berbew | f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe
Size

395KB
MD5

0c495ea406a2fd18dd4a83fe050d3240
SHA1

d8f2d9240119711b448b6e11a5f2d784287739b7
SHA256

f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315
SHA512

c012f7cf74a7493fa396ec4d76b911dffe6ce953f4e6718babeb6de3787ca6110505552467af9c36a67d981a4eab8747c914434b0f3cc399f94a4501e5b65559
SSDEEP

6144:MrS6BCRs4y70u4HXs4yr0u490u4Ds4yvW8lM:Uxt4O0dHc4i0d90dA4P

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hckeoeno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpofii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofkgcobj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkdjfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lggldm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Najmjokc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbicpfdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnlkedai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipmbjgpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpdhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aolblopj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fechomko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipeeobbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Injmcmej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlfnaicd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icfekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knfeeimj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgccinoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpbflg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmbphg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibaeen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmnmgnoh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqknkedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjmfjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chglab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikmbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqdcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgjijmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijegcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmaffnce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igfclkdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmdemd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojbacd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkipkani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enigke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbjoeojc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmmqhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ponfka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phaahggp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aehgnied.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4444	Fpejlmcf.exe
852	Fbcfhibj.exe
5004	Fpjcgm32.exe
3620	Fdepgkgj.exe
4124	Ffclcgfn.exe
668	Fmndpq32.exe
1896	Fplpll32.exe
4452	Fdglmkeg.exe
1540	Fffhifdk.exe
4428	Fjadje32.exe
2992	Fmpqfq32.exe
3044	Gpnmbl32.exe
5060	Gdjibj32.exe
4484	Gbmingjo.exe
1244	Gjdaodja.exe
3612	Gmbmkpie.exe
1884	Glengm32.exe
3372	Gdlfhj32.exe
3024	Gbofcghl.exe
4252	Gjfnedho.exe
3548	Giinpa32.exe
3880	Glgjlm32.exe
4380	Gdobnj32.exe
620	Gbabigfj.exe
3020	Gkhkjd32.exe
4156	Gikkfqmf.exe
3960	Gljgbllj.exe
2452	Gpecbk32.exe
3376	Gbdoof32.exe
3628	Gfokoelp.exe
4072	Gkkgpc32.exe
3144	Gmiclo32.exe
4300	Gphphj32.exe
2404	Gbfldf32.exe
2300	Gkmdecbg.exe
3792	Gipdap32.exe
1576	Hloqml32.exe
4196	Hdehni32.exe
3948	Hbhijepa.exe
4320	Hkpqkcpd.exe
2356	Hmnmgnoh.exe
4176	Hplicjok.exe
2304	Hckeoeno.exe
2856	Hgfapd32.exe
3596	Hienlpel.exe
2840	Hlcjhkdp.exe
840	Hpofii32.exe
1208	Hcmbee32.exe
2480	Hkdjfb32.exe
4900	Hmbfbn32.exe
2424	Hlegnjbm.exe
3380	Hdmoohbo.exe
1440	Hgkkkcbc.exe
4796	Hiiggoaf.exe
4288	Hlhccj32.exe
2868	Hcblpdgg.exe
4044	Iljpij32.exe
4064	Icdheded.exe
4748	Injmcmej.exe
1980	Icfekc32.exe
372	Ijqmhnko.exe
3508	Idfaefkd.exe
4348	Ikpjbq32.exe
5008	Innfnl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ffceip32.exe	Fechomko.exe
File created	C:\Windows\SysWOW64\Dnbjkgmg.dll	Jgmjmjnb.exe
File created	C:\Windows\SysWOW64\Llodgnja.exe	Lqhdbm32.exe
File created	C:\Windows\SysWOW64\Gaagdbfm.dll	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Fplpll32.exe	Fmndpq32.exe
File created	C:\Windows\SysWOW64\Ijqmhnko.exe	Icfekc32.exe
File created	C:\Windows\SysWOW64\Hiacfqch.dll	Jlkipgpe.exe
File created	C:\Windows\SysWOW64\Chglab32.exe	Ckclhn32.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Ofhknodl.exe	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Pmnbfhal.exe
File created	C:\Windows\SysWOW64\Gbabigfj.exe	Gdobnj32.exe
File opened for modification	C:\Windows\SysWOW64\Gmiclo32.exe	Gkkgpc32.exe
File opened for modification	C:\Windows\SysWOW64\Phigif32.exe	Pejkmk32.exe
File opened for modification	C:\Windows\SysWOW64\Bomkcm32.exe	Blnoga32.exe
File opened for modification	C:\Windows\SysWOW64\Ipmbjgpi.exe	Innfnl32.exe
File created	C:\Windows\SysWOW64\Ihbjebjh.dll	Phigif32.exe
File opened for modification	C:\Windows\SysWOW64\Pmiikh32.exe	Omgmeigd.exe
File opened for modification	C:\Windows\SysWOW64\Cdnmfclj.exe	Chglab32.exe
File created	C:\Windows\SysWOW64\Jngbjd32.exe	Jilfifme.exe
File created	C:\Windows\SysWOW64\Gbofcghl.exe	Gdlfhj32.exe
File opened for modification	C:\Windows\SysWOW64\Idfaefkd.exe	Ijqmhnko.exe
File created	C:\Windows\SysWOW64\Lmmolepp.exe	Ljobpiql.exe
File created	C:\Windows\SysWOW64\Ecakqg32.dll	Pahilmoc.exe
File created	C:\Windows\SysWOW64\Ogcnmc32.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Lnohlgep.exe	Lkalplel.exe
File opened for modification	C:\Windows\SysWOW64\Megljppl.exe	Mmpdhboj.exe
File created	C:\Windows\SysWOW64\Ojmcpd32.dll	Pknqoc32.exe
File created	C:\Windows\SysWOW64\Nohffe32.dll	Dmlkhofd.exe
File opened for modification	C:\Windows\SysWOW64\Jlkipgpe.exe	Jjlmclqa.exe
File created	C:\Windows\SysWOW64\Jknfcofa.exe	Jcgnbaeo.exe
File created	C:\Windows\SysWOW64\Obnbpa32.dll	Mgobel32.exe
File created	C:\Windows\SysWOW64\Njfagf32.exe	Nghekkmn.exe
File created	C:\Windows\SysWOW64\Mdgmickl.dll	Poliea32.exe
File created	C:\Windows\SysWOW64\Mfhpakim.dll	Lmdemd32.exe
File created	C:\Windows\SysWOW64\Fdahdiml.dll	Ipgbdbqb.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Bpcelk32.dll	Gfokoelp.exe
File created	C:\Windows\SysWOW64\Iemlnm32.dll	Gkmdecbg.exe
File created	C:\Windows\SysWOW64\Ooaafghm.dll	Hlhccj32.exe
File opened for modification	C:\Windows\SysWOW64\Kqdaadln.exe	Knfeeimj.exe
File opened for modification	C:\Windows\SysWOW64\Fpdcag32.exe	Fpbflg32.exe
File opened for modification	C:\Windows\SysWOW64\Gdobnj32.exe	Glgjlm32.exe
File opened for modification	C:\Windows\SysWOW64\Gbdoof32.exe	Gpecbk32.exe
File created	C:\Windows\SysWOW64\Mccfdmmo.exe	Madjhb32.exe
File created	C:\Windows\SysWOW64\Bmaioi32.dll	Dndnpf32.exe
File opened for modification	C:\Windows\SysWOW64\Iljpij32.exe	Hcblpdgg.exe
File opened for modification	C:\Windows\SysWOW64\Kcndbp32.exe	Kqphfe32.exe
File opened for modification	C:\Windows\SysWOW64\Llodgnja.exe	Lqhdbm32.exe
File opened for modification	C:\Windows\SysWOW64\Pmnbfhal.exe	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Kfcfimfi.dll	Pagbaglh.exe
File created	C:\Windows\SysWOW64\Bcghka32.dll	Fpjcgm32.exe
File opened for modification	C:\Windows\SysWOW64\Hckeoeno.exe	Hplicjok.exe
File opened for modification	C:\Windows\SysWOW64\Plmmif32.exe	Phaahggp.exe
File opened for modification	C:\Windows\SysWOW64\Ipgbdbqb.exe	Ipeeobbe.exe
File created	C:\Windows\SysWOW64\Eihcbonm.dll	Omgmeigd.exe
File opened for modification	C:\Windows\SysWOW64\Dgcihgaj.exe	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Pofkjd32.dll	Gjfnedho.exe
File opened for modification	C:\Windows\SysWOW64\Nhmofj32.exe	Nenbjo32.exe
File created	C:\Windows\SysWOW64\Ifenan32.dll	Jnlkedai.exe
File created	C:\Windows\SysWOW64\Lggejg32.exe	Lckiihok.exe
File created	C:\Windows\SysWOW64\Cjkoqgjn.dll	Gjdaodja.exe
File opened for modification	C:\Windows\SysWOW64\Nenbjo32.exe	Nmgjia32.exe
File created	C:\Windows\SysWOW64\Aajohjon.exe	Aolblopj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9732	9544	WerFault.exe	477

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fffhifdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddgmbpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhokljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfdpad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jiiicf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbnnpka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bomkcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbdoof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blnoga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hibjli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcnfohmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdmoohbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjlmclqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkalplel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjmoag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phdnngdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chglab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbphg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcphab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgiiiidd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjadje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gipdap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jqknkedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knalji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqndhcdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlnjbedi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jofalmmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbcfhibj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkjeomld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lqkgbcff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qachgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bojomm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpaekqhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlhccj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idfaefkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdaaaeqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kqdaadln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pecellgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gikkfqmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmnmgnoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icdheded.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcndbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcqjon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdehni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hckeoeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aolblopj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnepna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmndpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgclpkac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkipkani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dflfac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joahqn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omdppiif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlmfeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Manmoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nghekkmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejopl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmmfmhll.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcbnnpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogcnmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocjoadei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Injmcmej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bepmoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnlkedai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjdpelnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcpahpmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhcmcm32.dll"	Dbkqfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbfldf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phodcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Afpjel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpaleglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Linhgilm.dll"	Flkdfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmndpq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlcjhkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mchppmij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chglab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmggcl32.dll"	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnfnlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bakgoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcdjbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jencdebl.dll"	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbcfhibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdlfhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjoiil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkconn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fimgpahk.dll"	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbicmh32.dll"	Fmndpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnjmc32.dll"	Lddgmbpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnkpnclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oalipoiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbnmke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlnjbedi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaioi32.dll"	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khblgpag.dll"	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hankellh.dll"	Ipmbjgpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqcmdnk.dll"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbqpfg32.dll"	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glmoga32.dll"	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdgmickl.dll"	Poliea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqlhmf32.dll"	Hpqldc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmncdk32.dll"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmpdhboj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdplc32.dll"	Ljaoeini.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4444	4784	f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe	83
PID 4784 wrote to memory of 4444	4784	f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe	83
PID 4784 wrote to memory of 4444	4784	f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe	83
PID 4444 wrote to memory of 852	4444	Fpejlmcf.exe	84
PID 4444 wrote to memory of 852	4444	Fpejlmcf.exe	84
PID 4444 wrote to memory of 852	4444	Fpejlmcf.exe	84
PID 852 wrote to memory of 5004	852	Fbcfhibj.exe	85
PID 852 wrote to memory of 5004	852	Fbcfhibj.exe	85
PID 852 wrote to memory of 5004	852	Fbcfhibj.exe	85
PID 5004 wrote to memory of 3620	5004	Fpjcgm32.exe	86
PID 5004 wrote to memory of 3620	5004	Fpjcgm32.exe	86
PID 5004 wrote to memory of 3620	5004	Fpjcgm32.exe	86
PID 3620 wrote to memory of 4124	3620	Fdepgkgj.exe	87
PID 3620 wrote to memory of 4124	3620	Fdepgkgj.exe	87
PID 3620 wrote to memory of 4124	3620	Fdepgkgj.exe	87
PID 4124 wrote to memory of 668	4124	Ffclcgfn.exe	88
PID 4124 wrote to memory of 668	4124	Ffclcgfn.exe	88
PID 4124 wrote to memory of 668	4124	Ffclcgfn.exe	88
PID 668 wrote to memory of 1896	668	Fmndpq32.exe	89
PID 668 wrote to memory of 1896	668	Fmndpq32.exe	89
PID 668 wrote to memory of 1896	668	Fmndpq32.exe	89
PID 1896 wrote to memory of 4452	1896	Fplpll32.exe	90
PID 1896 wrote to memory of 4452	1896	Fplpll32.exe	90
PID 1896 wrote to memory of 4452	1896	Fplpll32.exe	90
PID 4452 wrote to memory of 1540	4452	Fdglmkeg.exe	91
PID 4452 wrote to memory of 1540	4452	Fdglmkeg.exe	91
PID 4452 wrote to memory of 1540	4452	Fdglmkeg.exe	91
PID 1540 wrote to memory of 4428	1540	Fffhifdk.exe	92
PID 1540 wrote to memory of 4428	1540	Fffhifdk.exe	92
PID 1540 wrote to memory of 4428	1540	Fffhifdk.exe	92
PID 4428 wrote to memory of 2992	4428	Fjadje32.exe	93
PID 4428 wrote to memory of 2992	4428	Fjadje32.exe	93
PID 4428 wrote to memory of 2992	4428	Fjadje32.exe	93
PID 2992 wrote to memory of 3044	2992	Fmpqfq32.exe	94
PID 2992 wrote to memory of 3044	2992	Fmpqfq32.exe	94
PID 2992 wrote to memory of 3044	2992	Fmpqfq32.exe	94
PID 3044 wrote to memory of 5060	3044	Gpnmbl32.exe	95
PID 3044 wrote to memory of 5060	3044	Gpnmbl32.exe	95
PID 3044 wrote to memory of 5060	3044	Gpnmbl32.exe	95
PID 5060 wrote to memory of 4484	5060	Gdjibj32.exe	96
PID 5060 wrote to memory of 4484	5060	Gdjibj32.exe	96
PID 5060 wrote to memory of 4484	5060	Gdjibj32.exe	96
PID 4484 wrote to memory of 1244	4484	Gbmingjo.exe	97
PID 4484 wrote to memory of 1244	4484	Gbmingjo.exe	97
PID 4484 wrote to memory of 1244	4484	Gbmingjo.exe	97
PID 1244 wrote to memory of 3612	1244	Gjdaodja.exe	98
PID 1244 wrote to memory of 3612	1244	Gjdaodja.exe	98
PID 1244 wrote to memory of 3612	1244	Gjdaodja.exe	98
PID 3612 wrote to memory of 1884	3612	Gmbmkpie.exe	99
PID 3612 wrote to memory of 1884	3612	Gmbmkpie.exe	99
PID 3612 wrote to memory of 1884	3612	Gmbmkpie.exe	99
PID 1884 wrote to memory of 3372	1884	Glengm32.exe	100
PID 1884 wrote to memory of 3372	1884	Glengm32.exe	100
PID 1884 wrote to memory of 3372	1884	Glengm32.exe	100
PID 3372 wrote to memory of 3024	3372	Gdlfhj32.exe	101
PID 3372 wrote to memory of 3024	3372	Gdlfhj32.exe	101
PID 3372 wrote to memory of 3024	3372	Gdlfhj32.exe	101
PID 3024 wrote to memory of 4252	3024	Gbofcghl.exe	102
PID 3024 wrote to memory of 4252	3024	Gbofcghl.exe	102
PID 3024 wrote to memory of 4252	3024	Gbofcghl.exe	102
PID 4252 wrote to memory of 3548	4252	Gjfnedho.exe	103
PID 4252 wrote to memory of 3548	4252	Gjfnedho.exe	103
PID 4252 wrote to memory of 3548	4252	Gjfnedho.exe	103
PID 3548 wrote to memory of 3880	3548	Giinpa32.exe	104

C:\Users\Admin\AppData\Local\Temp\f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe
"C:\Users\Admin\AppData\Local\Temp\f78657fe3f1488347207e3fe3ce339669646bd7d296afb6bf2227ff34c7f6315N.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\Fpejlmcf.exe
  C:\Windows\system32\Fpejlmcf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\Fbcfhibj.exe
    C:\Windows\system32\Fbcfhibj.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Windows\SysWOW64\Fpjcgm32.exe
      C:\Windows\system32\Fpjcgm32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3620
      - C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3880
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4380
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        25⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        26⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4156
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        28⤵
        Executes dropped EXE
        
        PID:3960
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4072
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        33⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        34⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2404
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        38⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4196
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        40⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        41⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        45⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        46⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2840
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        49⤵
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        51⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        52⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3380
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        54⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        58⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4064
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:372
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        64⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4268
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        67⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        68⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2880
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        70⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        71⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        72⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        73⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        74⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        75⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        77⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        78⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        80⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        81⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        83⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        85⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        88⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        89⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        90⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        91⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        93⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        94⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        95⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        96⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        97⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        98⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        99⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        101⤵
        Drops file in System32 directory
        
        PID:3972
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        103⤵
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        104⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        105⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        106⤵
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        107⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        110⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        113⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        114⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        115⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        116⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        117⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        118⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        120⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        121⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        123⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        125⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        127⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3644
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        129⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        131⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3988
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        133⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        134⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        137⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        138⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        140⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        141⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        143⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        144⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        145⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        146⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6556
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        148⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        150⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        151⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        152⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        153⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        154⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        156⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        157⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        158⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        159⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        160⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        161⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        163⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        164⤵
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        165⤵
        Drops file in System32 directory
        
        PID:4760
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        166⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        167⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        168⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        169⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        171⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        172⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        174⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        175⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        177⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        178⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        179⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        180⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        181⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        182⤵
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        183⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        186⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        187⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        188⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        190⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2496
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3184
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        193⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        194⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        195⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6180
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        197⤵
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        198⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        199⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        200⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        201⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3140
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6692
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        204⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        205⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        206⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        207⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        209⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        210⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        211⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5012
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2192
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        214⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        215⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        216⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        217⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        218⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        219⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        221⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        222⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        224⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        225⤵
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3576
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        227⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        228⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        229⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        230⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        231⤵
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        232⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        233⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1364
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        236⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        237⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        238⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        239⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        240⤵
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        241⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3928
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        242⤵
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        243⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        244⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        246⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        247⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        248⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        249⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        250⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        251⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        253⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        254⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        256⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        257⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        258⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        259⤵
        System Location Discovery: System Language Discovery
        
        PID:7804
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        260⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        261⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        262⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        264⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        265⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        266⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        267⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        268⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        271⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        273⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        274⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7536
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        276⤵
        Modifies registry class
        
        PID:7664
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        281⤵
        Drops file in System32 directory
        
        PID:8024
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        282⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        283⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        284⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        286⤵
        System Location Discovery: System Language Discovery
        
        PID:7532
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        287⤵
        System Location Discovery: System Language Discovery
        
        PID:7652
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        289⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        290⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        291⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        292⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        293⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        294⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        295⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        296⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        297⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        298⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        300⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        302⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        303⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        305⤵
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        306⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        307⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        308⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:8740
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        310⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        311⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        312⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        313⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        314⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        315⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        316⤵
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        317⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        318⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        319⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        320⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        321⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        322⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        323⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        324⤵
        Modifies registry class
        
        PID:8428
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        325⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8616
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        327⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8804
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        331⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        332⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        333⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        334⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        335⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        336⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8300
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        337⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        338⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        339⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        340⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        341⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        342⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        345⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8612
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8840
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        347⤵
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        348⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        349⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        350⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        351⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        352⤵
        Modifies registry class
        
        PID:8432
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        353⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        354⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        355⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        356⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        357⤵
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        358⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        359⤵
        System Location Discovery: System Language Discovery
        
        PID:9376
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        361⤵
        System Location Discovery: System Language Discovery
        
        PID:9448
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        362⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        363⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        364⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        365⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        366⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        368⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        369⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        370⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9812
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        372⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9884
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        374⤵
        System Location Discovery: System Language Discovery
        
        PID:9924
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        375⤵
        System Location Discovery: System Language Discovery
        
        PID:9960
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        376⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        377⤵
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        378⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        379⤵
        Drops file in System32 directory
        
        PID:10148
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10204
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8272
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        382⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        383⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        384⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9544 -s 404
        385⤵
        Program crash
        
        PID:9732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9544 -ip 9544
1⤵
PID:9664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akblfj32.exe

Filesize
395KB

MD5
921b4bc67d3abb2613ef12032d44970a

SHA1
d3d86cf10c15b660593c100895d66a86df5cc6bc

SHA256
f83ff4ef23ea841b014dcfc7ecb770914ed1b592f7a3391510bce365c26138a9

SHA512
4622ef59f58f2881981cabb293c5076810d6ccd3d1567ffdea98e5355630a72518a0de376700853d6274c04b525c02fb819154c9ea598c8c8d684ad7bdeb8cbe

Download Submit
C:\Windows\SysWOW64\Aojefobm.exe

Filesize
395KB

MD5
426133ead0093652b101f0e401cccb1d

SHA1
993851993552639e1167a85c9bbe89c98487cddf

SHA256
cc18e1364d986a46ab6c83074f3b8e265791b668aa5e9389f639ca6b55616f9b

SHA512
7454a5e3261dd3979302017c34095aa4dd0f6b82ad8a7b41ffc58ce2ce2b162a1ae849263056ef6fbfbe0fe19a9afd5848a4b18469bc6ffd7251633d31d3e8a6

Download Submit
C:\Windows\SysWOW64\Bakgoh32.exe

Filesize
395KB

MD5
f4e2cff1b61aa2983662f6d839e1f322

SHA1
5fcb58b2392016ff5a670919c702dbccfbf178e0

SHA256
332b78aa51dbe0db5d163f23f80c784762a0c8122afd160b43d9776a63c09dfb

SHA512
76ee2f618afb2c513c8c83065806ecc854b02a6b9efe434177f76866f2baeac49e26b70ccd1d9d1fac279c5311391a35edde38051143feec80661396d27a071e

Download Submit
C:\Windows\SysWOW64\Bdgged32.exe

Filesize
395KB

MD5
6af53b16a29872db38491c3258b98164

SHA1
46d95045fa7387b094750908ccadfe0f0939cd79

SHA256
df4c30b84f75dc8ac66717f964b9fd5556846bef2bb3c5568c4368786c5a3f83

SHA512
542fc93ea07c20f3069d24f2ac3fa323ab9e909cbf782a4a37bf8648089618a6d46e721f9dd8f30411ceb71ffd3b49dae809d0a7af0841b9b0d23ebdb174b64a

Download Submit
C:\Windows\SysWOW64\Bebjdgmj.exe

Filesize
395KB

MD5
b4c93a4c0f42731431b833f69f96cdce

SHA1
989da77cdb9d342561da1b090a910822e3b0a45e

SHA256
19a0ccf383439a18e9effb5d0b1aa6fb7688d3b5378742cff5a0e1e1556ff39d

SHA512
d7cdbd7d3e534989965e46cb4f752393a07fcd9b5e25980ad3fbb03eacea1265cf4cccd441aca58595ce59c93dbb9e99c334da217d2d6bdd5376bf64ceb29ee3

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
395KB

MD5
3eb340255a54773764df4d84cc9be02b

SHA1
c95d579b1a08d17da6addda5939f267df8006da1

SHA256
884c4346f110c6a5fd703951d4add8c6b5a40e0e1e20898eeda6b252cf7645c1

SHA512
2580bf019ac2bef4b4bca79bc421802dda11b149ae852092d5299017fde0fd676cf3a1888590e5b1291944d99f249a5f747d6671430d2e10102ebc38850f9c11

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
395KB

MD5
00e912efbab9e8947fd5df484a0f1834

SHA1
b0ab1485479ed842bad5ae4aab6ade9190aef23c

SHA256
116f769648549d7fc96f09f602520836649e1633dc6636656d589cf948f86cd5

SHA512
da55264a2578fecad58d7b4d62b286b14a34abdddc9becc3f42030f031c0d74b8c774efca5568a1b12348f24af565c5b4dba9a1aa53515da9866ae976ba9afc7

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
395KB

MD5
1e793b90cf527c72b1d6e66900b341c5

SHA1
220b641cf15dd6bcee47985a7aba75160d78ff4e

SHA256
d9cc99cb50e1155bc8c51feb60c1f4a12985701859e61cf1308dd1b5c84ad8ba

SHA512
5f9347485ae0f033c2c930e07ea7fdf38de00c3f835e3ec6670047cb4057dc25337b0ed775576ad83fc2765c94ecd12d030cedb948ff153ce89c735a13471d8d

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
395KB

MD5
1dbf051b9d3df19a7abd7720787dd504

SHA1
9b83eb071ed8d4ba4dc027181093332acb936a33

SHA256
4f2dadb18aa0a8cce3582ef31b43d62e4ec05bac6458890014e2e9192e6b9188

SHA512
64e78aa3ca0e5e91d3adedc7c26a02407b8b00cbe7e7e752c0dbafa65fcc8e9f5a6f5269ae1ed588d140d8861cb4d3c6d193dc74a20e43e5ffaa27779f325f20

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
395KB

MD5
2fa0a12fd1e57625ac68797b9db03560

SHA1
6001728bbfce80a4ff3ab864104fba2148de8960

SHA256
bc2eafe4b6d37f823e9ff7f8445b8dff6899e21013c231bfb627a2b43c214af9

SHA512
4c057ebd045d9fd309e369396e9c757ee922fccc38a8843576500c5746b1660f2f447023d8a9a5a35dc1e92ed5335488da64bc6399a20c717ad0712106c9dda1

Download Submit
C:\Windows\SysWOW64\Dflfac32.exe

Filesize
395KB

MD5
97065c17b7e8506003743543bcb57a25

SHA1
cd0a0f27383815c2ec537781095454481fa957e7

SHA256
d34cad4341bca9a313973367c7353fd01f5bd88c6181562b26b0b0754b004530

SHA512
b57911054274af0b30bb78a54e55b37426770ac90e49a6f4d0d20e8266845827c7e571d83898411621f69356c16b0c294aa11852ed5befc96dc61e42955c2684

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
395KB

MD5
a34dcf7cc8db57550ab5ed2f7f626127

SHA1
e904121cd28ad484f6b3b69cb25be815631a3a0e

SHA256
fd89626712b19eb56c29d43a2c732f954163000b780d97493039b50384650d9d

SHA512
91475017788ef0b029039a8846ce01d36c42a17ebdd36fcc39b9c4d0dd0ec06d024737f33ba95e038554e95a0eb6c9d6eee85b83e7db92e4ddd4f526b01204ff

Download Submit
C:\Windows\SysWOW64\Efjbcakl.exe

Filesize
395KB

MD5
abf4ad1aa9f2d4e7a8c47bcab1ed881c

SHA1
078392350cc7f54af38626f9623c914995e429bc

SHA256
b9d2a70294b8b2dd10e496ae0a8ebd85e181d408146023be18f71d103dc119c5

SHA512
d70f6e963f2fc0d2b8cce829a2ac8080ef86204ce4355d09e498f4220dbcb7778287dcb80c31895709edcb0d1f15445a707647bcbed9cb0f53c4e6e66d5846ea

Download Submit
C:\Windows\SysWOW64\Fbcfhibj.exe

Filesize
395KB

MD5
7ca7f41ce247c1661a3e5167a6023ce9

SHA1
fabb714b85f703b80b0bbf85cbfe4f3d2482e86a

SHA256
78e83479d7563a15ca2053e4fad3997195ceb732975bd95173fbaf51e10118a6

SHA512
41ae20194c8a90fb4bfe8a3604b6ef226a24732fef436786e631721c89e827fd8be0c910e5046e52a40ce68fd6eebde8e0f0e0869d5a95ba10fe3cfcfdcde228

Download Submit
C:\Windows\SysWOW64\Fdepgkgj.exe

Filesize
395KB

MD5
779e3e33f756e8cfd55427b47befff0b

SHA1
808e1d431e333d82a5953617340befbd27b5d623

SHA256
d359020d3295d69343c58b7f5d5664c8945105fa1ce5c05d6b5491e0fafd1c23

SHA512
84f9db7064c9d8ff3d1728731cb839b029013584a24cd627e159dd4f9cf37e9ca8fad733620e72e1de6a862377a0e91c63afb4b1dab7f59aab552e9c209de5f6

Download Submit
C:\Windows\SysWOW64\Fdglmkeg.exe

Filesize
395KB

MD5
ac3ae8bd138151f124f645d619c09974

SHA1
50744577a84612dc37d611b40b1e20e85ca2871c

SHA256
75be2fe4ba7b7707392cedcfb735ead887b85e79b7f33011e4f65468c94034b0

SHA512
b026747c64e32cd5f86b61831eb730d6ef6ec05c3f2de150d3815b86492c5bd8bec455cdc192ea8c539d6acbd05d49c8b4e81112d0b31ff934f0cf90ac417f95

Download Submit
C:\Windows\SysWOW64\Ffclcgfn.exe

Filesize
395KB

MD5
c69a388fd39673ae340105408f545c60

SHA1
11e873f4f84d0f76e56eea1d3147f4d14efa9d67

SHA256
959df372f2659697edadd00585c00f49a39e5aa510b028da607b265be58d795e

SHA512
89094de506ae381b65e3cc5507f69c9177c786c9e60fb3c8aa54eaed6c3164ce8ff2e58933e246184e39238ac2a5e6569220aaa3700d983c731c2de5b547312b

Download Submit
C:\Windows\SysWOW64\Fffhifdk.exe

Filesize
395KB

MD5
541ab27384f7fb55cbd012f512037469

SHA1
6642c96b0ef682d26b5c9d97c9114a17e929c13e

SHA256
646585e518c5df4cb5d9f6eaf93b716a233c8eb1efe5e231bc0af9c027b9d9e0

SHA512
232df5a6f080575ca8191518cd50cca58e6e5d1991b4c7ee92ff65f5728bd522f1b4a3ba0be1a2726a000862256ae9f0d510492b0e9976c0663956006948ebd7

Download Submit
C:\Windows\SysWOW64\Fjadje32.exe

Filesize
395KB

MD5
e2ed70046816595d5b5ec96a4776db20

SHA1
833411dd7812e58388b6b680507694b9a4b934a2

SHA256
e7df2e8e26d0e10321272d8c33aa97fde2d3d728f51e9e97a92fb9f5c7528263

SHA512
d124d01bb543bdcebbe661233f8abc3442a9614747c93db0c4db0145c5b1e7645c94026061ef8e3d3c14de102c0e1f3da50b965ee8de26ac13934b0e7e54325e

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
395KB

MD5
8c400e0a8fdd3ef31daf82aacb9219e2

SHA1
6ab5af7c4fe56f20fbc41df1ca4b86664691c646

SHA256
bc1b90effa6f9a0d1d2bf8ab49b2497bde8849a6ce2d39384551d1c542c19676

SHA512
abfa4907f5d5ebaf2617d6bac0820df7db412fad1b365324384a4d6043d979c9fbe4c8c95c7dfd30077f9fe5c825cf782f667c3190b983f9904d5481b026a989

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
395KB

MD5
4cdae1d2755b529bd59fece7454ce77e

SHA1
f789f025049ebba91491f7f1c92cd646a347e49b

SHA256
6a1fa7892d8344f8c94bbb18cc026819d29df09873b1f8bdd1bcaf46d2031576

SHA512
116cb66e169b2f12f757f54f7d0a02524be99ba3d69f9a6dfd2fcd8fc901dcb8871ddb3debc44c57282b7387976691de38bf51a8e8503e0b8977dd52b48c9346

Download Submit
C:\Windows\SysWOW64\Fpdcag32.exe

Filesize
395KB

MD5
167ad2c9cbce3cf31af66b80b843a1cb

SHA1
31293385492db43f68ed36247902a6cf1588133b

SHA256
e94805cea37a7a2450818f615f3cef03f4b71fbca8291bc8c5e8c86713174472

SHA512
43524304af6c04b5fd643d4919827475eb5a98c0492a343c6782d88ffa093ba50b4d2cfca9a9c6ecd04ecf560262b904d857a2b5751ca4257a5166c20f7676c7

Download Submit
C:\Windows\SysWOW64\Fpejlmcf.exe

Filesize
395KB

MD5
806117519b9488b697c3ed2f17ab9b22

SHA1
cfcd11d40293499e3cb7805546c248be55a924a7

SHA256
147a03d12f115afe8de2fb266fab1156211845350030ee2895b9334d1c1679b3

SHA512
6792d4cd7ad85c42fccdbc5dc497e7dd91be0e13d3f16bede6b098a266e68eb6329e3e45e3fa7300fdb6cf9216957f4747eb21638a41edae8bb8f83b171767e7

Download Submit
C:\Windows\SysWOW64\Fpjcgm32.exe

Filesize
395KB

MD5
dcb123d99b592b3cef1bd64d144c8f33

SHA1
0c26c5966790bb953e356df775af6c206846ac92

SHA256
6b82753ea7b0e954a37308213828e8adfbda6972888161c57eaf867fc78a9ef9

SHA512
758be3b514e8eb4d5bae7f5a071b66e0d759bc569bd8de46a9a1a74f0faa5e98fe765c874284726dbe841fee8a3c1ef16a766cc0960f5dc4e236f52d6160497e

Download Submit
C:\Windows\SysWOW64\Fplpll32.exe

Filesize
395KB

MD5
6b9d04b4dc83484759c526758df21629

SHA1
affa00f42068294f1a7b0c38622cc4b439bef9f2

SHA256
a29fe645d66228921d505b1388349cc77fc201d0ee79626a6fb5b477bef80d8c

SHA512
b1ed4de791a32be5a9f63b6569f7f708809753a88614f0a4ea266b3f67e3bc199c3839b47d749c09f6b77a39bba67c912e86ac4d2fe094c965484e54ccf45bb3

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
395KB

MD5
bccb9ec05d714e84348c9e9caf9a4688

SHA1
7d790fe2cfa76f0f6b5ae168898be35db84e9b65

SHA256
293acdce2af182d830691b9300ed99ff3ed9715ed3b422f6fa5c58425d87e214

SHA512
20590c73a985c295280c922dcdfb571267df868c0529efcb093d1d39cc30b922b049cccaa748968e0e0fdedfdc4fa87c68e6d08a99d02010e064a57023316a71

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
395KB

MD5
50d3cd49bffd8eeec860a727c033ef1c

SHA1
dc20e42541bd062ff9ee45758174d7bf315b67c2

SHA256
f65683dd7d97d8905ffb70cbb1de2c055730def5e3c623e8f3f11dc55c856f79

SHA512
6c98c15d92a8daeeaf0c832c196c925a6e7782bd9037209759f7a2c7205ef5bf931894115db122cc83c08ed4683eedc85fe03bda20a23533aced9447610855ff

Download Submit
C:\Windows\SysWOW64\Gbmingjo.exe

Filesize
395KB

MD5
17a1fc67f2f2185a486d533beeb536bb

SHA1
8157f4794d971aa8fc0b92ace47592249a372e82

SHA256
8312e0e93da6272fe6524299644711141e57dec53abe1cb5efed58f3f62adbe4

SHA512
22774e7690770b1eb1f1db642ed4cd074f86fd7894f8f2bb2e91fa5b269e753b66cb290eaeb4f6d0e3aa964dca65c2a1b74ad5b91070ccf7bba0f16dd75c48b5

Download Submit
C:\Windows\SysWOW64\Gbofcghl.exe

Filesize
395KB

MD5
6fd7b7c9d1b66282dcf10b9b4415a27d

SHA1
ecf2cff1865bea432d4a5b347a288e5814639b28

SHA256
ecaf046a15179d0be430036762949a7c2575ed3073d82ea12659d69b9608b7e0

SHA512
14fdeaf96280df24263c06461cb78a3efd206f0f1d46906b79288af3b58ed19e63be568c44e95d70be44bbe70365bdd9e35bf730af3a7b5744311f84f7a83896

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
395KB

MD5
0fc18c4cce01899830cf3c0af7a81a52

SHA1
82aa3a7695a6918828582e894987fad71ac9643c

SHA256
52b869e927a2c228b33e03f1db1e64490a3f3e76f25ad16b4253c3299dc13481

SHA512
382ea2e492d5373434a095bdc1c4a455ac1d1f62041f6da98aa54b33b130ea002127b5babeb634180cb016bd8125fad8b6b0107e4350b805e034ef3421a804e5

Download Submit
C:\Windows\SysWOW64\Gdlfhj32.exe

Filesize
395KB

MD5
017352e729199421b8274c4f63a1cc35

SHA1
bb868956458003899e5e144f7a241328573be10b

SHA256
cd17f55354fa07ba9de9e1445d021594abbbc185ed836a218ef970b5f749be6b

SHA512
50cca64aea906f37313da63db977aa72a4d1a5798ec2c715deb2b1fa35394a456fd2e401d1b846ae7bf519254107fbaaff21cf00c3ead60b40912268d6f3201d

Download Submit
C:\Windows\SysWOW64\Gdobnj32.exe

Filesize
395KB

MD5
1e98b154743f64b93d35de1ce76fb527

SHA1
05b888670193c5fc5af68410d617d9cb38dda4a9

SHA256
f6c91c213e8d5e5259f9ffa99c3463c34132187b48d1818dfac4999c90f00fa4

SHA512
847698661844ceeb8d7823ecede626eefd4797332f645e6e4b207e800723fca04a4db7cc3efa19f93a3c392e1725cdcc66e1fb30d8306312f742644452356f96

Download Submit
C:\Windows\SysWOW64\Gfokoelp.exe

Filesize
395KB

MD5
f2d189f2bb6f6253662592d69e0fb067

SHA1
ef2e35c68567527324da9190d4f30826eec23bb3

SHA256
af5a7de5b3263c0ed2e57887d84335c12e187834ceca7fcf89778f36c9fab7bc

SHA512
9dd03e68a51b72479d20ec846145cebd713a1346d1c06d4e4cd8eca8549df5ebc8dd9b170aa90aec435fcf294a81a37f0dd34b20fc06c76626a0da53fb99b278

Download Submit
C:\Windows\SysWOW64\Giinpa32.exe

Filesize
395KB

MD5
ac78c15c28f706e7afe4e902b168fc21

SHA1
da880fa7c46c4748830ce5e2edeb9ce2eeaebcef

SHA256
a837d2c8ee6f585c47333a698146b7cc0591706d96553ca36ca02795a3a28f06

SHA512
a89a28d0c9b6603f4955ea7efc769d833df267ec69883aacc4adad89463a38e40a61533e2b64994702f4383d2349e1e10f77359ff30482519efd01c8f60ba92a

Download Submit
C:\Windows\SysWOW64\Gikkfqmf.exe

Filesize
395KB

MD5
7d54e13c69eea52f455620bced3ca521

SHA1
8ab1db55006a7dc25257c04b19b0fbe21a4d3d9c

SHA256
49c9865865cf1bd983c7a3f714188cf1a58b84e0515aa9647256bd90d7da76f7

SHA512
1e600f5938a81d3aecfb27719f14453744ad1cf8dd4b6def90074d782a51c3068c6697d43256a6c69b210222c581e3e0a29e82e456ba29e17a3e298e56ed2d46

Download Submit
C:\Windows\SysWOW64\Gjdaodja.exe

Filesize
395KB

MD5
fbdf0139759e0a3f69f3078238dddcd0

SHA1
17bb50611b2d89782c76e82710ef895f2a05cf91

SHA256
20ecaa9f36033411bbb0bb5495b30ef3ec83e2e693fe1720733ef3e70766ff90

SHA512
df74729cb69ea0fb978f48c7ef3ed38f7ce7f6cef914d53079c42460e9c7e4c212aa3776056ddb02872641cdc2a1749808e448d2ae37feecc016c42c5aff44e9

Download Submit
C:\Windows\SysWOW64\Gjfnedho.exe

Filesize
395KB

MD5
a50bd878f04a1421da2bae2f3bd01447

SHA1
18bd8fd010c2e91b8b17a3d39082b3ea7b28eabb

SHA256
7940f37c66c36c3acc2eb43152027716fe0247459b3f5ea1a656925fe55fd9e5

SHA512
82f0b641b3366c2a420b974a2c2462e9d96e89a7b20100a182e7b14029965476f1331ea07e6cfa5e3d165796537387eed627e7666f0046418044d90719fa40b9

Download Submit
C:\Windows\SysWOW64\Gkhkjd32.exe

Filesize
395KB

MD5
637e02d268b3e0da7097a13b470c17b7

SHA1
6f13858496c333dcb20b88f6f76ccdf7ab1b212b

SHA256
31452224e9b91a93fdcb80048c0c9ad33c51d021fe06bfc13a65980cc9b38dac

SHA512
aa65e5d939a307b761b0854e303bde90c9b57b02279d89b7683cedf8eda46c7081c0fd35c8992c36e1a27d273aed1debfebcbf9c5184a33c67b15ab37d74e469

Download Submit
C:\Windows\SysWOW64\Gkkgpc32.exe

Filesize
395KB

MD5
021059aa2fb18bb04ab171dbc15db7a4

SHA1
4d3d44de24a8188c60f3c9c7571e9d996e4917b8

SHA256
c614cd3bf9a97d04967e0d4485b7538a898bbfa227a850004786d8639baf5405

SHA512
5dbf1e3ce5b775ce8b064e43a460fa1568971bf3b0264a3c1021f7a57a92385c0a00466633c555da53d9f44f68a0d7abb03909a54ba0028ffcd9cdd8ff459352

Download Submit
C:\Windows\SysWOW64\Glengm32.exe

Filesize
395KB

MD5
d249c6e6f78d795edbfdfa66269d09aa

SHA1
b3d42fc1ad5702df8ae5d2e023751a2430b01f3f

SHA256
e10ded8319d92a9bae6869f6a185161b8097c4ecd5f97039f6650b4fb62d01a1

SHA512
7a061844cec63f317706a901bfa415a9a76e57af632cb55e49cae5629bb05c841aebc46ee142a0f15f6a167cb0beee9d9a2285d3173cc6670e74f8f8d13d7ef2

Download Submit
C:\Windows\SysWOW64\Glgjlm32.exe

Filesize
395KB

MD5
f95e0e591b3a87e6f8142693e512866f

SHA1
143005863d3ae6e5b38c16f37cbd126190131e6f

SHA256
ce5d018bf2b4f038b79edc4a41f075b3d03c97a7a0d5e91e1e3ea0113f52a524

SHA512
5ee8700dbb83438c214b895c72b87a697397f80355331a1b819fbcc6f1139bcd6d641a482b60f52457bb44c2398d705ba47051acb937532fb13e5aba56c3216e

Download Submit
C:\Windows\SysWOW64\Gljgbllj.exe

Filesize
395KB

MD5
262cda1016afbeec5cc736ce8970fdd7

SHA1
87f2a8391c7f4caebf6a0d0680e5dfb7e351df84

SHA256
c920f486261e87e11e9b5da948af76d5ae758c4b75484f8cbfa6ace6a969ad8c

SHA512
0716716256b9f9f701dc1a4afc588a293494f8748b679e64833e622e7616492aafa0254e356a7ccd1c8f46e3cd7b6b3451e2fb581d34a505f9bec4b776e10c87

Download Submit
C:\Windows\SysWOW64\Gmbmkpie.exe

Filesize
395KB

MD5
238b20e9324b6417652f38c888c0f8ae

SHA1
751eb19e211c7a0694ee3a90a1de068b54d87c05

SHA256
9329c3e74528c0e83f82a64d6877fa687802555f19eb11a99c0514b354d05e7d

SHA512
26c938b764ecafb59d6015ee2bb98a60600811aa914e9f2f67e6074876e1a10d8a741c112c3eca2bce246286d45127fd5ebcadb0a152598d58f8f23da3f1ac31

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
395KB

MD5
9c036189bf3a61cf32bcf4d4c2458cf7

SHA1
c655ad395cb8907cd8b3203cfdd7cffaa203c937

SHA256
ae4fbe1ff4aeb0186254a2ee98c183d9711819bbe34209eed03ac9cce4e9f016

SHA512
989a95a0194a2898f49ea1055d16b5f28cda67abb6949865a26a71f1bc81aad0383530fcb8e85c0cce996aadc30d67d0fe0d924ddbf641743631bf8e8b81c5ba

Download Submit
C:\Windows\SysWOW64\Gpecbk32.exe

Filesize
395KB

MD5
022591b18ade03f7d1ba943c1ed071dd

SHA1
798acca998ad8ac9279082faa96f3af4ebec9f1b

SHA256
713c3d2b5ad45540540d6a6684a8815830680bd0369909d723cd379f13e9ab9b

SHA512
06126c5e1d5c5c11245d8a85c63f2c0358f7bb7c815d2aba38e8338dd183e59512cafd7d26f862250ce3af51c8b4ed3becdd406acea0866b168a5c0c2b3c3103

Download Submit
C:\Windows\SysWOW64\Gpnmbl32.exe

Filesize
395KB

MD5
5a8d12f51a8dfda0ba9eb81593016234

SHA1
9743c23e9a28fb73819834bf2a19dbc78a5dff0d

SHA256
113eb385eb5ee7509b9c1bf0d15efc43a37f047378e946ebb8432bd7cea1d956

SHA512
6c7b88307ae37940f559a5e815ca97e5d915ced081483c520ab117e3a3b5a64cee1907182a54815b25a6cf041cde2d11e075f879097ad2b8da4346fc45718098

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
395KB

MD5
f1470960ffbd9949f3da4ee66706c457

SHA1
03f85cd3d4e57548a14957bf81839b38205b65d1

SHA256
e7f35a6d49d093cb9a9f74f257ed2443b96c5b8c802d12369bc90dc60e0ccd1e

SHA512
9c6022d0a2616616d465194375b162ce85a8f4647c27fabad456c602febe10b251b5f227e3018a15afe1e88ffea070850b67124e4b854be8190931b37a888ef7

Download Submit
C:\Windows\SysWOW64\Ipgbdbqb.exe

Filesize
395KB

MD5
052fe355152a30d3717ed165a6886f78

SHA1
1b5c9d467054ddfcd62f19ee52a6cd35fa5657bb

SHA256
abecce48063934cb916d1b06aa89729ef8eafdddcc07b5a30ba5eab2e3299d64

SHA512
c84d83edf84d8aae48c9696973283f4d0dce18f151844c375f2f1848edd40ffc577466b6a08923d312bdd871b8850973918228e1c422ae974b44507b49586f40

Download Submit
C:\Windows\SysWOW64\Kegpifod.exe

Filesize
395KB

MD5
48d73443a9257e833b4b665015ac6bd5

SHA1
de15e59033da1f75d894bd3dcd9f8f9c61e49e85

SHA256
ea9e0ee37b4e30a22f360a68d98353a34f6e21f5d0df5e7e75d28bcdecae0e0a

SHA512
9b559f439d62e3bc4cb89ca4474313caf5faa3d0e7a116b5c876fb40a33d3cc53a210f3d621fcb28693cf10447d61972daab7414741cabb06f8b3a0b251f3f6e

Download Submit
C:\Windows\SysWOW64\Kgflcifg.exe

Filesize
395KB

MD5
081c22c7946bccb2ba6d161f6b79d096

SHA1
96311d56ca9b4d46ba42ebf3b317e0c69fab1b08

SHA256
38a410afbaec2a09f0d0681e898e3ebca0c65a31ef4ecbd5c5598722fcfe1f26

SHA512
bdb43404d9ccc35525bd95f0190a249d08b676d1987c63f4ecda63ee417b7c9771257489c120978fe464d6d430f3690124639be33761170282f2340e3a81940a

Download Submit
C:\Windows\SysWOW64\Mqdcnl32.exe

Filesize
395KB

MD5
b10d1fe11b74948ef4fb7b173cc3b4bd

SHA1
6b48e000c6c1a0bb6ba31c03dcf34a2b5ed55f92

SHA256
5fb7ad51cc1e2b87936c9c8e8c0c078ce8fccd3842097d5730023d6259a88d02

SHA512
402774a323ac65950ed6c0ed971b11963d95440aa1e44aed4f12577fb9b02289405bd96ec74010001cdb1efc1be9adfce882ed24f4e0537c797fa8eecd1d53e0

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
395KB

MD5
1f4927faad49a59ddc5d2a1d03a9f787

SHA1
049e6edf7d14822e1453e968f7260ad345dc9bf8

SHA256
d66a4bf394b011427487cb680bf91adad070adbcc0abaa6c29e9a6f7bae84cd6

SHA512
c06e1b8b6e574ba15e0811c39113276cd05b3998aae82eedb9b4d8c3ed2e4012d275cc4e054efd19968a567f509aed7655b2a2aa0b26b4a3fcf1c6afb96f90b7

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
395KB

MD5
b528a77324c78fd30a04a9f8922f9b0f

SHA1
f8df4e36e05b67b850d6d1e818a057b67024848b

SHA256
6e6b875684fbfb4296664de1120bb5999f16903b0850ee89ccfb0e92e01925c7

SHA512
d4ba62bf406f31148e3e1158375a600f5976567cad18530087cd1ebb9b4c9d68afd312673b6419dc1df3a3a7893b5ebdbc0631ae172a04c65883fb695e1a403b

Download Submit
C:\Windows\SysWOW64\Pjdpelnc.exe

Filesize
395KB

MD5
6cb1fb08d7dac15e00fdc0fb9bb28e99

SHA1
b5791ec02edb284c3063a9865a6a0e7683870645

SHA256
f6e3de090a88bbf62ed3545b66ac12f74f7b56fd5cd331926e95cf329a33344b

SHA512
ff764b4457233f9ae1df25a5a9b0deffbee06225aff878031cdcdbf406c283abc3a63e0c74825dfc45224937c660d1b21579eaea2e733a6b836e7620bda6bbc8

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
395KB

MD5
48fd856fe9ee39974d03c0ee0be866f8

SHA1
5a002eed9bcca239f66761b31e158040a88046b8

SHA256
0322a40c259be02271e8bc31d5b604dcf42dbd9d37135e25a65dcd04e773e9f6

SHA512
7aada4a342bf6f6ea3eeeac812b022a8e2bd5adece149293ebfe8de09106d19b4af991dd9f677a0651ec3d4aa47c8736a897d8aa9bb042c1b07f93bce5cde168

Download Submit
memory/372-430-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/464-483-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/620-195-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/668-578-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/668-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/840-348-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/852-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/852-554-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/940-489-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1208-354-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1244-124-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1244-632-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1440-384-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1500-2561-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1540-596-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1540-76-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1576-289-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1884-2762-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1884-644-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1884-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1896-584-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1896-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1980-424-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1980-2672-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2300-277-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2300-2727-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2304-324-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2356-312-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2404-271-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2404-2726-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2424-372-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2452-227-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2480-360-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2840-342-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2856-330-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2868-2677-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2880-471-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2992-608-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2992-92-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3020-203-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3024-656-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3024-156-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3044-100-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3044-614-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3144-259-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3192-495-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3192-2652-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3280-465-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-650-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3372-148-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3376-235-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3380-378-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3508-436-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3548-668-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3596-336-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3612-638-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3612-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3612-2764-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3620-566-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3620-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3628-243-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3792-283-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3880-179-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3948-301-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3960-219-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4028-477-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4044-406-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4064-412-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4072-251-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4124-572-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4124-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4156-211-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4176-318-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4196-295-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4252-164-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4252-662-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4268-453-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4288-395-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4300-265-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4380-187-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4428-84-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4428-602-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4444-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4444-548-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4452-590-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4452-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4484-626-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4484-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4700-2590-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4748-419-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4784-542-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4784-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4804-2436-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4900-366-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4936-459-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5004-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5004-560-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5008-447-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5060-620-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5060-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5104-2336-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5128-501-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5176-507-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5208-513-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5288-524-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5324-2640-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5324-530-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5364-536-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/5480-2507-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6076-2553-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6148-2499-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6184-2497-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6232-2358-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6244-2337-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/6800-2467-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/7032-2366-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/7472-2323-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/8176-2292-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/8332-2276-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/8688-2248-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/8728-2221-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/9112-2256-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/9304-2218-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/9348-2193-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/10148-2196-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads