berbew | 8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe
Size

608KB
MD5

06f37dec5f44acb1c17fe1fdbafdce98
SHA1

12eb3e1286a2b904ac28a91b97678b1990dc6869
SHA256

8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072
SHA512

7a8b7ae00d61f8bd925c054f1fb166536e45f2359f0434c95d039d2565ceaa22cb4f0b43b32e510d2bd3c2b02b2096ed9336e7da746e9f6d37c6360073b6abc5
SSDEEP

12288:i63t3cjkY660fIaDZkY660f8jTK/XhdAwlt01A:i63BcjgsaDZgQjGkwlp

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibaeen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kofkbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hemdlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcmfnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flkdfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igajal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Glgcbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmbphg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcanll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhifomdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Emhkdmlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Joahqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiiicf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lchfib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacmpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmhbqbae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gldglf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofkbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnnccl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfmlghd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggnadib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bbdpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdcmkgmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cacmpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcanll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcmmhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lancko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Biklho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gimqajgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llcghg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qclmck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpacqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fefedmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Enkmfolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhifomdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Likhem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gihgfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npgmpf32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4908	Dngjff32.exe
2812	Dfnbgc32.exe
1364	Emhkdmlg.exe
2672	Efeihb32.exe
4744	Eejeiocj.exe
2768	Enbjad32.exe
2864	Feoodn32.exe
4180	Fpdcag32.exe
336	Flkdfh32.exe
524	Fnipbc32.exe
2452	Ffqhcq32.exe
1904	Fiodpl32.exe
4436	Fmkqpkla.exe
4088	Fnlmhc32.exe
4996	Fbgihaji.exe
660	Fefedmil.exe
4648	Fmmmfj32.exe
4808	Fpkibf32.exe
2112	Fnnjmbpm.exe
2044	Gfeaopqo.exe
4836	Gidnkkpc.exe
1856	Glbjggof.exe
216	Gnqfcbnj.exe
3160	Gblbca32.exe
2136	Gejopl32.exe
4156	Gifkpknp.exe
4112	Gldglf32.exe
3088	Gppcmeem.exe
1976	Gbnoiqdq.exe
452	Gemkelcd.exe
3712	Gihgfk32.exe
3420	Glgcbf32.exe
3824	Gnepna32.exe
4772	Gflhoo32.exe
1984	Geohklaa.exe
916	Gmfplibd.exe
3556	Gpelhd32.exe
3104	Gbchdp32.exe
4500	Geaepk32.exe
4200	Gimqajgh.exe
2256	Glkmmefl.exe
2524	Gojiiafp.exe
4856	Hfaajnfb.exe
3100	Hedafk32.exe
4632	Hmkigh32.exe
852	Holfoqcm.exe
1604	Hbhboolf.exe
1204	Hefnkkkj.exe
4832	Hmmfmhll.exe
4044	Hplbickp.exe
3740	Hoobdp32.exe
2528	Hffken32.exe
876	Hehkajig.exe
1124	Hmpcbhji.exe
4568	Hpnoncim.exe
224	Hblkjo32.exe
3048	Hfhgkmpj.exe
4944	Hifcgion.exe
2680	Hmbphg32.exe
2164	Hpqldc32.exe
5052	Hbohpn32.exe
3312	Hemdlj32.exe
2536	Hiipmhmk.exe
3164	Hlglidlo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lohqnd32.exe	Lhnhajba.exe
File created	C:\Windows\SysWOW64\Ikgbdnie.dll	Igajal32.exe
File opened for modification	C:\Windows\SysWOW64\Ojqcnhkl.exe	Ommceclc.exe
File created	C:\Windows\SysWOW64\Qclmck32.exe	Pciqnk32.exe
File opened for modification	C:\Windows\SysWOW64\Figgdg32.exe	Fooclapd.exe
File created	C:\Windows\SysWOW64\Mmmncpmp.dll	Ieccbbkn.exe
File created	C:\Windows\SysWOW64\Amoppdld.dll	Bdcmkgmm.exe
File created	C:\Windows\SysWOW64\Fofdocoe.dll	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe
File opened for modification	C:\Windows\SysWOW64\Ljqhkckn.exe	Lgbloglj.exe
File opened for modification	C:\Windows\SysWOW64\Johggfha.exe	Joekag32.exe
File created	C:\Windows\SysWOW64\Legben32.exe	Lchfib32.exe
File created	C:\Windows\SysWOW64\Jihiic32.dll	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Hpceplkl.dll	Hppeim32.exe
File created	C:\Windows\SysWOW64\Kedlip32.exe	Jhplpl32.exe
File opened for modification	C:\Windows\SysWOW64\Keifdpif.exe	Kplmliko.exe
File created	C:\Windows\SysWOW64\Nimmifgo.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Jjofoqdn.dll	Hbohpn32.exe
File created	C:\Windows\SysWOW64\Eeccjdie.dll	Kofkbk32.exe
File created	C:\Windows\SysWOW64\Ldjcfk32.dll	Koaagkcb.exe
File created	C:\Windows\SysWOW64\Mqdcnl32.exe	Mnegbp32.exe
File created	C:\Windows\SysWOW64\Mnokgcbe.dll	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Mkiongah.dll	Fnfmbmbi.exe
File opened for modification	C:\Windows\SysWOW64\Hplbickp.exe	Hmmfmhll.exe
File created	C:\Windows\SysWOW64\Qgjamboa.dll	Iinjhh32.exe
File opened for modification	C:\Windows\SysWOW64\Pmpolgoi.exe	Pdhkcb32.exe
File created	C:\Windows\SysWOW64\Lmnbjama.dll	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Gefklj32.dll	Hifcgion.exe
File created	C:\Windows\SysWOW64\Pgpecj32.dll	Kflide32.exe
File created	C:\Windows\SysWOW64\Gmbjqfjb.dll	Nmkmjjaa.exe
File opened for modification	C:\Windows\SysWOW64\Likhem32.exe	Kpccmhdg.exe
File created	C:\Windows\SysWOW64\Fnnjmbpm.exe	Fpkibf32.exe
File opened for modification	C:\Windows\SysWOW64\Gihgfk32.exe	Gemkelcd.exe
File opened for modification	C:\Windows\SysWOW64\Kedlip32.exe	Jhplpl32.exe
File created	C:\Windows\SysWOW64\Debbff32.dll	Kpccmhdg.exe
File created	C:\Windows\SysWOW64\Bdcmkgmm.exe	Baepolni.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Pnkbkk32.exe
File opened for modification	C:\Windows\SysWOW64\Gihpkd32.exe	Gghdaa32.exe
File created	C:\Windows\SysWOW64\Pdhkcb32.exe	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Cpljehpo.exe	Bdeiqgkj.exe
File created	C:\Windows\SysWOW64\Hiipmhmk.exe	Hemdlj32.exe
File created	C:\Windows\SysWOW64\Jghpbk32.exe	Joahqn32.exe
File created	C:\Windows\SysWOW64\Hpioin32.exe	Giljfddl.exe
File created	C:\Windows\SysWOW64\Halhfe32.exe	Hpkknmgd.exe
File created	C:\Windows\SysWOW64\Jgpfbjlo.exe	Johnamkm.exe
File created	C:\Windows\SysWOW64\Jhpicj32.dll	Nfcabp32.exe
File opened for modification	C:\Windows\SysWOW64\Ljdkll32.exe	Lancko32.exe
File created	C:\Windows\SysWOW64\Gflonn32.dll	Oophlo32.exe
File opened for modification	C:\Windows\SysWOW64\Nnfpinmi.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Ahaceo32.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Nqpcjj32.exe	Nnafno32.exe
File opened for modification	C:\Windows\SysWOW64\Pbhgoh32.exe	Pcegclgp.exe
File opened for modification	C:\Windows\SysWOW64\Mlljnf32.exe	Mfbaalbi.exe
File created	C:\Windows\SysWOW64\Mokmdh32.exe	Mjodla32.exe
File created	C:\Windows\SysWOW64\Oplfkeob.exe	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Pnjiffif.dll	Iamamcop.exe
File created	C:\Windows\SysWOW64\Jjgkan32.dll	Oikjkc32.exe
File created	C:\Windows\SysWOW64\Hefnkkkj.exe	Hbhboolf.exe
File created	C:\Windows\SysWOW64\Johnamkm.exe	Jpenfp32.exe
File created	C:\Windows\SysWOW64\Folnlh32.dll	Mfhbga32.exe
File opened for modification	C:\Windows\SysWOW64\Ieccbbkn.exe	Ibegfglj.exe
File created	C:\Windows\SysWOW64\Ihjoke32.dll	Iialhaad.exe
File created	C:\Windows\SysWOW64\Pfepdg32.exe	Pbjddh32.exe
File created	C:\Windows\SysWOW64\Ajbfciej.dll	Amikgpcc.exe
File created	C:\Windows\SysWOW64\Dohjem32.dll	Kngkqbgl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9008	8432	WerFault.exe	431

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geaepk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hefnkkkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibaeen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnajppda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpaihooo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oikjkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckdkhq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmfefni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holfoqcm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klcekpdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbfcigf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllagh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llqjbhdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfihbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Figgdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oophlo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmdblp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fmkqpkla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iidphgcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhqcgnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmfnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdcmkgmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdeiqgkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gimqajgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmpcbhji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlgepanl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpenfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kngkqbgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcanll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqncnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hihibbjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieccbbkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komhll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lchfib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljbnfleo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfpell32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoobdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iebngial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koodbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdhkcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apeknk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbphg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iikmbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ioolkncg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klhnfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Giljfddl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlolpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhdgpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgeakekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gflhoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqkiok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhblllfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpdcag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofmdio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpnoncim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifcgion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpqldc32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aanfno32.dll"	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjiffif.dll"	Iamamcop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbhboolf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcanll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kolabf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcomgibl.dll"	Qclmck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fnipbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmmncpmp.dll"	Ieccbbkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojqcnhkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgaclkia.dll"	Hpqldc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lejgpb32.dll"	Gflhoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ebifmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ggmmlamj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlqeenhm.dll"	Kolabf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmkdjo32.dll"	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqgnfcmm.dll"	Enkmfolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igcnla32.dll"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboeco32.dll"	Glbjggof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gflhoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekellcop.dll"	Egohdegl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkhpfbce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mofmobmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hohahelb.dll"	Hfhgkmpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcdihk32.dll"	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahlom32.dll"	Dphiaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolece32.dll"	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iikmbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oppceehj.dll"	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blqhpg32.dll"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnfpnk32.dll"	Pnifekmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kplmliko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jgkmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdcghbo.dll"	Jepjhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcgmgn32.dll"	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkjmlaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncbegn32.dll"	Ljdkll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfqhkbn.dll"	Ckdkhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbegml32.dll"	Hmbphg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pijmiq32.dll"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofljo32.dll"	Nhegig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpphjbnh.dll"	Baepolni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqojdee.dll"	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnkdmlfj.dll"	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbcikkp.dll"	Loacdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngmnjok.dll"	Qmdblp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbplml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lljoca32.dll"	Cacmpj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4908	1960	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe	83
PID 1960 wrote to memory of 4908	1960	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe	83
PID 1960 wrote to memory of 4908	1960	8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe	83
PID 4908 wrote to memory of 2812	4908	Dngjff32.exe	84
PID 4908 wrote to memory of 2812	4908	Dngjff32.exe	84
PID 4908 wrote to memory of 2812	4908	Dngjff32.exe	84
PID 2812 wrote to memory of 1364	2812	Dfnbgc32.exe	85
PID 2812 wrote to memory of 1364	2812	Dfnbgc32.exe	85
PID 2812 wrote to memory of 1364	2812	Dfnbgc32.exe	85
PID 1364 wrote to memory of 2672	1364	Emhkdmlg.exe	86
PID 1364 wrote to memory of 2672	1364	Emhkdmlg.exe	86
PID 1364 wrote to memory of 2672	1364	Emhkdmlg.exe	86
PID 2672 wrote to memory of 4744	2672	Efeihb32.exe	87
PID 2672 wrote to memory of 4744	2672	Efeihb32.exe	87
PID 2672 wrote to memory of 4744	2672	Efeihb32.exe	87
PID 4744 wrote to memory of 2768	4744	Eejeiocj.exe	88
PID 4744 wrote to memory of 2768	4744	Eejeiocj.exe	88
PID 4744 wrote to memory of 2768	4744	Eejeiocj.exe	88
PID 2768 wrote to memory of 2864	2768	Enbjad32.exe	89
PID 2768 wrote to memory of 2864	2768	Enbjad32.exe	89
PID 2768 wrote to memory of 2864	2768	Enbjad32.exe	89
PID 2864 wrote to memory of 4180	2864	Feoodn32.exe	90
PID 2864 wrote to memory of 4180	2864	Feoodn32.exe	90
PID 2864 wrote to memory of 4180	2864	Feoodn32.exe	90
PID 4180 wrote to memory of 336	4180	Fpdcag32.exe	91
PID 4180 wrote to memory of 336	4180	Fpdcag32.exe	91
PID 4180 wrote to memory of 336	4180	Fpdcag32.exe	91
PID 336 wrote to memory of 524	336	Flkdfh32.exe	92
PID 336 wrote to memory of 524	336	Flkdfh32.exe	92
PID 336 wrote to memory of 524	336	Flkdfh32.exe	92
PID 524 wrote to memory of 2452	524	Fnipbc32.exe	93
PID 524 wrote to memory of 2452	524	Fnipbc32.exe	93
PID 524 wrote to memory of 2452	524	Fnipbc32.exe	93
PID 2452 wrote to memory of 1904	2452	Ffqhcq32.exe	94
PID 2452 wrote to memory of 1904	2452	Ffqhcq32.exe	94
PID 2452 wrote to memory of 1904	2452	Ffqhcq32.exe	94
PID 1904 wrote to memory of 4436	1904	Fiodpl32.exe	95
PID 1904 wrote to memory of 4436	1904	Fiodpl32.exe	95
PID 1904 wrote to memory of 4436	1904	Fiodpl32.exe	95
PID 4436 wrote to memory of 4088	4436	Fmkqpkla.exe	96
PID 4436 wrote to memory of 4088	4436	Fmkqpkla.exe	96
PID 4436 wrote to memory of 4088	4436	Fmkqpkla.exe	96
PID 4088 wrote to memory of 4996	4088	Fnlmhc32.exe	97
PID 4088 wrote to memory of 4996	4088	Fnlmhc32.exe	97
PID 4088 wrote to memory of 4996	4088	Fnlmhc32.exe	97
PID 4996 wrote to memory of 660	4996	Fbgihaji.exe	98
PID 4996 wrote to memory of 660	4996	Fbgihaji.exe	98
PID 4996 wrote to memory of 660	4996	Fbgihaji.exe	98
PID 660 wrote to memory of 4648	660	Fefedmil.exe	99
PID 660 wrote to memory of 4648	660	Fefedmil.exe	99
PID 660 wrote to memory of 4648	660	Fefedmil.exe	99
PID 4648 wrote to memory of 4808	4648	Fmmmfj32.exe	100
PID 4648 wrote to memory of 4808	4648	Fmmmfj32.exe	100
PID 4648 wrote to memory of 4808	4648	Fmmmfj32.exe	100
PID 4808 wrote to memory of 2112	4808	Fpkibf32.exe	101
PID 4808 wrote to memory of 2112	4808	Fpkibf32.exe	101
PID 4808 wrote to memory of 2112	4808	Fpkibf32.exe	101
PID 2112 wrote to memory of 2044	2112	Fnnjmbpm.exe	102
PID 2112 wrote to memory of 2044	2112	Fnnjmbpm.exe	102
PID 2112 wrote to memory of 2044	2112	Fnnjmbpm.exe	102
PID 2044 wrote to memory of 4836	2044	Gfeaopqo.exe	103
PID 2044 wrote to memory of 4836	2044	Gfeaopqo.exe	103
PID 2044 wrote to memory of 4836	2044	Gfeaopqo.exe	103
PID 4836 wrote to memory of 1856	4836	Gidnkkpc.exe	104

C:\Users\Admin\AppData\Local\Temp\8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe
"C:\Users\Admin\AppData\Local\Temp\8dd0662bb975ba28855664a87d2ed97baaa7742349a76a40b3cf11bfb6d3c072.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\Dngjff32.exe
  C:\Windows\system32\Dngjff32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\Dfnbgc32.exe
    C:\Windows\system32\Dfnbgc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\Emhkdmlg.exe
      C:\Windows\system32\Emhkdmlg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:524
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:660
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1856
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        24⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        26⤵
        Executes dropped EXE
        
        PID:2136
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        27⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3088
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:452
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        34⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4772
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        36⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        37⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        39⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        42⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        43⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        44⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        45⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        46⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:852
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1604
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4832
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        51⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3740
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        53⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        54⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1124
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2164
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        66⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        68⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        70⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        71⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        72⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        74⤵
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        75⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        76⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        78⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        79⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        80⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        81⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        82⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        83⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        85⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        87⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5664
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        89⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        90⤵
        Modifies registry class
        
        PID:5748
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        93⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        95⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        96⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        98⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        99⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        100⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        101⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        102⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        103⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        104⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        107⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        108⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        109⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        111⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        112⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        114⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5476
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        117⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        118⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        119⤵
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        120⤵
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        121⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5988
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:6048
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        125⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        126⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3132
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        127⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        128⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        129⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        130⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        131⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:844
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        133⤵
        Drops file in System32 directory
        
        PID:2716
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5184
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        135⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        136⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        137⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        138⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        139⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4260
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        141⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        142⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        143⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        145⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        146⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        147⤵
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        148⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        149⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        152⤵
        Drops file in System32 directory
        
        PID:3896
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        153⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        155⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        156⤵
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        157⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        158⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        159⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        161⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        163⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        164⤵
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        165⤵
        Drops file in System32 directory
        
        PID:1200
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        167⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        168⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        169⤵
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        170⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        171⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        172⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        173⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        175⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        176⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        177⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        178⤵
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        179⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        180⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        181⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6200
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        182⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        183⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        185⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        186⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        187⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        188⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        189⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        190⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        192⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        194⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        196⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        198⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        199⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        200⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        202⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        203⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        204⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        205⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        207⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        208⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        210⤵
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        212⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        213⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        215⤵
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        216⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        217⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        218⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        219⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        220⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        221⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        223⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        225⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        226⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        228⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        229⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        230⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        231⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        232⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        233⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        234⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        236⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        237⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        238⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        240⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        241⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        242⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        244⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        246⤵
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        247⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        248⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        249⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        251⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        252⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        253⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        254⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        255⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        256⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        257⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        258⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7900
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        261⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        263⤵
        Drops file in System32 directory
        
        PID:8048
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        265⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        266⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        268⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        269⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        270⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        271⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7844
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        273⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        274⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        276⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        278⤵
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        280⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        281⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        282⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:7336
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        284⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        285⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        286⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        287⤵
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7952
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        289⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        290⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:7732
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        292⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        293⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        294⤵
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        295⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        296⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        297⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        298⤵
        Drops file in System32 directory
        
        PID:8424
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        299⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        300⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        301⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8560
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        302⤵
        Modifies registry class
        
        PID:8604
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        303⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8648
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        304⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8736
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        306⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8780
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        307⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        308⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8956
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        312⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        313⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        314⤵
        Modifies registry class
        
        PID:9164
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        315⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        316⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:8304
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        318⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        319⤵
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        320⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        321⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        322⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        323⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        324⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        327⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8992
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9116
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        329⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        330⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        331⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        332⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        333⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8572
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        335⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        336⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        337⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9096
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        340⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        341⤵
        Modifies registry class
        
        PID:8412
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        342⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8432 -s 412
        343⤵
        Program crash
        
        PID:9008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 8432 -ip 8432
1⤵
PID:8764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adepji32.exe

Filesize
608KB

MD5
0f9720fc36a70630762347a3f053928b

SHA1
45f0bdf7ee204fbb8c8048964f88789b13caf67e

SHA256
6fc084bd8dc1f93f1a70333a70720d41b28af2b09dea3b68c9c10f0b4b89101c

SHA512
f20b185e35b4abb07e130bf3c68f9b58af2286a940c2498a6e158e1b788e801d3a2023e05df81568d50fb4914a90ae243fe3f8224d10958ec018781f4691b75f

Download Submit
C:\Windows\SysWOW64\Ahaceo32.exe

Filesize
608KB

MD5
22c2f6f8830a5e335510da1ee5ebdbc2

SHA1
a81513768c1f4b834178950c9af837186da5d5f2

SHA256
137d4ffdc517594c8313151d506872c77fc3f41e0d8885480fc3a27fbdd7ad73

SHA512
bd7e7b8c6e0376f183ec1dbea11dd62834ceb1a0a5959b5ca18ca20fb0d4bae7ccb10b7dc04c4b515c2743711ab124ba53b544deaf9b18b769816112ce0ebd42

Download Submit
C:\Windows\SysWOW64\Ajdbac32.exe

Filesize
608KB

MD5
8f244c43aa29fc87f0396ed39c676def

SHA1
ebad83628ca21f26d60483e806958b46f66207fa

SHA256
467aa05b94d2e9d2e0728fba36949b84efa25a157d460924482084fa7b5587f0

SHA512
8dd87e80cf28c3bcf015c195160630e96716ed276b7bcecc1fac866410f335fd5534f3623a7015033ffd226335a2e15cb910a9084d6d82251bd5bcabc9353ee2

Download Submit
C:\Windows\SysWOW64\Akkffkhk.exe

Filesize
608KB

MD5
48318f4b3c8916ee87fec902cd2bc7cd

SHA1
f95f7c4a60fe5e4c384428af0e4a54ac62734329

SHA256
0bdd935320e47e19d0d8dfc400060d21b06b62f074b7ebcc47bd728da784c00d

SHA512
e1c17e5c42d5476a4d14a4212be018192d88d87086b56171beec094ecf4ca1079697a6840b5e32d97a5425915e98af86adf94878aacc43613f474645b028148c

Download Submit
C:\Windows\SysWOW64\Amikgpcc.exe

Filesize
608KB

MD5
a2f74ee75a7c5b4eae57de8f96d59a8e

SHA1
5cda320d260a696848d59e9521dd0abcce20faab

SHA256
2fe049d024f63890e28d8ff7006329ba9d1db4ef4e84942f7b889e843e86eb0d

SHA512
f6851117813ab8b7c4f56042492e2a0a43f84e0934ed5e5a86341f776ab943aa3556e26ec291af9dfe45b173811f5d1876763befcffc5279c45de982c005913a

Download Submit
C:\Windows\SysWOW64\Bbdpad32.exe

Filesize
608KB

MD5
a0ff8c80a16d05dedd3506180a1592cc

SHA1
39c6cd2410a26da2ac1ac763c70addfc6993c615

SHA256
73ee48151f560223de69f0f97f9fd1a42720d47d06faaaf0c0ac24c8ad30af9e

SHA512
c1830bfb955ee9ac2a5246ee5702dba60d71ff4954dfdf65dec72b8eb7b406ae67f290230652d4ffb63c69af642f1f38ae4f81ec416c04f1cabc7f5ec763a8f7

Download Submit
C:\Windows\SysWOW64\Bhblllfo.exe

Filesize
608KB

MD5
7bef7cf4366724cec1e0e2f097c428fd

SHA1
65a10ea76c59112df8b31359a890c8ce0a9df092

SHA256
9e4a5fbe73cf62e2b23bb37ed4bf596f376cbd5d017906f859f0f7d9443e3668

SHA512
b8999cde6d249080e2aaf97b6314e8c9e1924fad3b46005ea2d6b8a9c6f8819db35673a254f21a67b850213974354bd371cb12645b5bfb265c3e10442fb678a4

Download Submit
C:\Windows\SysWOW64\Ckdkhq32.exe

Filesize
608KB

MD5
5d225b56294ec1c6e1f27450cae32f3e

SHA1
cd10cdf979d933ff93e9d4543789758962838aba

SHA256
9165320e071d7fb4880e055b4c9bc3dee76d35cb8e4ce320bb36e7cefbe6d581

SHA512
615bbafcca4c7c5e4b382899dcfccce4318ade362d01dbbc9177cec3d2bb65004b7732d79f72ab08298e088f9633bfa5fca8de68cb40d4959bfb71350f5713dc

Download Submit
C:\Windows\SysWOW64\Ckggnp32.exe

Filesize
608KB

MD5
459b29a63c19f02036268977000ce177

SHA1
409860b8810c30575660b49d645813a1a5d5dd50

SHA256
ddeec118e1f9a77aee2691f2215aafc29e6e522351e33d6d64ec82addf2e35db

SHA512
1ab924dc413302bf380c8ba10268b0a0c7fe0d64b70f89d3b3980388a3704c4eb06d2e00684cb60d74530ca8b846e8fc157e1549c1f2f76b21eb012004fa3082

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
608KB

MD5
508fffd77591d97b38e63f3db103778a

SHA1
5a0a83f6f2a70ea37d2ec14faba557c0f52b3f0b

SHA256
f4309caf1f3515df1ac463b9033f7a0bd44cfe3b6eb96a2f6b541d21e082a294

SHA512
5321492f176878c9f620d8d3a2ae5562bb77f5bd1fe3c30bd451a9f8159fe0aaa748405efce032bad210bfd3e03a4f2670925a86f17f8055fdfb7fc998e5b687

Download Submit
C:\Windows\SysWOW64\Cpfcfmlp.exe

Filesize
608KB

MD5
96a22b06b4b32d1e09053a6c37d792e1

SHA1
cf4f1f6d1b945562a03f43d006852296f18ad02e

SHA256
738ee350d0660f20022245f068e8246124c90361e91efc5e45d6d94125cee7cd

SHA512
89c42a57523ae4cdbf15f23d15d38d15d7a861e9ca9c96da56aaa04747b7562cd8a64300a0d257eaed98c4268c237782176c971a72722dd76614be20431ba89a

Download Submit
C:\Windows\SysWOW64\Cpfmlghd.exe

Filesize
608KB

MD5
845926737489212fd78c9ab146670b56

SHA1
2fc80fe31fb298090cae825127d32b4eaba9224d

SHA256
c6dbf76d2f8caa5429aadb7458303cb2530885f515f0710647012cb5bd99161d

SHA512
432973d0f3e317225809676cf1d0aefcb6e94f6fae1cf68f234e97c8a134de0d88b843a1cec1c364f33c88a4d7528e6d0106fe6f8e567d21d7db5c50e02374d5

Download Submit
C:\Windows\SysWOW64\Cpljehpo.exe

Filesize
608KB

MD5
3dfd8f1c02817d22fdfa38e29796a8eb

SHA1
75b8c3cb3dd0d2d912009a411443d9946e31ab38

SHA256
a957f76fd0ce68b392a09e0a549bd60f5259c365c6b0178fdc5f47cf542abd75

SHA512
fdb40393476cd499e659b33ec6f11576a012ea078ad38453c72307ac2f24bff6a92620a1076232c09ec4e01296057d939460e56cba445376fc8d6fcfe7447c38

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
608KB

MD5
3fd0e86c952470b9e37277ae2d5879c7

SHA1
484a77708078e8af2c61f177c98af0a0a38fc04c

SHA256
75496ecea1addc9e1f12ba4cea6bee6085437d8f14c764a9496f005203f2d5cd

SHA512
efb6e6ca90053bae8be42e2551f1cbaab653e277a93cc23585b93cd85413f37a07dd15c38043f9d8e49b672ae61730876b7e18c241f1d1474e5169d2d6ac707d

Download Submit
C:\Windows\SysWOW64\Dhgonidg.exe

Filesize
608KB

MD5
51ccc7eee2f72705743c299d8d2f358c

SHA1
25f2bb8689625f96c0f15dd28582d7e9d9be39dc

SHA256
10a4aec20038fe57c61189a807ad109243bd231054d5a1c093ed592265dd7a47

SHA512
e939146c03eac30d64bc782b9a0e1e4be6f54e0cbfceacf854d69823d489671b29234f984bd13dda8acee5b2b77e355a8e66b3ecfaa287e00a66739b5ba06677

Download Submit
C:\Windows\SysWOW64\Dngjff32.exe

Filesize
608KB

MD5
58e9202de525ce4fa0912b8408decd32

SHA1
e5683d36b7f889ad06ebd6ab2126837b12f7be5e

SHA256
24ae2184fa25579701c2b7987edbd5346c76ed7be9d9eac1779fdf9e7e653fc6

SHA512
209c2e8b687c4343e8aed7dfebcb1bcd2fd277f0586c54d726e1b394e132454bf7e1066983c96eb0f53d98393baebbb1af347334f7e47b0930c5638cdda0e0b9

Download Submit
C:\Windows\SysWOW64\Ebifmm32.exe

Filesize
608KB

MD5
ef9e84242755a5d22d9b7c9ef421d93e

SHA1
be50b2cd7d8fd5bff2af555f4e29c9c4302e515b

SHA256
f425df2f3a853c8ee43964a334dbce2f570aa2bafec18b79443eced43057394d

SHA512
1e165bc696f330467218683254b5468ef614f732d090d6cfd86a9bd3f27794b464968bd8817d811a72caef2a84d0b0c0a64c6400fb92a758423711cc1f870d37

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
608KB

MD5
aed996e4481f67679d5189b75bcca490

SHA1
d0f7b54e4665dca2cf2c9ccd25d40746ba7e1ff0

SHA256
b3d49b2cc9fa1334d9060cacbc1066ec4f3cac1365093e5a6a047862524aabac

SHA512
2b4737d29d3a4477b393e6d90948c5023a7b25f142f48e5184cd1fa801224b9ba9a740704a531ff14a2880fc643cf21ce25ff05a54852895bb117796b278dfe1

Download Submit
C:\Windows\SysWOW64\Eejeiocj.exe

Filesize
608KB

MD5
d24884f85ff0f6b543dae1a6596f75b3

SHA1
9ac7e49d9c1cafc3dc36cdbfce9d77ff23d01a10

SHA256
d1b0ffe12620448d15fdf66abc9b6f735597d81f312d00421056b21ab5620c16

SHA512
44285c2a72d4380c0b0d8acc15228b4204063a86b380ad36232bb8ca7afc3ac3a9bdb3fcb56e3e6ce601b08a2e97a124aabdebf8263fd09d7df55d9118f9c02b

Download Submit
C:\Windows\SysWOW64\Efeihb32.exe

Filesize
608KB

MD5
2eb2f2364f7eec23408cd981a1139aa7

SHA1
a98853394f8fcde779d22e6accad3443a013fb6c

SHA256
ea3eee2cac28eb6d3a485bbc4729698d0cd4c3ebd36beca6ae6187458c064d79

SHA512
fbf2086206ce38f3170071fb477954656c90513e9be938647e687d3d94879e6e4c88698357f2bd3bd775c524c64cb63a4a7c5bc6d5bd37d6e52df540274fd13e

Download Submit
C:\Windows\SysWOW64\Emhkdmlg.exe

Filesize
608KB

MD5
f214f766f5790feb7462cff5cb03634f

SHA1
f60d1e2151bd81b4d0e5819c3b0276de4b232f12

SHA256
ae3dd4794c2726ded77bbae2a1df98819fc47498d892bbfb778178394669e20c

SHA512
a0edf284c07671a6140aa0f9ebeb99bc4295ddfcdafdb82f675124e56c3c7038e4e187925a898cfbcf2e565aa10d4a629a286d6118c056ad8fb835754f3595f1

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
608KB

MD5
12d83c7b6c6f103bd8fcb0beab73fcd4

SHA1
67d962d75ec2519a7c60ec06ac27653259938188

SHA256
21168f74881f5d5cebd07111e2e6ba3aea7d2b918f0f3dfffcaf7078b1b035e0

SHA512
13dc734dc6a3e6dd3f35d727071cb3719a7ab198ebccae1bde4afcb724ff8f9798de3de0b6ac2170b9e0334bab8d3febba8348e648dffaed43a65cb194e7ea64

Download Submit
C:\Windows\SysWOW64\Fbgihaji.exe

Filesize
608KB

MD5
2f18ed1d57ede2c61c0300bcefaa8657

SHA1
f61b8fc2ada8b55a44c09d433e6d6cbf972cecff

SHA256
5296618ef6b2c47555600382f4676582e9b47bf10206e1d29ce48cbe8f717d02

SHA512
0c8daaa0bf9ef3f306f010643440f3d7da2b3f0eec302171a893bdbe2e6171253411bbf09bd827d993bbc3e6ceaed83fd1a59450411351655d89a0994276e60c

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
608KB

MD5
b3addbab42a7644a34b08434d42e6df1

SHA1
68ebbb78f80ff4fd6a024b3c70f603e161f2cebf

SHA256
bc10fcc4e90081eb62bd2465af9def7d571b2ea123235abec4300828e35f7313

SHA512
10408064fdea0c9e79d0642c14017e465c23048445ea387f9faa33b520cdf3eabb14e5f5dc7729cd0d3e18fc905af0dcf35d8c8dc843f5ec03875648375e69c6

Download Submit
C:\Windows\SysWOW64\Feoodn32.exe

Filesize
608KB

MD5
a2863a9a1e7ffc3c89f0446ea936011e

SHA1
eac429776edeb9ba0c1b231f360756d79a1e14cb

SHA256
f9430a77de091f01d1673d19818b58b30d812eefcfce62b828899b938c2888ba

SHA512
2e3bc6c6fc3c7c7aaac4787ed820bb66c8028824ffeb645b10efd309a5d7a0658f92c857b359c4b86f922ca1b9a0153039df42d837ff73783fc5d5b54e796bf5

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
608KB

MD5
5045f30d09a81c4f30c8c812b5bcb3dd

SHA1
40bc3968fe1153e3794dbb803a93d6262d7385f6

SHA256
7a8a6fb57fba748d75793d3b5cae4dba1942d32b7dcf0962170e4d73823c4f48

SHA512
8129b5f18017db5d8c3654c84e9c502dfbcffcd8d75fd1e3adb9bbbedf0961c297f36262a3ef2b81819d1046b757455baeea7f8a77819c8e9b6a9d642232c7bc

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
608KB

MD5
da5f045aec1b642b0d3cc2d393e84b4c

SHA1
e8ae20193a8a12ea8e7f2160a986065ddfe0cab4

SHA256
4773253ef65b19ce4ee8b81260ba532c0baad0b4834e0aafe82df2774ae5310b

SHA512
a84dfdd43a2d527ab19fde9ea70fdc9105eddaddc976d6640d5eb201307d243a959b15b3a07d00e183ef0084d6173dfb3c158798aa61238bf0322b57b39208db

Download Submit
C:\Windows\SysWOW64\Fiodpl32.exe

Filesize
608KB

MD5
68e66316af95aa07db9898ada5a3a1c5

SHA1
9ca13048d9d67e8185d3f418184dec3e69143228

SHA256
b6934b1c8dc7ef23c1670f8775207098dc42383379dcc1d150ef5fb492402e5e

SHA512
80469b2e54f6e6f3d5974be96917a0b6bf11802851853d001e881874e2bab0befd39201356c5f95e1c640e1cc700dd8625c28adf7d1bfdd5ebefa07abc4d1bb6

Download Submit
C:\Windows\SysWOW64\Flkdfh32.exe

Filesize
608KB

MD5
e662952da3d9996bcfc0f45308587ef4

SHA1
c5365a710cc062dd5da83a2f25a65fe77f5d5e1f

SHA256
8a5bebd002261c793e889c5adf07f1b28bc5d20be0999e721bd30c7be4bbbf4c

SHA512
668bfd478b543f1832d1a8bf6dfed11b7a72455f51f4082d11a1c3016e0a7661f38c99589487cbe5ea7f2b22ac0468087c2cd79f5036b1d84d0f33b2678cda47

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
608KB

MD5
9f882d0137b64f64de27803b679ce97e

SHA1
95fcc7da6869fb7fb05f93973136cfda55f4ac01

SHA256
319a45dc4d9aa82109959ace92590f0dc324a016230bfc24967fb9424aa93516

SHA512
be84f7b0aeace0b95c00a9cf8933355c0f6eba19bc793b3d760f8bec3358aa840e747774971f94bfb9c1dcb7509a35d9b9a881a2284428a9f5b08ae8e8296ce8

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
608KB

MD5
b916efb619d6406d04664dcd6dd1a3ab

SHA1
7fa6e243f21fa609400fa8e4711017b9fce1b468

SHA256
0689b8e9ce8ee6bdbef50864c922aace0cca15aed0c766f2fc89709bca0ca54e

SHA512
5dbc7383d40c9d0165b2b96708b0df5faff52f9591008b6b4476f4d8f0d69ae413e3071c1d834b99f997e19273edb6782eaf966171843f4d83684392a8d1246c

Download Submit
C:\Windows\SysWOW64\Fnipbc32.exe

Filesize
608KB

MD5
30a059390baa90f3c73d7ae0745cb2a2

SHA1
90b383d550013a3fc35d2d578b0d0d21e32591f5

SHA256
53f2c365d401aa83e7009d313b414dcebc1e15c9cf650322daba6730865e6fa9

SHA512
1a44b0a249e197f9d7811ceec51ec5f8a1667792697308168e8d01ffaa1c0035289ae1308e1d143ce971fe4495c490b9e730b4e1fe9aff073288c300381c9dde

Download Submit
C:\Windows\SysWOW64\Fnlmhc32.exe

Filesize
608KB

MD5
d768b31c6e7cf05acd0f8259e0f12ff0

SHA1
9b82e3c13b7c059e4ab20ae24379a7b8dc9d5cec

SHA256
81437f7f1aa0e6c27cf32cf777fb787a923b8e02eb21ba1d1834f7b56eb64e93

SHA512
50d266a59d41c212fd1d9f32cd32fa75b36e9e19b0fc043bd30b50336c7f0f7de881146ea640a7dc6cdeeb60089ae26e44c633df1df93bc3f4bd1052e07ff725

Download Submit
C:\Windows\SysWOW64\Fnnjmbpm.exe

Filesize
608KB

MD5
6cc7b600edc4d2a574d128db825633e2

SHA1
0b31618657cd51917888f5ff5b7cbbd9fce8be4e

SHA256
5a5ea5af5b6c5b80b8dd2f180f4c88d07e025c665a976d13f85e0881c8a8889b

SHA512
b34b67478da707aca2399b44bc9711468808db9dbd4e61834322e6efc09c61921904b6cc3fbfd5b526beb9c8207d01129413d6569065332fa948e9b2a307c747

Download Submit
C:\Windows\SysWOW64\Fpdcag32.exe

Filesize
608KB

MD5
3881ddfeaa2867bd8293441421f03532

SHA1
57daa07bdadc6ed80a1721f12d8a3114b044f05c

SHA256
4310a3cc5a3197b41ad5cc194751b9a656323b9a573a8af852ab1b9d2c642af1

SHA512
321f5f4b502967f457c59b409c7fee1d261a5f56fff8d13b14b9c75f9d5f762fb6d3c650a49aa9b392e87ecb0cbdd963f5aad98e3a167b059ea34740db1e23cb

Download Submit
C:\Windows\SysWOW64\Fpkibf32.exe

Filesize
608KB

MD5
bba3d7b88f996d6c162779510223c9cf

SHA1
14b3ae8878a5a8c43ff275f582accd26627a4dbd

SHA256
b16d8171964747db7b529f47a1972982f12093c940d1e135486656c0787feaa9

SHA512
d1240c02c8ef9ba401ec4372cbcb70666333f28fe6eb340325146ed5e86b0fd30e3715e3806e579cf4caf5d589a6c1fa6907cc3d11c0be5d9f1b201b67cb18dd

Download Submit
C:\Windows\SysWOW64\Gblbca32.exe

Filesize
608KB

MD5
29a03e6f6ee4e58d97cc4d9232ceff60

SHA1
6fa1c03277d1891dc0ce22f5b6622ad0a559d20a

SHA256
4a4ed5837e3554ad67753bd0354b95f7b7aed2f29bb838d0d0fd0e99ebbfb0ac

SHA512
d35eb73bdcb4a4924efa12b05e15661abc56b850b83fa971cb2cf30b8e6b15397a76c36c4e07171a73dd8b4f210419e6c72a46b8d9a1eb5c56f50a790dfe1af8

Download Submit
C:\Windows\SysWOW64\Gbnoiqdq.exe

Filesize
608KB

MD5
68cc3b06d56ad85fbcb1a297f2434f82

SHA1
39aab3d58b804fb60d15d3ea1903793f8b81ad3e

SHA256
8f8b3cd6fe0925a860c592b106578c44e66a10ee9566557e520e3d986d5460fc

SHA512
7506adda3626f4259ea26fe3f15f707b379308b12a3ece65743e541456e3131f70957c25c4539c70657e5e76cbb1d25d2f67382ed910e0a58dc32beb8b9aaffb

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
608KB

MD5
327c0a9aa49d1badcb36e86bad5c90f6

SHA1
ecdce0cb2c6270ad38dfa149c9fb3e19cc00db72

SHA256
6c5c0441e0ffd1167e8375c46c737c900155ba9463a8e2e6ddf8e935c2089f10

SHA512
242cf55af3a86a88c5cf93b0c2d4ffb62057a8c52c4a0c91df6869f5b6e876ffd12ab118b7935541470851de6a9c45986f68be0e8408147a1b4f0809293464c0

Download Submit
C:\Windows\SysWOW64\Gemkelcd.exe

Filesize
608KB

MD5
6098fc8cd829049cc791c87ba7946570

SHA1
6dcb13e7110a88d325570796da55db48f25c5289

SHA256
f023d066a344e1c56571e305cea920a0362112da9f9277cd1b1deeac5cd4a0a4

SHA512
a2479ecc8a95e58544e0876bb0e71357fe7ff51e3c40cfcf5742fbfb6315da7475a545369e51212f56cdcedb851179f272d3d410d487ee8b6482b79c85ac055b

Download Submit
C:\Windows\SysWOW64\Gfeaopqo.exe

Filesize
608KB

MD5
e4c560b592b3fb5c4b264d84917787b1

SHA1
6584ff6b30b2d7dfbf8126ba6b4fd6a9eec8b124

SHA256
1ccef54c64ac123e070027455acbf0abcc0c3263ee4a9357911442f0978068ca

SHA512
57d828acf2eacfd999b330256d37581605b3cf01a846720ed9f2912b9d6e1037aa39fe87f8c72bf86b20728d2e5da0810d4e4911697bacf8980868a32ddfe4f0

Download Submit
C:\Windows\SysWOW64\Gghdaa32.exe

Filesize
608KB

MD5
5f8aeaa8ccdb2a4127e23d19537e5db3

SHA1
7ec780138de9aafd6e16bd2353438c09410ff9ad

SHA256
73ec0dfa52741f684fcd3ddfda38451b1b8c19baca2c676ec00bb45459c0dddd

SHA512
058956967d38030d9aa4118a5f939f4f0857fd895f6c2b362a27cb78b305c6c7985b09315818faf226c907eeafcbba968a97be35bdae1d286ddc8cf3cfcfbed1

Download Submit
C:\Windows\SysWOW64\Ggmmlamj.exe

Filesize
608KB

MD5
1a0b83831230d2a55dfa23415956d3f4

SHA1
12a42c3f3fff6b82ba7f0ff9c8d1fae8111641c9

SHA256
460b91c81825d18457791b33d4da8fb0ed5e82ebe6bcc67553d7bd99e093c5ec

SHA512
c3cb2eafa76d0b5adf771aaa6df8422c8f915f09a6e21abfb5b76e12c9c689a964e6f44cf2fc1b161fda43cdf4f9c5269453d042a60dad0a18d7d218e11b2400

Download Submit
C:\Windows\SysWOW64\Gidnkkpc.exe

Filesize
608KB

MD5
3e381229b7198f7a881e7c1f2c11aeb8

SHA1
37696e4c71c39cbe5ffbcf64ee17eca41ee01bde

SHA256
89018a1b1ebc8c1f841b99c46359def95f612758ee6cdc73ebcd9540d16073f7

SHA512
b95c948d7073f27e9e52b94329d23174fff19da9b1b25b568ed1dada3981f3fe49fd3a7ca4a901a53daf8301efa4e8ceda6921efc2d82fc0fbb5874afb0fe54a

Download Submit
C:\Windows\SysWOW64\Gifkpknp.exe

Filesize
608KB

MD5
286f6b51dcb751f34222546496bc950f

SHA1
70355da8f9ad807476f0c1500c0a481a08c29a52

SHA256
0f213446fa46dbc8b321ab8e5bfb3538f4b636c6ed2c546e9b7b3c8b38c4d856

SHA512
e8908ed9931828bb9e882806b546932909fb7146b700ef1ad993e74ec8bb0e258ff6ff07c89a7b100d115bc3158049731be3cbf356f3456d591f9c6aa23b5272

Download Submit
C:\Windows\SysWOW64\Gihgfk32.exe

Filesize
608KB

MD5
85ac33f610b83484daa9fa63693e6fa5

SHA1
b7c0bf9ec5a12c8de9157e575239875b03567830

SHA256
7cbb28285e227db4e475ef03aff1c5d16509572d3933ec75eca4397371aa48a3

SHA512
8e3a8a703cd4192271147b33d2d39145115be681c1a72efe5062db100a0997b99bb94f1383e3cee12c72848775c2d38dabafeca1b24d4db72122df6eb4fc9c60

Download Submit
C:\Windows\SysWOW64\Giljfddl.exe

Filesize
608KB

MD5
22bc0ac0bf46e45f5e1c5a5156cb9922

SHA1
7dc839b92337e5da28054e6562b1c428697abd71

SHA256
85490b49f6b0bde78a6c6192af908b8d96f43707b69d0921888adb07779eec99

SHA512
f6dc28ebb4e7bb4369091e30cf2c9ed240182f64058e534b2598c11b7bf2e52c332d4dbcf94f3c5dd7beb3f647ef47affe8853d31b50a5866e12d9af11d4c1d1

Download Submit
C:\Windows\SysWOW64\Glbjggof.exe

Filesize
608KB

MD5
443a1563a3569ff8d5a9048be6d7e9c4

SHA1
b46e7910226466b85567aa2a8beaa48e0d288286

SHA256
7415f746d561ad14b09fc122817a4dcf53b9951ebc4c22344cd4926f64cb288e

SHA512
63774e8e8fb79b34c53f2ff5e36384c0c12bfbd7d9d1463fb5bb7025276f25af2fa616c2c230f96c69667e7b3c232b972123b9fbe19e60771c4d66b0c1b47d08

Download Submit
C:\Windows\SysWOW64\Gldglf32.exe

Filesize
608KB

MD5
610cee65af55b9124f26966f317e6ab8

SHA1
a3b0ea39884187d44bfe1fd06bbc6f364b86d5b6

SHA256
8fb5d5d354e0a0dd9c54df172e0d2c6bcede3c0c61b1de940a7af06fd5647bca

SHA512
765aa76eab611c69c99d32d79ee89913ae50c0840b140a08b96b4c54ac8bbcea085132da3a0b60018655a45c5593a80af131929edfe172699f191999657c148f

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
608KB

MD5
ffad327d7167e9b784e25982fab955c3

SHA1
cb8afcf96504d81c810276923ddc14f6b669445c

SHA256
8570bc1ffb5e28e96a6347750cb7a8d0160dbec5547cb05ae9e8962ca2d637ad

SHA512
424c8e1a720487675542e5cb40942a140b8aeee3a7e70c86592099ea4eabbca1e61df0f94ae2845d1a2a5bbe95d67e0127fbbe7cc8aedc7bff89ca0e85a40696

Download Submit
C:\Windows\SysWOW64\Gnnccl32.exe

Filesize
608KB

MD5
3b5d96f52df88dc6dd4663fbd4529b31

SHA1
e919d0100a28cf4d76ead229f523e13bda9ec06c

SHA256
d9e4738d67b5b34c287988c78edae47dd105aedf02b3f47c02cb6fd10e9090c5

SHA512
0c25202fb14fd577afddf19fd220e19611323ef7440475be3f12603b0e9a16c93ada59f3e302da457c59757b3bdf1aedd6f0f53f3e9a19bd823c8ed32da93e37

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
608KB

MD5
2c97ed7dce5d2f87cb21ab4fb0ea23cc

SHA1
6883a7b20e9ae7f7d61095a22c45de804ad010b2

SHA256
39afbcd70207248494f53e96f5a92d34952fb89e7d58558d8cc5cb6ba873cc03

SHA512
da15a3b430c992ec3071e4279db1b774edda1ef5ae665a09ab6db3630dfa5746a6f17beebfe2710940d2b7d071ff8a2151e27f495e7a2098d7e24e9b39b83bcf

Download Submit
C:\Windows\SysWOW64\Gppcmeem.exe

Filesize
608KB

MD5
74afe3001df40e6636a4ab7fd639ce90

SHA1
63998bacdbc4d3f018a2a3ca8a0a8fa87694944e

SHA256
d05207b1a718f2adfb8e5bb207e40a604f05e00b55be61b5111cdf4b6f160470

SHA512
dfe0a3b7d8a30f8f4b6b0e6a6753458f696390cf9547d1835426fc890bb39f16a429dd73765dee0841f4ad08b4bcf7b90d5348c877ef7eb0dd06c78364bfd6d9

Download Submit
C:\Windows\SysWOW64\Halhfe32.exe

Filesize
608KB

MD5
659376f118fb039878f958e28078cf6b

SHA1
87df45db962748506bb01d707a5b200e77de262f

SHA256
a3da697df477eb700eef9e9c63df24cbb0e47cd2311e4f3a330f27b78e2a1f93

SHA512
3d730710a585ef8efb8d0d4b7a8eccd25721768a4b500d4f088853882baf3971b287bbb1810c3cac7404a32a444b8630e12389fd0e02142826c98edbfb3cf935

Download Submit
C:\Windows\SysWOW64\Ibegfglj.exe

Filesize
608KB

MD5
e9f881c70b30d4303c1a8197763a124d

SHA1
74954bcd9204b2df16513d2fc0ffcdddc3788d16

SHA256
eeb92945147457d04a655a72c19c5722f1d19419f94884e05d13052ed1c8edf3

SHA512
ad6a0ed3e75a57f144fc9ff17c158e4b92f232bb6098c0b2f46c9154d4fa7cdce127e33e1f35b91cee81cbfcee88471fa03efe5c13895b7eef7c4c5a4f9e627b

Download Submit
C:\Windows\SysWOW64\Kcmfnd32.exe

Filesize
608KB

MD5
27060aabde8f4364f74496f6760640e7

SHA1
263b2d8a1b45de8caf8cf07b15cddf20892e03bb

SHA256
629b2169da1f955c4c19fbf727016315c8814843acaad2097bd7956d5b16ab9f

SHA512
aa05795070f598b4947f215a78aa376a5e8b1740d063c7628a7d955c0411670cac83ae9cfb30568c52a1ca21d301b023f3e8239ed97e0c508ba11e9e3470db67

Download Submit
C:\Windows\SysWOW64\Kolabf32.exe

Filesize
608KB

MD5
377f1d7c2533f3f55b872875303e1c74

SHA1
37798f9620fbf63e5d3bdf4db104104810b08565

SHA256
ca593017d46d67b5a13255df3e9b5f429ce47f9acfa853b725db297fdf4b4137

SHA512
22fc4013ff5efea9476a49f8154c42e7ea947e3494adeef647def5c0a1cdf50d90e7e0c7e1fcb332dd6c03ce0ce32d11457cd88e4269063daf8ab61f49513961

Download Submit
C:\Windows\SysWOW64\Kpccmhdg.exe

Filesize
608KB

MD5
f6a65b88400401e6b863e83e920d9eb7

SHA1
85bf239e0d3ec1144dfe5c8309367c900a011c07

SHA256
df5b4c4ace5dbb3cbeb3a588ebee77b908138ef848004e918789720169581e1d

SHA512
55af1de29a17d38dd5c5be59b169e1ad1e0fd6af7af4af566b5e4b4b364ccbbe396482a9370b179cdbfe1ef85f074492db57c026c79f2c77769579a06cd7a635

Download Submit
C:\Windows\SysWOW64\Laiipofp.exe

Filesize
608KB

MD5
6a2f0125d02b8828323defb191877de1

SHA1
f8c232f8d0b6130671a2b4f6fbbb55e8993e42f5

SHA256
05332d75eccaf9e233578cf467b1e9b1cca7c5609cf265c00be571b3ebe959f5

SHA512
a68e0017409ddceb5a1459f4006740caefcec30c82dfcff4326cca8290d5b4809c8ec213e230fd98d4fb04c67b040e432dd17db1a7316436e0f5da8ca9115457

Download Submit
C:\Windows\SysWOW64\Lgdidgjg.exe

Filesize
608KB

MD5
31e4400bea1bb0c1857083c5ab9b97a2

SHA1
93b8fef3bc6cd781654d0567f1d0b09aeeb41cfb

SHA256
b47cf779d7b299cb980d9771ad069eb9a041af21c823e8668042f7e1d3f58d35

SHA512
e1bef61eb9ddb66541b1582d6813270149f40d58cfb728102c90c5b4986190a6ecd1bf698769e5ca7db5afd87d9818621258116cef18855844039deaef383b5d

Download Submit
C:\Windows\SysWOW64\Loacdc32.exe

Filesize
608KB

MD5
c8c8fbe779ef7beefac05f24af85bc6e

SHA1
2d7caa42305de602a5a0b41274492efaa38559d6

SHA256
307b98dbcb2082af488644b13083eb5eafd09b8f1d0396b8a3855668074de483

SHA512
3e152878fa249343fec9649bdfb7c0a5029a208133be07d18e232bb266a2401b08a8b1cab27b3a9f5fc32f5c6de483bdb5e3995d1319cda983759590e68276af

Download Submit
C:\Windows\SysWOW64\Mfenglqf.exe

Filesize
608KB

MD5
3d0da1c27de3071ee53a9b80e58442cd

SHA1
d632cdcb988c6ca518757c7e11e7873ef1823e55

SHA256
c1f68dfaf1aa52b287ad993ae036774ccbacb148f17981187dc784a26aa64ffb

SHA512
651d2ff3780bece6e539907ea00d4fe4fe2cf86bdf0b5bf530e4bfd9e2b01400a3a721d904ad9785bd88fdbb03c99eb393532aad8882e229d48c9aba17639ffa

Download Submit
C:\Windows\SysWOW64\Mhoahh32.exe

Filesize
608KB

MD5
b72c7f0cb5288b5756ed5eeced4b9609

SHA1
d1f0bf2e7de3853bc20b4e3416477ae7a42265e1

SHA256
48d958413059eb700d2ade90b3057a311f237afe87b83f42c0e846258a113450

SHA512
710cf0398c7625ccf7a9e678b19f61cc8b574f052e35f082f52dd57a4c5b1b1f7f1e7a65bd5285adab4a08910540e41341223558eadec6906a1084ac5273e71f

Download Submit
C:\Windows\SysWOW64\Mqkiok32.exe

Filesize
608KB

MD5
f3640d39c3d67f847c231425637bdd05

SHA1
5835d6baf7bd695d88bbcf2db4b7344a9e0d77d2

SHA256
bddb743d220266599f143cdbae69ec7a5fda76f008ba0dffa7be17b7ba535a55

SHA512
14a66f19b1daefd9c3e37f75045fd73444da8c2f120be15d258baaac226eaaae024472c552a65fee6643cde8b49a5d95a1a6511b707f47f57fda480a92e50860

Download Submit
C:\Windows\SysWOW64\Noblkqca.exe

Filesize
608KB

MD5
4581579eb3494fdd5ce48c5404073b29

SHA1
c93460d5d7c237af05a0fbd5522fedf3009970b9

SHA256
93ebcbddec330786f3cd79a21bb9499a8136593fde0391633b4e92ed1c1a9475

SHA512
e83737e424efc88311a6ff4bd6bf3cfa9a0dfe899a90a2c474de32f2cca26788a8142a06cf5623491f9e5e233d74c3aa291ccb2f758416caa5a4c23fd00b7d14

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
608KB

MD5
b9bc9e5b41927006e34f63eb00234fa9

SHA1
ef75271641e70b7e57cd1b2010cef8a4a90df986

SHA256
1dbff88773188cad4503c9f974f044c8676f165f3ee719606a9763982dbe5baa

SHA512
a6557357a16125908908c9c443aef3c4c9bf00a5b9eaa531f11fdcfa097609f89282e92da8ff6b25f0e15240f77584193f6aa03a7b67aba8a5ddbe1dbceee30f

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
608KB

MD5
bebabd60161b1fe73071008f730d4662

SHA1
c3f61f6d719326969a09333ba4c9e4414f6f0965

SHA256
778d6d0bf2b072e0c6c1e580a715ff8dd4a0f91caaf528eaabe81f13bb3bcf2e

SHA512
bb27b4c68450529e6f7b947e0c08351d30ba2f43a508b8e414a6031c09e771815ca28f17aa4bf8d758f22cef5cf257ce5cbeb20ca6d8e24477608fdf9485ae83

Download Submit
C:\Windows\SysWOW64\Obgohklm.exe

Filesize
608KB

MD5
719c39bc78ba521df4c15e990f62d76d

SHA1
2f4a7b50836c34503d3e763d61740f6305a0e2fd

SHA256
65762208cbcaa032c4b8341a89f4e808d141d83615122f6256c67e913a71ac21

SHA512
a8a7641537a82b691fe976519f0b71e270da5639c4a67d563ae224e0b8a94d3737b9c255ba3bb83737ab67cdd51f613545fc7373d7b29638850276e662a911bd

Download Submit
C:\Windows\SysWOW64\Ofpnmakg.dll

Filesize
7KB

MD5
13c3ab2e6dcc7cce1216245d8edb6b7f

SHA1
15fc6bcb09fbb55c409068e57b888898b39ba89d

SHA256
b04959ab9ccb7ec6828ab970e64ea63b92350e07d7d9831d7d44e914a2c38c3e

SHA512
aea7d7c131f81b057fe88c38195e1a5504845397524703b061d28d2587b5346a804b30a9ea96bdbbaf0b1c9d7336a0109c86c14bb71a2a186777f0bc8652137a

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
608KB

MD5
c4430921072e49db0f72a6707005f7f3

SHA1
37e22c9f87fab061ef64d7f4ac6a5ea26b7ea07c

SHA256
af07162620f3214e51d99fea1ee8c68ba8586ff0af0f9f316c7213131cc7a04a

SHA512
7645f559a89c6a42b7901b5d2bed19b634c2a1c06fa90cdba7fb94d08621a551b78cc7f8b55dd587ad299a277fdebb0c96f5d6d313d2a24c8997e57b05c58622

Download Submit
C:\Windows\SysWOW64\Oonlfo32.exe

Filesize
608KB

MD5
e87ba99121fb6de56f9f24f2165a222d

SHA1
7d6e19028b6c467b870f4ea38db1abd69cd1a3a1

SHA256
541a5a7d8c9cd28944739fbc46d613c743d4ba34387ffbc786276cc415e3e16d

SHA512
f3576342940387cbe9a4196fbbe1d56e9a52786a852cd732689f77b9bb02f8c2ec94742d600763f09b5d6465a534118a58e3f9c5cbd590c20fd562aa2319b631

Download Submit
C:\Windows\SysWOW64\Pbhgoh32.exe

Filesize
608KB

MD5
5d480cd84dd80929b6162a62493cc1c2

SHA1
9dc7d8992e7255eda81cc32e884798cca9ba0867

SHA256
406ba83d6a7d81e23153388363b357b3e938a60ff306934c5979afe3c8fe77ca

SHA512
771f93b06c5414c2b5087c32d76438f18ef6f43ed0d52dd372f9dd3c35d51e5e3f126fe6c9abda6b7de6d12af2da6c81a206f81cb811d1569a9da84f0c0bf112

Download Submit
C:\Windows\SysWOW64\Pciqnk32.exe

Filesize
608KB

MD5
91a5665aabf82726822f611764c3aa87

SHA1
b3247a9401bd1a531c3a9f2aa0a6c53bcccfa414

SHA256
b4c9f0ec1aee5419d7b26e2025f29de6a2050ec423382467ec5fb92d04e7118f

SHA512
5b82f17b303dfab09c260acb15414850aef059c7cae1d95a75dd4381acd7a1ccda7e38c114401e22db3126521e2eddc0df4ff2e6d06ddabfe855e6a756c158d0

Download Submit
C:\Windows\SysWOW64\Pdjgha32.exe

Filesize
608KB

MD5
f6cac828b151a1218481132e479e99bf

SHA1
e14c8b43b01fdb4731bdfb8e201bf641fe8a8499

SHA256
ba6c9b55ceab6274b693a4dd4f096e31ebeefb13b51fdd979ae77661bb1fc5f6

SHA512
9d795141540e7fdb342fc75143e9b3d5072cb46eb48f3883276a564188e797104fb61ca015a825f6538c33088c90a19dbe7e3eb651709dd4891ced88b27459ba

Download Submit
C:\Windows\SysWOW64\Pmhbqbae.exe

Filesize
608KB

MD5
4ae3abff655f08d788f85e1796059d60

SHA1
beb26f83ca5af17953a50f996aa9fc6b3e4914fe

SHA256
19f19593876127d9d450e02d3f6247c085c896fb5e84b8f26fc63831169dcc4d

SHA512
a9a407c81e9427940484a656278220953e191dc60ec8886f78cc47a45fe866c4c6892fe02c9b2755a092491bd53281442b6cab9b8bef9cac935ad1d0d9466095

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
608KB

MD5
b5f1c4d609308324bd8ec21d0bb02ce2

SHA1
7ef1fed5aa8d3582b5605c9a12a24e298db4b958

SHA256
3a78787eab5d48cc79f2fdac544c992c8aa135e625a979cb355506a6d2152d98

SHA512
d4c05bb0598b80316f5842c83681eadb6c4e6236544d2fc5a5c95e5771fbc96a8bdbf43fb7f7c703985abed3cd3af5e39c0aa7ea9f6615ea7e0872771cec4fd2

Download Submit
C:\Windows\SysWOW64\Qfmfefni.exe

Filesize
608KB

MD5
834f4c9daf35c8ac693957bf77b46412

SHA1
8476b86e047ef5d61688eafa4ff70fae948382a3

SHA256
c5c569ec3afa4e51fff9fc896214ce6f081cfaae6cba76d74c91aa83c8f67d6d

SHA512
c22ea908bfc687f048c7f8e765e7d93c14bdcaccba46975874ce60efaf6a5ec37e45c3ac78c423830fbe0ab03f55772459e7ba4fe7676c6c957cd3ceb70e5f45

Download Submit
C:\Windows\SysWOW64\Qhhpop32.exe

Filesize
608KB

MD5
417fcb7c488dd2c0dc41d15372a486b4

SHA1
6ea07c7abfadacc1fff36237181c0709b83851c8

SHA256
cce0096488a73b1524412e6989f1758c08e4bbb5ff07fb6b7165bd88bbf47b6f

SHA512
295012667ab43df8ad05bb1cf5e63b2ca5ddbb0874faaf65b9ea89f4d6fb50332bad8736a8496b6b4cfa9a389306fddcf92d978a77d32b9dca435a444121a81f

Download Submit
memory/216-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/224-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/336-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/524-84-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/660-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/848-506-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/852-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/876-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/916-284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1124-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1160-458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1204-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1364-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1364-569-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-350-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1656-488-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-482-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1856-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-548-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-494-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1976-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1984-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2044-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2112-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2136-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2164-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2256-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2452-92-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-320-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2528-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2536-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2672-576-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2672-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2680-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2768-590-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2768-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-562-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-597-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3048-410-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3100-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-296-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3164-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3312-440-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3556-290-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3712-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3740-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3804-500-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3824-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3952-470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4044-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4088-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4112-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4156-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4200-308-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4436-108-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4500-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4568-398-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4648-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4736-512-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4744-583-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4772-272-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4832-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4836-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4856-326-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-555-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4944-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5052-434-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-476-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5156-518-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5200-524-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5244-530-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5276-536-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5316-542-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5364-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5408-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5448-563-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5488-570-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5528-577-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5576-584-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5620-591-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5664-598-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8460-2317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8528-2316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads