berbew | 3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2N.exe
Size

60KB
MD5

5a3262c25db9b6ac0f01153294b61690
SHA1

ba85d22e37b7247364e0d8b108e01045f8f16489
SHA256

3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2
SHA512

000cc43521f699282b645ae8f74b343830b0cdb1812a7828e8ef02dfd910996641590ac05fedadcb10d127b9362504c12491cfae1d792cb574c644988de3977a
SSDEEP

1536:DkvHEd9speAzi0LgfkSDnJJzfjZTPdJB86l1r:wzi98qJJJTPXB86l1r

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbkqfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcain32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aonhghjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemqih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkaobnio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhdgpii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bllbaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondljl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmimai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hipmfjee.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoclopne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipjoja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkokcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fefedmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgmjmjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbpjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbpajgmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpiecd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiaael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aehgnied.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilcldb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpaekqhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocjoadei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgcbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fechomko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgiiiidd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmlkhofd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmkqpkla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anobgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmmeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efeihb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoideh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjjbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblbca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoja32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4704	Anobgl32.exe
3908	Adikdfna.exe
5096	Akccap32.exe
2996	Anaomkdb.exe
4696	Aehgnied.exe
3576	Akepfpcl.exe
1052	Anclbkbp.exe
2868	Aekddhcb.exe
2212	Akglloai.exe
2036	Bemqih32.exe
1204	Blgifbil.exe
2616	Bepmoh32.exe
4720	Bklfgo32.exe
1636	Bebjdgmj.exe
1724	Bllbaa32.exe
2628	Bahkih32.exe
2540	Bkaobnio.exe
4680	Bdickcpo.exe
3864	Cnahdi32.exe
3604	Chglab32.exe
836	Ckeimm32.exe
1956	Cbpajgmf.exe
372	Cleegp32.exe
1000	Cnfaohbj.exe
1616	Cdpjlb32.exe
4268	Ckjbhmad.exe
1536	Cbdjeg32.exe
2476	Chnbbqpn.exe
392	Cohkokgj.exe
1916	Dmlkhofd.exe
1840	Dkokcl32.exe
3676	Ddgplado.exe
2792	Dhclmp32.exe
4276	Dbkqfe32.exe
1048	Dnbakghm.exe
872	Ddligq32.exe
3812	Dmcain32.exe
4256	Dflfac32.exe
1924	Dmennnni.exe
628	Dngjff32.exe
4220	Deqcbpld.exe
3444	Eiokinbk.exe
2796	Eoideh32.exe
1176	Efblbbqd.exe
2992	Efeihb32.exe
1588	Ekaapi32.exe
2896	Eejeiocj.exe
4764	Enbjad32.exe
3472	Fmcjpl32.exe
4868	Fflohaij.exe
1172	Fbbpmb32.exe
4012	Fimhjl32.exe
1336	Fpgpgfmh.exe
2728	Fechomko.exe
2984	Fiodpl32.exe
4936	Fmkqpkla.exe
1120	Fbgihaji.exe
4508	Fefedmil.exe
3608	Fiaael32.exe
4664	Flpmagqi.exe
3976	Fnnjmbpm.exe
3092	Gfeaopqo.exe
3356	Gidnkkpc.exe
1548	Glbjggof.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gemkelcd.exe	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Ilmjim32.dll	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Hfjdqmng.exe	Hoclopne.exe
File created	C:\Windows\SysWOW64\Ljeafb32.exe	Ljceqb32.exe
File created	C:\Windows\SysWOW64\Dkodcb32.dll	Mnhdgpii.exe
File opened for modification	C:\Windows\SysWOW64\Jinboekc.exe	Jcdjbk32.exe
File created	C:\Windows\SysWOW64\Mcbpjg32.exe	Mjjkaabc.exe
File created	C:\Windows\SysWOW64\Qaqegecm.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Chnpamkc.dll	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Jhijep32.dll	Cpfcfmlp.exe
File opened for modification	C:\Windows\SysWOW64\Dhclmp32.exe	Ddgplado.exe
File created	C:\Windows\SysWOW64\Hlpfhe32.exe	Hfcnpn32.exe
File created	C:\Windows\SysWOW64\Joahqn32.exe	Ilcldb32.exe
File created	C:\Windows\SysWOW64\Jcleff32.dll	Ngjkfd32.exe
File created	C:\Windows\SysWOW64\Phcgcqab.exe	Paiogf32.exe
File created	C:\Windows\SysWOW64\Baannc32.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Hbobifpp.dll	Cdkifmjq.exe
File created	C:\Windows\SysWOW64\Ekaapi32.exe	Efeihb32.exe
File opened for modification	C:\Windows\SysWOW64\Gppcmeem.exe	Gifkpknp.exe
File created	C:\Windows\SysWOW64\Kghfphob.dll	Joahqn32.exe
File created	C:\Windows\SysWOW64\Cpkgohbq.dll	Adcjop32.exe
File created	C:\Windows\SysWOW64\Apmhiq32.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Boihcf32.exe	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Bmaioi32.dll	Dmcain32.exe
File created	C:\Windows\SysWOW64\Accimdgp.dll	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Nkbjmj32.dll	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Bdmlme32.dll	Mqimikfj.exe
File opened for modification	C:\Windows\SysWOW64\Opqofe32.exe	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Bklomh32.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Gmimai32.exe	Geaepk32.exe
File created	C:\Windows\SysWOW64\Kckqbj32.exe	Klahfp32.exe
File created	C:\Windows\SysWOW64\Jcdjbk32.exe	Jpenfp32.exe
File created	C:\Windows\SysWOW64\Mfcjqc32.dll	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Akepfpcl.exe	Aehgnied.exe
File created	C:\Windows\SysWOW64\Cdpjlb32.exe	Cnfaohbj.exe
File opened for modification	C:\Windows\SysWOW64\Cdpjlb32.exe	Cnfaohbj.exe
File created	C:\Windows\SysWOW64\Iikikigb.dll	Cbdjeg32.exe
File created	C:\Windows\SysWOW64\Fiaael32.exe	Fefedmil.exe
File opened for modification	C:\Windows\SysWOW64\Jcmdaljn.exe	Joahqn32.exe
File opened for modification	C:\Windows\SysWOW64\Mcgiefen.exe	Mqimikfj.exe
File opened for modification	C:\Windows\SysWOW64\Ngndaccj.exe	Nmipdk32.exe
File created	C:\Windows\SysWOW64\Dgeaknci.dll	Amnlme32.exe
File created	C:\Windows\SysWOW64\Aekddhcb.exe	Anclbkbp.exe
File opened for modification	C:\Windows\SysWOW64\Gemkelcd.exe	Gfjkjo32.exe
File opened for modification	C:\Windows\SysWOW64\Mjlhgaqp.exe	Mcbpjg32.exe
File created	C:\Windows\SysWOW64\Baiinofi.dll	Ngndaccj.exe
File opened for modification	C:\Windows\SysWOW64\Ddgibkpc.exe	Dnmaea32.exe
File created	C:\Windows\SysWOW64\Dmennnni.exe	Dflfac32.exe
File opened for modification	C:\Windows\SysWOW64\Fmcjpl32.exe	Enbjad32.exe
File created	C:\Windows\SysWOW64\Ppihoe32.dll	Gmimai32.exe
File created	C:\Windows\SysWOW64\Bnnkgo32.dll	Kpoalo32.exe
File created	C:\Windows\SysWOW64\Gikgni32.dll	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Jilpfgkh.dll	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Lpamfo32.dll	Aekddhcb.exe
File opened for modification	C:\Windows\SysWOW64\Hedafk32.exe	Gbeejp32.exe
File created	C:\Windows\SysWOW64\Difebl32.dll	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Pmblagmf.exe	Pfiddm32.exe
File opened for modification	C:\Windows\SysWOW64\Cogddd32.exe	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Iikmbh32.exe	Ibaeen32.exe
File created	C:\Windows\SysWOW64\Cfidbo32.dll	Ipjoja32.exe
File opened for modification	C:\Windows\SysWOW64\Lgdidgjg.exe	Llodgnja.exe
File created	C:\Windows\SysWOW64\Jkmmde32.dll	Boihcf32.exe
File created	C:\Windows\SysWOW64\Cogddd32.exe	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Eoideh32.exe	Eiokinbk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7916	7792	WerFault.exe	325

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpgpgfmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdmmeo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpcdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfeaopqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kofkbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgbld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpoalo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgdidgjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgeakekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ondljl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akepfpcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anclbkbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkaobnio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cohkokgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oclkgccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmkqpkla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flpmagqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gemkelcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfjdqmng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggnadib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjbhmad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddligq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiodpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnlkedai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckeimm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpmnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnifekmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkqfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmennnni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hipmfjee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlepcdoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqbpojnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iohejo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnjgfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljeafb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfohgqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glgcbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlpfhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoclopne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knqepc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adikdfna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbpajgmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iojbpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bepmoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fefedmil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnnjmbpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmimai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gblbca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmfplibd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hekgfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilcldb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemqih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deqcbpld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enbjad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glbjggof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqfpckhm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobifpp.dll"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckjbhmad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkmlmnl.dll"	Gblbca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdbeojmh.dll"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gahamgib.dll"	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olieecnn.dll"	Jcdjbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqimikfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkgdfb32.dll"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anobgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofpnmakg.dll"	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iedjmioj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Joahqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npldbgic.dll"	Mcbpjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccoecbmi.dll"	Baannc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgdidgjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcpcdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Didmdo32.dll"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifenan32.dll"	Jnlkedai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbpajgmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdjfee32.dll"	Efblbbqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmodnoo.dll"	Nfohgqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hegaehem.dll"	Bahkih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hipmfjee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knqepc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkogl32.dll"	Mcgiefen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfnba32.dll"	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpenfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggmkff32.dll"	Jpenfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfcjqc32.dll"	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Binlfp32.dll"	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qedegh32.dll"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnifpf32.dll"	Mgphpe32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 4704	1928	3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2N.exe	83
PID 1928 wrote to memory of 4704	1928	3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2N.exe	83
PID 1928 wrote to memory of 4704	1928	3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2N.exe	83
PID 4704 wrote to memory of 3908	4704	Anobgl32.exe	84
PID 4704 wrote to memory of 3908	4704	Anobgl32.exe	84
PID 4704 wrote to memory of 3908	4704	Anobgl32.exe	84
PID 3908 wrote to memory of 5096	3908	Adikdfna.exe	85
PID 3908 wrote to memory of 5096	3908	Adikdfna.exe	85
PID 3908 wrote to memory of 5096	3908	Adikdfna.exe	85
PID 5096 wrote to memory of 2996	5096	Akccap32.exe	86
PID 5096 wrote to memory of 2996	5096	Akccap32.exe	86
PID 5096 wrote to memory of 2996	5096	Akccap32.exe	86
PID 2996 wrote to memory of 4696	2996	Anaomkdb.exe	87
PID 2996 wrote to memory of 4696	2996	Anaomkdb.exe	87
PID 2996 wrote to memory of 4696	2996	Anaomkdb.exe	87
PID 4696 wrote to memory of 3576	4696	Aehgnied.exe	88
PID 4696 wrote to memory of 3576	4696	Aehgnied.exe	88
PID 4696 wrote to memory of 3576	4696	Aehgnied.exe	88
PID 3576 wrote to memory of 1052	3576	Akepfpcl.exe	89
PID 3576 wrote to memory of 1052	3576	Akepfpcl.exe	89
PID 3576 wrote to memory of 1052	3576	Akepfpcl.exe	89
PID 1052 wrote to memory of 2868	1052	Anclbkbp.exe	90
PID 1052 wrote to memory of 2868	1052	Anclbkbp.exe	90
PID 1052 wrote to memory of 2868	1052	Anclbkbp.exe	90
PID 2868 wrote to memory of 2212	2868	Aekddhcb.exe	91
PID 2868 wrote to memory of 2212	2868	Aekddhcb.exe	91
PID 2868 wrote to memory of 2212	2868	Aekddhcb.exe	91
PID 2212 wrote to memory of 2036	2212	Akglloai.exe	92
PID 2212 wrote to memory of 2036	2212	Akglloai.exe	92
PID 2212 wrote to memory of 2036	2212	Akglloai.exe	92
PID 2036 wrote to memory of 1204	2036	Bemqih32.exe	93
PID 2036 wrote to memory of 1204	2036	Bemqih32.exe	93
PID 2036 wrote to memory of 1204	2036	Bemqih32.exe	93
PID 1204 wrote to memory of 2616	1204	Blgifbil.exe	94
PID 1204 wrote to memory of 2616	1204	Blgifbil.exe	94
PID 1204 wrote to memory of 2616	1204	Blgifbil.exe	94
PID 2616 wrote to memory of 4720	2616	Bepmoh32.exe	95
PID 2616 wrote to memory of 4720	2616	Bepmoh32.exe	95
PID 2616 wrote to memory of 4720	2616	Bepmoh32.exe	95
PID 4720 wrote to memory of 1636	4720	Bklfgo32.exe	96
PID 4720 wrote to memory of 1636	4720	Bklfgo32.exe	96
PID 4720 wrote to memory of 1636	4720	Bklfgo32.exe	96
PID 1636 wrote to memory of 1724	1636	Bebjdgmj.exe	97
PID 1636 wrote to memory of 1724	1636	Bebjdgmj.exe	97
PID 1636 wrote to memory of 1724	1636	Bebjdgmj.exe	97
PID 1724 wrote to memory of 2628	1724	Bllbaa32.exe	98
PID 1724 wrote to memory of 2628	1724	Bllbaa32.exe	98
PID 1724 wrote to memory of 2628	1724	Bllbaa32.exe	98
PID 2628 wrote to memory of 2540	2628	Bahkih32.exe	99
PID 2628 wrote to memory of 2540	2628	Bahkih32.exe	99
PID 2628 wrote to memory of 2540	2628	Bahkih32.exe	99
PID 2540 wrote to memory of 4680	2540	Bkaobnio.exe	100
PID 2540 wrote to memory of 4680	2540	Bkaobnio.exe	100
PID 2540 wrote to memory of 4680	2540	Bkaobnio.exe	100
PID 4680 wrote to memory of 3864	4680	Bdickcpo.exe	101
PID 4680 wrote to memory of 3864	4680	Bdickcpo.exe	101
PID 4680 wrote to memory of 3864	4680	Bdickcpo.exe	101
PID 3864 wrote to memory of 3604	3864	Cnahdi32.exe	102
PID 3864 wrote to memory of 3604	3864	Cnahdi32.exe	102
PID 3864 wrote to memory of 3604	3864	Cnahdi32.exe	102
PID 3604 wrote to memory of 836	3604	Chglab32.exe	103
PID 3604 wrote to memory of 836	3604	Chglab32.exe	103
PID 3604 wrote to memory of 836	3604	Chglab32.exe	103
PID 836 wrote to memory of 1956	836	Ckeimm32.exe	104

C:\Users\Admin\AppData\Local\Temp\3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2N.exe
"C:\Users\Admin\AppData\Local\Temp\3fadad85ffb7c19a2414bf820c73310af124a3c435666bc743a9656dd1a42dd2N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\Anobgl32.exe
  C:\Windows\system32\Anobgl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\Adikdfna.exe
    C:\Windows\system32\Adikdfna.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SysWOW64\Akccap32.exe
      C:\Windows\system32\Akccap32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2996
      - C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        26⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        29⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:392
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3676
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        34⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3812
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4256
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        41⤵
        Executes dropped EXE
        
        PID:628
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3444
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2992
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        50⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        51⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        52⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        53⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1336
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2728
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4936
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        58⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4508
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4664
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3976
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3092
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        64⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:60
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        68⤵
        Drops file in System32 directory
        
        PID:900
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:1044
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2932
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3460
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        75⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        76⤵
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        78⤵
        Drops file in System32 directory
        
        PID:4408
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        79⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3488
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        82⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        85⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        86⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2428
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        91⤵
        Drops file in System32 directory
        
        PID:4208
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        92⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        93⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        96⤵
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        97⤵
        Modifies registry class
        
        PID:4828
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3888
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        99⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        100⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4308
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        105⤵
        Drops file in System32 directory
        
        PID:2352
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        106⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1520
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        108⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        112⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        113⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        117⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        119⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        120⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        123⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        124⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        125⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5824
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        128⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        129⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        131⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        132⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        133⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        136⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        137⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        138⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        140⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        142⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        145⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        147⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        148⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        149⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        151⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        153⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        154⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        155⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        156⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        157⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        159⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        165⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        166⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        168⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        169⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6692
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        171⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        172⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        173⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        174⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        175⤵
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        177⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        179⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        180⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        181⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        183⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        184⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        185⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        186⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        187⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        188⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        189⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        190⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        191⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        194⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        195⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        196⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7152
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        198⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        203⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        208⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        209⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        210⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        211⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        212⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        214⤵
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        215⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        216⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        217⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        219⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        220⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        221⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7200
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        223⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        225⤵
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7376
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        228⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        230⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7616
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        232⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7704
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        234⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        235⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 400
        236⤵
        Program crash
        
        PID:7916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7792 -ip 7792
1⤵
PID:7872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adcjop32.exe

Filesize
60KB

MD5
fb8f4d610a12b219654ac439d91383a5

SHA1
ab82ff71c930b61bd22278e1da2f20f9a1ba0914

SHA256
2cb38387b0bd40ad0df7b19940cccada170f4db7e219094711ed56034b7ee47b

SHA512
5ace4eae4a85f613bd77e512ba17f2b9772fdd42f0bc093c761e8bc2706d34bd411551264b19445f6be0f1f392d68d19ceeaaf01e6beb7bc46d8a61f97a45248

Download Submit
C:\Windows\SysWOW64\Adikdfna.exe

Filesize
60KB

MD5
6c9a4ac30527b9cec8627b22255adcdb

SHA1
e439329f6efec2c2528ce52bcfe81a3894a03490

SHA256
1406eb8fcc46c79132792884e6160f7e50cbafb3d0c0cc5f2a06959da624eb60

SHA512
c99c244080ef05c534c39830c0afb59cb817ef85f0daaf82001b543844f918ee13a351733ee52b5abc411256bfef80feb0df1e57deb40a924394fcdfb390c634

Download Submit
C:\Windows\SysWOW64\Aehgnied.exe

Filesize
60KB

MD5
15a92a00fe3eedbe2bcedd48d6b68334

SHA1
6170ec596db66654246000fc502e6d648eb1aa12

SHA256
aedf1e2c475bf39e0e38a31e3e46e3b1af3ccc47f2f6ad8a4872e36dda286b7f

SHA512
e0d4be3ddd5fda966aa0ac54e23c38a8c863c4bfe7de9fc1e95deb7ebb1f99abcb427fd492a0b5c8bd0ad83397ed55dcdd186d142934ff4cbdf6c5ad7cf16de9

Download Submit
C:\Windows\SysWOW64\Aekddhcb.exe

Filesize
60KB

MD5
182103cbff5afceb6f05e9e4fa58ab08

SHA1
cb71b3e4b8f62549e26576a07217789c4546ff00

SHA256
2e5d2d4b167157f3e456c4416d010cf6c4e421fdb9f9799c415f02f562b2c346

SHA512
f26b4d923ca9d561dc3852d8a1a84e75442ada03cdb712d064cd9b330e4f563b7af8f6a515ea4b97868bab34a917149850c4d6a56df2c9521a8e2d384bec6e94

Download Submit
C:\Windows\SysWOW64\Akccap32.exe

Filesize
60KB

MD5
7ca61ad129dfe5b2fa122c1a24aeb893

SHA1
d1c6a4a74d4a8671b0c6153e0c402844475752c1

SHA256
384dd1943aca087de1d03b19caebccf6201c5a5e7312cba5a159f1a0d8cb3d87

SHA512
a18f20fe779d4539a36b12c346ee2c04f9609b44ed8ba111d8d4704a8fc4b921065ebfe242b4619ec58b4d004e64c0e372b8258c6d7f95f7d8551f2eb62435c3

Download Submit
C:\Windows\SysWOW64\Akepfpcl.exe

Filesize
60KB

MD5
208ce5cc8368e4d605610533176ec6a9

SHA1
64c8a1c0aaa2ea9e1050f566f43ff4c20867504e

SHA256
e1f546af00f3ee5a0e2902f1fa508f577b832742fea13f646d710f7e79710f11

SHA512
d2361cc432f8418afaa29e49a4185bcf81122e3a081f7cbc91dc1da641b924f0f4d4d9fcb6f7fae627beecc416b5c1b64846da268e848a8a45002b72b392190a

Download Submit
C:\Windows\SysWOW64\Akglloai.exe

Filesize
60KB

MD5
86842cfa134a4c42c5329f8ccca1bfa9

SHA1
5a3481a3360e01cc4890e3dc83b8eb5a270eb269

SHA256
c03f0545f032be2914c1aa8ad792f78565869460d266cb8a6154ba137659ebfa

SHA512
308397b344bf25b6b3b08e898d1bd1f50d36820587187c99f031515eb8b8981c3be9b582d09ed69efd361de49397450c48a99052bf3fdd4c1deeafebea1f2540

Download Submit
C:\Windows\SysWOW64\Anaomkdb.exe

Filesize
60KB

MD5
8d53cab50c672de2dd550e87c9a2000e

SHA1
8050c6c52871c2da994ff6143288e82b5a487abc

SHA256
30a847f5e0d3e71beb64da913987110f54add1258ced50aad0ddecb41d9719ce

SHA512
2cf14f69e3228619b3bba6338a450cb2a9defb823d72dd0394603b82ee69d45e301e56656d6dce70b1022c8105f1bef901076dca964310305bc142421db85192

Download Submit
C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
60KB

MD5
01a4c5fbaaf618d46c5c31a5fec25f09

SHA1
003c52711f31012f96d2241076168fb36da54e7b

SHA256
7d6fffbfa853b21b4119bd26609f4a4a2f8f521f25156c805bd7db3002310851

SHA512
3cf4021592714b6d7388a798b2940ef5a2958cc5f18601134fe16e87485f07c873f0ebd0d72d4f151f8134c8a7443eba29f19139b55fdb266cf56c90be9dd927

Download Submit
C:\Windows\SysWOW64\Anobgl32.exe

Filesize
60KB

MD5
312c7d81cf3bd20729fe81334e36aacf

SHA1
bb9f5681cbd026e11e58edffdeec58ff74645e56

SHA256
cc8db5ed04d214710478dcd50e912f54291fe3b8820426912eb9a2be34baacb1

SHA512
47dff510e3ddfd044beb6868b3df4b8692fa442ad8ca6721940a87615891a947fd26f5c9deb5c9102ae33879de846bc73473f5f91439d656ae734aa9480ea101

Download Submit
C:\Windows\SysWOW64\Apjkcadp.exe

Filesize
60KB

MD5
775e9f9b5471987e2cbbe5e10107a7e9

SHA1
9c2a59e3555821221042ddd2f598b06a43a6b01e

SHA256
f6ef3bfc9906e97e430acc94bec1c66ac31c4a4cc73bab1a0f459bd21a79c109

SHA512
4d480456757163ede4668b0236bdd00893d284758d1908a020a00576754dadc5ebcb081dc05059a3b34026daa03e177e14e4c15d687612d3a353b1d94af59902

Download Submit
C:\Windows\SysWOW64\Bahkih32.exe

Filesize
60KB

MD5
aa3bf897faecbe7ab525b8f3059cb53d

SHA1
320d0d464959db852ae95c2f9d5eecd740ba3194

SHA256
cba7f033aa1dc6167dc696b599646996a5be2fbf7fb2a067acf4c3edaad6e865

SHA512
0fa7709042df28a9d84ed5d26c606c4910304f59e945a54c7f7cf31991b0b3a36810a81ef39286f9ba1843bc0cf0d5c0f1d6524c7f33812648bbe2b802a19336

Download Submit
C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
60KB

MD5
ef80816e6150ac3e00f6f46d4b698ed9

SHA1
818f143a798b3f89bfb20d8253ab3e553b14404a

SHA256
2b59b95a38072bd0a0bcf7f6d55a45c567e37160be5a1f18544ffd95e93ae96a

SHA512
020d8f8597bc39bf336d770cd5ddcf46f1d3e2d06ad833b9fb4b1ef4874fb4abda458978d14876d1cedc65a87fe697443552b05a15a86821f2b464447acd4fc1

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
60KB

MD5
2658381855e865c366145b418bb3eabd

SHA1
071a1822b906dd5d92e687bc7518b2fc497f6f39

SHA256
aec1168cb558dfd067a204721d07329b7e418b6f64a3ec7b6e7155a4b1dac0fd

SHA512
d14523fc1b62eaad0444f73b846b504a7dea123505847bfcaef15a70b8f7168dbcdc81f39c20415a00cf9627a0efa253cabcae9ace630e51975b34ca326544de

Download Submit
C:\Windows\SysWOW64\Bebjdgmj.exe

Filesize
60KB

MD5
64f9e90eae2a82f287acb3b5d52a46a2

SHA1
d93c080f7c2a3eaf0a923f2bb91673871a53a73b

SHA256
5c82c479f4ad1a23d028186bafccd4b7ec7cf3713ab3983fd7d4931e8c694c9c

SHA512
139a64d99ac5f8226d16e665e1c2929e978363da6db17ab8c5ca6fcd018ac215be0fa7ba5d82ebf9809f47c0dcdfb0cad3849205645b52f05e4624ba6a0cc784

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
60KB

MD5
c4e945387011274e7927139ffd783dee

SHA1
8a9f8b17e545ebaede82a05b4ff649207b5ef42d

SHA256
b44f91fe73919da44c4978cfd06b3992ed14d4edae976591d7c0de0a6b6f1c53

SHA512
880b712c6e2ee50d9ec2416d9a18f253e8f117a701794802db2cacb26966f8eb1e90b8c54c54997ef74e226e4318d37a84d52acfd8de18152ec5db6ea847a093

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
60KB

MD5
57a8db86ef744ee83b86f87bb8891e5c

SHA1
01db754ff328fa83f0fa76fbba72d8a131fdb81b

SHA256
9c9543c6160dd2f0ab7a0c8e9a8c2de1e765b19357da0a09c8025f99da2635c1

SHA512
b455e97c6aaa271046fca6dfd3cb6b41352293b0df6c58d2d1ed51f4f959ce897dcd7ca9bba32c07f96fb7360065b9c38e2a20353897d3e900005c29aac5fe98

Download Submit
C:\Windows\SysWOW64\Bkaobnio.exe

Filesize
60KB

MD5
39f5306c0c5d1024f3dd5a915a0a884e

SHA1
62f289de21ebec42897087c16628a1e54b23637b

SHA256
ebf445420f8f214266e2d7770a72d6ba7c3c8fc82366c987795f4566e765c534

SHA512
091bd235e5191daf5daa2ed3bfea7edf66c655d23f9409697013ca2af280466970f33994b2a85780fa14c443f73eba72b25bce12e5d25458ab30382eff8a9666

Download Submit
C:\Windows\SysWOW64\Bklfgo32.exe

Filesize
60KB

MD5
65f2a1b5903c493dab1e871e074e2ff8

SHA1
a290339b55589532cf0bd8e55fca8dd01c8e83be

SHA256
934d8e6990f6e48f5fc754b57a4c0f6bd1ba7e5e85b1382089720af8fcaa28ca

SHA512
addbf3a1615a91e3909604cd685c5ed487348bf427b185ffba519b6b70df222fb57611f8c4cebaa19313e730086b7c8cd4a99d0134a5fee0095f0b9fc45c467b

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
60KB

MD5
9e1a3bfc9f90d573f61873808c79115a

SHA1
5ba01988af21082301bfa721375bf446abdf1a4a

SHA256
3f079370cc0a484e3b8a2f16e7270e467f4324c4dd9c3a0e6779c01522d13b8a

SHA512
dc55eccc25e30acc837218a0f0b3a97d921c9a3253334c2d90a858867eed053c69204ce3b3d649424cb5e1e75660554875fad91fa4627aa1d3dfff49ab3504cb

Download Submit
C:\Windows\SysWOW64\Blgifbil.exe

Filesize
60KB

MD5
ff24f9847aac7d54b3050cb9c8c4e322

SHA1
23645f83a63b52856f76fe1c141ca6353427e5de

SHA256
4a5d84cd4caba2fedc90d1b97005256d14d67ee87debb8008bd1079c43b72190

SHA512
827aca8548a6f1fd83f4859f902b5198a82c055c6e71cede530fb2fe69d252baca27132ed3b6ee754b3437d92609d68983035ea9be4df6ab703e625d30500419

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
60KB

MD5
9116e29a5bbaa7e3548a7b5270bf9bf5

SHA1
495784d3e47990fa0f83b6638fdd7759eedd2ec9

SHA256
a42066d4328b91e8d93f30a2c7cee3e93ce5aad5c1ad52ee229e64496d6267cd

SHA512
04d3ae6c20407875e313a27b54f4947982d7ea8adf24e7f2253731f96398eb25297cddf192218155f0fbf02488780f743a426885a543b0d01a3886b7285825ab

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
60KB

MD5
54b0f48ac516d9ddbb0f1a041b1785fe

SHA1
2e282b688fef3d3bfe7db75183a1942004f0a591

SHA256
5ee27fafdf991ad66137af5d1f5fe063675abc87afabe7e2cd2325437997b9b8

SHA512
d28a989f9c372d4104dd184e004e9712af60186e85419839186790a94011c17a2725b76f7cae0c0797ae5cdb0e78fe3c03ed4eb406aff24d1900a0ededbf5508

Download Submit
C:\Windows\SysWOW64\Cbdjeg32.exe

Filesize
60KB

MD5
f063120b08468b65b768b409ef8e9fa9

SHA1
76a2f2796cfddf7161075372b25a6ec05e76a650

SHA256
9201b172a439f4ede84ca10efefe8902028fa52d5c7d988ec9427a5cf779a4ec

SHA512
1333928c8718bddb882c57bf2019182e4052ee3e20c418d53d1dd90ac37df11039fbd7eecb5117a378812d36c220de5d78bc51ad02c639fdae9d5f807d351990

Download Submit
C:\Windows\SysWOW64\Cbpajgmf.exe

Filesize
60KB

MD5
afe3ecd78a368f4560798e03861f9ce6

SHA1
8cd15af6f6b218912d563560007315fb12f56bdf

SHA256
07d9a67224f7f23d7509022e908ef6fe616837197d8187c4ca15d55bc5768251

SHA512
b6a2f81f737ed2e0083737ac7682e259621e10d62780914faa6193d56f072df5844ef76d606ab2791e29f6e43869ea9b1151095dcf88e1e801760b6f85566c5f

Download Submit
C:\Windows\SysWOW64\Cdpjlb32.exe

Filesize
60KB

MD5
f611b88e9a843bfee23e0baa828792c0

SHA1
c1fdc2c71856ffda6fcd3048b505e4bf14c31ce8

SHA256
c723758c1434493bed28ef8a5ef83250e1b5e415238996eaf76272588ccae99d

SHA512
07d92cd3b89be0067203aa95f54c3e26943975e4291e41803b0e9ddfbd3d53c4d0b1992cafb27689d55dca0a3c08fb97242b238de31bd7f6758c7a30fee23fdb

Download Submit
C:\Windows\SysWOW64\Chglab32.exe

Filesize
60KB

MD5
25e8f7fed87a5de69250d28adff26fc9

SHA1
eb7bd2b700be8e2b53143988037d128dd036231e

SHA256
ddce9f18d30f1ae49ac4b491dcd650e5d0ebeb830dbfdfb4cf4ae2bb209ef2c7

SHA512
32cc6c62023cf78ac0e244f844d04c8cd7a90ad54beb7abc706f4cd5991f72fd7c4415a6480d050b9248756a62eaf4742b7cf4c63b5bdb117f785282cea5b182

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
60KB

MD5
faa6f17d5f36a8bc2269982e5b6f432f

SHA1
274313a0a921584d016431cc4bf5c666bc9de5c7

SHA256
7d6fc038599ea17010721c88187ae3019c0f4c3c51fce1fa7c3b6d32e7017e4c

SHA512
1499ced09cfb26e6130e899f019502cbafb49cc0ccbb34a85bee691009280b72a2bd1ff30cdadfd869bd421f2feb986365d4cf5093709b7bb192e9d1aca68eb5

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
60KB

MD5
e356143c1ba4148bbf53ffc4e74b1718

SHA1
e8430756fcc0cb04e1f7947b54432baffb85a59d

SHA256
8d13f21c2b827137f53c5fcd0f98757355fca44af131760fcb5186a09a80c38c

SHA512
d2da30b65dda760d5ff1c6f59ed6e00c73d61871aa6d00c8c1e0008deac4405a2983734c489e38a60f8c390a4e281b6817881b58f4749942937c1663c1e41116

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
60KB

MD5
618f4e0480c7b87adc3b5c5f7164884d

SHA1
a911db4d322fd826301eb3ce608253b954b89b10

SHA256
70b5570cd4ec0c96c7e61549bba29e01178d7b2b3d6ebeb8904145c990769881

SHA512
89b7b8b84a4a098a55c50fbb60f113b564490974a6036c712459adc301c0e2a5afdde6779136b2a246a4f105435ac5304beb53c4eebe178d740867ca5e7b0d87

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
60KB

MD5
883904b6730dfa58798a363cb326abe8

SHA1
b7c783931eb030f784343311bef698b47a424db9

SHA256
2b558ff0913696752bed625147e0213a18f1855f027305c174fd3b33094eddac

SHA512
c5f3b273c37b1c97dde7ca4d3418833758461b8be76a1a2b7ec487cf8c981f0eed34fa04e1b6fb3f32275f532576482913dbc2f32204f1877944973b51124282

Download Submit
C:\Windows\SysWOW64\Cnahdi32.exe

Filesize
60KB

MD5
f6e51039fecd10aaad2ff619fa8c970f

SHA1
8dc1460f4dbfd248da03d9f1a965695f76470220

SHA256
015872285f98d11e11a585dd86e0f87dae4d3067157d0554aa4f182031acc86d

SHA512
0ee40676b7b6a52077d8c4e8740b3fbc72d6a6f2400332d75adad6755d1139d35abc728b3bbf8c6bdfbb883858737b002b0802478a0aa5c638cff347affc173e

Download Submit
C:\Windows\SysWOW64\Cnfaohbj.exe

Filesize
60KB

MD5
a2c373d34c54690acd78909f06f4f06b

SHA1
715f03395fda6fb6fb33e17e4d99af2dfa8f0737

SHA256
672c9652ac8191560e1c3c799f78258ae61c5ea0a246329dac84da44432278a5

SHA512
7b923194e73ba4e93d0fba45f6ebabf63c2d73936a4007e3f2c395cfe50bb527a6a4e944dff60bc596dc8c51af62676de1b2eadd6d14c01fb9b262118adcb69f

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
60KB

MD5
c35ae5401ce52114e97cb04238e82984

SHA1
379217c0633a53062fcbe91b1055b271525cc8b8

SHA256
1d7bd426583c316518e44856178794641a07b10283baa05d2318dbf8f2f4b44e

SHA512
8f9a9c6d7767f7e3f9caca1fe6e93dc1767396284c782357ff8c159b6496c4a0b08aa9875e56ca3cbcf085e6c328ed40c1a212c1f8b8a4cb78ee626b1b24746a

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
60KB

MD5
88247ed458cc05fdc0e2a5d91019173e

SHA1
4023c85fd051832ae0be757e9ff9bcd00f629563

SHA256
08b632e834e947983ac2e7d60b6de19338b450d012afee23faca1c243e71315f

SHA512
dcde8cad2cb7a9710007a676c4f00b6f278624e098fdaa6171c79ece92d3eadf5615e41d9f73c4b3883fba5d8389500c86bd4c4a3ab7862f73d15aca3bd2414f

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
60KB

MD5
b9c87d7124f6966b0f1ec83dad5f57ee

SHA1
3a01bde5c13f62590c5ee3d90cf26e4f49e4903c

SHA256
6ca06478ffffc6b3cf0bf225abf1591ec64734c12b02982f850184ef3896baad

SHA512
8f30193d2b9fe30a5b8b005764fee17c886a7ffe158feca240871f271d03cf9740d77cbac33385add6b8735d75328d4a375d85d30100ab8a3a0eb1a79735ad24

Download Submit
C:\Windows\SysWOW64\Cpmapodj.exe

Filesize
60KB

MD5
b86e5956a7490f85c38aadf2e6de48fa

SHA1
83e739852cbc8c09b45914bbc236c575f61355ac

SHA256
b4bf2810ac8de0836cb38ca896111b61e5a47c3bb73de36bac6dba4abaf8ade5

SHA512
4a9650766e6a45b93f2d9d4327dfa6195aaf12109601190e8d96d53e3b200a5c5f04bdfd8bdc6c896a7ada4142d4102b1f37f59b869e434d50cfa28941f4df53

Download Submit
C:\Windows\SysWOW64\Ddgplado.exe

Filesize
60KB

MD5
4e51c8aaaceea7c85f1a093c7578d7e1

SHA1
d6d5d6dd0934e0d37e79ddd2f4455488a9ad0121

SHA256
f8d5bab388b3992ac9c365b0a2423b796b9915b19b63fea7d805d97c48f36c54

SHA512
510bb2600546f19eb696ad664c9bcbdec2a3d0860c1feeb8e5279440bf83d16ef08059e5211588072b451ee13589e4798c0b57cd9ab6332632730e2abee55e6b

Download Submit
C:\Windows\SysWOW64\Dkokcl32.exe

Filesize
60KB

MD5
02389c8e4dc030d744dd5fab4da01399

SHA1
0a54bbc111a79abcd1ea945454346f225826abf8

SHA256
8a362ebf17454c7aa7b372ae5121cfb1d6a39c9599bfe49bc7355934b0eadf3a

SHA512
9e15d07bc7dae7ed1e8ca639ae661c6ab89e1875795cfd17ed92cbfb18d4c3b62cc8b2e58f3a521eab31ff99cfadeb4933cd3c879f1557b3b0adad835845471b

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
60KB

MD5
880d55ece0414e972833e47ecca7551c

SHA1
29a2ebf98b0746e344cc558a3fe8ebc34d47a992

SHA256
0c298941fbcd6972078df0c2022e3adc4d077c502b96ce915493acc4f6790157

SHA512
8b298aa54e0983d679a87c2ef18277bd146608c49b8f217c5576adeb9a714da7d39db7d4a1dddbde561f48c078e410f5dff16c97f177c32b172390b88543ccd7

Download Submit
C:\Windows\SysWOW64\Efblbbqd.exe

Filesize
60KB

MD5
5f0c66b7627c7e43763e8e850e0a98bb

SHA1
d4cc32309ea5f8c47e48454e0434698920cf2dfe

SHA256
2c251500a99c966444edc33a237e117996436b0138d32fab078a9d82b918e5d1

SHA512
87d50dfbf8eae966813298e97e9c1ad43801009f887d950dae223aa8c93c4303adee9665f0fdd7b43b47fa2ff319a0215c12de3169d7eea2e6f8bd39720305d3

Download Submit
C:\Windows\SysWOW64\Fflohaij.exe

Filesize
60KB

MD5
b86e9a10eb7f23aea679a77d6a07074a

SHA1
e187b600089d347979c01d5b55b105b693e0a471

SHA256
1a210ceba6ed1c94e148c469e49edb74494ffcc5ed729b42d80facbf8279cd96

SHA512
e0f0f4f8a71141bdf2bc4c05e020377bce08ec62621479283a43b6a029b24bfca39aa4eb8d153a152b161725c1f4f3adf4c6775afffb9aaad262f4725e43799b

Download Submit
C:\Windows\SysWOW64\Fpgpgfmh.exe

Filesize
60KB

MD5
f04256fcf429b3a9296554308a083343

SHA1
50f4492ca15377a3d1d85dbc139bf916bdd0e0cd

SHA256
816d874e03d0581cb46a9906a8d21e004ec8210c7f6156b1e5e343fb6b91be8f

SHA512
3c46c6f6c1fb6727970fff496920c27f69647ce5de78f6fa6db2620f183bc7b8823986d010eb8d8be3a87bbfd72494ecd37198ba4e5dd6ddb315516a90b1e944

Download Submit
C:\Windows\SysWOW64\Gfjkjo32.exe

Filesize
60KB

MD5
e16ddfe07c7c2035a1ad670005568069

SHA1
dc00e8de2aeff7d938c472bf01196fd177f9e30d

SHA256
10716112060a10c534d6f98810c38465708c0664612339d464ffc23c96dce9f5

SHA512
0e78d84716aa3b088892eae2002b964fbd16329c977d20f042aa9f160af1be98f02ea5985b201ab1d88982129d06daf8b620b91e22420e2958052a7402004689

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
60KB

MD5
6db4a46d74d9fbfc013ebabfd2b12508

SHA1
31d9665d4c16f4a57e4383dfc879feedd9bf9912

SHA256
8d0ebc48e55d241587553e033afea4c09b5867c9e86c58baf84f4f058c420fc7

SHA512
3df3e2a68b4d6ce130870bffdaef116f9a4042d22ccdaeacd4348327e93fdf3cd33fb4bc672c3e24a340a110c72b46684438e81dbb4ab6ffc58ea8e32942a5d4

Download Submit
C:\Windows\SysWOW64\Gmimai32.exe

Filesize
60KB

MD5
14783e4fad6a4742935f88f84f1f9019

SHA1
cb3b3c3eb7f834d5b58f5a68fd3b9d9338b26592

SHA256
7431aba05e5b1e3f498d3e883832d752a224fdcac9086d9bbc8cf2d6947b087b

SHA512
a0aeb3443593b4c5701e48855af80b989080f560c9ce47fb9e34d44719ebc937f22c6c2ed52c5f889aa4434248b5a43391d6d1000cdddf26796d33ff9f1d9233

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
60KB

MD5
f2010e786e9e96952d0c5ad6b97a35ef

SHA1
0048c971bcd57c0cd615e4c2cef59fd546a3b0ae

SHA256
04064738439e439c3afbba523db309056fa32c59208fd7d709cb04372120013c

SHA512
8939fe4a408871b84a54248a23c6a85e5fb0db10f1e337718e541e776090903d0dff811945d09b497d997bee65f12f6dc1dd673a62646fe61830927e22220290

Download Submit
C:\Windows\SysWOW64\Hbhboolf.exe

Filesize
60KB

MD5
3824f544d2cab1bf4a513477cd523d9c

SHA1
776304dcafcbec5469aa8647cca4b8964beccf32

SHA256
1495d35ef2b1d1e03f7179e01e5e3da9c15010ea57db5fb7d897233a3c32edfd

SHA512
5f7d6ee1522652bec7c9ca8100f6f8ea8288412a5cc3d4d37c49823e1b30411f12b086226875d4b92e9963caca66a184ba5244208fd66b4efb8882385191168a

Download Submit
C:\Windows\SysWOW64\Hehkajig.exe

Filesize
60KB

MD5
bde2a6db217c92fe24916633c1098644

SHA1
3bbbd1635b983ff6c39191680f681c3b3366c2bd

SHA256
4dc424e87423e3e8a8f68d8a57e25908efe206f0fb69515e05fb76861d83a33c

SHA512
1aadbc75571620f094faed51774de56ddb2d11b714b6845a7716af797de81a51e1bc3b1d68db9a9a6c345d9fedd9523e6e9242bcd8529e41d8d03e5a0c031e94

Download Submit
C:\Windows\SysWOW64\Hoclopne.exe

Filesize
60KB

MD5
89eb793b4e42f0a07c8462f736b022c0

SHA1
596cb0f88cb5e3d4ac1682f87a4728f51cfd02aa

SHA256
79226c7befc009e4973fdc2cf7e168b38698521af6826983d497a0b4a31f45fc

SHA512
88e8425594c8c3679288b4dec0c4aa6e16cd5db6c7828ed33a230e732537262c0c32fdbb19b76e5dbb0d0b57216adb25665c0cf22eabed92b356eb4b261d6522

Download Submit
C:\Windows\SysWOW64\Imgicgca.exe

Filesize
60KB

MD5
e5b0fb86d41d99d6b71a4613453a64bb

SHA1
6a6f33f5210e3aab2bee33bd5bdbbff623f4e8fb

SHA256
0d658f89916e6b1ed38a1a6145ca484970b95f6b42f04eb677b6ceb22af9cdef

SHA512
2cea7fd7edb8d9ec9971e557858b72262b05b9e2151e1d33c7efede8f164ec189ae410120a78ba63e51da4e8637f4be5ff9d76922ae95c5b3efd6a4982ba6c2b

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
60KB

MD5
a5175725e3ae66d086505fc6368c923a

SHA1
899ef024a188618776891d82cdc70bce4d6551c3

SHA256
def845bf804c8f029df86ba1e60357f1cb3037ed503ea8bd69df051b4a4fcc2e

SHA512
907b0abf1612eeb5d0e899b7734dbecdeded2500ee5cc989ca66513f8c75599b8640d47d110f4501370ab993ce9dfa9e266504df438cdddbb94aa8cd163c054b

Download Submit
C:\Windows\SysWOW64\Jcmdaljn.exe

Filesize
60KB

MD5
825d74dc1bd842cb514f4178039bb119

SHA1
1ce0a0eedbb71767ac9db15f2e6c7f7865d648a9

SHA256
500bcb078d987f2e1c083e1293b4bd3fbea0210e677e9cfdd8b719a32c04b887

SHA512
b16413810cb06a1cc2f99ec42bf907669a8a606ab3c925be4ed849cfee81073a6c72d717cb5b1199e2e7d1ed9ec954ef2a55a41fecc85fc003efa248f84b4165

Download Submit
C:\Windows\SysWOW64\Jinboekc.exe

Filesize
60KB

MD5
c96edab6e2433a2641b9f620dbc22ba9

SHA1
19756daf589e91759ccb037b7401f3b142e88a41

SHA256
5332229a988d597681c48f81cf93dd285535beb206b0ccb6c09027d38e5a8efb

SHA512
d5cea93c849b486fd321d87f36f7d3ac6d04b62c8fb2af226334bbad44c9ce8abef760c9a010178c555f9f8ba2375ede3c651f847247ef500099b5077dc1bb3d

Download Submit
C:\Windows\SysWOW64\Kgnbdh32.exe

Filesize
60KB

MD5
07e1a866e2ff39641494157f63fbbe4a

SHA1
895828668ff881e562d55465ab6df5e32a1546aa

SHA256
a5d119ca99e1007d66554c39474ab9dd12f29a3626c74ec31d34aa8c660079d0

SHA512
cf67678bc89a80328337155795c7537ebf5e6873825e7a500ed691e9279738ebf728e20b4198ec2692dc7c5cae3b59c1c6eedf09ba10892ff3b1e425acc67650

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
60KB

MD5
629f484f26e798a7285562f71f0882e8

SHA1
d44184a4ba7cc1c70d021c71d1ec94429ec26fa3

SHA256
cce08abdd570192100f9b830224cb1dac820e813d89c2b97d503aee6aa83b73b

SHA512
43542e20ff337f4f8accbccc527d48eee9329719b6cfab8d91ff160fac59beee498a1880fc739d3b84aeb8f0d436040cba10ca0068dfe71b6358ef079afa6b58

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
60KB

MD5
57ea0045ea14ef522abba814767f0356

SHA1
9bd3f887a2f47ed06be49a2794f890b9c6d0e82a

SHA256
ca58c3b16f3ee4c3895e144e46ea326abfe0538d20eed2ad88e95596f0b5c9a7

SHA512
3028a6da0b67b8bb89c7ea3a5f7640e509657451fae2a4802ca7bd7d540d5cecd88b8a9f2605b88898d49596f435c679214abf5f05d13f6fff5ca9bd8b20711b

Download Submit
C:\Windows\SysWOW64\Kpoalo32.exe

Filesize
60KB

MD5
50ea3bf252511c39bfe42128be26229f

SHA1
2b4317f1cfd078e39db8afba59635d4bc6a45a79

SHA256
1f88863733a794464e821a6a3e508febff08e3da4962c884a46a65993577b421

SHA512
0faba37b825128a7f9b39e4024da24d1602cdbddcd28b3700471ca553d9d2aa54a8a03d94b1445c7b48ef08dbf26e5c20a19c09e5f15ada4e23305e821f49e0d

Download Submit
C:\Windows\SysWOW64\Ljeafb32.exe

Filesize
60KB

MD5
c622b6a39282d484f47b7b7b1e5d45e8

SHA1
17f578cc49c5f45a88179bd24b60e719c6dcb996

SHA256
0ae0f2893d71978eab31b92d6269f84919a4405ed59c693cf957f1968cc30c72

SHA512
52dbee7c9eecedf01a1e375db0114adc1f506096cb506d4f39d944080ecea6f3b203e2c9db9c7b68c03eabe88740e6d8958cb9de691a0f2632c2fad4e834eead

Download Submit
C:\Windows\SysWOW64\Ljqhkckn.exe

Filesize
60KB

MD5
d152e27fde1a8ccad5d4e32fc9692e52

SHA1
65ecea71468d016b50e31bcf6bf2c1f777ab2d8c

SHA256
b5b5bebaeb0f83ba26a11b8967db0dd8c516542f202399da38a9dad69da88eca

SHA512
4ffdade263fa33c1fa67bce1534d25dc4387cb66826ab9d8878e9c0e9436b917460b7d2795741120e318d1f49bc2a35f2f5c2e0a628e196af9621ba4b957cb71

Download Submit
C:\Windows\SysWOW64\Ngndaccj.exe

Filesize
60KB

MD5
4f8c413305d0de1d7e7f3494d40e9f92

SHA1
90b82816a1647a1545dc59df55ee74021394eb11

SHA256
96e6f9a629e243052744b738b3d281bf5f6537b22aea903610d92e947ce96b36

SHA512
f6311de2b7bf1f1d6adcad5b4d4fcb49ae385c1379245da4a6d18437e520703c207ef8dde50f0480a4dbe418f49864ac565f533163da07c489a66779ff552f2f

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
60KB

MD5
4a2278a4d416083d68183fc7f7d8ffc3

SHA1
41815c4f4b063a49daf7a520eb820ddedf293a02

SHA256
20b362bdbc50078eef7d4d6380fd1ebf4da9d18e06bf2928633ea97a108d2f32

SHA512
72eede640d30229708ae6cb7f205d0e0a5696bc5e0bb408e8a20f7b5ea0b50ffe6cd43cb3cf9875f0e6f640fa31e392c41e9b86faac06988363a2fdfa848844b

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
60KB

MD5
2c0cb38e9979f536a36330087c515940

SHA1
c8ead7ba374305a895c0b49c86a48808968990a6

SHA256
dc110ee301b18461a043463c0014df62d4f5d0d954c2224d024e6ed10f6eeac0

SHA512
acd0b49c8555ec409423175a3e8a921d780e99df222816f17d386ecf0801b433f32068e1ffe02eac6d7d8e884a586936347078f6e5776b6141ba07cfd1010a7b

Download Submit
C:\Windows\SysWOW64\Ocohmc32.exe

Filesize
60KB

MD5
c2b0c5769089d50db7ec8828d6ac998e

SHA1
d2fd1c588092c85f823664f6c1c3fafd009214a3

SHA256
db924b19c104b18be2245736bfbaf6bc81c972bcf98e15bf1493ff9298d04811

SHA512
92d860d6cfce5512d533ee060859cd7e738c5fce84d29e5c4a4aa12b95b73f026f1e5de75776c42f45a9a4adc3a1e17264a3970d827846c1086f4d186a2a68ea

Download Submit
C:\Windows\SysWOW64\Omdppiif.exe

Filesize
60KB

MD5
195e047d3eab7c2d53c34b2f4d95dea2

SHA1
c7b06e0ace3475515b63602e909e24b1f17e1824

SHA256
9e4307146b704420e707a08248fab9737440bc9b8819345aaff3c4b81c30493c

SHA512
84390624588c546afb9b07c1cb510fe4b673e2c102c0d68ff651cdbeeb93d1d7f3d52e2c622a52194ee76da49bf320507428c84f39baebd71bf408ae3855a85e

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
60KB

MD5
e1c70ba63efeec547d23dc9f04dbe9fb

SHA1
28b87f0f975b41b99f259751514a98426280a672

SHA256
0e4de3fbf5390e84d7739d3d7be0b44277a6cba568d771932cd07d9dbe9449d9

SHA512
fe64d4bb34310f61b8ffca6352ce31e35f096c415f1d78dd1cdb9cd246a178ff940c2d235fa6cf79de05932e479bee48ebbbbbcd959d69610ab720e6eb4097ac

Download Submit
C:\Windows\SysWOW64\Ompfej32.exe

Filesize
60KB

MD5
405b07c711dba6e1adf87abf56e44b53

SHA1
57a9954d49d7779a262f223d1a2c950eace1722d

SHA256
8958109e9b198e4bf15ae80aa8fcaeace6bd30c6aa67882b13c39c9f1e26db24

SHA512
554e83dd28e4bd2b98ba7fd2b293310f62a0d3cd5b9747759de2a37be54d70c22a0b8faa32e6c4bb20002e7f5eef7cbeb0916caf78c278efc378b1ed2ee0437e

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
60KB

MD5
3645d6af2d78e5657e941604a1e18000

SHA1
e3ee8345c5f9c0b49f42fc43fe3c43d87f48d0db

SHA256
ed958628044c63f9542114ec8e376cc487c8f71f6c37ddb09bb627db59946ca6

SHA512
52e52754e4337532d4285fd7308c7f48529ac2b849111363591bf551d53a751827ab42b57ce96dae2e08c43dba9b77ee65b4eff407846979b64047945f089dc0

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
60KB

MD5
262507dc035ce7095859d8488e76fd33

SHA1
8b20db3a21fefcecd2fcee1e473ec082b59be8b2

SHA256
faa23a333708ef5b9d2400439f36f23e24fe7c83d85dad81dba01e64fd1cc6ad

SHA512
1f673114b28fb3bbf555c6d02ce21ae644766f56ad7e3ce5589ad7321118976ad35359d7b945686c66f9797a9315a928685c2aed5668fb02e36a616e8425f54b

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
60KB

MD5
0da2626577d8e05e4ab9a1d44940dd77

SHA1
9281b9b8a2e28a32ab4a7e1af7962c69207e95f1

SHA256
2a28b6eb34b31e893724596221eae6e98e4eaaa11996405433aec844ca9fef45

SHA512
8606088bc7d5a518144b59d455d8254eced61994b498dd47d36b690719a9a12fa885d856f643ef65b7a81459276e3c3d41c2365b56496e6e1e3193d0425d15ec

Download Submit
C:\Windows\SysWOW64\Qhjmdp32.exe

Filesize
60KB

MD5
f7cb72872fcc2251f42c4f3611683d9f

SHA1
74a19b7d6be9749c517694987c831b6ce1a73628

SHA256
b9b0ca0801ee6208463b2a54a909e9c592dab82ea86ddd6e8c79a0fe41a8c20d

SHA512
fee45e28f79c2eff2b642e7ffc3814f691c43c18651cc9599d041f44cead8ab342119671b96c3639b8a3c8e3e973b3db14864f0688694e11b9b409e3c69de79a

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
60KB

MD5
f626ab1809d452f50f15664dbc75e13b

SHA1
d494b1eb7e31abf86a98b8d2ce07d5a2cf362c3a

SHA256
baa3d2aa08677346833dec1be7a2f5bea82ce18cce137b8b5f3a4898b567d83b

SHA512
85a9e8e7b108cde46b73299db22af878232040cbf84b4a97675dafb187bca014f40ad0d3cefbe642be98d7b5dcc9e2695c8cc5fffda68d5b992eb88be6a1aacb

Download Submit
memory/372-198-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/372-284-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/392-251-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/392-326-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/628-402-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/628-334-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/836-180-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/836-268-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/872-374-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/872-306-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1000-291-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1000-208-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1048-367-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1048-299-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1052-143-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1052-57-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1172-410-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1176-361-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1204-179-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1204-90-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1336-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1536-312-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1536-233-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-375-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1616-215-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1616-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1636-207-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1636-117-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1724-126-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1840-269-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1840-340-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1916-260-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1916-333-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1924-327-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1924-395-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1928-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1928-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1928-1-0x0000000000434000-0x0000000000435000-memory.dmp

Filesize
4KB

Download
memory/1956-282-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1956-190-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2036-81-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2036-170-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2212-161-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2212-74-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-243-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2476-319-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2540-232-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2540-144-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2616-188-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2616-99-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2628-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2628-223-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2792-353-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2792-285-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2796-423-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2796-354-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2868-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2868-152-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2896-382-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2992-368-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2996-116-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2996-33-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3444-416-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3444-347-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3472-396-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3576-48-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3576-135-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3604-259-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3604-171-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3812-381-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3812-313-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3864-162-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3864-250-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3908-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3908-98-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4012-417-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4220-341-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4220-409-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4256-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4256-320-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4268-224-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4268-305-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4276-292-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4276-360-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4680-153-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4680-242-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4696-41-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4696-125-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4704-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4704-89-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4720-197-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4720-108-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4764-389-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4868-403-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5096-25-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5096-107-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5172-1860-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6472-1756-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads