1e6f4e9a3c155f1d2cd973f075c69d594a87fe

SHA512
4250589db7488102c3e0cac253403b98c1f0164b0ca58bfcbbecdc266dace29ed04960751b3488852ee6b455ee6f414843581cd65f157343ab0b746d75d36dae

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
1.9MB

MD5
741dd787a0f24436fc9e6d8f381a4a5e

SHA1
7a2c309843a6c8b790a86e3be5440a17c72ec6fd

SHA256
1af92f2b08e9fb840ee8326963aef87e7c47f8a3a18cf6c0c37787a6e0f34518

SHA512
643a1ff7955affc300344cf4ec64d3e1687231f2e399cf18a852fc2facead7644358187b67cbd5663991be060333f31bad7e57703fa66349f7f235cfec7d6087

Download Submit
C:\Windows\SysWOW64\Mkadfj32.exe

Filesize
1.9MB

MD5
f0f010fcc7184f72cb6c20547d907d25

SHA1
72a7d13449a252da3b9f78767084b6659330e61c

SHA256
97b5a688e4ad84a46033b5944c60883bf5f5eedc4cfa9feb935e0d1bfd8813c0

SHA512
bb09800a7f6a7f8d57cba9987556d2e31b47411a93dc52302321665b048dae4eb1eebd899ad419f1675b4f2f75df8dd32e37b1bdf0c71f2e450f4e0e5b3d8b25

Download Submit
C:\Windows\SysWOW64\Mminhceb.exe

Filesize
1.9MB

MD5
f2005e11b020977c6178c7f9742231c4

SHA1
3ac309445579f371b06379d2394e39fc8897d099

SHA256
9bcb3f4e3ce54314e055ee652570d7e65c45fcdbced74402d6fd1089c3d4e5a8

SHA512
563c802366096a7434d07d78dec07b185817b42fca73f45836dc94a4f26210656410abe0f5f24e492c3d3750f79aa30b8ccb0f1f494cc75e60454f2449e73060

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
1.9MB

MD5
aacdc17af7a731fe3e5a4641d758a8ee

SHA1
7844a91b4cdaee5dcbc2f2719e024df0b27fb61c

SHA256
0d6e86ce37e03a7c81ae9c51bf90e42cc0f80452b10635fd6378d0fd91767f9d

SHA512
8e426f714937778d0bfeb1080be28bc925c927d5df6b426473801dc418164bbebd180b902f3d0c8d1db6e58ceb71f969aed00d87522bf3cee704edcba2cbb408

Download Submit
C:\Windows\SysWOW64\Nmlddqem.exe

Filesize
1.9MB

MD5
0e58258177c4aecd8c2c60dbac78f603

SHA1
ae47cdff6abad47b04e75f219e37dd54ce252170

SHA256
0ac519a8e164a11906dbdf3d59af2ddbcaf5444d16ad92030acf16bdd7caac92

SHA512
78d71d1c034763787b84e608cb0838052fa41ad96572a458f5e47ec7689b6c0701456e56f06a0c98cfb03f26035171ec40e50ff32c6a39ce3bf22d59aa98a31d

Download Submit
C:\Windows\SysWOW64\Odoogi32.exe

Filesize
1.9MB

MD5
42e2b662025ba9d7bbf6d39a55a055f1

SHA1
1ed998c0261b6645cedf8a146767de2d8feed3ee

SHA256
a6349e5b754d2f7b9e15abe9f1ac6020efca51b8f2270ca2ba470ea13ec672be

SHA512
1ca8045e1521c36fb30b541a1e6d1208a74b9713772dd0bf2a1be0b456fb8c33d15dc450396741978f5f16b656312ce293d70eb94b9897cefe17941b1b5a31ec

Download Submit
C:\Windows\SysWOW64\Okkdic32.exe

Filesize
1.9MB

MD5
bf44141cfaea6984e5b9e1ab1669992a

SHA1
8807e76e100421cf6ce89af85ae6b415044f5f24

SHA256
5898dd1fab71ab2a6541023117616b6c882cf09f8b6b2a17f51f2e15edc50f5a

SHA512
d60d5b624010de44403e689424c9b6a20087fcb5a1f483c77306d88c9bcc27e7f342bd2e5763f9a9d39b235a3e496f6b098d0b37b33bc0cf802e27c56d111302

Download Submit
C:\Windows\SysWOW64\Oloahhki.exe

Filesize
1.9MB

MD5
d5c4632f9e00fe3d5c15dd570f49a5d0

SHA1
23cf64aec8ae0b62470ce7badce4d1dcd0704bfa

SHA256
235bdffee27a6dd37b303ea88f831a74aee82c5b6618d63c2558c15da865f402

SHA512
8edcecb754811681baf715ebcec74358168fe1c4ea042be18d2a491152c328f36dc727e41c5a1960cb2852e8da8a3abf9e43890e88c300442b9c203e2e80f034

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
1.9MB

MD5
6d004044a789b750efeacaa9b5fddfa5

SHA1
1fc0c25bd980e9c2973e64d223bc2c45bc0ad37f

SHA256
b8f905eee7b437ca4682eef9a0eab070ea09f6a947a3549f3195c1064c80aba0

SHA512
98816b3ca5812f6c937c044536ca30efa67b6106466b9507d283070cfb1a553ecc1158eccc899126380407356fcebe36a9ae191c81c9ff73cf18482f7add82b5

Download Submit
C:\Windows\SysWOW64\Phfjcf32.exe

Filesize
1.9MB

MD5
f2fb332f9fa82722938fce93bb567340

SHA1
dd924db421c9f04ba1e723741a2cd88d723eed82

SHA256
3c5c5c9f240b4c7b7868d2c5d611aeaa8ee66462f9cc35fecada4c5c6f09af1d

SHA512
6ed9f2fce84206e5ad73d6aef034c1349914eed1c9e03576b282d86bdd3e1aca46c428d71d5024b1b9edd795cb575194a03d6801abf6d3ce48d1d4cd879ff39b

Download Submit
C:\Windows\SysWOW64\Pkpmdbfd.exe

Filesize
1.9MB

MD5
d1bd9084f403d9ea5bccf0734c6c55ab

SHA1
c2aba7faf2a91f65ee32f5c5ecb332363ffa5996

SHA256
5178851368a9d5177e01fd37070d3a57bebaf190321924d5d23435984023431c

SHA512
570bf56c4d4bd89c3badb634e042cb4cc697ccca0ea5506921bbd1d25fcbfaeff229c48f62d3fd92333da47cbc17b762a13b43dbaf28ab681f26be8ecf2464e2

Download Submit
C:\Windows\SysWOW64\Pocpfphe.exe

Filesize
1.9MB

MD5
e0bc816488061ec62574bb582ade215d

SHA1
e7adbb1968ac18bb6a229acc24afff0e6207ab3c

SHA256
37264fc81c20744e16f87544a1e224387b28b993cb3c47ccda42a0dc94fd4c08

SHA512
d0ea8c9638b5c05ecf96a5188bfaa88b2ef641118a0129d921f3df5ba949a299c53fae8926f3b06505b1b8e7ff927921bf2760d42701ba9bcb9391e81b35bbbf

Download Submit
C:\Windows\SysWOW64\Poimpapp.exe

Filesize
1.9MB

MD5
00ddcedcf7affc25b0304940941c38da

SHA1
4c9cc7ebb0bf69689f3c88d6e41ed408c0769225

SHA256
6e0fece8d10da8296b24b33cacd8dc381a805e61937416c9a8637f23dc71cc0e

SHA512
a319c80b3bc5ee164305b0707bff17bcbaa98dfc0a79a2203c2ace5bbdb37a83ca45397109ebb8a4ebf4ae76123d4925f07ce0479fe3d557c0e4651a784d6972

Download Submit
C:\Windows\SysWOW64\Qoelkp32.exe

Filesize
1.9MB

MD5
14b4d086638373586b8ad12d9a5594ae

SHA1
4c2c54d3859cee19a1dce3191ab4fb8ecd84afe2

SHA256
23a9bf99328c6dda0fe4503fd8ef0445effa306920a129acfd8a3b503784afe9

SHA512
80f938b0baa90fa61fee1ac4a6749edceab74d07c929eedfb604bd220d39ae8346d8f039f85e59b099226f08d0b8caf2f0d125b82684ff423b7787c63fde8a9a

Download Submit
memory/404-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/420-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/652-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/732-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/796-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/816-37-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/816-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/940-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1068-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1176-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1180-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1324-416-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1400-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1584-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1588-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1700-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2056-108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2084-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2284-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2392-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2432-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2584-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2608-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2668-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2764-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2764-30-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2784-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2880-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2972-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3020-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3224-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-60-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3364-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3368-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3424-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3424-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3552-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3712-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3720-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3904-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-103-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4016-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4108-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4272-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-84-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4452-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4460-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4464-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4468-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4524-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4828-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads