berbew | 402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe
Size

368KB
MD5

de5c87be7a9b431dfef66aa368f27abe
SHA1

16b71ff03a0eda606597cbc2c78b6df42d052f5a
SHA256

402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4
SHA512

f84d9cf6792d5df4936b27a904615d17a4934fec2a77d5236812c43b7497d84395514721176a7da2bfbb60cb931e48198d601dbb9cb83cc8215c061f0d1814c2
SSDEEP

6144:qoQquUA4QO+zrWnAdqjeOpKfduBX2QO+zrWnAdqjsqwHlGrh/tOz:qlquUz/+zrWAI5KFum/+zrWAIAqWiO

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekmhejao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efeihb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enpmld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpclce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekaapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnlmhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gijmad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdbfab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geaepk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hehkajig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgiiiidd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmeigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmodajm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dflfac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egcaod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llqjbhdc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efgemb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnpphljo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebimgcfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnnjmbpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpbpbecj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikmbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbbffdlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddifgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekbjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdickcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flpmagqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilnlom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbpjaeoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebkbbmqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpffeaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kckqbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbebbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfglfdkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lljklo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fndpmndl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcoccc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhplpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhclmp32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4084	Bepmoh32.exe
400	Bebjdgmj.exe
2640	Bhpfqcln.exe
3936	Bkobmnka.exe
4256	Bdickcpo.exe
2052	Cfipef32.exe
5056	Chglab32.exe
2484	Ckeimm32.exe
4220	Cbpajgmf.exe
2804	Cfkmkf32.exe
1836	Cleegp32.exe
2968	Cocacl32.exe
2412	Cfnjpfcl.exe
2352	Chlflabp.exe
1724	Ckjbhmad.exe
2072	Cfpffeaj.exe
2032	Cdbfab32.exe
2508	Cljobphg.exe
1788	Ckmonl32.exe
2424	Cnkkjh32.exe
1692	Cfbcke32.exe
4784	Cdecgbfa.exe
1064	Dmlkhofd.exe
4584	Dokgdkeh.exe
1676	Dbicpfdk.exe
4952	Dfdpad32.exe
2808	Dhclmp32.exe
1540	Dmohno32.exe
2276	Domdjj32.exe
3308	Dnpdegjp.exe
2192	Dfglfdkb.exe
4508	Ddjmba32.exe
3468	Dmadco32.exe
4840	Dooaoj32.exe
680	Dnbakghm.exe
1372	Dfiildio.exe
4384	Digehphc.exe
4564	Doaneiop.exe
3092	Dbpjaeoc.exe
4692	Dflfac32.exe
2780	Dijbno32.exe
4492	Dmennnni.exe
1924	Dodjjimm.exe
1936	Dbbffdlq.exe
3836	Dfnbgc32.exe
2348	Eiloco32.exe
4280	Ekkkoj32.exe
4532	Eofgpikj.exe
2372	Ebdcld32.exe
4372	Eiokinbk.exe
4680	Ekmhejao.exe
3580	Enkdaepb.exe
4072	Efblbbqd.exe
4828	Eiahnnph.exe
1000	Ekodjiol.exe
2440	Eokqkh32.exe
2836	Ebimgcfi.exe
1608	Efeihb32.exe
3644	Eicedn32.exe
3608	Ekaapi32.exe
4856	Enpmld32.exe
748	Efgemb32.exe
4100	Eifaim32.exe
3096	Emanjldl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Domdjj32.exe	Dmohno32.exe
File created	C:\Windows\SysWOW64\Ljceqb32.exe	Lqkqhm32.exe
File opened for modification	C:\Windows\SysWOW64\Kcapicdj.exe	Kpccmhdg.exe
File opened for modification	C:\Windows\SysWOW64\Gpelhd32.exe	Gmfplibd.exe
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Qmeigg32.exe
File created	C:\Windows\SysWOW64\Mqimikfj.exe	Moipoh32.exe
File created	C:\Windows\SysWOW64\Ehbnigjj.exe	Edgbii32.exe
File opened for modification	C:\Windows\SysWOW64\Hfaajnfb.exe	Gpgind32.exe
File opened for modification	C:\Windows\SysWOW64\Kcpjnjii.exe	Klfaapbl.exe
File created	C:\Windows\SysWOW64\Hehkajig.exe	Hbjoeojc.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jofalmmp.exe
File opened for modification	C:\Windows\SysWOW64\Oaplqh32.exe	Oghghb32.exe
File created	C:\Windows\SysWOW64\Dojqjdbl.exe	Dafppp32.exe
File opened for modification	C:\Windows\SysWOW64\Hajkqfoe.exe	Hhaggp32.exe
File created	C:\Windows\SysWOW64\Pgdhilkd.dll	Jeocna32.exe
File created	C:\Windows\SysWOW64\Kiljgf32.dll	Dmlkhofd.exe
File created	C:\Windows\SysWOW64\Fimgpahk.dll	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Mhckcgpj.exe	Mokfja32.exe
File opened for modification	C:\Windows\SysWOW64\Ekkkoj32.exe	Eiloco32.exe
File created	C:\Windows\SysWOW64\Gflhoo32.exe	Gbalopbn.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Cnkkjh32.exe	Ckmonl32.exe
File opened for modification	C:\Windows\SysWOW64\Gflhoo32.exe	Gbalopbn.exe
File created	C:\Windows\SysWOW64\Mbkkam32.dll	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Khbiello.exe	Jbepme32.exe
File created	C:\Windows\SysWOW64\Ildolk32.dll	Nhhdnf32.exe
File opened for modification	C:\Windows\SysWOW64\Oplfkeob.exe	Omnjojpo.exe
File opened for modification	C:\Windows\SysWOW64\Ondljl32.exe	Ofmdio32.exe
File opened for modification	C:\Windows\SysWOW64\Gmimai32.exe	Geaepk32.exe
File created	C:\Windows\SysWOW64\Jofalmmp.exe	Joahqn32.exe
File opened for modification	C:\Windows\SysWOW64\Kheekkjl.exe	Kefiopki.exe
File created	C:\Windows\SysWOW64\Defbaa32.dll	Lpjjmg32.exe
File created	C:\Windows\SysWOW64\Cgogbi32.dll	Loofnccf.exe
File created	C:\Windows\SysWOW64\Njbgmjgl.exe	Mhckcgpj.exe
File created	C:\Windows\SysWOW64\Dnbakghm.exe	Dooaoj32.exe
File opened for modification	C:\Windows\SysWOW64\Gpnfge32.exe	Gmojkj32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjmba32.exe	Dfglfdkb.exe
File opened for modification	C:\Windows\SysWOW64\Fbmohmoh.exe	Fooclapd.exe
File created	C:\Windows\SysWOW64\Onmfimga.exe	Ogcnmc32.exe
File opened for modification	C:\Windows\SysWOW64\Aajhndkb.exe	Amnlme32.exe
File opened for modification	C:\Windows\SysWOW64\Aggpfkjj.exe	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Doaneiop.exe	Dmcain32.exe
File created	C:\Windows\SysWOW64\Akhkncql.dll	Dijbno32.exe
File created	C:\Windows\SysWOW64\Gnblnlhl.exe	Gnpphljo.exe
File created	C:\Windows\SysWOW64\Jeapcq32.exe	Jeocna32.exe
File created	C:\Windows\SysWOW64\Ckjbhmad.exe	Chlflabp.exe
File created	C:\Windows\SysWOW64\Dkbnla32.dll	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Gkoafbld.dll	Ljceqb32.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Iogkekkb.dll	Cfnjpfcl.exe
File created	C:\Windows\SysWOW64\Fnnjmbpm.exe	Flpmagqi.exe
File created	C:\Windows\SysWOW64\Bebjdgmj.exe	Bepmoh32.exe
File created	C:\Windows\SysWOW64\Dbbffdlq.exe	Dodjjimm.exe
File created	C:\Windows\SysWOW64\Bkobmnka.exe	Bhpfqcln.exe
File created	C:\Windows\SysWOW64\Elckbhbj.dll	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Lbmolo32.dll	Lmdnbn32.exe
File created	C:\Windows\SysWOW64\Flbfjl32.dll	Opnbae32.exe
File opened for modification	C:\Windows\SysWOW64\Khbiello.exe	Jbepme32.exe
File opened for modification	C:\Windows\SysWOW64\Cfipef32.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Nlnhqepf.dll	Efgemb32.exe
File created	C:\Windows\SysWOW64\Dafmjm32.dll	Ipgbdbqb.exe
File created	C:\Windows\SysWOW64\Ekbmje32.dll	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Fgjhpcmo.exe	Fdlkdhnk.exe
File created	C:\Windows\SysWOW64\Jbepme32.exe	Jhplpl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10064	9924	WerFault.exe	450

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komhll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnpphljo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eppjfgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibfnqmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpgind32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbpajgmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkkjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifmqfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgmdec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koajmepf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbbffdlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gflhoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocaebc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjmlaac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpaihooo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcbfcigf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfbped32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjcngpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfeeabda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chglab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbnoiqdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Efeihb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flmqlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfeljd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fooclapd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbicpfdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiahnnph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piocecgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgjhpcmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihpcinld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knenkbio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogekbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbepme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kefiopki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gemkelcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpqldc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilfennic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfpell32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddkbmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekjded32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feoodn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gehbjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfiddm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agimkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gnblnlhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nodiqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdickcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpnhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hblkjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpgmhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpfqcln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqbpojnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eiokinbk.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmhkafda.dll"	Imiehfao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmamhbhe.dll"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjqlnnkp.dll"	Ekkkoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gehbjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Geaepk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpecpo32.dll"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebnfbcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gpelhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chflphjh.dll"	Igdgglfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Doccpcja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghklqmm.dll"	Kiikpnmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jpnakk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Enpmld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdkgabfn.dll"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chlflabp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqjoqdcl.dll"	Cbpajgmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqqpnlk.dll"	Cfkmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlgjal32.dll"	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilfennic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdebopdl.dll"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilnlom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Ahmjjoig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpfoag32.dll"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gnpphljo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhdcmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbldphde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hpqldc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpicj32.dll"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbkofn32.dll"	Ppahmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkjmlaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnknop32.dll"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdbplg32.dll"	Gehbjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kegpifod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbhmbdle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llqjbhdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hpnoncim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imiehfao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgiiiidd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbmohmoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmiadfmi.dll"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dokgdkeh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4084	3028	402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe	83
PID 3028 wrote to memory of 4084	3028	402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe	83
PID 3028 wrote to memory of 4084	3028	402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe	83
PID 4084 wrote to memory of 400	4084	Bepmoh32.exe	84
PID 4084 wrote to memory of 400	4084	Bepmoh32.exe	84
PID 4084 wrote to memory of 400	4084	Bepmoh32.exe	84
PID 400 wrote to memory of 2640	400	Bebjdgmj.exe	85
PID 400 wrote to memory of 2640	400	Bebjdgmj.exe	85
PID 400 wrote to memory of 2640	400	Bebjdgmj.exe	85
PID 2640 wrote to memory of 3936	2640	Bhpfqcln.exe	86
PID 2640 wrote to memory of 3936	2640	Bhpfqcln.exe	86
PID 2640 wrote to memory of 3936	2640	Bhpfqcln.exe	86
PID 3936 wrote to memory of 4256	3936	Bkobmnka.exe	87
PID 3936 wrote to memory of 4256	3936	Bkobmnka.exe	87
PID 3936 wrote to memory of 4256	3936	Bkobmnka.exe	87
PID 4256 wrote to memory of 2052	4256	Bdickcpo.exe	88
PID 4256 wrote to memory of 2052	4256	Bdickcpo.exe	88
PID 4256 wrote to memory of 2052	4256	Bdickcpo.exe	88
PID 2052 wrote to memory of 5056	2052	Cfipef32.exe	89
PID 2052 wrote to memory of 5056	2052	Cfipef32.exe	89
PID 2052 wrote to memory of 5056	2052	Cfipef32.exe	89
PID 5056 wrote to memory of 2484	5056	Chglab32.exe	90
PID 5056 wrote to memory of 2484	5056	Chglab32.exe	90
PID 5056 wrote to memory of 2484	5056	Chglab32.exe	90
PID 2484 wrote to memory of 4220	2484	Ckeimm32.exe	91
PID 2484 wrote to memory of 4220	2484	Ckeimm32.exe	91
PID 2484 wrote to memory of 4220	2484	Ckeimm32.exe	91
PID 4220 wrote to memory of 2804	4220	Cbpajgmf.exe	92
PID 4220 wrote to memory of 2804	4220	Cbpajgmf.exe	92
PID 4220 wrote to memory of 2804	4220	Cbpajgmf.exe	92
PID 2804 wrote to memory of 1836	2804	Cfkmkf32.exe	93
PID 2804 wrote to memory of 1836	2804	Cfkmkf32.exe	93
PID 2804 wrote to memory of 1836	2804	Cfkmkf32.exe	93
PID 1836 wrote to memory of 2968	1836	Cleegp32.exe	94
PID 1836 wrote to memory of 2968	1836	Cleegp32.exe	94
PID 1836 wrote to memory of 2968	1836	Cleegp32.exe	94
PID 2968 wrote to memory of 2412	2968	Cocacl32.exe	95
PID 2968 wrote to memory of 2412	2968	Cocacl32.exe	95
PID 2968 wrote to memory of 2412	2968	Cocacl32.exe	95
PID 2412 wrote to memory of 2352	2412	Cfnjpfcl.exe	96
PID 2412 wrote to memory of 2352	2412	Cfnjpfcl.exe	96
PID 2412 wrote to memory of 2352	2412	Cfnjpfcl.exe	96
PID 2352 wrote to memory of 1724	2352	Chlflabp.exe	97
PID 2352 wrote to memory of 1724	2352	Chlflabp.exe	97
PID 2352 wrote to memory of 1724	2352	Chlflabp.exe	97
PID 1724 wrote to memory of 2072	1724	Ckjbhmad.exe	98
PID 1724 wrote to memory of 2072	1724	Ckjbhmad.exe	98
PID 1724 wrote to memory of 2072	1724	Ckjbhmad.exe	98
PID 2072 wrote to memory of 2032	2072	Cfpffeaj.exe	99
PID 2072 wrote to memory of 2032	2072	Cfpffeaj.exe	99
PID 2072 wrote to memory of 2032	2072	Cfpffeaj.exe	99
PID 2032 wrote to memory of 2508	2032	Cdbfab32.exe	100
PID 2032 wrote to memory of 2508	2032	Cdbfab32.exe	100
PID 2032 wrote to memory of 2508	2032	Cdbfab32.exe	100
PID 2508 wrote to memory of 1788	2508	Cljobphg.exe	101
PID 2508 wrote to memory of 1788	2508	Cljobphg.exe	101
PID 2508 wrote to memory of 1788	2508	Cljobphg.exe	101
PID 1788 wrote to memory of 2424	1788	Ckmonl32.exe	102
PID 1788 wrote to memory of 2424	1788	Ckmonl32.exe	102
PID 1788 wrote to memory of 2424	1788	Ckmonl32.exe	102
PID 2424 wrote to memory of 1692	2424	Cnkkjh32.exe	103
PID 2424 wrote to memory of 1692	2424	Cnkkjh32.exe	103
PID 2424 wrote to memory of 1692	2424	Cnkkjh32.exe	103
PID 1692 wrote to memory of 4784	1692	Cfbcke32.exe	104

C:\Users\Admin\AppData\Local\Temp\402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe
"C:\Users\Admin\AppData\Local\Temp\402f897816d386161282fb96eb52895340f816ece44e3ebd65d0ab6eb2da56d4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\Bepmoh32.exe
  C:\Windows\system32\Bepmoh32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\Bebjdgmj.exe
    C:\Windows\system32\Bebjdgmj.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\SysWOW64\Bhpfqcln.exe
      C:\Windows\system32\Bhpfqcln.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
      - C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        23⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        27⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2808
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        30⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        31⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        33⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        34⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4840
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        36⤵
        Executes dropped EXE
        
        PID:680
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        37⤵
        Executes dropped EXE
        
        PID:1372
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        38⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        39⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        40⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4692
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        44⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1924
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        47⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2348
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        51⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        54⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        55⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        57⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        58⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        61⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:748
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        66⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        68⤵
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        69⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        70⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        71⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4836
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        74⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        75⤵
        Modifies registry class
        
        PID:3768
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        76⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        77⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        78⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        79⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        80⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        81⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        82⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1880
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        85⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        86⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4520
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        89⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        90⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        92⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        93⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        94⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        95⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        96⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        99⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        101⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        103⤵
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        104⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        105⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        107⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        109⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        110⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        111⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        113⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        115⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        116⤵
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        118⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        119⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        120⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        121⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        122⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        123⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        124⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2960
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        128⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        129⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        131⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5776
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        133⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        134⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        135⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        136⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        137⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        138⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        139⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        140⤵
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        141⤵
        Drops file in System32 directory
        
        PID:3796
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        142⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        143⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        144⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        145⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        146⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        147⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        148⤵
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        149⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        151⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        152⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4360
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        154⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        155⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        157⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        158⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        159⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        163⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        167⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        168⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        169⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        170⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        171⤵
        Drops file in System32 directory
        
        PID:2776
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        172⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        173⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        174⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        175⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        176⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        178⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        180⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        182⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        183⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        185⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        186⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        188⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        189⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        191⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        192⤵
        Drops file in System32 directory
        
        PID:7012
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:7056
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7152
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        197⤵
        Drops file in System32 directory
        
        PID:1796
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        198⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        200⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        201⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        202⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        203⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        204⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        207⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        209⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        210⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        211⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        212⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        213⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        214⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        216⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        217⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        219⤵
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        220⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        222⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        224⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        225⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        226⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        227⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        228⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        229⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        230⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        232⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7648
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        235⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        236⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        237⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        238⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        239⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        240⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        241⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        242⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        243⤵
        Drops file in System32 directory
        
        PID:8096
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        244⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        246⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        247⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7364
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        249⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        251⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        253⤵
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        254⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        255⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        259⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        261⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        262⤵
        Modifies registry class
        
        PID:7252
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        263⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        264⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        265⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        267⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        268⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        270⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        271⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        272⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7752
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        273⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        274⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7296
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        276⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        277⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        280⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        281⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7812
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        283⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        284⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        285⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        287⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        288⤵
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        289⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        290⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        291⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        292⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        293⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        294⤵
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8588
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        297⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        298⤵
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        299⤵
        Modifies registry class
        
        PID:8768
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        300⤵
        Drops file in System32 directory
        
        PID:8816
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        301⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        303⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        304⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        306⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        307⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9168
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        308⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        309⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        310⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        311⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        312⤵
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        313⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        314⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8824
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        316⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        318⤵
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        319⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        320⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        321⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        322⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        323⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        325⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        326⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        327⤵
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        328⤵
        Drops file in System32 directory
        
        PID:8508
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        330⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        331⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        333⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        334⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        336⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8380
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        337⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        339⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        340⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        341⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        343⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        345⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        346⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        347⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        348⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        349⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        350⤵
        System Location Discovery: System Language Discovery
        
        PID:9560
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        351⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        352⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        353⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        354⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        355⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:9832
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        357⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        358⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9924 -s 412
        359⤵
        Program crash
        
        PID:10064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9924 -ip 9924
1⤵
PID:9996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
368KB

MD5
5bbf5129cca792309ba114586b295d26

SHA1
e07f322fc4046406ca6de83ff42ee6909e0c25d6

SHA256
b0d9ba259a6199e32c8a3f75ef1916392405f748708d899cd05644a811f8f082

SHA512
264e8c6f80f9822efd6949b4c361cc41eb53dc00705da0cd2e5a64f167410b47cfebe5cb61fd14fa1f7c4d31c6c4082a987b9a3389f4978b645ed071201e0ab0

Download Submit
C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
368KB

MD5
0118fc7a3ab612f441e15fa667e22eb9

SHA1
ec14bfa12f1e294a3cd3664bc96459c66eb5ff86

SHA256
68675cda647c2a821ac51a7b5efa721122be7e61003a6a6269df961cf754b57d

SHA512
c12529f258ea38553e3728443e7adacdad4a894a4efe777abddcf791213140d0b7084407eb26e87366aa56d3ea91603cdbc1ba31d9ad0b461ffba6215dd3ac41

Download Submit
C:\Windows\SysWOW64\Bebjdgmj.exe

Filesize
368KB

MD5
b906e3075f4a3e8f581f58a02129cb8e

SHA1
934c58de74b609f39cc4b388c5ba984cb3046488

SHA256
06f5301c7eeb99c2d67ab35140b68b23fd65d2f96e0a43dffd633371ff6980cb

SHA512
6385f49d569d66eed680673099f839f7a0eb7d93828e7cb75d56343b736f1f5411c8f2022308399346d7cadf13b1191d7f29d36b434fa1ae6aa4514e0b8c4993

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
368KB

MD5
eb259e10bc00e27822083baeadad3f42

SHA1
857f117b1519171f5eeaf40c25ac7081dc727ac2

SHA256
c290255e422f2320f8f7aca1461676df7b2919b83fccb8554a04b101e48daee9

SHA512
67838d5c7cc86d60c0e643e040d7eb9fbcbc5e25119fa25e101649bf8c5d8b7875bcc1b7a002863dcad24cc768dd4d24b125af7b442ebe7fd24e0a51207c89c9

Download Submit
C:\Windows\SysWOW64\Bhmbqm32.exe

Filesize
368KB

MD5
ce8d2d801082005c20720711d9b9e024

SHA1
8a2754085656ca60e8ee89440db4368d25de9c80

SHA256
3f96cea386ac177021b680e6166318d7aa6970388822452394868a7ad1170365

SHA512
09c4609c7ab7bb67dcdaa934fdf7f17d3580e6e15fee2867ed45c83d8a8667f7cfe64f6e57472d6be307a96419a7bd390d687a0d12d183a5ee9e9e8695cb267e

Download Submit
C:\Windows\SysWOW64\Bhpfqcln.exe

Filesize
368KB

MD5
366ba7ce9c71ab99bdd22308d60a873b

SHA1
a20e2a645d48a7ed2baae178d15d6959986fa741

SHA256
f346a1b919870f7157c70154a59771bd7d3d62381c3a22df1b50ff9b95dac4f5

SHA512
afb0f4ee21888ffb2d39382d19723e1332cf60b85bf37ec4d86b44358bb7cb21ce5a3d7b70cff3e52f55f104f2dbe93df81a765a9096ebc86930b21b1aff10fa

Download Submit
C:\Windows\SysWOW64\Bkobmnka.exe

Filesize
368KB

MD5
7877d7a4cd11581d064e8c1e61c7d444

SHA1
59899cebfa8c890d99403cd35a0c13279bf4baff

SHA256
f3f5671534b298697c3c0291314efdb5ccc7bdc568cedad310468942b49637f4

SHA512
4f84c8eacf1e178a5b18d35cd4faac790458eac471cc6b8630e4e525e52dd90e05fea8123d8655e44d769b4daa9856fdd267f2531a8f93812a104de4521fa35a

Download Submit
C:\Windows\SysWOW64\Cbpajgmf.exe

Filesize
368KB

MD5
10dc80ac8746e22d73bcc3e58b64b2ff

SHA1
65e451c1daeb10944a6ebc8d1fb6386a1206eb01

SHA256
bc98baccdb7bccdc341dffb6a458b1b56eb915dc3029fb586c88f3cfa453b1db

SHA512
c2e05446a34f866705010de0bcdbd3d939aaef761eeef35908b51bd8a6587be54574a28707ff2a06ada59260278ab4cee5c4843fde5e384b262d71b5c170d842

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
368KB

MD5
e670909122a931ccb70433c46592b842

SHA1
6bbe0df65ca7323bb9b906c80844c409ca7398a6

SHA256
c1797cffb4b2c58e92d0ccb0ca64cda354fb5f11f62772bc511463e82da0d300

SHA512
062760140882f949a9faf9e85dd407828a7105519114e99bd56574e7a46279afd5e3c8aa98e4795c7ced211dcd687fac4a307237e380603f69635c6ce855abc7

Download Submit
C:\Windows\SysWOW64\Cdecgbfa.exe

Filesize
368KB

MD5
7a8c901e477e29b7791175086ea7ed44

SHA1
b7b1db611695d37d1e47dcede17ca41c8c45c02e

SHA256
b63eaf17f9b1a6a72392df893b69b4977aec68691a27431195505212f36f2e9e

SHA512
f0d64d453489f314d6f14ee7feea850ad21f366cfe407816322e985f2ee38343f31e7a5ef3ab6f6c7244975e1505d452616fb7c4394d279d62e27c8aff008ad8

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
368KB

MD5
aee8b92fa0db64deb7816c8aa4c315bf

SHA1
bdd95306ac198c849a1422bce05e6f1fb8136c2f

SHA256
8bc010942d6e494ac02e298cf339d665378edce2cc5449a4c6e262db23bea614

SHA512
5fabe1224f83ee1687e8154ed51345fab204c64ae392fcd915ce71480d7f9df493657663d4f9bb1f7592f5921613f0bdc8c5e63d9dc4af89ed3190b9bca58345

Download Submit
C:\Windows\SysWOW64\Cfipef32.exe

Filesize
368KB

MD5
80c7f7234972068552a28794ccd10d9e

SHA1
2665813958dd8827298bac14492d2bb456c92a79

SHA256
b00e3ce20200c7b26a6f1644ec571d9c8f9bfbebc726dc3ebe38975838feb2f1

SHA512
ae1ea7d80cf367e3093ef8463780f27944cf50e07a9be340ee8b5b59645567959c772d05b377fdf742049d2ab43b093393d23b69da77099bb587bdee3d0c392b

Download Submit
C:\Windows\SysWOW64\Cfkmkf32.exe

Filesize
368KB

MD5
633bd50904a04dc0c3b4b20e0efa9434

SHA1
0c75fbbd0152c33460d05ea2cd63c0f0189ea6fb

SHA256
4be995d6dfd7684fd4a414d3f8335490de1a36f4fe54888a7fa9ab340a2a392e

SHA512
aa334500509f4edebd38235e053b850981b76e1b9f273edcccbd1bf057655d64aca41727e1916b11baa71ec844dcbbb007e0cb89d72b315e4d4cabafc4bcc087

Download Submit
C:\Windows\SysWOW64\Cfnjpfcl.exe

Filesize
368KB

MD5
3f1546414264807e3d705a8a8d0b5b97

SHA1
d70a843ca5a2311faaba16f81d1e0aefa3783461

SHA256
f52e1c4c95e6bab9e784cf6109cd3007d8e15722ca8e21a84a8e274c1751bfde

SHA512
4c3104368cbc846277d349815d6f309fcf74b3547c8c535eb0b5ddf3175db3ee4935d1d3a2005efba3a3a56860e765dae290755d36bf411dbff2bd9fccdefa90

Download Submit
C:\Windows\SysWOW64\Cfpffeaj.exe

Filesize
368KB

MD5
6239a824814af41ec9c16dbc6c602da4

SHA1
eea103521a693a8c9d657c5c02817c4779fd9e0e

SHA256
c13f600b55b2a94793219b9db44c95ded8b4200f7c936181855b7186ce523e44

SHA512
2d60f356b323f950b27f79975a81c6d66c83231fa53a7171c13d0b603ced92e8f27ee3b053582d1df3c7d28587f1dadd1f74acb11454cbc73e9ab296094c2ca6

Download Submit
C:\Windows\SysWOW64\Chglab32.exe

Filesize
368KB

MD5
b4f54e94a5a5dc1fa5b75dc58a33bda2

SHA1
247f05e23219d9bfa84b0b6b88f5dc3137c5a41b

SHA256
b4b3d29f4c8f647c7c7e517c6131338a1213662a08efa58d4a527ae481036a03

SHA512
6e47ff63d8e268ac286d5882a8d13d33ed134be73c1d2f886bc2606bb60fb21dc8624efb1a57591492b5de80aa0e0b4c62457564a7687e18b7fda07a40786cc4

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
368KB

MD5
f29eecf990c2fa52492c7ff57df45087

SHA1
53e0ef1c8562b0505eafc88e93321239c0454040

SHA256
06a7cf7887242c248dc133ac989c8760890062fce7d4d1b8f815c120d023b9f3

SHA512
fa63819ced3fb4187a5d38075dcef06b27362d4ac53d7f51da4607a84ed38e9f47cf607a74cfeb47ffe76ccc69b7a34ea91fda778ee82061787fae50c6001121

Download Submit
C:\Windows\SysWOW64\Ciggeb32.dll

Filesize
7KB

MD5
7b26079bffceab26b235243848b1ccb7

SHA1
e4ae00793acee5479e0ed60288acb036e6484de8

SHA256
377e83acdfbe2e698bb92ad69c8456c78cc82a176a408aa0f38b6ff9652918f3

SHA512
84104110f7296c4a2b0151aad3126d2710367145144c344217455b77a346556fbc5a8b7e52ffda642f883bff17adb04cbb35e2c9f65edbe8450c745daf28f229

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
368KB

MD5
02ab49332e4a15e590aa29241f74b123

SHA1
ab28b3c391dcfad57f72610cd52b8b44174d0b51

SHA256
9ca7b17796bc2f36e735a6e59b736cce938b491cb11550553a488f20661ea9cb

SHA512
a5bcca37ddd9e35859575bc2675e5a6ac63b2a165ab055075e0e452c6496d6554250d8713bf3621cc6c9bb164007430546d02b6d70c41ffcaa75b3592ed3ca76

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
368KB

MD5
49ef46841a096381c424a1c209c7a03d

SHA1
fb128a141b84f466a3d6b3f087661a3807c34eeb

SHA256
d9e8f5e6d6eab64ed9fa513e836668205d5731b237a7deffae7510e52536e286

SHA512
dcc4c501d3c52c42c679b9781a5678c04f02a0bea4f24ed9930f4635c77b7bafcc7360daede7a833a62cbaf6bc2eeafef325110b069495d30db4ab2a4e455b87

Download Submit
C:\Windows\SysWOW64\Cklhcfle.exe

Filesize
368KB

MD5
f61264b867d8cba362b7752b04b0099b

SHA1
0fa7a1b6820f7e22036fd69d03bc4e0d2984c784

SHA256
66d727cf4fa3f87ff976328008269191f80026f419b79fb437ed92349a06efee

SHA512
92452d829d7ceae5508012f2a7743d2132a089d3a3270ea78d6a754f6d5df169108b619ed54367fdf6cd37dced1e9c8271b3f17ce27bc19e840ad84f59385291

Download Submit
C:\Windows\SysWOW64\Ckmonl32.exe

Filesize
368KB

MD5
b609ddf237141d9b58ed360d8b1e2633

SHA1
661b640a5e48acf60cc25c15110c694d413ee657

SHA256
9842e254849ce337a092ab0c10b9631d8e16ccb5f05ffb9173e4f01cbce9cd3b

SHA512
68ae8db3a57f53788a173faf8c9996a121b42347cc6515a26acaa4b248101b686e3c6530f7f5c863a50acb41daac76583a217e2cad437418d5e5da1fa5d2d556

Download Submit
C:\Windows\SysWOW64\Cleegp32.exe

Filesize
368KB

MD5
11d0343817a4b6314a23c3489421b1d3

SHA1
ad14c0c47e92dcb1e191d112202884e0d814c4af

SHA256
f317d1ec2fc650b6f8842165017060cd70ca0f3093870197383336eacc6ee064

SHA512
8519e190b83c5e24807b19b8a9089d8f2c388ce28ce00fca4b65c833b9126bb7d3425437c31c5639e9fc71ff6e5b151ab2d56039cbc313332ffc3103c43b44ed

Download Submit
C:\Windows\SysWOW64\Cljobphg.exe

Filesize
368KB

MD5
0beb7e005446a93c3f0271e40662d8e2

SHA1
79c24c9c152f7a9f20d6aef8b7003d19010662b8

SHA256
e74bc052912d8dfc12800e3b07c84809a1a775e367b3db1b9ff57854c9f55ae0

SHA512
d58f0108a5165d18ef86f25bb070f5ac1c20f004696154528008a45d5e24b29efd78eac11d922addec9a4d50ba4e870021c7f8926d42e06de96ec53997859f36

Download Submit
C:\Windows\SysWOW64\Cnkkjh32.exe

Filesize
368KB

MD5
8a3caad16f887827bfb18754ddf34014

SHA1
7ecacef3d280d70d901b71277250f55693d65ce0

SHA256
fcb670b79a6f8920b579d57dfd6800b06a67c6606f6abb1d79fb77e75b234d0b

SHA512
bc4c4b2d367581ab6d9f2eccd51ea700f61adb42fd0cfe2505f8dbba67d77855c102fff132aec1eec27c98e6016ceda15acc677c97b337fea5383a68d13c7852

Download Submit
C:\Windows\SysWOW64\Cocacl32.exe

Filesize
368KB

MD5
70f451cbaa24c1b03c02bfdc6bcd6792

SHA1
7906ff5e137483e1c69655b2cfe24fe9fa286299

SHA256
747169f5ffd98966774108f577879b82347fb0e4c131cf2b14e7aa6f56b5d85b

SHA512
2bd4eb1f96f1ed5c2a09dfd37783fcfbf60c95376571a0b2775a7d37afa7ed89c3daefed87a3f36bd7d8d4e86e61b664cdc8beadd3738a917862c84f8efa8c65

Download Submit
C:\Windows\SysWOW64\Conanfli.exe

Filesize
368KB

MD5
41c0fd57e1d59bd8a2ae0d005826fa23

SHA1
4e4dc84bd510ffcd14eb519aff9697fd7c18762e

SHA256
95c7d219d1d00f7812580cdf504ddffc127f9139a756a696e4c407b4670bff38

SHA512
b6b74869eae6e8b461ef487caeaf0d14f259eaa8cbd88785697a368b91de61e3754c3af07f0f56df2b0f049c1edaac2b0152082484663c487ad829fb6a07191e

Download Submit
C:\Windows\SysWOW64\Dbicpfdk.exe

Filesize
368KB

MD5
45ee3551aacd072a73ed5cb1c4b4985b

SHA1
0bbac7b311722b889fb1bfca68394fb9ebfb405b

SHA256
0e99bf284cc35f740eee531bce9f6ffdad4d4cb9f42b88168c90a524d26cc8cd

SHA512
5c7e75489d362bf30694424228632d8ddf2dbee2a40679583b36d4790da330d52d81f6df9cb6527762277b394d5b746c97cfaed9caba437bdbf6cedf667141b9

Download Submit
C:\Windows\SysWOW64\Ddjmba32.exe

Filesize
368KB

MD5
8cb0b174e6085b834bbe4d5ec1f711e1

SHA1
71674281604111e99f5ec67ee0fb22660c724aae

SHA256
c935001d591d6853c7a63dab7657c734cff4db6ec4fa99a6a16dc4af0f0c888f

SHA512
b97daf885898b64c96c20f57db5d73805d494249e6e48c525ecfa20e0c9a014c80fa62d3388c368ebf01350b70749f7da1b391643ae89d78bcc7a50ddd42e937

Download Submit
C:\Windows\SysWOW64\Ddkbmj32.exe

Filesize
368KB

MD5
76157994ae2025256a9635dfddc695fd

SHA1
17ab6e4bcfcdd79decb863b3df545baed5ef954f

SHA256
edf83b5c43f65772c4c0e8da3c47e3afcb62dbcbbe79467c8fdf76bcd52a3057

SHA512
d9cad8cbe8dc4de0fa1446a7ced9cbf6dfb0c83697587319a494372947c755b012e0839ab59de8510ee35a922d9cc47f98442a68131f7c86e9e3995294c976f7

Download Submit
C:\Windows\SysWOW64\Dfdpad32.exe

Filesize
368KB

MD5
dc069164611fc200acb106142e4aa497

SHA1
f34d17d1eb79b2e405d64a7e96a70ba6efe06ef7

SHA256
0b10fcedc91a860197fb9373d2f2ae16d99d3b9afb8dbd39383d4d18113139ce

SHA512
aa8b999f170e1ca34492cc4796e326160330a41855ed8ccb6be5be633ebbff1d593c0bccc720e5664dfbf83f739a39f72f8e69165129a039575f35904557dc27

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
368KB

MD5
f014d23f46bd033e2a0ddfbf32bcdc1a

SHA1
4ef8afecd727dd5affe4d10e117229818ffcd1a7

SHA256
2028471e710b824be4116650853a8ec1587fcbb040130f4395647943398236a0

SHA512
dc7e73a4fefe5fc1902a5cf3b080cc0464e9e2ef49e932ec6e6863c82567247b25eda20e1fae38dd23649e83cbc531ed7094817db65524f00ab5642ff5ad8286

Download Submit
C:\Windows\SysWOW64\Dhclmp32.exe

Filesize
368KB

MD5
de922de9d9d635db1f5caaa4b6222054

SHA1
2ac4907e9ac86f580df6bbdcb46424a195a94e82

SHA256
5fe80072e19e245c89a76e6e136433657c46ec08e7519f7aa9934b67ff3cb32e

SHA512
d4783f012dcd81a0de34466a5af4df68262f5454e6ba32fd0928920fb2ba8b6bbfa47b8ffac2adea63985c3a8a750023a5f234e662fe2febe9f56f5345b23647

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
368KB

MD5
e8536a51d2557b3c71c0b278caaea346

SHA1
b04be91f61c466cd24be932ea04f1ae02852ab89

SHA256
549ab59e0648d973413b61cd0dd49c4112bcab85e4d5ac78101a4353627b775d

SHA512
3c80b3d673d905897a8e428469fb6f0d5d816d4da8d7626f6b5c0d3b2169f64e4a15685c34dc0d1333f3a97cc660cc27041b81597e521e9a536f30d1d8e1a5a1

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
368KB

MD5
0062ed1e6b47990cbb6af74b124cf50a

SHA1
8c3d61408ff7604816931e201c843a866e3db62e

SHA256
9c4e451f2d5b965053a61f5826d110ffb3c18e1fd8d9480e9c46c4a40c151066

SHA512
5fb217130b5a68d9b40fb74364da4b68c06376a14c33ac20ff922b156b6614c060638ef076f88c93fd18be34a37c9faad621f3a583f66dce89e0e880f42a9e09

Download Submit
C:\Windows\SysWOW64\Dnpdegjp.exe

Filesize
368KB

MD5
f2ee429c3b2866335d66ace2899207c0

SHA1
f08ea8a0c0f45eef71f7e69d8f355828fd7ae01d

SHA256
3f86fdc4ff5939d9e97aea4084b9da0f7067560d4299d3923d99675e0a9975e5

SHA512
de694a8421125e11de3b5f1695359cee5305949260dec5f8224df157a83b512c04ba50c780abde2e886d0e1b11a0f506160b5b1ddb6afde4b3e1d799553f06e1

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
368KB

MD5
4cdb341145b00445c290f6641949ba87

SHA1
efe204f88aea7dbb42b8e223d829360f14b72f48

SHA256
c2d637aba08c8f58a031303d8cc4ac693bfccc2303a8c5c7c0cd47b22ace997c

SHA512
b22df3e3401647f9d91194a83f0e958bf8ddef4fd080fcb1c8a569aca2e9699b8b42ebf4ee89b4129bf886536814aa0202f997edd2be857020ac3c8df3f16236

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
368KB

MD5
54c85c223f4b691857724ee545cb4413

SHA1
c18c134657f231165c910939f7380e039f77c20e

SHA256
c386d7181601cb30b25c441ea88702d844f5bbebb6d058c6c98eaff4f2ae02a0

SHA512
15e4a8dc8035bae9b6839537d8a423308d5c2c0347dea1ee7f15c98ed164b17cb7221e0a69df409ec291412d3230bf10db42859140dd251b2dbb4fd86ba264d8

Download Submit
C:\Windows\SysWOW64\Ebkbbmqj.exe

Filesize
368KB

MD5
2bf02a53acf7361ff6431af7de161090

SHA1
73834736539eef6227f0b669b8bb52ab651437ef

SHA256
d30870bd080f338a2443052faa4f4184fec423c51d941ccf170074529595e9d1

SHA512
e17e200277228772623c569bfb3f9e66b9de6cfcfa354be712dc180cf1ecc7063cbc81a16a0dafe1f74ad3d45ff7d5b4e23cefe0f72186076153ceb355fc8222

Download Submit
C:\Windows\SysWOW64\Egcaod32.exe

Filesize
368KB

MD5
541d3723952472a82532deab2214a007

SHA1
ddbdc528fb2af9d4e402be4ec2d5eb207ba2f09a

SHA256
8f559892805812560ed489145187f9ad7ee0e863eac2e9be294091528bf56efd

SHA512
e0ae122e66f3b92fe5c385f533d0300358a1e7e373e9fb2d97a67495326bcb53c71ab24462bdcaa20558755f07e3ddb6be5fa4559c6348cff5f18198b51e9041

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
368KB

MD5
508a407b3ee64d0aac78f92588db4b1e

SHA1
aedc7d8e7850506737f2f623ecdcc00663e99113

SHA256
eff87d693329b204d12623bc8b43dec5210e655c8b3cc0e156c81daf26a87285

SHA512
e6b6bdcb66e584baf4a7558ecf8bf366cc02de7097036b266b88b6f0d19e40edbbca93a9ded9c820b70d0605a2571ba96acfd3f38390769a4e919282847283e8

Download Submit
C:\Windows\SysWOW64\Eklajcmc.exe

Filesize
368KB

MD5
caef6266f46b2cc46088c862f252ba86

SHA1
b6b3952a4a12786fd9de5e0b5bd159413dac48be

SHA256
b981f3f7b72e97b63a4756c65f6f19800ecf8c2e0dddb2af6098d4f6fa1892f3

SHA512
e3c3e3ab844073ec5530baca2f052864f3a75c4c69f20be49a408d1b66152c07fcf0babd50042631e1618e0957f70cec6f4db14256ea850357b506be16f0c7d0

Download Submit
C:\Windows\SysWOW64\Fkjmlaac.exe

Filesize
368KB

MD5
9fbd33f568b9b6bf8fccb5769b859cce

SHA1
8a1864f5cd81a8432eaf9dd815e5b7131b4afac0

SHA256
81dee4ca3ef8b5b7307276a4730c5367b364860c4945e1edba7a69db257434bb

SHA512
738b65b0af7802dad1d7aa2418792e96e540a500e697bdffc884232cfdca74f6b441864de5b58a8d4167c1f1e1153fc8d1833c05b710ce95e123f55dccc1293f

Download Submit
C:\Windows\SysWOW64\Fnkfmm32.exe

Filesize
368KB

MD5
ebb376a6bb424e24c66afa7e77a47226

SHA1
8507405b8e2ce6e7f980fe744cb8975a3835a85e

SHA256
0b694fc86510024b3ec05f222f9a9382b480d37af16bd84d67a8975abd1f960e

SHA512
f8d8c152daeccff18d48dea385ec3470a56f09b4f1cf8ac3db2d1e59fcdb8a6bc9b58312b68b2947eafab96452ad183d9e80fa2de363c721a06086452955a622

Download Submit
C:\Windows\SysWOW64\Foapaa32.exe

Filesize
368KB

MD5
0e452062836fa5c4671b627d8964cafe

SHA1
9695058844ca7b310d9fd24712f6f963d647f2fa

SHA256
b1a831413479c626165cef68389fea57ddb0ed1d69bab54e66244da68ab5be33

SHA512
7332fe2f024a37cf70c4362f6f7eaf21f54225ddb635f7aac0c13ee35a40a19fe37c35426c5ef43cb2d966c0f9975d1850c93cc451014a9a65e75883fc791049

Download Submit
C:\Windows\SysWOW64\Fqeioiam.exe

Filesize
368KB

MD5
281b0d99cfd00633d706911b734e0cf4

SHA1
367b02272626339582e55a8e6309129667deabb1

SHA256
e573712be4cbf78e0606f93703c69bba9f42eebaa542dacf87e76b644d63190e

SHA512
d94d72505dc0a4da7b2f9db6a7277fcf5a53f7a4b0722df5aa2b37d997f076a1d0e9947bbc3d76382321f90e9e41bd67ea86b21eed10ec9a595bee7dc014588e

Download Submit
C:\Windows\SysWOW64\Gijmad32.exe

Filesize
368KB

MD5
813563b214886206f8d9a3472545f734

SHA1
9c1f0b78b5b57437de216ff3322a43c8bae6398c

SHA256
4526198d6050a78d5b342cd98819159de4f301eacfedfe3b2be24135d530f30b

SHA512
95d5cda2b153c9779ad666aa809544a6c1b3b41b95c3333cb225c587eda40d4720d184440f873659ca670ba7cab28219c567bebeb9826f14f5a3ea0690c4f57d

Download Submit
C:\Windows\SysWOW64\Gnpphljo.exe

Filesize
368KB

MD5
ff300fc440b57d26fbb72a0e25803013

SHA1
a40e0987e843237393c02a5556d0ae48c0ddbb24

SHA256
4cbd67f71fcf241ae1073319d1d72fdf048e4414e87c83567be6e69b9c2be37b

SHA512
72242467f62f36f73ead21d317c2572ef935f6f693fa4adeda0776a1f423808a34d704b52a5cfbb6e87e761737da817cc6b85daf8f2c746eab25859963981465

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
368KB

MD5
d38995555c1dfefa395905bdbe5d4d04

SHA1
9e1572a3ad8b2220073fb1bfc58c736a3017f9de

SHA256
6e5499ed3c31a7f9632c068ea3e6bac7313e0fea444fb739aa629ff4aed0ee03

SHA512
13c98a3de5dda0e45114b07938bf114349699a023853d516b1676ab314d8460188ed494b2cf832386f5bf6c0d681f2a1dc07b5dbef84303b4ccebb63744da6d5

Download Submit
C:\Windows\SysWOW64\Hnibokbd.exe

Filesize
368KB

MD5
911792ec407c185cfc53f59cf06ce811

SHA1
81c9bdd8558e185794b0ed79dec6e5921a451843

SHA256
1736b29e42abab40e1ffd37e783f6b36f29f944a5f80098977d2682755e1cdbd

SHA512
770836afce810ae48f0bb298068e3aeeaaf218c349a1fe02b3dd511149f3cdb409b5148337c0104f77f0f1f0944b397f6b152acd1e53ddeeb0c40b0add6b8e32

Download Submit
C:\Windows\SysWOW64\Ihpcinld.exe

Filesize
368KB

MD5
8468210404a49453aca63a38223fb4bc

SHA1
a1a2d2e886d595465cb1f349a4eff425dc27a5f3

SHA256
b14e9ed14fe9fd0f1c29199e3edf0df516244c33ddf8e1f9a60375453a732c55

SHA512
b49e9960a262febac5362d5233a01326bbfbdb6c08e82305519c9e759542c34bc2766d6e8861521232caec4edb3e251dc12b8dbec7b6ad63bcc20bc4b556de61

Download Submit
C:\Windows\SysWOW64\Iliinc32.exe

Filesize
368KB

MD5
6150ea4683c9309f529ae69a54dd6606

SHA1
83b00771cc47c02f318fc4bbc940cb38da9bf0fa

SHA256
577ab66388b5bb78259c928af7e8f8bad7b59b4425e332fa5ccf08b15cac0f6a

SHA512
d73d4fb4430fa2435914dc9b82719848f3aab22eae52c639a274a186bf1196d174e1a9f59ee9af6702e1062f53cfe5a8bad8e86351dc4ac73f6dd7e6205c19c9

Download Submit
C:\Windows\SysWOW64\Jbepme32.exe

Filesize
368KB

MD5
5c3d7a26a411a6c5a7017fd4cb13a003

SHA1
80ccf596c3d35daf3404f9615cd24c1b13bf30be

SHA256
7a7d856edfa0796e01615a24c161f8de4f560ef9c75484cf4e6343330229a638

SHA512
d62059729ace258222dcd756ba38ec09683ad403961159959fa3408a1c62c4bb479bb98669f53ef384ff8d8e15c03ff078124a346e1f8795814a72ea784cfe6f

Download Submit
C:\Windows\SysWOW64\Jppnpjel.exe

Filesize
368KB

MD5
4dfe17ae50dc30c7e2b652a3cdc3dcea

SHA1
2305ef80faf52008829be6d03c591d153ae6935e

SHA256
f34070cf13b6435c484482137b553d7128bc5001fb23dcf29a848729eb107190

SHA512
704bc6d4e2ac2e73f30b41b1137af7acdb2f0c9df0b50f455d08c34abb82a997ab1e54924176039e7f9eb36434105bae109be9e2175bd2b2c6b86ea0f8c6effb

Download Submit
C:\Windows\SysWOW64\Kamjda32.exe

Filesize
368KB

MD5
6aa98cb102300ca07669faaaa9d88931

SHA1
36fd37915389674b0228ace9db58b05dccea7cea

SHA256
e1f8b8bb706747bbd3930d04135b2926ea1840854214ba29b1dd22c1bc9b1cca

SHA512
e3200ed2b43e9be66fcdfa06c688fa5f9d4d7793b6e3e95ac654fb9a566cf48902d33d48612e344a4e3f3260cf26edfd3673280e721298fd44d3ca4cd07a1320

Download Submit
C:\Windows\SysWOW64\Kckqbj32.exe

Filesize
368KB

MD5
f67851c91aff61333455bc8dd283f779

SHA1
8b16bceb2ef73aae17580793d2d03c75d3383c41

SHA256
e2a87d9776d8063b2036caf9a4c1dc9c6a1cf2913fa6238c7e559410ce9d8c94

SHA512
b60bd233f2d0f4bc0f2237dfaa91e61c7f756b662a2600dc89643a775fd07dfbd0175f729b8f5e21f311e876052819e8f4ad3174546edda2e3657b36aecf7e05

Download Submit
C:\Windows\SysWOW64\Kcoccc32.exe

Filesize
128KB

MD5
620d1d5cae386c3bb69837bd3a3caedf

SHA1
1c4bac0f056c87b59d45bba8b39ecd39c37d3c80

SHA256
171f3bbabde6ecdd06771dffc48aeaf48ac736363f5f96ec918d1d05c67c5046

SHA512
9df124141a834f637a97ca004db789166ad35626241039b6890e15e15f06eee58d58e82738f55a62ca3a780436c3eb1bb7d648081a5cc6be39dbdf0bc9ccd7d4

Download Submit
C:\Windows\SysWOW64\Kheekkjl.exe

Filesize
368KB

MD5
e242527b7c949c659666bb8120de895a

SHA1
489312d9aabbf854a2df7837e6c2d9f947f55ef8

SHA256
00174cbfb6541f2ad67e4453bbdd6638b5bf906b596bd001065fe9fadb042847

SHA512
ac5d3497eb1fabc94fcf37e594e0acbb66daff182263b990dc4727098cd6b241f8bd3e6573f8ce60302f86e8e0b07b4fc0aa83e362f0629e33e7db801311c76b

Download Submit
C:\Windows\SysWOW64\Khiofk32.exe

Filesize
368KB

MD5
5e854ece17fe84e6a54832fb07a63c3a

SHA1
3dc6152bd235c48771d25574fafc5870939c15aa

SHA256
a70c150682d6c4898329ec3f6b11aea21629a4c3775c55e308efa1bf0b558b54

SHA512
15fa0a652928289c04a25c65a199704fc74143e6cd4812d1607e7ac8abd2911586668a28cef763741e46bcd885c7d35aa92467e3b18df40425a0302c7daa5d78

Download Submit
C:\Windows\SysWOW64\Lfbped32.exe

Filesize
368KB

MD5
c8249225685be54c7468a660490d4e4d

SHA1
6e3296207a0f6353298ae27855cc0b58481e1f56

SHA256
43d7c3bf0cb623cebf325dd9cd4e9f0902d8080b647abb3a14c1e8ab72f59570

SHA512
8bce3a933bb2e35d351f8d48d1a258686db66801fd491cb01fd95537b74f07dd1eb3a2f9396136d8ec83d35b8dca4416bf839aec80982b5da229a98e447dc63b

Download Submit
C:\Windows\SysWOW64\Lfeljd32.exe

Filesize
368KB

MD5
60fec858ac6f75697159bab1dfa4ab9c

SHA1
17697665dc36f27312103fabf870dbdacafd5668

SHA256
542029d95f4227c3dcd7296dfd6912cca0681636dc40ae01f842d49feccaebf6

SHA512
99d46102b2db9dcb6e6371d3a8d04d460c752b6fbb3e69e4347d6d038062486f687eb7b445cd8fa99b401a75684513d54a137cadf51341f02d3eaf6c7e653121

Download Submit
C:\Windows\SysWOW64\Lhnhajba.exe

Filesize
368KB

MD5
f948e3f8b1132c57aa7ea0b85fa739e1

SHA1
4b1765df681fa5eddc412bbb7339d521e760384e

SHA256
43c64cef708d79a6a881696e5b83894aff3fb952ce4a8a73dab9600a59a21328

SHA512
e0f124a928b64ded3937decbef899bc0085c9cf45e1f8fe1cbcaa9ad13872850f7fc8dcdbc3e3c6ced561042954e18bc2c7dd38c1bd065830b68689476af4932

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
368KB

MD5
19638fe15026442453faaa9fc0f10458

SHA1
cb7db9c0c66ae8f05e4925a542735aa5c918663f

SHA256
24dd99c89046e1ac0b3674ae2047cc8907be0798483aa652aba6c2011278fb92

SHA512
4e603ac5916bee20d695730aca59605de820308bfbb912536c0960015783691604811c5895020953e04ed7a44a139c67a0efbae2fefaa843cd557d2f07742186

Download Submit
C:\Windows\SysWOW64\Lopmii32.exe

Filesize
368KB

MD5
dc110d9b923f0d1b0a3a292f952a2ed6

SHA1
1910c33cc79303bd2ef748a4e73b14836ae28577

SHA256
3db921d7070828ea215881fac23fc0165a8296adf644c5ec65e0fde6c2f03d02

SHA512
98af8df0d34dad13572a69ccc7e7f337cd5e165f083e76648b7eec9fbd54496c84cfc9f0018a57d21efad631f17d848dfc557efd69f91555309b0f3f6c4e870a

Download Submit
C:\Windows\SysWOW64\Lpgmhg32.exe

Filesize
368KB

MD5
8867a4b971ad4328e76411262a10eea7

SHA1
8578c8d839338288a23ad40039deabfd8a1866a9

SHA256
bd6487a9c5c503ca8a16dafbb30a88734ac056c982110ff614a98fd88eec4f35

SHA512
371b19682034d4d337931a4ad51fee581d0fcd5d72115ade70aebbd825cfaf0c24faa02e67bcde367fab0f39a91bbec99c3ab867cc14abb2f96a5cdfaf83635a

Download Submit
C:\Windows\SysWOW64\Mbgeqmjp.exe

Filesize
368KB

MD5
dba78eddf5fc1cc0af5e7e820d03611c

SHA1
1956b911e8a14da9fb8a0653240fc9dae3d5b49a

SHA256
bf9788fd9f556580ba94b62f4afee58a99733d643f6278b7f373caae0f9ab40d

SHA512
2717aced93bfc8ba01b3ff0fb93453c801911d43d226fda01400fbcacdcc38bd3f391cba660274cf5d6cd2680a01883da0cffca79a84f8371cc9223c4262f3d8

Download Submit
C:\Windows\SysWOW64\Mhckcgpj.exe

Filesize
368KB

MD5
782d60c56f19958162d8008b215c2f45

SHA1
c9f3a2af603fe70d08a9b7cbcfd3d4349de5482d

SHA256
f1d9300dcbb38e447a78dd3ab0b8f1e5516466c884a4fbb82241f1d0323eefcd

SHA512
9883159782b1769366db770659d1266d3c92d4bbaf1a18e32a311b972632b89392811df77d6d8dbcd1b2777aef7d3c084cd914e910eab43760dbeee9ac39755e

Download Submit
C:\Windows\SysWOW64\Mjggal32.exe

Filesize
368KB

MD5
fdf5661d947288d06c3738734fc2e280

SHA1
71e16649c4ec958eab76aceae6fc38279c1de2c2

SHA256
b48b97e7b6df63b5b3a6f5218721399d13fe6273bd6e3a9a44e645573a40156c

SHA512
a02a5b3f6bcc3905bc4e52d1ff00bfa04c248afdb2cea8bc5075c3a250030455caeff30425910d68ad8251ed1b3920e0336c706a752aa10424d176a71487c0ac

Download Submit
C:\Windows\SysWOW64\Nbebbk32.exe

Filesize
368KB

MD5
e13d5460c594a7b520b18d716fb0b050

SHA1
75de7fd0c9dad552642330766f874c599b7f9793

SHA256
cf81940963a3e3631819df28101d18a22f80d69de6da86e06c1df07327564f3f

SHA512
46db0dede0183f56a5edfc0599a693a2b9abf044bc489e65e29da7aef22193982ebb223a931cff12cec4272c4456dee394ee4b3f8120cb2c326053fb1a5a3bb9

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
368KB

MD5
3c5e9cf6dc995a3d5bab77788a844365

SHA1
282b807132032998243c16442082a6786cf52463

SHA256
30f4fe6b4fea15febaeaca16c64ff895ffdd5e2161fd08c756d077054512b0d6

SHA512
f4b958165d5436bf9ea3ead71b7e85a7781bc949dac908fdb5776a8b7b0a6c323f5d534fe3930ed1a94f0a64e4d95ef0e75bafd69dc3ce52b9045512468f318a

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
368KB

MD5
f9b66233f61562c9023e5e4ecea4340a

SHA1
79d11e09e0930ff70be5bd48664f43bfb2e84e3c

SHA256
270fa75721e490623fc0edf516b7cf9efc4fed7ec1e0ce268423b6b662202b96

SHA512
7bac2b0fd6e5d782da77ee2ea5b0dee712549dc5c351f772ed095db04b02204624e11158fdd2dc6c34b7a6b70ba4c423790b6f21fab2755bba0f9d21ca41997e

Download Submit
C:\Windows\SysWOW64\Npgmpf32.exe

Filesize
368KB

MD5
e2ec47a5b1010a036498f2d322a8cd2a

SHA1
e5fa41a5ec3d85a27c39c46b6c64b13751e560b3

SHA256
a017c787ed24a77dda212d39bb944f3df22416fd38146bb05ddbe305c4e20a5b

SHA512
d091a89e5f7a423e4c8ccb251a00a6d15f596d683c75891dab71205a6b0ea06a00058aeccaabc0c79d8917c5ce3fd370e2052dc70fae0ffd9c08a648a645ddbf

Download Submit
C:\Windows\SysWOW64\Oanokhdb.exe

Filesize
368KB

MD5
39c9065b9d91f9b6867a4958705508bd

SHA1
20f0f6be6f5112a664dd701b52a084341f8cf0ce

SHA256
889d1b3348c55df3f674ea38e2337691a071c82dbc73d42fa81fad12ab80f2bf

SHA512
41c025320cf43de6f76abe33fb05333cb62b576f96f5aa6a0a2e0e13c91af88c50bfec96001f6ec396626cc8419501174bd1882427d3482ae6b5054f772899ab

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
368KB

MD5
ba19b7e91698b7c8ec02a382d0045b09

SHA1
1a629a793901600f573293e09278822e11f5e3b8

SHA256
5a03e9db592c8d465f34f5a88214d9a5eb89662f7b0d18038481d64e40ee3d62

SHA512
7934e7ab89b50ab26dfe7fd11d8513973b61435e24a360985b47b753292f38ab806196f45b017eb3de4055cd3844c570a2cd5cedd3ebf1f91446428fef4c76cb

Download Submit
C:\Windows\SysWOW64\Ofgdcipq.exe

Filesize
368KB

MD5
461cd6b967495e977c817392374241c4

SHA1
60222cb0e2948f804eaf54b06a405ebe25156d3a

SHA256
d7cfc8b9c9b6e5ce7afe691d98fc73de038c5c7fbe38caad32c283642706a7dd

SHA512
ee2b4c1c9d7d4e165e3e3c7937185bde59f790c089b294fe0f692c49cf0174c283438f1b30c396a353aaf5ddb3a91b90aeba609e7aa4e4263a01049262bae073

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
368KB

MD5
2789dc056dce6209e6907282019f0257

SHA1
dfe2fdc91fc8d70f06c3018597fa2055b50b34f4

SHA256
197da2c5cb355842dc9768f0955abbb8c9daf9cb308aea4783466da5df5cdf35

SHA512
07f1cb5f58f9649875ded18cedeb738284e4799814d3fbc29b7dd9fa712baecc096d6691aa70a449b3292a5229f50cdb7db59c6776f9b5dc8d1468779ecdcf25

Download Submit
C:\Windows\SysWOW64\Ojhiogdd.exe

Filesize
368KB

MD5
0d520e6e8ed955d331934af138f6435d

SHA1
5e5ea822cd5a832bb27a77c1fdddb51267b6a8ff

SHA256
e61b2d29607543a2e1036f38c88470e47e73814308510671eb8b0e2598f23482

SHA512
11b8b354d4b3ba4e50f0dc7c3318f3cc384428e904503f46373ed8f306ef9eb0ca96cf9e14862675d1fbe5bd4bb6dfc42b7d8f6bb00273977d788fa8f5196842

Download Submit
C:\Windows\SysWOW64\Pbcncibp.exe

Filesize
368KB

MD5
be0f6e06daaa5198afba7c7831b79807

SHA1
2e6ae8f4fc2e42af62d0636ed6867064d1b949b9

SHA256
0715098982361a874b7b2e5c02decd3b159b9f37a0fef7bb3884eef12dd50b03

SHA512
0ef50218a78eb4ecb8378b230919fa35fdbf0bd6845d9334ac526575dadcfe8e7ad6a0f309ffa999284cde6064961f76957d91568a7a4fb8c0024eabfec35df5

Download Submit
C:\Windows\SysWOW64\Piocecgj.exe

Filesize
368KB

MD5
324121748854a5ed3b21bc753b982fc1

SHA1
a9fb15191a5963a51e0a18ba16593f372e5802f3

SHA256
f6fb422b83549b131cbb0c6e8a8d5092eef19664dec07796dc73d4a8623a8434

SHA512
58a97334a375b80668faf23a5d903a159c8527f0bdf97e35de4310852f490c6b494ee6afd2e7c0717d75fe0458b6d04e8d981720453a8f9fd6b3ea3dea22cec5

Download Submit
C:\Windows\SysWOW64\Pnmopk32.exe

Filesize
368KB

MD5
7085a1c4b21776bf076b342c4bc8d5e1

SHA1
90e9f3ddf6c3bc5ac434b6ec0050decd88b698a2

SHA256
704e6adef86f44e2ca7e51344c9981dda13fcac44738969450455a826c4fd5d6

SHA512
6d7fc53b41ccc194ef1d0dce338ead2c7f17fb15a6502d17816a1521245b159c58523826b60df0496e6796c1cc2a4a44af93def19b05e6ec56f2abf364933bc8

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
368KB

MD5
e2f96646eb0af59c8dec86858b2b46c6

SHA1
50bc187fd22ffb1ce53f2918784111b9047fa82e

SHA256
9863e0e6977d57e377a615607292043687e2d08233c8536f9288f77f740c6ef1

SHA512
aa6b87108b855a5a70b1de3e41164573f357d559a85e5026e33a572a81463a6030999f454371c502f587a5642c8b989c026de6418af21dbda24e36643580f72b

Download Submit
memory/400-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/400-557-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/680-278-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/748-442-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1000-400-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1044-478-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1064-189-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1224-466-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1368-472-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1372-285-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1540-229-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1552-520-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1608-418-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1676-205-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1692-173-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1724-125-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1788-156-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1836-88-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1844-538-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1880-566-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1924-328-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1936-334-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2032-140-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-47-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2052-585-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2072-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2192-253-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2276-236-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2348-346-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2352-117-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2372-364-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2412-108-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2424-164-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2440-406-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2444-496-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2484-63-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2508-148-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2640-565-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2640-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2780-316-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2796-545-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2804-84-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2808-220-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2836-412-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2968-96-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2984-573-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3028-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3028-543-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3092-304-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3096-454-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3308-245-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3468-267-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3532-587-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3580-382-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3608-430-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3644-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3676-460-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3768-508-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3836-340-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3936-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3936-571-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3968-526-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4072-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4084-551-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4084-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4100-448-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4220-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4224-552-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4256-579-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4256-40-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4280-352-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4352-292-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4372-370-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4384-286-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4456-532-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4468-514-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4492-322-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4508-261-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4520-594-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4532-358-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4556-559-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4564-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4576-580-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4584-196-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4680-376-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4692-309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4784-180-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4828-394-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4836-490-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4840-273-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4856-436-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4952-213-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5020-484-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5056-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5056-592-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5080-502-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads