berbew | e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643

Analysis

max time kernel
90s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643.exe
Size

1.2MB
MD5

86488fb3943dda6c2c057db66bf0a16f
SHA1

f5f5c90a33d43e08ecb1277ad22032e7fbea8ba6
SHA256

e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643
SHA512

3e71bbdfd7873353008646402457947c734b37be3fb3e84c4c2d4763542b3fa0bd29ee1d889b2025471c71b7007355e69ea3b629267c1cd0e89636dfa3150665
SSDEEP

12288:0HwM2UuHk8D1fIz7kzwFYvNA+XTvZHWuEo3oW2to:PzwFYv2EvZHp3oW2to

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djjebh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebommi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glengm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdkdgchl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcecjmkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgfapd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilccoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmaamn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeddnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gingkqkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcmbee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjodla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmcolgbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fideeaco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmgfedl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcikgacl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgipcogp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcigeooj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdpmbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfbped32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfefkkqp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfjpfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfjpfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbfgppo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjmoag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cioilg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flngfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnhcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmafajfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfcfmlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hloqml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekodjiol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbloglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahfmpnql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dihlbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlegnjbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiloco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpofii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iknmla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmhand32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebejfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbdoof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmieae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpdhboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnoga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdglmkeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgfapd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdmoohbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iljpij32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3808	Plpqil32.exe
2268	Pcjiff32.exe
3036	Pidabppl.exe
4860	Qebhhp32.exe
3568	Aeddnp32.exe
1728	Ahcajk32.exe
1656	Alcfei32.exe
4512	Ajggomog.exe
3056	Bfbaonae.exe
1428	Bmofagfp.exe
4020	Bheffh32.exe
1856	Bopocbcq.exe
760	Cmcolgbj.exe
4904	Cobkhb32.exe
2316	Cijpahho.exe
3400	Cmflbf32.exe
4820	Codhnb32.exe
2672	Ccpdoqgd.exe
2088	Cfnqklgh.exe
2828	Cimmggfl.exe
4056	Cmhigf32.exe
3948	Cofecami.exe
5044	Cbeapmll.exe
2460	Cjliajmo.exe
3296	Cioilg32.exe
1132	Ckmehb32.exe
4880	Ccdnjp32.exe
2724	Cfcjfk32.exe
4960	Ciafbg32.exe
2236	Ckpbnb32.exe
220	Ccgjopal.exe
4928	Dfefkkqp.exe
2032	Diccgfpd.exe
2984	Dkbocbog.exe
2172	Dcigeooj.exe
4468	Dfgcakon.exe
1984	Difpmfna.exe
4168	Dkdliame.exe
564	Dckdjomg.exe
1836	Dfjpfj32.exe
464	Dihlbf32.exe
4852	Dlghoa32.exe
1916	Dcnqpo32.exe
2360	Dbqqkkbo.exe
4012	Djhimica.exe
4152	Dmfeidbe.exe
4908	Djjebh32.exe
3324	Dmhand32.exe
2296	Dpgnjo32.exe
1156	Ebejfk32.exe
2232	Ejlbhh32.exe
4592	Emkndc32.exe
2472	Epikpo32.exe
1456	Ebhglj32.exe
1740	Ejoomhmi.exe
4692	Emmkiclm.exe
3020	Eplgeokq.exe
3504	Ebjcajjd.exe
540	Ejalcgkg.exe
4500	Emphocjj.exe
3900	Epndknin.exe
4816	Eblpgjha.exe
3912	Efhlhh32.exe
624	Embddb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Gpecbk32.exe	Gmggfp32.exe
File opened for modification	C:\Windows\SysWOW64\Hibafp32.exe	Hgdejd32.exe
File opened for modification	C:\Windows\SysWOW64\Jnelok32.exe	Jkgpbp32.exe
File opened for modification	C:\Windows\SysWOW64\Kdpmbc32.exe	Kmieae32.exe
File created	C:\Windows\SysWOW64\Lnmodnoo.dll	Nmfcok32.exe
File created	C:\Windows\SysWOW64\Aooold32.dll	Lckiihok.exe
File created	C:\Windows\SysWOW64\Cijpahho.exe	Cobkhb32.exe
File created	C:\Windows\SysWOW64\Igigla32.exe	Ilccoh32.exe
File created	C:\Windows\SysWOW64\Kglmio32.exe	Kdmqmc32.exe
File created	C:\Windows\SysWOW64\Bllbaa32.exe	Bafndi32.exe
File created	C:\Windows\SysWOW64\Eifaim32.exe	Ekodjiol.exe
File opened for modification	C:\Windows\SysWOW64\Djjebh32.exe	Dmfeidbe.exe
File opened for modification	C:\Windows\SysWOW64\Dkhnjk32.exe	Ddnfmqng.exe
File opened for modification	C:\Windows\SysWOW64\Lpfgmnfp.exe	Kcbfcigf.exe
File created	C:\Windows\SysWOW64\Ifolcq32.dll	Mcpcdg32.exe
File opened for modification	C:\Windows\SysWOW64\Ffobhg32.exe	Fdqfll32.exe
File opened for modification	C:\Windows\SysWOW64\Kjhloj32.exe	Kgipcogp.exe
File opened for modification	C:\Windows\SysWOW64\Dngjff32.exe	Dkhnjk32.exe
File created	C:\Windows\SysWOW64\Nlnhqepf.dll	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Dlqjei32.dll	Fmikeaap.exe
File opened for modification	C:\Windows\SysWOW64\Jddnfd32.exe	Jqhafffk.exe
File opened for modification	C:\Windows\SysWOW64\Nnafno32.exe	Nnojho32.exe
File created	C:\Windows\SysWOW64\Qedegh32.dll	Ombcji32.exe
File opened for modification	C:\Windows\SysWOW64\Gmggfp32.exe	Gkhkjd32.exe
File opened for modification	C:\Windows\SysWOW64\Aahbbkaq.exe	Aogiap32.exe
File created	C:\Windows\SysWOW64\Gmfmgg32.dll	Kdkdgchl.exe
File created	C:\Windows\SysWOW64\Nnicid32.exe	Nnfgcd32.exe
File created	C:\Windows\SysWOW64\Ogigdpmb.dll	Hpiecd32.exe
File created	C:\Windows\SysWOW64\Aagkhd32.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Olaqbelh.dll	Cmhigf32.exe
File created	C:\Windows\SysWOW64\Gpbkpm32.dll	Dcigeooj.exe
File opened for modification	C:\Windows\SysWOW64\Iknmla32.exe	Icfekc32.exe
File created	C:\Windows\SysWOW64\Ppioondd.dll	Dfdpad32.exe
File created	C:\Windows\SysWOW64\Lmaamn32.exe	Lomqcjie.exe
File opened for modification	C:\Windows\SysWOW64\Ebhglj32.exe	Epikpo32.exe
File created	C:\Windows\SysWOW64\Epndknin.exe	Emphocjj.exe
File created	C:\Windows\SysWOW64\Jqhafffk.exe	Jnjejjgh.exe
File created	C:\Windows\SysWOW64\Nmfcok32.exe	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Cogddd32.exe	Chnlgjlb.exe
File opened for modification	C:\Windows\SysWOW64\Ffaong32.exe	Fdccbl32.exe
File created	C:\Windows\SysWOW64\Jgkdbacp.exe	Jdmgfedl.exe
File created	C:\Windows\SysWOW64\Famcfn32.dll	Lgccinoe.exe
File opened for modification	C:\Windows\SysWOW64\Jcanll32.exe	Jleijb32.exe
File created	C:\Windows\SysWOW64\Iohmnmmb.dll	Ahfmpnql.exe
File opened for modification	C:\Windows\SysWOW64\Glcaambb.exe	Fideeaco.exe
File opened for modification	C:\Windows\SysWOW64\Hpofii32.exe	Hmpjmn32.exe
File opened for modification	C:\Windows\SysWOW64\Jcbdgb32.exe	Jdodkebj.exe
File opened for modification	C:\Windows\SysWOW64\Fbelcblk.exe	Feoodn32.exe
File opened for modification	C:\Windows\SysWOW64\Amjbbfgo.exe	Afpjel32.exe
File created	C:\Windows\SysWOW64\Aknbkjfh.exe	Ahofoogd.exe
File created	C:\Windows\SysWOW64\Alcfei32.exe	Ahcajk32.exe
File created	C:\Windows\SysWOW64\Kjccdkki.exe	Jgeghp32.exe
File created	C:\Windows\SysWOW64\Moehgcil.dll	Aahbbkaq.exe
File created	C:\Windows\SysWOW64\Cnahdi32.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Ljhnlb32.exe	Lfjfecno.exe
File opened for modification	C:\Windows\SysWOW64\Ljqhkckn.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Bpdnjple.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Ccoecbmi.dll	Bmeandma.exe
File opened for modification	C:\Windows\SysWOW64\Ejoomhmi.exe	Ebhglj32.exe
File opened for modification	C:\Windows\SysWOW64\Fdccbl32.exe	Fllkqn32.exe
File opened for modification	C:\Windows\SysWOW64\Hgfapd32.exe	Hdhedh32.exe
File opened for modification	C:\Windows\SysWOW64\Ipmbjgpi.exe	Innfnl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10056	9936	WerFault.exe	452

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpdhboj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iipfmggc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbeapmll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmhigf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdobnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igigla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojbacd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cobkhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epikpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epndknin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icfekc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnhcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gppcmeem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iomoenej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcanll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alcfei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bheffh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Difpmfna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejlbhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flinkojm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfokoelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgfapd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilccoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Plpqil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhclmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knalji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hdmoohbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljqhkckn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cioilg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cimmggfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfgcd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddnfmqng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kodnmkap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidabppl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Injmcmej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklbdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klcekpdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckgohf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djjebh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emphocjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idahjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloidijb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmmfmhll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckiihok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eplgeokq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljhnlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hildmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ffaong32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glcaambb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgdejd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijqmhnko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfpdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckpbnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejoomhmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knhakh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnqfcbnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoeieolb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djhimica.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgiklme.dll"	Hcmbee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnelok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kqmkae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnfgcd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojgjndno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paelfmaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdaia32.dll"	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdjibj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icdheded.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gejopl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdcghbo.dll"	Jcanll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiohdo32.dll"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhlndcmq.dll"	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpoeg32.dll"	Aogiap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hccdbf32.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emkndc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcmbee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obnbpa32.dll"	Mccfdmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jedccfqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfokoelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebgpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijqmhnko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojnkocdc.dll"	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlgcp32.dll"	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccgjopal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmhand32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgflp32.dll"	Fbajbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ememkjeq.dll"	Kjccdkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipgijcij.dll"	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmpjmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlmdbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iebngial.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbloglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdehni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojgjndno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnbidcgp.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajggomog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdlfhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfqnichl.dll"	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgqoll32.dll"	Lomqcjie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gologg32.dll"	Igigla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhhdjbno.dll"	Bafndi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkhnjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiiggoaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iphioh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdnpclpq.dll"	Jgbjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mccfdmmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoeieolb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3808	3564	e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643.exe	85
PID 3564 wrote to memory of 3808	3564	e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643.exe	85
PID 3564 wrote to memory of 3808	3564	e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643.exe	85
PID 3808 wrote to memory of 2268	3808	Plpqil32.exe	86
PID 3808 wrote to memory of 2268	3808	Plpqil32.exe	86
PID 3808 wrote to memory of 2268	3808	Plpqil32.exe	86
PID 2268 wrote to memory of 3036	2268	Pcjiff32.exe	87
PID 2268 wrote to memory of 3036	2268	Pcjiff32.exe	87
PID 2268 wrote to memory of 3036	2268	Pcjiff32.exe	87
PID 3036 wrote to memory of 4860	3036	Pidabppl.exe	88
PID 3036 wrote to memory of 4860	3036	Pidabppl.exe	88
PID 3036 wrote to memory of 4860	3036	Pidabppl.exe	88
PID 4860 wrote to memory of 3568	4860	Qebhhp32.exe	89
PID 4860 wrote to memory of 3568	4860	Qebhhp32.exe	89
PID 4860 wrote to memory of 3568	4860	Qebhhp32.exe	89
PID 3568 wrote to memory of 1728	3568	Aeddnp32.exe	90
PID 3568 wrote to memory of 1728	3568	Aeddnp32.exe	90
PID 3568 wrote to memory of 1728	3568	Aeddnp32.exe	90
PID 1728 wrote to memory of 1656	1728	Ahcajk32.exe	91
PID 1728 wrote to memory of 1656	1728	Ahcajk32.exe	91
PID 1728 wrote to memory of 1656	1728	Ahcajk32.exe	91
PID 1656 wrote to memory of 4512	1656	Alcfei32.exe	92
PID 1656 wrote to memory of 4512	1656	Alcfei32.exe	92
PID 1656 wrote to memory of 4512	1656	Alcfei32.exe	92
PID 4512 wrote to memory of 3056	4512	Ajggomog.exe	93
PID 4512 wrote to memory of 3056	4512	Ajggomog.exe	93
PID 4512 wrote to memory of 3056	4512	Ajggomog.exe	93
PID 3056 wrote to memory of 1428	3056	Bfbaonae.exe	94
PID 3056 wrote to memory of 1428	3056	Bfbaonae.exe	94
PID 3056 wrote to memory of 1428	3056	Bfbaonae.exe	94
PID 1428 wrote to memory of 4020	1428	Bmofagfp.exe	95
PID 1428 wrote to memory of 4020	1428	Bmofagfp.exe	95
PID 1428 wrote to memory of 4020	1428	Bmofagfp.exe	95
PID 4020 wrote to memory of 1856	4020	Bheffh32.exe	96
PID 4020 wrote to memory of 1856	4020	Bheffh32.exe	96
PID 4020 wrote to memory of 1856	4020	Bheffh32.exe	96
PID 1856 wrote to memory of 760	1856	Bopocbcq.exe	97
PID 1856 wrote to memory of 760	1856	Bopocbcq.exe	97
PID 1856 wrote to memory of 760	1856	Bopocbcq.exe	97
PID 760 wrote to memory of 4904	760	Cmcolgbj.exe	98
PID 760 wrote to memory of 4904	760	Cmcolgbj.exe	98
PID 760 wrote to memory of 4904	760	Cmcolgbj.exe	98
PID 4904 wrote to memory of 2316	4904	Cobkhb32.exe	99
PID 4904 wrote to memory of 2316	4904	Cobkhb32.exe	99
PID 4904 wrote to memory of 2316	4904	Cobkhb32.exe	99
PID 2316 wrote to memory of 3400	2316	Cijpahho.exe	100
PID 2316 wrote to memory of 3400	2316	Cijpahho.exe	100
PID 2316 wrote to memory of 3400	2316	Cijpahho.exe	100
PID 3400 wrote to memory of 4820	3400	Cmflbf32.exe	101
PID 3400 wrote to memory of 4820	3400	Cmflbf32.exe	101
PID 3400 wrote to memory of 4820	3400	Cmflbf32.exe	101
PID 4820 wrote to memory of 2672	4820	Codhnb32.exe	102
PID 4820 wrote to memory of 2672	4820	Codhnb32.exe	102
PID 4820 wrote to memory of 2672	4820	Codhnb32.exe	102
PID 2672 wrote to memory of 2088	2672	Ccpdoqgd.exe	103
PID 2672 wrote to memory of 2088	2672	Ccpdoqgd.exe	103
PID 2672 wrote to memory of 2088	2672	Ccpdoqgd.exe	103
PID 2088 wrote to memory of 2828	2088	Cfnqklgh.exe	104
PID 2088 wrote to memory of 2828	2088	Cfnqklgh.exe	104
PID 2088 wrote to memory of 2828	2088	Cfnqklgh.exe	104
PID 2828 wrote to memory of 4056	2828	Cimmggfl.exe	105
PID 2828 wrote to memory of 4056	2828	Cimmggfl.exe	105
PID 2828 wrote to memory of 4056	2828	Cimmggfl.exe	105
PID 4056 wrote to memory of 3948	4056	Cmhigf32.exe	106

C:\Users\Admin\AppData\Local\Temp\e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643.exe
"C:\Users\Admin\AppData\Local\Temp\e69091a4b652d179d74feaab1b650803937bf9b66ce2b75317e7960ca5c9f643.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\Plpqil32.exe
  C:\Windows\system32\Plpqil32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\SysWOW64\Pcjiff32.exe
    C:\Windows\system32\Pcjiff32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\Pidabppl.exe
      C:\Windows\system32\Pidabppl.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4860
      - C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        23⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        25⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        27⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        28⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        29⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        30⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        34⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        35⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2172
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        37⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1984
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        39⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        40⤵
        Executes dropped EXE
        
        PID:564
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        43⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        44⤵
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        45⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4152
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3324
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        50⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2472
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        57⤵
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        59⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        60⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        63⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        64⤵
        Executes dropped EXE
        
        PID:3912
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        65⤵
        Executes dropped EXE
        
        PID:624
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        66⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3544
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        68⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        69⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        70⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        71⤵
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        72⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        73⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        76⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        77⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        79⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        80⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        81⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5532
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        83⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        84⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        85⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        86⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        88⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5812
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        91⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        92⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        93⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        95⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        96⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        97⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        98⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        100⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        101⤵
        Drops file in System32 directory
        
        PID:2896
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        102⤵
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        103⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1296
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5160
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        107⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        108⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        109⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        110⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        111⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        113⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        115⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        116⤵
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        119⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        123⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        124⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2932
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3192
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        127⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        129⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        130⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        131⤵
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5724
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3896
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        135⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        136⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        138⤵
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        139⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1956
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        141⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1292
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        143⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        144⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        145⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        147⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4316
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        150⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        153⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        154⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        155⤵
        Modifies registry class
        
        PID:3232
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        156⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        157⤵
        Drops file in System32 directory
        
        PID:3644
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        158⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        159⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        160⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        161⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        162⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        163⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        164⤵
        Drops file in System32 directory
        
        PID:4324
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        165⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        166⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        167⤵
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        169⤵
        Drops file in System32 directory
        
        PID:4460
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        170⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        171⤵
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        172⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        176⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        178⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        179⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6544
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        184⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        185⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        186⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        187⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        188⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        189⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        190⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        191⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        192⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        193⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7088
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        196⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        198⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6404
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        200⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        201⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        202⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        203⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        204⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        206⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        207⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        208⤵
        Modifies registry class
        
        PID:3256
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        209⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        210⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        211⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        212⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        213⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        214⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        215⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        216⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        217⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        218⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        220⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        221⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        222⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        226⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        227⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        228⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        229⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:6224
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        231⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        232⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        233⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        234⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        236⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        237⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        239⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        240⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        241⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        242⤵
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        244⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        246⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        247⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        248⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        249⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        250⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7940
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:8012
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        253⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        254⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        255⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        256⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1348
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        258⤵
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        259⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        260⤵
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        261⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        262⤵
        Drops file in System32 directory
        
        PID:7872
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:7948
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        264⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        265⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        266⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        267⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        268⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        269⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        271⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        272⤵
        System Location Discovery: System Language Discovery
        
        PID:7296
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        273⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        274⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        275⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        276⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8008
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        278⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        279⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        280⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        282⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        283⤵
        System Location Discovery: System Language Discovery
        
        PID:7592
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        284⤵
        Drops file in System32 directory
        
        PID:7528
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        287⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        290⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        292⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8548
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        293⤵
        Drops file in System32 directory
        
        PID:8592
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8680
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        296⤵
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        297⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        298⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8856
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        300⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        301⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        302⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        304⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        305⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        306⤵
        Drops file in System32 directory
        
        PID:9164
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        307⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        308⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        309⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        310⤵
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8376
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        312⤵
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        313⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        314⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        315⤵
        Drops file in System32 directory
        
        PID:8764
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        316⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        317⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        318⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        319⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        320⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        322⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        323⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        324⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8796
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        326⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        327⤵
        Drops file in System32 directory
        
        PID:9116
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        328⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        329⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        330⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        331⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        332⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        333⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        335⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        336⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        337⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        338⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        339⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        340⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        341⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        343⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        344⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        345⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        346⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        347⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:9580
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        349⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        351⤵
        Drops file in System32 directory
        
        PID:9712
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        352⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9800
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        354⤵
        System Location Discovery: System Language Discovery
        
        PID:9844
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        355⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:9936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9936 -s 400
        357⤵
        Program crash
        
        PID:10056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 9936 -ip 9936
1⤵
PID:9996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aagkhd32.exe

Filesize
1.2MB

MD5
1dbcf8caf6fb30998694346a454cc944

SHA1
3abe3b5872289ea54fb48ee6d49dbb7c5ddf7dfd

SHA256
37aaeaf1ae5e31ad6eac2e99515f944acf89b9323e941ca7d0a951e869635343

SHA512
ef2a417b0512930d94878e72aa3763ecafd95bda74481294ea506ab0d9bd3c967d2b99e0e1d5a9a26275681a5759c2b1ef2d7bb8da9abf168bc274262c6ec2a3

Download Submit
C:\Windows\SysWOW64\Aahbbkaq.exe

Filesize
1.2MB

MD5
59af3356a82a3fbb573e136406728331

SHA1
0a8038a24548ad8a1e75f055b88dccdcbed8ac70

SHA256
5c9853ff0a1de7ed9d71191eda6a6ff4e294f79680bc8601b32ea2d1e9d0434a

SHA512
507236e687524053789d0d61fdb4b763006b6c8b4bdc2b0cd2398aea7df79b18980b2ee7430e4c7adccf53f7ae3a17a6f8973a28dfb14b73c2038632412b56eb

Download Submit
C:\Windows\SysWOW64\Aeddnp32.exe

Filesize
1.2MB

MD5
6ec00d03080c9d75cebfdc51ef1df847

SHA1
1d6d9687c294c6f442283f62b34612ca8494601f

SHA256
5ea303b946d5904c1c545374d0745aea7cd7c01dfc7155bc856fe527c686fd5f

SHA512
3b09a135dc08773d1ef33e51cf68b49980851296fc917edee6c26e7e484d89a8902ad4fb7a5d2b14ca5d56d5b415fd459aed1a638dc3b8e57eb5172674a4aee7

Download Submit
C:\Windows\SysWOW64\Ahcajk32.exe

Filesize
1.2MB

MD5
a17edcb56cf63cee55dda03b3cc9bc7f

SHA1
7b53dfc02a89a41b29fe1c762ab8f2a18f8b6f22

SHA256
1b7dbe6cdf1320a4773ee334607a3ce37d9bacabfd0e9a20e383411489cbd7b7

SHA512
58a64de60c0c4419c30067093a721fcc6a5831bb11d20d25312fbf24d92f16eb8fb9d96e323afd9e6557eb9fdeba4565feeea8819ee0da630f31cffd153d0555

Download Submit
C:\Windows\SysWOW64\Ajggomog.exe

Filesize
1.2MB

MD5
7045ed7acbf27680279fa2f3c618141c

SHA1
fe1d4c38c9610e6ea971692f7e7663f9eed9ae7d

SHA256
a91ff6c44c9f1f1d26477cbaef2eb9df091a9726a4b316b77c56d7ca6de0134e

SHA512
ccdda2c45e48bbdd31cd36f1507b2c83fea537de4caa2f200d4e4ccc001df0852f02068ff4f4f3f020436fcdd8128ed9e1233b9edc34f34ec5fa9ea5731ace22

Download Submit
C:\Windows\SysWOW64\Akglloai.exe

Filesize
1.2MB

MD5
ac57e39193bcb5cd46cac2eec9946789

SHA1
4dbbc753160c8c71309289ef4b5f76c8a06d3d79

SHA256
7771c09eb4c090788dacfd6c518c2bd2ef1cd65ec8c95ae9f0d9852eec4d077f

SHA512
2a42ef309e85dcb0c4ca5f032d1bb0a8178916100fd17e5f277ebaba23bae111b29a9fd55302b39acc67ac619a07c027f5c1ab700ce8cfd426f38b69ac67e39c

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
1.2MB

MD5
95c023bb1c84e1223e82d66d078f01df

SHA1
75b95e5c70bbe29d939ce64058a285bb96472c6c

SHA256
6b8a06e327cf1ff35dd92bd2d694080ada6a04e4a142e72aee1607f87d46d696

SHA512
2ce0eeeebab89694fbbdab168cf5a80fcfed96154ac2ab9d6f2aa88141f5215276f9931b66423a69afdac532b277ed44e8365858543949b3d536952db5e5cbce

Download Submit
C:\Windows\SysWOW64\Aonhghjl.exe

Filesize
1.2MB

MD5
3db9733ee6cd9a70c4d76fbc822620b2

SHA1
01b57decd74ea06e2805c48dda4c42396fd721f8

SHA256
6ab6039ff5b81a99193a7a07a69e3f470ccba00ec5eb332f27b38f7ce737d4f3

SHA512
a3480cbc066a1181623ace2b805896f6f44910ba3fb14ced51b86cadd475147bb2b4560f236615196e2ee0e9090b70fcc0b5a68fde7d20d6ceaf0307a0e55779

Download Submit
C:\Windows\SysWOW64\Baegibae.exe

Filesize
1.2MB

MD5
aaa59d00b955f60e01ec02ae6740c827

SHA1
b36a73c6dd3e97102dd235da5f869c946f652dd4

SHA256
f4d70e2e3b2962ee26390384f892c4ba44df4a007bf3cc3cb7e7a893e060b051

SHA512
630ebdc70ee2698535ce121383eec94bf65196a175e09bac89beeb5f7c74346b2903057533b6ebd528e24f2de710da8fd2f22a269cdc9c38362d8e9032d4ffc3

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
1.2MB

MD5
d2884933706d0a2c3ecd20b398995f10

SHA1
ff48b56c48481ae0cdbad36948f8c292c8f5bc14

SHA256
6365a92379746f35b1045e58a7809ab634e70de60d01bbc823c4aec547f11a3e

SHA512
297d803f566918214b9391bfdb832c2bae1e6e26df4820701d9ae173cbfbc78b386d730c22978a005b091e075ad81a3106dec98655f3c60290a0aa2433ba454e

Download Submit
C:\Windows\SysWOW64\Bfbaonae.exe

Filesize
1.2MB

MD5
4445b3288846607536041475e42098a5

SHA1
c77123b9adaccaed8f6555a6797ef5c2b85b6af7

SHA256
660c3cfb41c2d8495e46c9bde25555d991af00c43d1ec5ce8888baae38b075d5

SHA512
78d39a78ab19df931afbdb8310c34bc35c225be27e373fac25ccf41935cebf9bb08d61ff38848d9d74942c19e8eaa3a9026ee6af7cbe22027c88bb6c76aadae6

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
1.2MB

MD5
6a3b24d76a4123e32e084ff10ae36a73

SHA1
567ed7da0252ba18090c9842f460db8d2761415e

SHA256
b577206927cf873a5ae03789b1bc008051da6f810be0fc01efc9099c71df4c75

SHA512
45a36c717522c43932ef8307040bf5a1f46fe2e275d7f4d1c2512e35139bd521379003cc5991b382e204d19bfa0133ef9569bbf6328b295cc864350eec32f478

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
1.2MB

MD5
6bdb3a9a5b18c539ccfddf47d3f74e11

SHA1
2474d52312b959140a952bfab6fafc4bb139d8a9

SHA256
084f097aebc144e5133226516b58811f8737b4b8db5171a675347049f90cc38c

SHA512
c2ce2d72cfb459df842b27141109658f59de89fcae8b23f0737ef7d214de53f7478ae3f8338486e913dd1d9e7a649e805ef6b2c8f4a847f7cfa2c8135088ee12

Download Submit
C:\Windows\SysWOW64\Blnoga32.exe

Filesize
1.2MB

MD5
9eebf3939fc5c114754e810e7c6076ed

SHA1
cd4ea3b7b7bb9a8b0a2f61cafefba49dc4bc6838

SHA256
0df6ff6aabacc1a0efe87f78d31df8782cd99edc511119b4cf4e4567b95c95a8

SHA512
290b09020d8b4eddc712072241bdb4d8c5b423e4de877a2d289a531b007157c647d115a6c8ecbab228fbbf29c5d62f61d73475b10fa7b9fcba403a4868cc5e96

Download Submit
C:\Windows\SysWOW64\Bmofagfp.exe

Filesize
1.2MB

MD5
c69a512a3a3cd7bf69298d9149f9b653

SHA1
ee0ac56a607c7da3a795b96189b94a53184d714c

SHA256
4761d10a9ecc00f2c52252484173be9497d6d40b8dffa20b264dad8c5053ef49

SHA512
abfa2e429ce6a74aec54966e4844e4f69c66c58726dc6b9bf70278b3980076386ea83bf26debde71af6b822cc16f1e5a60cfd4345c2344b1caf3fcc5affd7510

Download Submit
C:\Windows\SysWOW64\Bopocbcq.exe

Filesize
1.2MB

MD5
00e1d091cf9558bae8302dde6ac01d0c

SHA1
c21e232aef0d1e841c199571b3a7985fcbec4251

SHA256
4fac8dbb6f37e9db6afb682d3d56ccfd8916a69fd6db70969781da5ae4d74738

SHA512
1f41db5508e8d16c5fe0b103a649259871d37b9d7b367fcae41c1129eef2b3a6650618e0dfd426cec0f0ecfc2d529b2209c9cafc291bab2d190327e4316a3ca2

Download Submit
C:\Windows\SysWOW64\Caojpaij.exe

Filesize
1.2MB

MD5
b372da10a7c8ef2671469d0f85a4623c

SHA1
a3db76c20ad9ad8bfc33e6fa28cf7e5294a44522

SHA256
f172a5a0c583576a220ab3d374754fcb7002b2e6c9795b75db66e75194d3bff9

SHA512
03b7bb9c87e8f949a567174b89b21b59b939513babfb1cfe0d4e957da41961e761fce7713a463ec1d0891249f1694c0153c4d125e489e36f801da4ff467dc7fb

Download Submit
C:\Windows\SysWOW64\Cbeapmll.exe

Filesize
1.2MB

MD5
978aa257d3a2a138fb9883e9381a8fc8

SHA1
54c523f04dd0114081fe33fcc39081f942ef1775

SHA256
c634849a9a8b5983e1141c78b2f3c626249d7f94cb437ce4b8097aff7f9676b4

SHA512
3c89b113b1f539e23054bc9eac33640a8a7d325049672274e61e488fd1afff385bab053882117bd1fadd31b811083768887c6468fe6eae17dd4df5536f839f08

Download Submit
C:\Windows\SysWOW64\Ccdnjp32.exe

Filesize
1.2MB

MD5
d5b70bdc1eae94e8874d5515ad41c056

SHA1
4d1af07d077a865ade3bd5d3a2d02df937df02bd

SHA256
a5708c6d966e67bd53fdf8c82866439867a9f0151dd1d9f123ecde35c24a1b17

SHA512
39e6614d4f4afa2fdf34cb1b31d38917bfe4b58cfbfccb324ced2e990d5f3c587019b7e017ab2d58caaaec0c8176b968c169ed3d7a5b5d85dd141fa213ef15cc

Download Submit
C:\Windows\SysWOW64\Ccgjopal.exe

Filesize
1.2MB

MD5
14b3258e21d13bd503f03602fbaf2007

SHA1
923e7b778fae59f20ba533bd019f3e08bd75b24f

SHA256
132ccab328a748d79dff4e506de3b9bb0ce5a5bb325f9b2dabf659dae58f56da

SHA512
eb2800a0efb6a5061877775d93e8e0dd0fdf54b2f1c1860c86dfe9350e4f4aa14927d29dd8e3917bfeecea3ebef8e28a99cae732199e78cf069dcdf543109e98

Download Submit
C:\Windows\SysWOW64\Ccpdoqgd.exe

Filesize
1.2MB

MD5
0553ed933d1d13ef789448fa2b56132e

SHA1
e3c694f8bbd18502a0ed9324b7d42ebed33516f8

SHA256
d8a8704bc96bf2f8d4cb6160d59e2f2fd40efdf26bf01ad8ae809cbe47783e0e

SHA512
0705867f20ee136babf1c034fdf4e3d907d3842ccfc8a29240c706be9ad5d69ceecf008691356f458c0eb910b3958a52aee0265e2a76117afc89dc0a8c8d8b20

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
1.2MB

MD5
560528dc892084893f3d52c39b193e47

SHA1
efcf7b35f424e6024346d32d395730d71d220bff

SHA256
8ebc3559377f6a8f77e24cfea590372b94be1130b0b18ad2d8800a36541331c5

SHA512
87c39baeda329f99e17f9b8f5d20f9c1bab65efc1f17a3c55899b17a64aaacacaf3b03fbe3042557151dbd3f5082766da3c9bfe54857f80be06aa2fda5dc0733

Download Submit
C:\Windows\SysWOW64\Cfnqklgh.exe

Filesize
1.2MB

MD5
e5b430f19e5df4d9a4607bd50941edb0

SHA1
6ef1a59dedc2d9f75b4b3fe984f6c8b4df3986d2

SHA256
3ada0e1706822780019f4fa93a5391ee6be773f69f07294ffe7e0585f4e33659

SHA512
45ec2c7187aafea8b5c9cb313cbcd3da5e0324c178f19ffd9ac23e93292ad73f94d7ac79d58614df7f6177910bb7582082f8ac33e92a1dc9f94af19017a756e0

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
1.2MB

MD5
66efe5083ce633f44bf97706d2c5864e

SHA1
1a10ebb70c965ee81ee2d28fc872378057f91464

SHA256
51a95d9bff6a30e33493cdab5c22c0629651a7cd1a53ad53db4679a9b93c15d7

SHA512
9b7b22a34dba436d6ff517b622ac99f6eac141846cfea355f366b0079f2dcd1d273aa0b1b0d9e8a67c378c9a78814091c9eeca57c0bc6f49531afeac61f3c859

Download Submit
C:\Windows\SysWOW64\Ciafbg32.exe

Filesize
1.2MB

MD5
1cf71ee5ce1e993952b16594848ca596

SHA1
57c82a385215350fe5b09da4bd3bba6c49ec3e1e

SHA256
7f37a39092ca709089a9319407b7afe4e1e6de3db6d83b1c4fdb540ba2d75974

SHA512
c3a3d4ecec44623396c9cfcebe9b238b53120b3e8b5bf074dada254b9a61d27f484abdede39680ee08b8884601f8e557f944b729ad62eb65f7002a4a1bb95be4

Download Submit
C:\Windows\SysWOW64\Cijpahho.exe

Filesize
1.2MB

MD5
696244fdc8cfb0a38c5e486594c5cd36

SHA1
66b2715ca235a291eab9c468f89410a1062bb2cb

SHA256
846600fb76ffa50ee6bd986494820cadc1e7a411a109c9a8aa462caa2dc03ba0

SHA512
4e6991d678aeadac7665c38d7c1d1f7970dac14c899e0c0356746cbbc897d9dd083acf1f8851c4c67bf08275d883e9bcbe76344a5e3a0ac154ad31f4dd9214bf

Download Submit
C:\Windows\SysWOW64\Cimmggfl.exe

Filesize
1.2MB

MD5
3022f88f5fbd8c965214ec967e16d12f

SHA1
c6a88fd74e0a42a9ab458da906048043e7c6d940

SHA256
864f1aabbe528de2c0dd7527f6400a394f83d277353fbc6189001a2a5587042a

SHA512
501dc84ede20455f687ff62f7daa689025789b147f99c06140814871de75608cb674898a8e9b8032d8eed0b88ab12887b04d1446ea793161efde6493c9ddf201

Download Submit
C:\Windows\SysWOW64\Cioilg32.exe

Filesize
1.2MB

MD5
19f7b6683e2e5718d0ce552cb4e46e60

SHA1
d209e12d517867e58ebd99b6b27b0fce36005b60

SHA256
faef064475c5508c1e5d32871ef934c7e1dea8b2a4a25bc4dfdcc8e781ebce2c

SHA512
2c28f69aa83f602b47499e7e5d620f7c526a333317272063ddaa11e7241b47302da810bb7ed47092bd6d8b61408ad2031f3454b418679c3a0b17fafa007fbe74

Download Submit
C:\Windows\SysWOW64\Cjliajmo.exe

Filesize
1.2MB

MD5
7411a7575d7d1a89f0110e9921dc6130

SHA1
b57b208562d63acf7e696ae4a3657d13cfc59911

SHA256
81d4d51f211a575e900e832b41681c9b40effd668950a20db7e5c1a447fc9dc7

SHA512
1cdb4a4693ab3fc0e88dd7d966e24ecbe2e91f698e376235433b6a76fad4b01fcd5cd27a29536a14c700165b245dc91eea2865d978588dba6a1d8863f7348488

Download Submit
C:\Windows\SysWOW64\Ckgohf32.exe

Filesize
1.2MB

MD5
b257244b838110f26d495dd09603abff

SHA1
c80c8cd10c16664699cebc9dc249f7ba0e148b8d

SHA256
14c2ffc703ddc94ebd924e6c93c289b87936f20b47f2897eea1f372cac6d8178

SHA512
37156310787b6919b6badd9f8eaa3f1111beee4843a1f6b8e6134537d9f767044bef040fb32719cfdbe296b31c726cfdff564e46ced7a30227f31e649d0ea4bf

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
1.2MB

MD5
d9f433174dbc74e76850a9c12a000a6e

SHA1
7103b09e0a1836476181e3e260c90e37a0e0b6c0

SHA256
f225b8894f1b1d2e2dc2d116ca3f04049592b92ef243452ebd68b76bcc79e714

SHA512
47e97fbb111b3ec8178da9831118201f28152b1e7893b9715527184cc35c6da779ce576067df600c0eb2752a82ca0fb7a9b454c90003c99686835751d1a47fbb

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
1.2MB

MD5
bcbfc3e4bc723c1fcf1228c910d177f5

SHA1
87c4029eff73ca944526875b25a3d2c6efcfccf6

SHA256
3018ffe60b54e9629908c51179f988f5e122a26538d98d7de64f5a4e6acce342

SHA512
bbc5b6fa0b97c933d5a218930d50cfb56ee6abb2970544117bbe9f631100c86fc78db1491f3d3096040a6b75e5828fd7c9f5ea277d3985136776e729cf419926

Download Submit
C:\Windows\SysWOW64\Cmcolgbj.exe

Filesize
1.2MB

MD5
6b327e9afc89b345f06711d8d9b39394

SHA1
fec008c5b34d2a1b28346b86ca9cc42c2cebcab3

SHA256
1855ebddc38ab58b6977e8f4605155e085bde1dc0c06ce45d60840647bdfd705

SHA512
ba6d9aaabe70a9e305b4bd1e57e543a18b489b8cfaba2aa79148129d9470307dcb66756dfca2677e9925d3bd389334883053c1d301411bcdd6cf45b2efb9206d

Download Submit
C:\Windows\SysWOW64\Cmflbf32.exe

Filesize
1.2MB

MD5
b8b9bb86613265c87b10cd31a15558ec

SHA1
a5507f721b2e3283f488946ff946522529d7c94e

SHA256
9cd2c08388456c49ce5924c78fad7a5b0c9e51cc0f0f32b6887442ebb2f80bee

SHA512
12cfdebffd96cdf1cae040d6cc038b980609574fa9f4c5bc1d0c8e35367a440e9d65f6e575487eb82fe743d41901e7e041c1a32dc9e7e21fab9942ef2c7a5ae8

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
1.2MB

MD5
fdb25e230fd615e4c1da38d3045ef2b1

SHA1
a1d3461d2aadf6c2634fdfc2b3d1333002fb51a9

SHA256
38e0dc7e13cba85129ae767c5520a92d2a4a401867acc444c5a032f10340f601

SHA512
f6d36d616b43da2ef27996afa7d84028f66d9963aca02f1956807cf0915d8ff402ad984f04142ffd94c7b31027e440c019409ae56d83241e2eddd94a1a1f75d9

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
1.2MB

MD5
e9cd7ae2bd4f3702d15dbccdc8971be8

SHA1
624ba1ba2715af979e78f0ede771d2c0fa7acc4c

SHA256
f5a85d50181fab8c0ec1626d81ae0204ae3073c592931a85868b1cb591b50194

SHA512
100b2fcddfd007e51d4559fd70dfc49edf5fdf0496fd5f2b951f54452e35c5a49d4351d3d0430fce924b7655b1c67bd4bbf1604a84ad7a23d5ce07c312d971af

Download Submit
C:\Windows\SysWOW64\Codhnb32.exe

Filesize
1.2MB

MD5
0bf8c2d85c6ec05cac591db1818a5ee9

SHA1
40157b1987a7c2738777a89ce652c933b6d2a016

SHA256
3edc6633a8f090542085a5c0c5929ff1d2d33bed19a9057cc21d5f072279d94a

SHA512
5fd1e700ed700e4fa4a89ef28b3bc1bef9b9be9561a8d63b2628f544f31ffc683f2e707af1063067bd9340a00f3c0e1525192b9e9e55f01c98a569a12d666f7f

Download Submit
C:\Windows\SysWOW64\Cofecami.exe

Filesize
1.2MB

MD5
9877649a5676d884579af133f882478f

SHA1
665e656224a73c0f7a1f08be3288d98db327fb63

SHA256
dd8fc606de1eb84b55a7b84af577cf348da71861a74e159f62fd39efdae1780a

SHA512
627f0fd6d44e2f112e1d59646534e0178208cc0a9611339000cf6f20e9097a63cfeb14e086123f54de8fa8630fbd97e6f1c022d39587932f38574a59c75f71ac

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
1.2MB

MD5
dfcf8d58579d117872bb7cbc40ccfff6

SHA1
1218703c5318f7fd94c9b998028afd0ddc778e1a

SHA256
9a07f52b5a978d06a1e7153229313b07a5cc888bf663b982e09bf802d29c0341

SHA512
1f7f7018582e751dda59642e4e1b5e817502d154b54cd91a0b490dbe143d4841f5805adc9ae4bee03dc807bd072187b03e60294a354e8964481cbc653c842d0b

Download Submit
C:\Windows\SysWOW64\Dfiildio.exe

Filesize
1.2MB

MD5
8f61f3c61486e53da3220d65b7c0fcaf

SHA1
95495a4e037b52f99199be413120550eee5f52c0

SHA256
88492b978ff1c4389f23a2eb64a80bae0c8596e6b7d7af8974921bf76c72955e

SHA512
125db89733a1f0c567e1fda6d2b0bc2ccc3470fad36a44c6dec03364e0e117a4f9deb5453699fee5441f2aeaee3bb6064fd3915ed02a83e82d40515dc19a6482

Download Submit
C:\Windows\SysWOW64\Dhclmp32.exe

Filesize
1.2MB

MD5
55ee1d0bd02f332f6564c7302f2db13a

SHA1
c3e2740484aa2c387b9582173d2f6129173d5a4f

SHA256
441e26505e84fa2c5d015cecf29bc8f80265a81fbf872e5a6717f1432048e6b1

SHA512
a786e6d713dcdf3a9882ba712f246fc2f4517045bdb3f3aa4b106832a71152ae684dbe446a363ae2a6d9c51a5e36287336e09f0e9ed96551659508ab800937e3

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
1.2MB

MD5
3278866472ad78505a2a2889f7a1c215

SHA1
95410b8f1be217ea45b29d31bcd71dd3622da3db

SHA256
8f72e977e289465c65768c6561c7c19d1809835e4717b99d3432c0e5014d7fc2

SHA512
a0bc1481943633ebaf05bab7cc7add063a0daac751a3ea9b4a98dc54c18db4734440bc027e73bc9693218ba92a1e0c6bd418f47a906de99748d8ece0e0925891

Download Submit
C:\Windows\SysWOW64\Ekodjiol.exe

Filesize
1.2MB

MD5
a45ccbf3a7b6a5409e665c0d2bbe500a

SHA1
38804a293b36066e65d03b5ecd5e749b9d1c2f96

SHA256
3e8ee10e3686a31958f4b1840799d7f6b169d89125cba4d3440c50f1e1f126ab

SHA512
c2c6c33580dfcf1fad67b663287be0a1eb45aa375f66b91ff3e2d74438181e3d07eaab19cbd4d49ca6e9e0d3f463e8a45910ab31cf4338dd77701b28ff8c6cde

Download Submit
C:\Windows\SysWOW64\Fbelcblk.exe

Filesize
1.2MB

MD5
b7a634e6e0f90a33537de77561c49209

SHA1
668439ba009725c33cfd44765a2fe411a004617c

SHA256
09460ac6e733655f51461f38351606fa51860bef9092a4ab1cfa15bcea77b009

SHA512
6b8b1e7c0c7606ef4738992b15bf5dc7cd4e09ff7e6aeb97c262ac3a5681f70f0386728ebe82d32220afbd3c3e0a33b41a1ad4095bf3e20e4b60ef5d116a641b

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
1.2MB

MD5
68f08d75ac4d85fb93f0110499b8f8b3

SHA1
59cd13b7c12fad7a9459f013ce5ea73a72f1bdff

SHA256
1097a1500136d62a896a49d102eafc97548abd86f9088cbb3010219e48f65b3c

SHA512
5fe9033ae4a87b7bd1de473ea4147edd839139215b0013469e9013036cb1a0078db1c104e1679d43a95932db9a4a8d137efdd07d275b1626ca094e0e47172e0c

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
128KB

MD5
28897d367e7fa2fbdf7c2fd0debdf03c

SHA1
2962d9a7aaae70e02588eb95a23848718f7cf402

SHA256
971d9ac6de1b7fb423499be38c24048b057c9f1405a5017c016df8139a10d970

SHA512
fddf7361c74e3c32312ec23d90eab4c69af64e9038b57668463953e381650ddc6804d4068f6d0d9a69a3ecb87cd2b874c4f2e8bc817ea8109538f6beac0f24d2

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
1.2MB

MD5
e608e177f29ca5551c01ae44da7a3b2c

SHA1
ec7f4cad4b34d760243b8744def6cfe9ef4725b4

SHA256
3675b193a11db7ebb90a56d235aee4542fe70dbe9fdc8b0ea9037f95a809a4f5

SHA512
dd2757553c0352937a3640008ce61dc0a15fa6795345ea303bd1b30a32f0e04d4b4c37defd6625eb617d09c57e6e3ed547d71b33ea3474dcc24778ee338ce277

Download Submit
C:\Windows\SysWOW64\Hekgfj32.exe

Filesize
1.2MB

MD5
454e3e007f3b1a2187fb3ce3fd7bf751

SHA1
e9d73dee594ea2f47a9a356d1ea0dc8791eb17fd

SHA256
4023b1e9771abfed10d0d36c85cf78c0c3514a194384b9c0a0393106dc290cb7

SHA512
02050ca89647f1ef32d34320a9b70e6a2032e9b41e320e4a602db8b1c25f57403cfd274b17e7d5d0c549c4b63cb977619e0ba00a73dbb0d59b8aec7c85715f66

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
1.2MB

MD5
5e6e14bdb82856f4c24de52b5191d7e9

SHA1
9aaa8cb7ea933fedc67376cfc6fd69c9b4aff604

SHA256
c54f136cf238c72747fe45fbfcd024900e5c9a055595a4d37ba02a081cd0f2f8

SHA512
2c3d617aa6dca872332245cbf4c6a9e00d1b99814189d92fda564a6e04b130d2cdf0fc09447dc6489549055b97629d63c6a58d18d094b1a95d46c43b4dcd7db5

Download Submit
C:\Windows\SysWOW64\Igigla32.exe

Filesize
1.2MB

MD5
cca8ce8d792df01127d0408154fc6e97

SHA1
9d6452ed138857f1a0fd9041239c67734ef0ffcc

SHA256
0c09b1476b1e834adaafd6dc2b170f1f6b5b33a810db3b3a1a1785e2dc4905d1

SHA512
3bacc5e783a9032ef8bfaee3a6f43bda7dba5680f5b9234b130224c7948712e16abe4cd09c78d2efd068d7f6a68593a5f4131313abdaefbc7d64f9dad515a1b4

Download Submit
C:\Windows\SysWOW64\Ipoheakj.exe

Filesize
1.2MB

MD5
89e35ff7b3cbd9775bd503e0a451b08e

SHA1
8f3499ed15ae8faa6f36b8b7f873b7d0ace0a84b

SHA256
6c3dc7b5233b69eeffbc270625e0e8079019bfdd0a7d29c8bd8c43cb9f7b36d6

SHA512
250dc9871fc7f8c258603ac499d50061b8dd77fec6d7086f6c59b5ac3eeb985df1bb85c95e41c45c05e260899507e88cc037a9d120b00334723c9165f6eda878

Download Submit
C:\Windows\SysWOW64\Jgkdbacp.exe

Filesize
1.2MB

MD5
ca0e6c62cb5a7df690e858e079a02e59

SHA1
edb03453f1b9ef0bc4267f60425b24b7a2ee0e1a

SHA256
75a80067ea716ae5886cb0b00badb2324d3b4b40ef5937d832fcc72aa8bd8f79

SHA512
2e4105fbd615da6007ae157ed9db76fd0de48c826194e876a0ad01faf995462be0276f7045c99ff4023edd66fc471c49482dbab046af38539fb770d554920c7e

Download Submit
C:\Windows\SysWOW64\Jlkipgpe.exe

Filesize
1.2MB

MD5
b4caa4a5d582f0798e65b78fca3ce090

SHA1
330d661997a9a838d200206503b96a796cfe4cb8

SHA256
9f512859431b2ee9d62746df48289460f45c3af2ea0ba096696e437e6e767daf

SHA512
ddcbde16eadb02056799291eb45cabd1ed00b25fa862cfd8528ec4cffa7f65d2e716b8e5879a5febbd4976d7ee870e8edc5f6c2dbf715881990b9e2cc12f2488

Download Submit
C:\Windows\SysWOW64\Jngbjd32.exe

Filesize
1.2MB

MD5
057c7ed94c1324ed2f56bfdf06d90562

SHA1
560386e8448d08b869d5d07fda9ff7260c737382

SHA256
1aa2a3db6dc72b3ea4f1bdf6edd88515999682a6225c91d6d3169bf082b5bcae

SHA512
1c1837db76097427df72652b815ceaa2c08f5e888598a63cdb62a80f525ac84bdf99b7da85d6132fa99a0e43dad95ae53e9100de8c9976df9eee26c8aa8179bd

Download Submit
C:\Windows\SysWOW64\Jnjejjgh.exe

Filesize
1.2MB

MD5
968fa717d7b982683879088f591c5c6d

SHA1
0f7195d26461aa51b0dd749247c04534208974f8

SHA256
5a826476fa0d4853069d422b12a509d0ca6bf1b54a5d9ccbae3a7a5d61f98f5b

SHA512
2bf105ffe9bcff84b3a392e8e011170f88afb5ec55d09662c44862837d3073e08d518372c5929e3a589eb9cf3d2c9bd7e3542d3730c32f2a75ffdfbbaa15c8c1

Download Submit
C:\Windows\SysWOW64\Kjccdkki.exe

Filesize
1.2MB

MD5
d4e003dd036e9c8c8d6ba4c33dec4d4e

SHA1
e36588a9943176d49f0a674270002b22747bb4fc

SHA256
fe0fe2b34f2d1b766f8e177b15d5127d68638013e604aa681e7cd07cfedb442b

SHA512
db74c96bb029a26b15377e209fc22b2e8170f75b7928c3a5fa7ba9496b50e734ac123b683d4a376e2634aa083011dcf27bb352779920dfd0e938d667accd26b2

Download Submit
C:\Windows\SysWOW64\Kjhloj32.exe

Filesize
1.2MB

MD5
d9ff63592fac416613b3be83c7efd9ce

SHA1
6f1d7b7cb3e468071fe26eaad60694e5df07d109

SHA256
115511520520bda9eaf9fa2eb2a357ec8149c95988802d985826dd96d195d5f6

SHA512
21abc422d0b9e84d1ca283b45cdf34423980d8328834f54fc19d1d6f74b0a26c3862f0bd8d090cc3cb0a162bea01547b4ca93bf7e68c56edc41a1040ebb06096

Download Submit
C:\Windows\SysWOW64\Lcnmin32.exe

Filesize
1.2MB

MD5
d1c84ebdb560fff6c9cd73982151422d

SHA1
89422b4edb79650b0e180b73f4c14b8dd02ca0f8

SHA256
6d371abfeade21319c0f42d2f9df0bd8ae25178cf74f20f3828684bc41dbc761

SHA512
c1e998a1f3eb8ca22c916d92cfafd756cbadb9dfefded347cbe142aa8ea2c9d33c3d1889abb4582bcf0a375fce5e9e74006680d6bc90680301d01de1fcce6f6b

Download Submit
C:\Windows\SysWOW64\Lklbdm32.exe

Filesize
1.2MB

MD5
4da7beaab915730b5b090d0e029937a7

SHA1
dfe25b2c63debe1b479ae7c6b90c77a555fa7c62

SHA256
e9547f495e927685fd06373460e87eeb2104a7115e50cf28ec7fd5e1075340ae

SHA512
63d3185c2719c27b3fd16d744723e9787fb694b123d5cbbcf667941997abd816e96269d5b86b676b5e5b2f3a0d4eace5d563ab302f455db82c13a2a2a8488b75

Download Submit
C:\Windows\SysWOW64\Lomqcjie.exe

Filesize
1.2MB

MD5
aa9799d0880220afbccb353ca6dc84a4

SHA1
501795eeb6f2dd79cbc8bb1f99d18239a503c7d8

SHA256
817ca8db47268423d300752179de3c40c42abe0d83ac68457f659d291ed869db

SHA512
f7f3e60b7a2f720440946e754e8eb9b8892896fb2f0fb486d2ce59407b115bd1199aacf826b0f8e880c50a99f5e8107e4fe639491f428aa814ba7618f1f6f942

Download Submit
C:\Windows\SysWOW64\Lqkgbcff.exe

Filesize
1.2MB

MD5
1ba34f409b7f915571dc22c978fb79b1

SHA1
e4684c2a4c2fe703aacc4bc0d5dbd5b14e7b1bcf

SHA256
1b2885bfc3dc05ab2b914c889e61ca7e69cea51a4eec9d3e1192dc71128f2ca2

SHA512
4cdcfbf2c8a3b4e1c6a747a9beba3143401604816daf9eeb7aad0944fda833ae552bd9e1ec63718b84f38f0862c8115faefb4b85a83972488e0138188f513079

Download Submit
C:\Windows\SysWOW64\Mgeakekd.exe

Filesize
64KB

MD5
62466e7b57da323397a062cafe21622a

SHA1
d77c0cade8944c0e8ca7b2cd3f4b435e099a374a

SHA256
2342805df0b7c437fbbc921ccc277203dc7b7583b44b166487680a9f3a18d743

SHA512
8b5b0433eccb3327b2c5dff8b01ca372f3017c0cec45235454b7c8850f761154f9e359e8550956fcfca8aa2c17f8ca41d9e3ae580e7b1ac8e6cc87cd07bdf793

Download Submit
C:\Windows\SysWOW64\Mmpdhboj.exe

Filesize
1.2MB

MD5
64ff4ea1442422ca780b6e000845e71c

SHA1
1cd24347c7f8ffa926da3359a003663e3b1def01

SHA256
1f532cf6e8f6c757e59d853b4ee30d55f0ed949b2e9b0f2f990f3b9d99f2e6da

SHA512
e9233a6249a7e4bce928d821c0540a703fdb23408d7310925d417d79c001f3e2f08d97bb6fb8efc669dcd5fc6161b6255d5463c32d12f4c90b80e01cf1effec0

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
1.2MB

MD5
163603bb12a8c1334825531f6fe8410e

SHA1
d21d4520f09528832b7a12fd09ad7440b4c49c14

SHA256
150a38a93326f68fb12cf7442f7aaeee2640307a3d4763ee4f09cca98fbdc011

SHA512
f780c0dfd45491a8485dc220723172499f141915b9a2d67ec409247ba91d8ba21380b887d33e2f8f9725ffa24fa7d1a746053ff63ef47c3e187e6fdd37a2b204

Download Submit
C:\Windows\SysWOW64\Nmfcok32.exe

Filesize
1.2MB

MD5
d0699e40e2214e918b4c74dc41b04bba

SHA1
4454878ac1179585a6a5595a0364fbf5ba17c918

SHA256
6a7a3bdc631f6da2e3cb266a3c9ab9f023df189efdb2e763e7b752f02ec8a808

SHA512
6fe1a26a56ff06294f7e12aa3b0c8e625278548125054d60f860c48860c79af6a60a22c6ab9b5f6c150a37614836809ca712859f41b3e6a4fd5714d0e1f645a7

Download Submit
C:\Windows\SysWOW64\Nnicid32.exe

Filesize
1.2MB

MD5
f31f62736fd3bd41630d9e80f3d68cff

SHA1
faf373d78a2c6a9dbdd8ea3c1e03e1fd29303f20

SHA256
1ce09fdc7e8006f00c0518ae4d990cbe9e075f456d793cb80690ebae986e5894

SHA512
e8c19c1aaca1d128af0e2dcb505f24c1bba75e7fc27c26c93fb9032cf3a4d6972edc398f504f0096a4aebc8ac8fe325578b85f1d373819513c308ce265ff7cf0

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
1.2MB

MD5
e953bcf1fdfc701b5e9fe8b3f1b4a756

SHA1
20d1c779dc847a404e4844b48abd3786cf01aa90

SHA256
4065c392eda2213334ffdbbff7a2a4f89d6a52334ebd187aeb9e53c1ade1b88d

SHA512
533acab6138a8a94909b0bce2ca263e6418e1a88b639b2b6e22fc82aa12b4d31b0f7a1d9837bc4f53d00e3a25ee94f18cfe91edede97020d727fab3a33767638

Download Submit
C:\Windows\SysWOW64\Ojbacd32.exe

Filesize
1.2MB

MD5
c987907a93f1db66531a44fd7e740a11

SHA1
71948a8ab7a5ea348c4178f5ae0e995c3dbd4862

SHA256
cf14331d5255677a2a09e381e05023d239e282013706e622f8fd9b1ede496b4b

SHA512
f658e8a0d71a0a83e6263c210f73d6e8fed9ce7cc4d08dace1ce0eecd4a557307af82704e6e2eda7e41bca5a706ab8d03e337e6ab0a565978ecc378e7bb33835

Download Submit
C:\Windows\SysWOW64\Ojgjndno.exe

Filesize
832KB

MD5
de101e38ec72f3fa3ecfa81eb1008491

SHA1
0dc63b1e886484f92d9cbaa6b28a0c3d17099fe9

SHA256
da0bf424ac8a2ebcc654a2ae4e6afee8a81fee3e7b0ad3c5048df6f72be7fc58

SHA512
2af8133db7a1adff5e484e1cf20947874fd30252546bec3df3e8657f3a67da0b35d8bd28888623957facb95c0a0fbdd22a8760588ecd15992788319d2798df99

Download Submit
C:\Windows\SysWOW64\Omdppiif.exe

Filesize
1.2MB

MD5
4ba54293e9d2efbe5b6e0c004ea30116

SHA1
e30c91b589f4c8f29476e5081f30f08659c65f44

SHA256
c5dac4e1e20510f2abd116767450b8315c6af12771d9ef6576c3f4e63ecc884d

SHA512
0e87d631911045a41c8238e31d2ea1497fbe41b6bd8d95bc72139df9102bd05b6067eb492f18b373471e7b3e6183097d58eb38aba06c31853af2b202057b0937

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
1.2MB

MD5
1ff5e9a7e1da3703a56eb39b957994ed

SHA1
147de46e53ffdb4ad904e752d6dbe3107262ff86

SHA256
33d474f71ba3542b337e22087961cc2c3ce6f13674486336adac151ed077a368

SHA512
6dd5a3e17e0bec7f46da341e000e4d176e2c8e6d2ae2d53e0fbb99be8d05242cb9e150510944443c770edb4d36c595daf06c9151b7faf0f5bd9c202b4dbea6aa

Download Submit
C:\Windows\SysWOW64\Paelfmaf.exe

Filesize
1.2MB

MD5
5615c896ef17c7db55170568dda2f3fd

SHA1
20b5b1ae7ab8415f7a0bf2e883f3d6823a3f8fa2

SHA256
30f27a7ef88e91fb9e1dda2c36ae30c94cad7220035af7dc6d78b010c6fa3332

SHA512
4a44963b4e4df0f1a690dd083fda37181483bf1868cebcd6b4ba5e9afe3c28bdee1ca28cce0a5a62362e9931ddc1ebb9966ce798d9b7ccc03d47db35d50c2f6e

Download Submit
C:\Windows\SysWOW64\Pcjiff32.exe

Filesize
1.2MB

MD5
4bb771848035544552a4116ea531b9fc

SHA1
a753ccb207bba2cdc2baf88efa0f3cfbcf793ba1

SHA256
0292799c25e3cdde6e652c21d6b14aea2dc1225231a09b7523ec5aa43f8120fc

SHA512
8202121ca625079d17bcc6d7a06783ed5fe336fb413fd01c64c965f269423b69f4af02b97d61e287b6d24b99dd1524f27e47afda95e775c2bd3fb2ed01696f4e

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
1.2MB

MD5
b92f1efef7bd4177ffd08d059c9bb6db

SHA1
5f744c1b64289a798dcf5fa71b1e9ac45d35e452

SHA256
902deda1be9ccb4996dccabd5dde981093e451a7f20ed68fd4375712ac698c3f

SHA512
eee8c68f039822a41233d4df4366af33d8d685a49000b3f861704e00792d822ff2d1d42c1a8c248657cb2671b24071f1ba9f61a9518438951ff503edc402e25a

Download Submit
C:\Windows\SysWOW64\Plpqil32.exe

Filesize
1.2MB

MD5
6f391ec0127aced3cc240d3a5d333ef3

SHA1
136675a17042ed54c390bb97f258f9a1b3ed43df

SHA256
b13eca281a5eb7a84cee33461bf0add19d63654d60be3ed3003981a383db96e8

SHA512
16606b8e28605b47eed9105fb30e76662c15492f5440b0774f361ecdf65c2ded17d891180cddc778785a747d9a29e3da2d43aaf6c5964c4c22c46407f7cdab32

Download Submit
C:\Windows\SysWOW64\Pmaffnce.exe

Filesize
1.2MB

MD5
c840dc87693012a1d602c65c8bf367bd

SHA1
5f44404d5688611b8cb6bf62f899ce8a8457d1fb

SHA256
9672419bd24f2f3424a865aa3790381bdee735d16f9cb461ad3501206529ec91

SHA512
a2517af16b2a0243c5224bfdde4d5751a43ac0f9959781d268ffd484656ec408ea13e6471b1b9eb167b56a8b846618d8c8db659a2f0a12fb281ba381a2104c04

Download Submit
C:\Windows\SysWOW64\Pmpolgoi.exe

Filesize
1.2MB

MD5
1b5c02d782b01b5df47c142a29a5aeb6

SHA1
572001b8258691b2f7f75797501bc5c0165033d6

SHA256
4f58fa31bf9a3e48755f56e87cb43afa3fc58f10e0720f92726e0ea2f0b6ed68

SHA512
4bad9f22a92771523151b2df6429849f2c567522b3438639cb3adccdb4b190d4accb6acfc788e3957a8eefbb471e5a14d3195c597384b5baaa2eb1073d64eaf6

Download Submit
C:\Windows\SysWOW64\Pnplfj32.exe

Filesize
1.2MB

MD5
918f37c091af1cceb5f591f6eaaa1540

SHA1
0df547294fffa804c1d08755e8c05f52de4333f5

SHA256
1ea8f8e5eaa8b63ac26fec2458a72668b248521f6ac37eacb835344989e79a1c

SHA512
adef9838b0f697746f95138fb6e5c2031f1507fe9a74ff85fce70aa47d45ecbd1f17c5b5492476a8f90cf8b0604808532ab963c3f7dd6229e21b7761f63ea56c

Download Submit
C:\Windows\SysWOW64\Qacameaj.exe

Filesize
1.2MB

MD5
7bbfad4346731ab18675e4425e7b1dbb

SHA1
c3589a3a9d595500e3d478c4b33d0b475eba6dbb

SHA256
0136d7d0588aad05de40c06f1c82c29acc1d30ef3dbedf2e71bafb231f3ecade

SHA512
89522dd7581f0609875d88904703de5d4802109ac30ac37d94f166027a7689970fd34832bac74ba3b1153b541c3b521e9554e9f2af3f7160d1398f64079a68f2

Download Submit
C:\Windows\SysWOW64\Qebhhp32.exe

Filesize
1.2MB

MD5
5dbf293a35712afb5156eef61c6d1916

SHA1
37a98c331d8bfc4c47c2c4d03975f3456271db6e

SHA256
d5e9d12e2025c3de08e41af4aeff4caaba1b4eafbc7221e740b60c6162708f94

SHA512
f7f004ae5ae4ecca59974437bf01d08f4de8adc6759e0762cd839544b14191b7a425d9a881b9fdbf5414bf720257f03e00be9d206015a179ea06e8929e527ac2

Download Submit
memory/220-263-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/464-325-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/540-433-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/564-313-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/624-463-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/760-112-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1132-223-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1156-379-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1428-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1428-173-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1456-403-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1656-146-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1656-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1728-137-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1728-47-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1740-409-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1836-319-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1856-103-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1916-337-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1984-301-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-277-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2088-165-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2172-289-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2232-385-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2236-255-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2268-102-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2268-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2296-373-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2316-129-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2360-343-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2460-207-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2472-397-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2672-156-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2724-239-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2828-174-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-283-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3020-421-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-111-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3056-164-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3056-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3296-215-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3324-367-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3400-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3504-427-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3544-475-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3564-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3564-79-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3568-44-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3652-469-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3808-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3808-89-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3900-445-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3912-457-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3948-191-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3968-493-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4012-349-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4020-182-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4020-90-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4056-183-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4152-355-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4168-307-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4408-481-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4468-295-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4500-439-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4512-155-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4512-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4592-391-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4692-415-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4816-451-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4820-147-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4852-331-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4860-120-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4860-31-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4880-231-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4888-487-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4904-121-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4908-361-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4928-271-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4960-247-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5044-199-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5116-499-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5132-505-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5172-511-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5212-517-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5252-523-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5292-529-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5332-535-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5372-541-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5412-547-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5452-553-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5492-559-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5532-565-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5572-571-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5612-577-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5652-583-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads