berbew | b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d

Analysis

max time kernel
92s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d.exe
Size

305KB
MD5

4fd177c398ea655187009f15933a79f7
SHA1

7270a0dda49775c54f5920d2c3f3b14da3a63090
SHA256

b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d
SHA512

d1a3983bee4d49397cc81e94f53638af7e8a6ff08480c5a1c114b95211ece422f395130d9f662a83ec8223b15945006d2bdd599783de0e09f7ca958eaf4e5493
SSDEEP

6144:hRZ+Ixmm8OAuW53shNxunXe8yhrtMsQBvli+RQFdq:hjxzy3YvAO8qRMsrOQF

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cndeii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeokal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phodcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aolblopj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aajohjon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cljobphg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Digehphc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjgfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qklmpalf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmimai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imkbnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfchlbfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Palklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkegpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aahbbkaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bochmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bheplb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnfgcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bohbhmfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckjknfnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmbphg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nenbjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odoogi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddjmba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekdnei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojiiafp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmdfonj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngqagcag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ljceqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aaohcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eicedn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jepjhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnbnhedj.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3500	Lgjijmin.exe
3368	Lmgabcge.exe
376	Mnfnlf32.exe
1196	Mepfiq32.exe
1988	Mgaokl32.exe
4980	Meepdp32.exe
4620	Mkohaj32.exe
2604	Mmpdhboj.exe
3032	Manmoq32.exe
2796	Nnbnhedj.exe
852	Ncofplba.exe
1144	Nabfjpak.exe
2728	Nenbjo32.exe
828	Nnfgcd32.exe
5088	Nnicid32.exe
2444	Njpdnedf.exe
2284	Oeehkn32.exe
3684	Omqmop32.exe
180	Odjeljhd.exe
3700	Onpjichj.exe
1380	Oldjcg32.exe
3652	Omegjomb.exe
4140	Odoogi32.exe
4172	Olfghg32.exe
4156	Oacoqnci.exe
1172	Oeokal32.exe
4372	Odalmibl.exe
4456	Paelfmaf.exe
1696	Pddhbipj.exe
1444	Phodcg32.exe
4056	Plkpcfal.exe
2128	Pahilmoc.exe
536	Pecellgl.exe
1136	Pdfehh32.exe
1204	Poliea32.exe
3508	Pmoiqneg.exe
4300	Pefabkej.exe
4176	Phdnngdn.exe
540	Plpjoe32.exe
4516	Pkbjjbda.exe
3444	Pmaffnce.exe
1384	Palbgl32.exe
460	Pdkoch32.exe
1968	Phfjcf32.exe
3256	Pkegpb32.exe
1288	Popbpqjh.exe
3056	Paoollik.exe
1216	Pejkmk32.exe
4308	Phigif32.exe
4900	Pldcjeia.exe
3664	Qmepam32.exe
4788	Qaalblgi.exe
3716	Qdphngfl.exe
380	Qhkdof32.exe
808	Qkipkani.exe
632	Qmhlgmmm.exe
3140	Qachgk32.exe
4328	Qdbdcg32.exe
2100	Qhmqdemc.exe
3416	Qklmpalf.exe
4460	Aogiap32.exe
3632	Aafemk32.exe
4644	Addaif32.exe
1708	Ahpmjejp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mmfkhmdi.exe	Ljhnlb32.exe
File created	C:\Windows\SysWOW64\Khoana32.dll	Nnfgcd32.exe
File created	C:\Windows\SysWOW64\Jongga32.dll	Gidnkkpc.exe
File created	C:\Windows\SysWOW64\Gmophg32.dll	Imgicgca.exe
File created	C:\Windows\SysWOW64\Igdgglfl.exe	Ibhkfm32.exe
File created	C:\Windows\SysWOW64\Fboqkn32.dll	Lcnfohmi.exe
File opened for modification	C:\Windows\SysWOW64\Oghghb32.exe	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Amjbbfgo.exe	Qdaniq32.exe
File opened for modification	C:\Windows\SysWOW64\Gblbca32.exe	Gpnfge32.exe
File created	C:\Windows\SysWOW64\Illfdc32.exe	Iinjhh32.exe
File opened for modification	C:\Windows\SysWOW64\Imkbnf32.exe	Iipfmggc.exe
File created	C:\Windows\SysWOW64\Accimdgp.dll	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Edqnimdf.dll	Kflide32.exe
File created	C:\Windows\SysWOW64\Lopmii32.exe	Lmaamn32.exe
File opened for modification	C:\Windows\SysWOW64\Popbpqjh.exe	Pkegpb32.exe
File created	C:\Windows\SysWOW64\Bnfihkqm.exe	Bochmn32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbloglj.exe	Lqhdbm32.exe
File created	C:\Windows\SysWOW64\Cpfcfmlp.exe	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Cljobphg.exe	Cdbfab32.exe
File created	C:\Windows\SysWOW64\Gepgfb32.dll	Fimhjl32.exe
File created	C:\Windows\SysWOW64\Hknkchkd.dll	Gpbpbecj.exe
File opened for modification	C:\Windows\SysWOW64\Gmimai32.exe	Geaepk32.exe
File created	C:\Windows\SysWOW64\Gbeejp32.exe	Gojiiafp.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hmmfmhll.exe
File opened for modification	C:\Windows\SysWOW64\Loighj32.exe	Kngkqbgl.exe
File opened for modification	C:\Windows\SysWOW64\Mmkdcm32.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Pecellgl.exe	Pahilmoc.exe
File created	C:\Windows\SysWOW64\Qnbidcgp.dll	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Cpdgqmnb.exe	Cncnob32.exe
File created	C:\Windows\SysWOW64\Fomnhddq.dll	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Ihejacdm.dll	Mnfnlf32.exe
File opened for modification	C:\Windows\SysWOW64\Bffcpg32.exe	Bomkcm32.exe
File created	C:\Windows\SysWOW64\Ggqecq32.dll	Eofgpikj.exe
File created	C:\Windows\SysWOW64\Kqqpck32.dll	Fnnjmbpm.exe
File opened for modification	C:\Windows\SysWOW64\Gikdkj32.exe	Geohklaa.exe
File created	C:\Windows\SysWOW64\Kcpjnjii.exe	Klfaapbl.exe
File created	C:\Windows\SysWOW64\Gkoafbld.dll	Lmaamn32.exe
File created	C:\Windows\SysWOW64\Bcjfln32.dll	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Omqmop32.exe	Oeehkn32.exe
File created	C:\Windows\SysWOW64\Hopnfa32.dll	Pdkoch32.exe
File opened for modification	C:\Windows\SysWOW64\Hffken32.exe	Hplbickp.exe
File opened for modification	C:\Windows\SysWOW64\Bheplb32.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Cocacl32.exe	Cleegp32.exe
File created	C:\Windows\SysWOW64\Kjeiodek.exe	Kgflcifg.exe
File created	C:\Windows\SysWOW64\Bdickcpo.exe	Bffcpg32.exe
File created	C:\Windows\SysWOW64\Lfipab32.dll	Emjgim32.exe
File created	C:\Windows\SysWOW64\Goglcahb.exe	Gpelhd32.exe
File created	C:\Windows\SysWOW64\Jfegnkqm.dll	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Ifmqfm32.exe	Hoeieolb.exe
File opened for modification	C:\Windows\SysWOW64\Mmfkhmdi.exe	Ljhnlb32.exe
File created	C:\Windows\SysWOW64\Njfkmphe.exe	Nfjola32.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Kpjgaoqm.exe
File opened for modification	C:\Windows\SysWOW64\Nnafno32.exe	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Lhdbgapf.dll	Oabhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Qaalblgi.exe	Qmepam32.exe
File created	C:\Windows\SysWOW64\Kbjodaqj.dll	Fiaael32.exe
File created	C:\Windows\SysWOW64\Qgjamboa.dll	Iinjhh32.exe
File opened for modification	C:\Windows\SysWOW64\Lobjni32.exe	Lnangaoa.exe
File created	C:\Windows\SysWOW64\Pnplfj32.exe	Pjdpelnc.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoiqneg.exe	Poliea32.exe
File opened for modification	C:\Windows\SysWOW64\Pldcjeia.exe	Phigif32.exe
File created	C:\Windows\SysWOW64\Cleegp32.exe	Cdnmfclj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9412	10216	WerFault.exe	454

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coohhlpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbbpmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbgihaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oeehkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgifbil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boeebnhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fpkibf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpnfge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbnoiqdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmmfmhll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iliinc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahbjoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fneggdhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcfggkac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlolpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgdidgjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfqlfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phdnngdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hefnkkkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifomll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkegpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Digehphc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekaapi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flfkkhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gpbpbecj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaamn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljhnlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aahbbkaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bohbhmfm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fflohaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Panhbfep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bochmn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdecgbfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebgpad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ennqfenp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eicedn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gblbca32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monjjgkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popbpqjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odalmibl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkohaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aolblopj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffcpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckeimm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flkdfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iohejo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qklmpalf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpjlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbfab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emhkdmlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hifcgion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iidphgcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kgflcifg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpcjgnhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaohcj32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egdagc32.dll"	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpcjgnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pccopc32.dll"	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Addaif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Boeebnhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lgdidgjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkpophj.dll"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ignlbcmf.dll"	Jcfggkac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmimai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hfjdqmng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijilflah.dll"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qklmpalf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ennqfenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Flfkkhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iinjhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mmkdcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oghghb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Blgifbil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncqlkemc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nenbjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fmkqpkla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqqpck32.dll"	Fnnjmbpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgflcifg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgihjf32.dll"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pahilmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Phfjcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eicedn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgjijmin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gahamgib.dll"	Dbnmke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dckahb32.dll"	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lnangaoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igafkb32.dll"	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mmpdhboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baaelkfn.dll"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogigdpmb.dll"	Hefnkkkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pkbjjbda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Minqeaad.dll"	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oeokal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qmepam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhpmpa.dll"	Ncnofeof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmlephen.dll"	Cbpajgmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbbnpg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3500	2696	b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d.exe	87
PID 2696 wrote to memory of 3500	2696	b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d.exe	87
PID 2696 wrote to memory of 3500	2696	b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d.exe	87
PID 3500 wrote to memory of 3368	3500	Lgjijmin.exe	88
PID 3500 wrote to memory of 3368	3500	Lgjijmin.exe	88
PID 3500 wrote to memory of 3368	3500	Lgjijmin.exe	88
PID 3368 wrote to memory of 376	3368	Lmgabcge.exe	89
PID 3368 wrote to memory of 376	3368	Lmgabcge.exe	89
PID 3368 wrote to memory of 376	3368	Lmgabcge.exe	89
PID 376 wrote to memory of 1196	376	Mnfnlf32.exe	90
PID 376 wrote to memory of 1196	376	Mnfnlf32.exe	90
PID 376 wrote to memory of 1196	376	Mnfnlf32.exe	90
PID 1196 wrote to memory of 1988	1196	Mepfiq32.exe	91
PID 1196 wrote to memory of 1988	1196	Mepfiq32.exe	91
PID 1196 wrote to memory of 1988	1196	Mepfiq32.exe	91
PID 1988 wrote to memory of 4980	1988	Mgaokl32.exe	92
PID 1988 wrote to memory of 4980	1988	Mgaokl32.exe	92
PID 1988 wrote to memory of 4980	1988	Mgaokl32.exe	92
PID 4980 wrote to memory of 4620	4980	Meepdp32.exe	93
PID 4980 wrote to memory of 4620	4980	Meepdp32.exe	93
PID 4980 wrote to memory of 4620	4980	Meepdp32.exe	93
PID 4620 wrote to memory of 2604	4620	Mkohaj32.exe	94
PID 4620 wrote to memory of 2604	4620	Mkohaj32.exe	94
PID 4620 wrote to memory of 2604	4620	Mkohaj32.exe	94
PID 2604 wrote to memory of 3032	2604	Mmpdhboj.exe	96
PID 2604 wrote to memory of 3032	2604	Mmpdhboj.exe	96
PID 2604 wrote to memory of 3032	2604	Mmpdhboj.exe	96
PID 3032 wrote to memory of 2796	3032	Manmoq32.exe	97
PID 3032 wrote to memory of 2796	3032	Manmoq32.exe	97
PID 3032 wrote to memory of 2796	3032	Manmoq32.exe	97
PID 2796 wrote to memory of 852	2796	Nnbnhedj.exe	98
PID 2796 wrote to memory of 852	2796	Nnbnhedj.exe	98
PID 2796 wrote to memory of 852	2796	Nnbnhedj.exe	98
PID 852 wrote to memory of 1144	852	Ncofplba.exe	100
PID 852 wrote to memory of 1144	852	Ncofplba.exe	100
PID 852 wrote to memory of 1144	852	Ncofplba.exe	100
PID 1144 wrote to memory of 2728	1144	Nabfjpak.exe	101
PID 1144 wrote to memory of 2728	1144	Nabfjpak.exe	101
PID 1144 wrote to memory of 2728	1144	Nabfjpak.exe	101
PID 2728 wrote to memory of 828	2728	Nenbjo32.exe	103
PID 2728 wrote to memory of 828	2728	Nenbjo32.exe	103
PID 2728 wrote to memory of 828	2728	Nenbjo32.exe	103
PID 828 wrote to memory of 5088	828	Nnfgcd32.exe	104
PID 828 wrote to memory of 5088	828	Nnfgcd32.exe	104
PID 828 wrote to memory of 5088	828	Nnfgcd32.exe	104
PID 5088 wrote to memory of 2444	5088	Nnicid32.exe	105
PID 5088 wrote to memory of 2444	5088	Nnicid32.exe	105
PID 5088 wrote to memory of 2444	5088	Nnicid32.exe	105
PID 2444 wrote to memory of 2284	2444	Njpdnedf.exe	106
PID 2444 wrote to memory of 2284	2444	Njpdnedf.exe	106
PID 2444 wrote to memory of 2284	2444	Njpdnedf.exe	106
PID 2284 wrote to memory of 3684	2284	Oeehkn32.exe	107
PID 2284 wrote to memory of 3684	2284	Oeehkn32.exe	107
PID 2284 wrote to memory of 3684	2284	Oeehkn32.exe	107
PID 3684 wrote to memory of 180	3684	Omqmop32.exe	108
PID 3684 wrote to memory of 180	3684	Omqmop32.exe	108
PID 3684 wrote to memory of 180	3684	Omqmop32.exe	108
PID 180 wrote to memory of 3700	180	Odjeljhd.exe	109
PID 180 wrote to memory of 3700	180	Odjeljhd.exe	109
PID 180 wrote to memory of 3700	180	Odjeljhd.exe	109
PID 3700 wrote to memory of 1380	3700	Onpjichj.exe	110
PID 3700 wrote to memory of 1380	3700	Onpjichj.exe	110
PID 3700 wrote to memory of 1380	3700	Onpjichj.exe	110
PID 1380 wrote to memory of 3652	1380	Oldjcg32.exe	111

C:\Users\Admin\AppData\Local\Temp\b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d.exe
"C:\Users\Admin\AppData\Local\Temp\b0d81337061a41f9ee9f558632110050c11b585e93c5ddb6515eb0520ccf368d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\Lgjijmin.exe
  C:\Windows\system32\Lgjijmin.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\Lmgabcge.exe
    C:\Windows\system32\Lmgabcge.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\SysWOW64\Mnfnlf32.exe
      C:\Windows\system32\Mnfnlf32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
      - C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:180
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        23⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        25⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        26⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        29⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        30⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        32⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        34⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        35⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        37⤵
        Executes dropped EXE
        
        PID:3508
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        38⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        40⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        42⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        43⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:460
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        48⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        49⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4308
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        51⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        53⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        54⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        55⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        56⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        57⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        58⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        59⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        60⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        62⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        63⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        65⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        66⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        67⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3600
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4736
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        71⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3212
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        74⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        75⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        76⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        77⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1792
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        79⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        81⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        82⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        84⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2848
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        86⤵
        
        PID:352
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        87⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        88⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        89⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        92⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        95⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        96⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        97⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        100⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        101⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        103⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        104⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        106⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        107⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        108⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1244
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        111⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        112⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5400
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        115⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        116⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        117⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        118⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5728
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        121⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        122⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        123⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        124⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        126⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        127⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        128⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        129⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        131⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        132⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        133⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        135⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        137⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5984
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        139⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        140⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        144⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        145⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        147⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        148⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        152⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        153⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        155⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        159⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        160⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        161⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        162⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        164⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        165⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        167⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        168⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        169⤵
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        170⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        173⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        174⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        177⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        178⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        179⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        180⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        184⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        185⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        188⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        189⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        190⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        191⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        192⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        193⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        194⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        195⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        196⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        197⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        198⤵
        Modifies registry class
        
        PID:7232
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        199⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        202⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        203⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        204⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        205⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        206⤵
        Modifies registry class
        
        PID:7580
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        207⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        208⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        209⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        210⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:7800
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:7844
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        213⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        214⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        216⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        217⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        218⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        219⤵
        Drops file in System32 directory
        
        PID:8152
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        221⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        223⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        224⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        225⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        226⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        227⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        228⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        229⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        230⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        231⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        232⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        233⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        234⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        235⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        236⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        237⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        238⤵
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7616
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        240⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        241⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        242⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        244⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        245⤵
        System Location Discovery: System Language Discovery
        
        PID:7292
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        246⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        248⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8016
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        250⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        251⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        252⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        253⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        254⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        255⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        256⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        257⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        258⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        259⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        260⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        261⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        262⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        263⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        264⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        265⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8524
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        267⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8568
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        268⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8656
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        270⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        271⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        272⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        274⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        275⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        276⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9008
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        278⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        279⤵
        Drops file in System32 directory
        
        PID:9100
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        280⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9144
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9184
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        282⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        283⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        284⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        285⤵
        System Location Discovery: System Language Discovery
        
        PID:8740
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        286⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        287⤵
        Modifies registry class
        
        PID:8864
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8936
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        289⤵
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        290⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        291⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        292⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        293⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        294⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        295⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        296⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8576
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        299⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8776
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        300⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        301⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        302⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        303⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        304⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        305⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        306⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        309⤵
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        310⤵
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        311⤵
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        312⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        314⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        316⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        317⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        318⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8892
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        321⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        322⤵
        Drops file in System32 directory
        
        PID:4684
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        323⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        324⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        325⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        326⤵
        Drops file in System32 directory
        
        PID:9396
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        327⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9492
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        329⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        330⤵
        Drops file in System32 directory
        
        PID:9584
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:9628
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        332⤵
        System Location Discovery: System Language Discovery
        
        PID:9672
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        333⤵
        Modifies registry class
        
        PID:9716
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        334⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        335⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:9852
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9896
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9940
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        339⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10032
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10076
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        342⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        343⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        344⤵
        System Location Discovery: System Language Discovery
        
        PID:10208
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        345⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        346⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        347⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        348⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9536
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        350⤵
        Modifies registry class
        
        PID:9576
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9660
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        352⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        353⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        355⤵
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        356⤵
        System Location Discovery: System Language Discovery
        
        PID:10016
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        357⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10160
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        359⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10216 -s 236
        360⤵
        Program crash
        
        PID:9412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10216 -ip 10216
1⤵
PID:9340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adhdjpjf.exe

Filesize
305KB

MD5
d7a9fe4fcc6bc4b54d075224338a68ff

SHA1
6a8f4511bf9a92a36738a99ae371a060690c94d3

SHA256
9f73b058b95ed7e3330a60e55873aecb7fecb5ce93884fb12b6d36a26b361180

SHA512
dd76ecdf30689b49578232d0e9bb47b8ed2d98bff7ad00d9cb7fe4433a25ca554d155a6f1d35788cd584b93f97022a6b6dcaf48035356c270374eb48784ce38e

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
64KB

MD5
f5359769ac6b0c3375e7785065901d34

SHA1
8d7cdc538f8249263dd3cbe0d86a9ddc7cb7814b

SHA256
6fd5e33b80dbf38f74d831a47b7d5f6fe3cfd7bb26873b621590817111c8a0b2

SHA512
69c9736eaf2a2269cf4332725126362654cc5c2e70b38418c90adb3f83b2b907a413babafe8237df2137e346ea343186ed6b461db06a3d8a30308bb2de59db1a

Download Submit
C:\Windows\SysWOW64\Bafndi32.exe

Filesize
305KB

MD5
b75b3a3e69b17170d4d8a03adfdd6b87

SHA1
cac382c547575e2f31428bd2eb4927b25ea020a7

SHA256
9c5121bbaef0c052cf70b3d87704d6585ddfc3585e652a6cf50c96433630d79e

SHA512
b569c3f41457073c45646e9f32fe770cec59a0b1b1d49aab5b7b772aa9a7bb67edc923b4386105181c59be8dff1e59ce80c4931b472cd2f40a396ac116fa2991

Download Submit
C:\Windows\SysWOW64\Bgbpaipl.exe

Filesize
305KB

MD5
5e6f1de5a772ba7c3d3073bc2b214048

SHA1
781640b3648d7d6ccda8ceff1fea57bf954b1c2d

SHA256
b674f95e43346b77a75851974fa10e9140309687f43946fa18e8e56cdcc41c30

SHA512
069f7c74d6339a34188c2fb8d9d47f79681f073ced5133e8f010a74926b204514a606ad1808e82c4796aae9ff36becac08657b059665e5d6468a801dbe1aaa6c

Download Submit
C:\Windows\SysWOW64\Bmeandma.exe

Filesize
305KB

MD5
d604834d9eecd5961c133b78dda4c0e4

SHA1
0fe44e8e8eaaec6fa43cdc673cd7a00774f8d6a0

SHA256
a9525d60123099d91c880c76c84df45da6a6056a735348f02b88c180a6dd37ee

SHA512
151618d7fff106494475b00c140b87aefab4a88f7be1c1961974a236bddd445823cc9e004123eff847ffde3e649fd5f9ff82fe9f77bda60d255798d1f216ee76

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
305KB

MD5
756c2cb581f53e510c973da576308d18

SHA1
b6a8e5e3a12cd5e73dc990f7defffc31bf0d4cd4

SHA256
580800dad600ac64a4292f6f13b06f6ad34c42df126829bc194b29b2ef4f4f7e

SHA512
709da634a9483561d85666688669ec93743b4f3bb2a9d86c40b658f8bdcaee86405b6dae7c4f588e906d033fad8c6a024997e85cadbe7d56154668a787ad44f9

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
305KB

MD5
4e856bd62c71d73e14ae3f27f903d521

SHA1
1693eb82c09d2a41b8c309f905d02f6c442e49a2

SHA256
99446e18de6f2c078719bac038c92e799fa575849c308bc59fa1261cb4724cdd

SHA512
9a960c4406d85cb5aa716c8e695a026f74e98201a439e653bd009c5e3d31e57955083b73f8b5673ea4e1a632c6f5060e9e8f388dcaf71613e41cd3d97872209b

Download Submit
C:\Windows\SysWOW64\Cncnob32.exe

Filesize
305KB

MD5
6928a9b351b49dd1adc5caa23805b80e

SHA1
dc352846cfecd6611a5f282770f12c70c18ae237

SHA256
2d2fb626de79e66ff8589cd558a4eaf4809299e5336d5fe63e5b9d530acc8e3d

SHA512
71115f7af50b6ae8adade1ce59acb734a0fb0a0b8da5895a6b80dc3f21cf5709cf5ff34780077ef0cb6a25ac3c0a237fca6cdfae3d9fe848ad1ef9cc9d5a7166

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
305KB

MD5
78ffd6dfb82fc9c519f25e19373d9f66

SHA1
2363c7f932a22dbe6d1625f1446299e8929524e8

SHA256
3a4a510dcc59dd3eae0a86f6da82000c5ab893d6a738d7caf74545f61c32b962

SHA512
3dbf02baf327c0b993c6409bec4dfcf5039034bb5fa06ae31c5d845d2a3367d1216c9418323ce218e7f37bb7ce1907ddf47956300bc0c52f5150551fb792622f

Download Submit
C:\Windows\SysWOW64\Ddjmba32.exe

Filesize
305KB

MD5
e3987d9659f20070b2ce9412e5376e9a

SHA1
bdfdeac614bc153a93b2613c6ebd97c5e2326967

SHA256
d0fb8f2859ecf344c90e0259240ed302d8c72ae7bff7aafbf3e0db4081fbda5d

SHA512
cdc003fc3bc77bdd8b3e00232103406b88dd52e12f2b6b2e13b8110d542074d73b7def57e84ff91e78f4eabaf2ce94179b5e4619e6e1670dd3814c56ea479e59

Download Submit
C:\Windows\SysWOW64\Dpiplm32.exe

Filesize
305KB

MD5
bd5a351b8219b12fca4e79174a5e55af

SHA1
5cd0b1c5f046a945dc61988cdb36b112ea115b87

SHA256
10022c76365ef445ade27bfc094a1c919099f83ab353c9e6a1b7567b27e3c0a9

SHA512
c7114847e03482162a62100f4d0ff8c9ba1d602d49e2f4b8c463ab7f11d46c87c0ffa5d84bc3395c547262bb7dd5ea368c46d951234e429db9477ddeb7c61fbe

Download Submit
C:\Windows\SysWOW64\Ebimgcfi.exe

Filesize
305KB

MD5
1cb801e85cbab6d83b1693cc3cae9d07

SHA1
91f4da52d8b7a5dcd3255442f5669e61ce67644c

SHA256
3e0afb648260f44c946d54fbda7e85f7694bbf82a4c423c0ef56d7fb3a95dd8e

SHA512
83ee1d258147a198e9c852161cdabcc54a3bd94e9bfea8f12ec972ee8bd627ec7407906f808a015a644324cd9bfd1b639fa64cc3214840196b499d016b365bb9

Download Submit
C:\Windows\SysWOW64\Ekmhejao.exe

Filesize
305KB

MD5
76054834d29e1ce28e4484252869ff4c

SHA1
479e106b4fd7fabe05f043a96d59527679f347cb

SHA256
25b93964248953204f72c55558fa2f4d7df7b375b941ae919cf52376fda649f5

SHA512
7630827765847e9f38f8ed8d192210c13fd5170a7dafc5cd584a6c0bb0a1b3889e03a9be2c294021eb39c0e82756ce5ead00d0b3e8093cc889ad2b3dd3339b86

Download Submit
C:\Windows\SysWOW64\Fnipgg32.dll

Filesize
7KB

MD5
f6ee0a74c97f061864b74c4052a9e18e

SHA1
7e60301cb692d7dcfb06d33a926de4f5aadc454f

SHA256
e03f4720474033c18049df5a642db01f4430362ee4e0e9342108ca0e0d89944f

SHA512
b8b98b5ec51082b5f928bb11083ef51af1ababc68a71a36e3701cdc535da01e21afa8ac9db1cca2daf77948ed3c348a7da892e7725891c7212ff332cf4f62237

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
305KB

MD5
64ac83d93659ec48cac296e82338a663

SHA1
5462a58312ce9f52c800e2a22931c53b2325a7ed

SHA256
830b66c0ef7fc663117ac9531f4d795bfcd136696ac29709159b116706d6c96a

SHA512
9810e47a88740f86b7174388e8a51aa18030d8ed5c6be31becf32a01d9eacd7f11613e6430238981c0abf26fd166b291b1815def636d89b29aa19caa9e15a856

Download Submit
C:\Windows\SysWOW64\Gldglf32.exe

Filesize
305KB

MD5
d04956b0bde9b47eb1a630c0a76405ef

SHA1
57cb1c58f9b1396e8169e1f36a9b804b596a0039

SHA256
01888e3ba85585adadc92bb9c018635b8a0b944456c4cca772cb6459518babf4

SHA512
4623b50b8330b148136d278ae24f4c318f3b8e520424d7a775f459c288412a93b39872b46c1043746c5ba2a2fec78e694ccc54011c9046097ee6c6c438d02792

Download Submit
C:\Windows\SysWOW64\Goglcahb.exe

Filesize
305KB

MD5
5f508e3b528b378f9d3a4d9850c65633

SHA1
1ddf9b060acec146e3b1f87c3f8c983371e2a8e7

SHA256
024e24e6dfd3076b2c2c1a20fd51fe3ae8d9585e9e17bf99fb88ac50b6b1951b

SHA512
4a6622a1114333e517d0d1f7994d648116e0e0b5ad177bd19e4572492fdbd0fbf805d93da2e7217352dff2cdaa248732014653adce7a755e9c9948f053a5c23a

Download Submit
C:\Windows\SysWOW64\Hiipmhmk.exe

Filesize
305KB

MD5
20ca1d52962d01a1337d96d419eb7d3b

SHA1
5b8cf4acf3af54651de49b4250f5bada3457ad89

SHA256
f93d029ca453f152918018d4cbbfec01aa73987f6c8f65ad4fd7f55d2af13201

SHA512
1153e03bd9ffc2838e52d636acc6cbc5ed10c36982062cbf6005b64e577877aa1f9154aef09e21d604309c55e4346ed4ccba5c5b47a458d5dacfdf5302fd61dc

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
305KB

MD5
040f739c99203b78ba32960154d582b1

SHA1
543917ddab0d09309a90366fd2f2ac2bcfc943cc

SHA256
df3d8bd562008194119a22a18ee2622de6e2bad7a5c39ba1c9c5636d53fe98d0

SHA512
bcb6e3ebc0dc8e633a2de0a523988bc7a472289fd8cc9b5f8d5296d96b90088555a5dcbe260c28c13b569ed4ddbd868e798c1f50d83f5f1d4fafc92c2512a85a

Download Submit
C:\Windows\SysWOW64\Jiiicf32.exe

Filesize
305KB

MD5
4b749a8d1cf414f6b82876062543ff4a

SHA1
92a6254e4595a176cade97490d5cf6483a71e888

SHA256
d6164d98635fce0210025f2bb88c0fc4cbf5b785e8ae0308b133f4a8047701ff

SHA512
f101a1fe162241c7b5586750fa7fbb8b984b72a91800c2ecf9fe827a533bc185d3d06b1d0d4ad35653a2fd7e470c5520a30afa7925a3fbde115f32f49285ea4a

Download Submit
C:\Windows\SysWOW64\Jpenfp32.exe

Filesize
305KB

MD5
d900067040f2492a8d33d0d87a9e26ce

SHA1
1ee319d29b5b619c8f46e35a22638516d1fd9cf4

SHA256
9247f0e0b2957a87c0a7e2c7d34dea47f55d42e6872662b5908ae353aef2e60a

SHA512
05da465ab7167b77313677b346e639011cc7007f6fe0cebda25c2f9701193d5ebed677dc2efdce8d0d4db682b5b50ef476976813d878f10297c43f50d0a1e53d

Download Submit
C:\Windows\SysWOW64\Kngkqbgl.exe

Filesize
305KB

MD5
3874475836b8e2ee552cbbcbe840d11f

SHA1
c8763622df67eb86cb84b0e697ff592665c2ad21

SHA256
bb006a2a26a3546759d8c49b5b86b5cdaaf86ec463c6d5e4d08a768a89036712

SHA512
76bdf1d25fc80c415d8546a4de236d6689afbb613934c76e8070a23269a03d5211fe7151fbbf0bc70f15139c1c949ddbb6fcb1aeb0bd01177b2b6a7fe5c96955

Download Submit
C:\Windows\SysWOW64\Kpcjgnhb.exe

Filesize
305KB

MD5
599e410bee50af5b5e56b068d9a8dfbb

SHA1
ebd72f203f626c61b69fbc564eb33f5ac58295d6

SHA256
c77b7a81358924764eb40d949a351d114b921fb09b3d3249251be01d6777704d

SHA512
55a7455ba4ac765607b4af81c847c1d6badced5cf9352e7c0def3758deac05cba1611e43344dd9b569eceab6ddd25c3c8cdcb2dd8663f27ace50c8eef1735bac

Download Submit
C:\Windows\SysWOW64\Lgdidgjg.exe

Filesize
305KB

MD5
e1b3118dbf2d36f05bf6ce404fd98c8c

SHA1
073a0b17ff233a1770f2174f1b0d00a015a3d94e

SHA256
7d3253955e71d20e91cd6df04a8184b9bb7bb06221bf8ae41f1f9c8ede8266ed

SHA512
48025160a1942cded74f5c1a74f9c9c8ef0e9b181e35c72761b710e52255b52dd2715bff1b7ec5aba328da858d165e5c0a4a1b3f94aa017036fd4ee6b7e54934

Download Submit
C:\Windows\SysWOW64\Lgjijmin.exe

Filesize
305KB

MD5
34a88da3ce6650f08533bc543efa3cc2

SHA1
b7b72eaba152d497d5997f148adafd77ca3321b0

SHA256
b6cbd86b482c4af1ba8d6e3fcabbbefb8de8d9509b841639be19e5b71d9e6210

SHA512
1477014b107c7677de48b66491d79035453fb864b2cc1600554e5447b370cb00fc14dca0c542f736bca17d939f3a7589fa83084ccb607c3a819282f7b1463dc4

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
305KB

MD5
4b031a82689e546e7312048fc6ee6387

SHA1
aa0b5aae7e2e9a5e0a618c837dc9294871e04938

SHA256
d0efcce37ea3effbfe17cd8c1a4c9084a2353544e6de27ff41a97535cb43a738

SHA512
9ac8400785410c6bafff5594ae15bb97aabf6f95c6fb601c658cb9bf97073d22cb625be247ae5f49556936a10565d0218de311c16026b65f6266a1cca6a0197e

Download Submit
C:\Windows\SysWOW64\Lnjgfb32.exe

Filesize
305KB

MD5
c23e22932ddd984198a915c63f9129db

SHA1
be40ac688a2937d5b6e66bc3a56b5667b1006f19

SHA256
60733d0e6073b084fb606bbd4c6c0645bd02c4cf9b5d4707e8047e26fd8793c5

SHA512
4b4d6a0aee01f401f20fdaa37474ca4586954a05a0ebc61d80cfa74a476a2003c0040ad639b94bddf3b30999db7939238f659c2f370c1533f65e538e1aea7f6e

Download Submit
C:\Windows\SysWOW64\Manmoq32.exe

Filesize
305KB

MD5
b93a02a2da115b87ed4731b8aade618d

SHA1
ff3b3204921ea3f9da16457bcbc91502bc47fa47

SHA256
340a8d44b8cc34899cfd1e13c89495c9aabf4c978e7713f5e4312b99ea55fb44

SHA512
15697525920cf397eb289c92ebf14ad5ba2406953814fb01920cc3107600364b05bbdcaafa7a9d1f60f652db4308936a6f355ba77a21fc8eccc76809992977a0

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
305KB

MD5
d867bb339cad0ccc6763fe3085ec043c

SHA1
75a5e6fcdbfb81a5e4857d1ee6ec4f00df8775e2

SHA256
1aeaf62ac327816c368e614f85146bd6bbbc98f7357075d7b21221bc39df7286

SHA512
09372bd260993b68014af03b5a1a48e49f23b3aa7d2f20f85501948fffcc3c0640cc6383f961796cb3b0a930f90e716049b43b1351ca2411d261c1dd47faab53

Download Submit
C:\Windows\SysWOW64\Mepfiq32.exe

Filesize
305KB

MD5
392fa1959226f1b0ea9d395d6e5556ad

SHA1
5bcd4ed2475164fc54150a5526bfcbcd68926b8f

SHA256
3d168a295aa2bdc16e0e1345741f34735b1fe136f89c00fb1da16c2fe33d166d

SHA512
799fcec3c697cd0b54bbe3cef1bbb5adf8aeaac95af9d2753d9d32f397624516bf4ed5e2e6f6d76352eb507e5e9654121eeead352ae6cfad1209b13cc62723db

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
305KB

MD5
b1b0d3dc3b47b0eaf5d92d0acf9e9cc8

SHA1
4afad4cbb974085362ebcc811271075d5109f147

SHA256
251f4f6371278782c554c0f2347f856359136c20bef496e9e54009410cb22ab4

SHA512
48e2b7f268e8fb7b0d1d26dd50a7f65f3bfd52aadc7ded65bdb15f851d607b99245eccedf019fcc6a5393f907c80b12c9a67727b05c82ba5779fe0d2fae49cf8

Download Submit
C:\Windows\SysWOW64\Mgaokl32.exe

Filesize
305KB

MD5
e7ede094f1351b324e39c7369da66ff3

SHA1
b770f6a3894902acdeb99eb0a4710f36cf47f3a9

SHA256
613c877e5e59dbda0b6b68c9b08354852e28c731c75f49ec14728929f20e5690

SHA512
bc48a78f93114bc045edc5bc003300c56e0b60af1b1b0c21b9960de39149a7e4a932bc6735863235d8b98dc7ca5ae64c6ba5a4ba2c385d7b526055425bf3e24a

Download Submit
C:\Windows\SysWOW64\Mkohaj32.exe

Filesize
305KB

MD5
7a09a640f70f837d873aea86e7571e9c

SHA1
0b0ae18adc3ad1b966f33abc0d86620591449af6

SHA256
ddccda456e4a53bb4eb7740e9fa571c19a1783838e1e8fbf1f6029ebc7758543

SHA512
3528ba1e302f238ff794cbe2386cb62ed3304d591cd1bfdc559e0e5e57a30cc89a880fc03dbed8220561e8b39c14d8ac41947621583b86492f6d6367e48c6459

Download Submit
C:\Windows\SysWOW64\Mmpdhboj.exe

Filesize
305KB

MD5
b17c561cd23089202d0c7869b92b910c

SHA1
56b96bb8664954414fdc7ec1d0c833349378d62c

SHA256
d587251d3aa2579dc100a851e9b016572245c9df716689f5e0816d58eeea9b14

SHA512
bf179e7930df99eb1a0f11f7781df32899e7adc72f7ee683996ef0c20ba8a4ffb676cd84a2f33b322ea37960b73ce7a979aa7c74433a315ca9f45d318659e135

Download Submit
C:\Windows\SysWOW64\Mnfnlf32.exe

Filesize
305KB

MD5
bab146ae9d3dab75ada7e38773f23ef6

SHA1
e33f8e0753e4679ab61379abeebcbf0bd6e9b74b

SHA256
6c249beac414756cecbaa0b3d7754de7a143cbf171480bd67b2700a38d78473c

SHA512
c628ec293f04580952c089b6326975ce17397dc94ebc02eb6f37f2bdb00888e9282b18f5df1308807be4aeb41505ca849cd4db86a5b65fc249f9871c9e429f1f

Download Submit
C:\Windows\SysWOW64\Modgdicm.exe

Filesize
305KB

MD5
488d6d3455f6e09a33f94accf2f0b5dc

SHA1
0a6a14713fd79803889175da8547be5f64c1d96c

SHA256
55ff45d73deccb91d6b74f0c678c333b697332471a6205e811c691b373cb35eb

SHA512
9d114aa37fd8f5e8063c7543faf24eb6d06233806d50bc77abfff93665e3569fe3e60035716e5a1f9c3b3a768cc3c83f34e2540cf833d497eeef8756efa7e811

Download Submit
C:\Windows\SysWOW64\Nabfjpak.exe

Filesize
305KB

MD5
28751f7e6d149e549adc8039b6129701

SHA1
d16daa5ff9fd605288e8bf3fc15e8a1493338cc2

SHA256
17ad72083c14604a762aeab9f81b10aeabfe0ebd0beef4d4723770fe3c09aeae

SHA512
b9308f6a071bbb86d858688d16a988feadacaa8dad4df3b553385a55e99bd3d5bdee2b4566ac24466d9b661299bc531a851e8e5de739108b20e2694a8cbb8d05

Download Submit
C:\Windows\SysWOW64\Ncofplba.exe

Filesize
305KB

MD5
4c64966ecf115dbefea81ba48ce1ff2f

SHA1
6f067f608cd2b01a023b077da9be7f2a14f0b2fb

SHA256
b2a14885f21159c4c59f7c583532ff9f1fd8b8d5311aebff8485dce12d382c8b

SHA512
a6016ed3339e8100948e8bd3a4338c200e192b9b3eb6683e2acc7ba69affbd72f3266c03484cfe65fc778ff4271b68c2af39681fe69af5843b69d0c73ef68ea4

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
305KB

MD5
fbcfae8d21f1e8bc24210070ab6fcdfc

SHA1
0320d5d903b2b987ba02135bea39ce28129dd9b3

SHA256
76c7e746ca1fb2cecc272e22d70f5d46647f5b30da0714eb77b0f537682d1519

SHA512
8bb0c90496f86143deb2852128c1e9a9052020e7893c1cb402349b03df55561342342ab7bc62a61cafc8073659b22c6716487ce5b0dc3ace928a0d6bfe21e363

Download Submit
C:\Windows\SysWOW64\Nenbjo32.exe

Filesize
305KB

MD5
eb58d5e99ed76d815a70942e55158c32

SHA1
e8e42d33359111bde3ca18b0149c113f667d96b1

SHA256
d0805dc8f29369bfffe6da995011b4245aff7d89d8e5054a444166b3fd4a18b6

SHA512
b83c6424649a5c7927006879f5592aa565b7e76e477d3eca9503d544edb857f34749fdfc718725f7cce439e4b829dc6ea744828b65af8f58258ee2db9706bc3a

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
305KB

MD5
62fcf91c90a79b1f0e3f220c9218a6e9

SHA1
d0358582b7c56a6e2ca2524480357c64a2911d70

SHA256
c7866896d7ce0d98a29d408114a1444350d8608f937f885d5c961e984cc65bac

SHA512
bc63398f3989d3791c8174c86e9e57a1cd861828488a98c99579d6eac3634c0a7cfdbc6c85b0441f20375a802ef5128d2d5b6ec0341bcb8f1c71eacc9b26c193

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
305KB

MD5
57d7773fd517ae41a043c000f98b36ef

SHA1
5c4be2c99e21fae238f1aa14321400ad26d1cb3b

SHA256
6b0c60db6f5c9cb006785b70b0185a2a8453550f89ed0c617452a1f2102cc9d8

SHA512
ca990ecc8e0986fc03a4a01c64abdc34877d1f555d24493d0f1c99b93952822a40c233f42d41755d1f7d87c1fcda5617c22f3f3bdfae703fb86d138035377041

Download Submit
C:\Windows\SysWOW64\Nmkmjjaa.exe

Filesize
305KB

MD5
954c7d8d669633a09546f04a842cd6be

SHA1
fe53fd205aa71557764dcdfaef1d79e2b30106f5

SHA256
e78b8dca684e557200a4aea085195c92abe8b360eb714a16ccaabfe42ba00bdc

SHA512
4bac26d14057c693224689aa852de26efc5b0728e38c6badcccd982f239e5d6c2cec5d87047e8ac6d4e3817662dbcd34d9a966148ed81da49e0693b88a20b1b8

Download Submit
C:\Windows\SysWOW64\Nnbnhedj.exe

Filesize
305KB

MD5
a6e8b30d60aaa3dc8ddde0e0df55381f

SHA1
021c5d2d77665d4ff011f409acd7a92058f0b25b

SHA256
ebb28345c7627933a67067236bc5e467348c1893ea2c39a1bd81b889a4e3d803

SHA512
40beb518856c15e3c84860f96fa4be491f9da217fa02959e73a801ce7ccd5169414eaac2488de52348dc3a19ccf6d7ca86f77c808499bfa14cae7f339ec54488

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
305KB

MD5
358db983f34961710e9c509f813b1fb8

SHA1
eb9ed15f38a04996d72e5a387e489527ba08bcb3

SHA256
c53445b77202983e99a05a7abea16d043df0cb3b4ec2325526660a1873a4432e

SHA512
cdb1062eb1f8f3f18512530fafc08b0b336fba78e5152352d0dc693cd7b55ece9d33cc87fa8d93932da6265c7c0426d4795bb92321381d8e2d47d1de3e00eade

Download Submit
C:\Windows\SysWOW64\Nnicid32.exe

Filesize
305KB

MD5
749db8c88b74792347c3c144912ef0ed

SHA1
1ac98d1483e987b2de928f620c0f8cf410920535

SHA256
b671e5d3e41715ba4387ed57511cca3956024c1ee33136f81851e3de8c4ddc0a

SHA512
b23668c03e5f5df8d8ac34e4ef6de375a096dc60815943d5e0d4490c353ac60ac5be548551a5a59c1bcec7047110a2e1ae4d5ed20aeadf1b6b0cca69323d74ac

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
305KB

MD5
90069ec569f3920a2d665696dee62a9b

SHA1
0b0bb03b0d44892446f0703fdaee233e96fca6c4

SHA256
00dd4159d047560525adedf692c4d573a7b52e55d78e15d0a9cd0ab8a1bd2685

SHA512
905e340fba5909a1f1bf5ea0cde976cf29271b86925bc77f8cc904a5c83e019bb3a50f0766a7a2f178c2b4b08855fccecd81a00ce7cf7b9142e1d2ebb523d161

Download Submit
C:\Windows\SysWOW64\Oacoqnci.exe

Filesize
305KB

MD5
972c491df85507bd5240590a93735b06

SHA1
70c86a0ab2ceef1a8311d64f355e8165693f3e5c

SHA256
e1cd65105a4275ab6479915c619beb587076bc42aaf07e3d06a406264356c407

SHA512
217491e658c2854e6b725c7b0599bc0e4b9f58c90ec228bc0eae2db76c994fb90721032d4ca9507c74efb643997b5fe531dd20aaa619b17e857c262ac227768f

Download Submit
C:\Windows\SysWOW64\Odalmibl.exe

Filesize
305KB

MD5
845c097b39eaeb75fa3fe332286a40a1

SHA1
306bfbcc9bc3264a10e87b1a488ef76150588783

SHA256
11e832d247547978be0aabef988ae65fed2d8a0520f4b457aa81c7e9f593dc1d

SHA512
0ca86e32e28dfd3ea60aebd51fe0391d63fa0231d51b8de6729bad83dd29b563d594be06e65408313d3b5e38c755b87639de9a8a38c4fea45f1d5ba137a47b6f

Download Submit
C:\Windows\SysWOW64\Odjeljhd.exe

Filesize
305KB

MD5
3a9a2159aa88d084f3fa38c556049e4d

SHA1
08f0c5e96651bf9284fc30aee950f145115c3a94

SHA256
c54288f6773e9287740c4ea3794b9c2063b71d010dc6b69b2e403adde640bbab

SHA512
f5e8495d808d56ce96d6df49285df83685e052a2b9cfcdfe8b860312e43b07b500cbcd05d4028c2f8217a5af0270703616e12a77c75cdc017eaf63690c76bc36

Download Submit
C:\Windows\SysWOW64\Odoogi32.exe

Filesize
305KB

MD5
7f263c62ac121face74185a8379e3c94

SHA1
01729856bd7abdcf79ba0f03ff109ef1393df9f7

SHA256
03f238e6cd26faca39ba99f43f95d1bca6d6c8351fc2b05d4a4f6bcb63c4bb0a

SHA512
d707aaca5d869c23f4e2f6371bde2d91c5e427ebd218ec257abbe448cb6af7447a01281fca8110a59091da527b038127bceee45bd1cf3d668a2a3ea63f241f30

Download Submit
C:\Windows\SysWOW64\Oeehkn32.exe

Filesize
305KB

MD5
0547920ff9f6b0a4d83d67a405bb4451

SHA1
0bc9202ca35dceb4c56659a29da7ccca6bb74481

SHA256
73dd796487aca6a9120c5e86145488b6d5e209254125b66b094a4a0803ba94a8

SHA512
9a12e9af185cc0728a75f3439c364a69bd8fe88372eee5684d057471e2a48ae0710247aa40373b770ad171755def84f911739d2c421ba6ad631f1f8baa147b7f

Download Submit
C:\Windows\SysWOW64\Oeokal32.exe

Filesize
305KB

MD5
972a59e5b4dc851c4aad00799a4bff80

SHA1
13cd125bce151972127ce31e51fcc8a36c61a402

SHA256
32615a8e554f5c381cd125a3442da08bc00efa177c4290fde5651a62866b487a

SHA512
ac04c4ca6368f2a55b1e4df0b91f8e1f49a60eee135b2ac1d472d6d9479f0b387bc268a3f567736664e4118f4b19e3a6d902abdfc55558444e0c306952d051cf

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
305KB

MD5
4434e7c806ee1252efc43f32c2e563d5

SHA1
5b27c6ac7e785cda038cadf5f9f1d10dd6d026fc

SHA256
12f90c0373b11a430a9b0c94885ca97505de7fe93f8e97a90cee2ecf2ebdbd22

SHA512
271f7668aa04f3f90ec4594edb8656ac937f856406d6556023b131d16ce4da95d2d8a8bf905235384aef3ff4dae38b814a1b93edb2a374bca7dc414fbde814d0

Download Submit
C:\Windows\SysWOW64\Oldjcg32.exe

Filesize
305KB

MD5
49494975aadb049cb48bc568aceeb35e

SHA1
6e2c63c6951c3412a525f310486b482bc7c0b79d

SHA256
d707779fb478d4158eed1e7a123b7cef54eab7bdb8f7bf4bc1287aeee87dda95

SHA512
1419ef4bb5817a537fbda2dc6afccf52336bb3256e1abaf6193aaf21ea3e2976730f0ae989602d459a9d14b8e63b19570e8ea82450d59737d3ea031147e0363d

Download Submit
C:\Windows\SysWOW64\Olfghg32.exe

Filesize
305KB

MD5
aed811a5f6f561fa41b5d3c23bc470ca

SHA1
18d0101aea612204184c1ce0b5e301c694c9c808

SHA256
3c62a65733682d4acc03604275b8de68f63f5e88b2f7c3035281395cc75c0a58

SHA512
8b7738930ba83fce58315048ba9216810bf7ccd95b7c39681be84bc490395300b92db9d9a81f69d29bd5aa9cd2825765a12a6ff0257499d078f5b805fd101a1a

Download Submit
C:\Windows\SysWOW64\Omegjomb.exe

Filesize
305KB

MD5
99c96dd2849b58d38e42fb51f6440bd8

SHA1
efa9f83195a34604a6de6866c9a015ba3472f830

SHA256
97814827b5c356ed8094b5c3a3d0d7ac3480da2689968236dd4036458211f6af

SHA512
e48af1f4f666cc69c36c952d6307a12e5b1db3693b62efd3543bbad6f43a0c1728a9741e7164fdabecc64f0a40b4d4ffbe205a89b724ce64aa27bcd07dc3644e

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
305KB

MD5
4375685098ec004b7a9511377dc666d5

SHA1
5673404b6bcd7b05bd45cc5982a5a3b3a55ba00e

SHA256
22b07fb5c7cae9bfff73b7e426ce8c1671b014a828cdcdcd46a38175da15ffc2

SHA512
587ba39126e481a264a7f821c47b1d510c9a1a74842bb788c8b9f3602ba8f122023e669193f86bbe25d8bb9cbf59900954d65d218d7f1a3d5a92a078713b8fed

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
305KB

MD5
0a5f19c620c2a1411f300058fd7a7b07

SHA1
236e83d05ab73281a1441767ec3c48c068749407

SHA256
6d5719481c4f2ca426474406389588d8e0961ef443ddde50081aeb03cf57bf1c

SHA512
96e254209af9eb2cd602f293e65e978cf26690456f5ff9268460a451d12df1275cd8eaae1235a08af4ef37d9fe4e0b90b0de76c059c9b5f73287b8da89b27e97

Download Submit
C:\Windows\SysWOW64\Paelfmaf.exe

Filesize
305KB

MD5
0feba250f28609edde072bc9a596d83e

SHA1
c57b328cdcdb966b674f32717887c1aebe250997

SHA256
da2920719a2b5e6771024609d257aea0bc207bb2e95e663c2f4fe83eb98a726d

SHA512
0de6b8009c36e2204576b20e7f3a5ee0ef7d861bb83d2fbf93149de97bc4c1361de2ef6b697b336c7efb1add30deaf9301c92e947222b9f71ed92fb1fed82f47

Download Submit
C:\Windows\SysWOW64\Pahilmoc.exe

Filesize
305KB

MD5
5d325cda14088e4ccb05cae2497ce276

SHA1
b23d9f889e6597b2234d4c2f18c135f0f9233f4e

SHA256
748594f004824ca7e4d322bebbe96e702bd9bf4e350c5c3765350e346527f308

SHA512
4ba39534f8d243ae40e9a1932d0525eabfbad2250ba0106f7fe0ef55209711317c9a3fc0806b2b9b9f1d6d707df266a6ff3b33c4c8b898d04cbb547b1d96730e

Download Submit
C:\Windows\SysWOW64\Pddhbipj.exe

Filesize
305KB

MD5
62d8fe0368f5438aaba87deb31ab65a6

SHA1
564910fc725fad7313bdf79b59cd4d7295d24ecc

SHA256
dffe2cb324fd79bf66616260a7d7a6664918e9a189b81913a0c76a9a06e5178f

SHA512
52551511fce7d04b6748e37c7ec5a3d80409106a6b4308adb5de5a215f3bb79cb46348bb9e519c3c8064d722eb5380c847e3d3a3c2cea58bf24d2ee13137c1b6

Download Submit
C:\Windows\SysWOW64\Phodcg32.exe

Filesize
305KB

MD5
8fb51a0db677d37937dcdd360285e1dd

SHA1
106dabd36ddb3deffa58543cb4bb94dc352db460

SHA256
146fb1133aff0fc4ad46c1c27c731e6265ed48182da973fb3f4b32e40a45fb8a

SHA512
bd1a6c9808e0faf36ff3e169de3cd42b9b72266c61bb42ab5ceec77e574e3f75f7b387d6a6f6b7e248c72155fb19999b9ea3f7aa463ea3e5fffff59ee1226c61

Download Submit
C:\Windows\SysWOW64\Plkpcfal.exe

Filesize
305KB

MD5
c2d0f4a2feb178e994c1387f37e1da7e

SHA1
51d3956709422e6b2a4ab480d75be0063a9ae887

SHA256
59b960df46b44379222d5b612109fc5f596881bb8634583afa07a29bab0633d6

SHA512
fddd5730dcc3dca41294917d7f06e282d4f1790703f464ef6d16b68730bf163ba04c169cfdc575f34a1d8fd8246af22f4d407a31e73a1a919c91eae8b664c11e

Download Submit
C:\Windows\SysWOW64\Pplobcpp.exe

Filesize
305KB

MD5
c0d7c9c15271212d3bb150277dc49698

SHA1
73e95c79fbb2bf201ed7713ee1fdd5fca5c5b2a5

SHA256
f89f597058eed8ad10c8a21e251f84800033d4d55085e7e92a19fe5096d7cd78

SHA512
fbca4b7c881bf7c7d5c3d49d174a3d6e3920c19cc4bf0d4b7eece2f4a86190c055f035d6852ff2ba8dbfc9c1c9c82aebfe287e680cd4353d4dd0c1d569f5737c

Download Submit
C:\Windows\SysWOW64\Qdaniq32.exe

Filesize
305KB

MD5
f020304cc450cc308cfe70829db2c99f

SHA1
27bf9b226babfb30382c48ee77d5ccfed474686a

SHA256
0d179a7dffd9767766a6de0c19bbbceb31a4dfc075f36973cda52a96cda14e12

SHA512
ee69e4754b62b360f9e7ecee19bb143def87c5c3cd4d38952b80fe6da0d6d09e128067ec89cdef53aa5a88e1317cabdfd2b58bf3800b72f964b2639e2582ded6

Download Submit
C:\Windows\SysWOW64\Qhjmdp32.exe

Filesize
305KB

MD5
7b521a1aa3a540db43509a495480fbec

SHA1
0f380067dacbbd0c86ec816fbd875ec5f9b1d37b

SHA256
9dc958b3cb0b6cd9959fddd425bd33645e45f228353aae365656aaa5d2f5713b

SHA512
e0be4c8cc9adcfa8f3a76a886e192f5d09e3937d7d9adcae71b1454bab9ccc665d5f0661e8e842360a152206cccee3b51ed0ba89cce5804fa4d5d72ed998c61d

Download Submit
memory/180-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/352-580-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/376-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/376-565-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/380-392-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/460-326-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/536-266-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/540-302-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/632-404-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/808-398-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/828-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/852-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1136-272-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1144-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1152-532-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1172-212-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1196-572-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1196-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1204-278-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1216-356-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1288-344-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1368-470-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1380-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1384-320-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1400-506-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1444-244-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1472-514-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1696-236-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1708-453-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1792-526-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1812-566-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1968-332-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1988-579-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1988-39-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2056-464-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2100-422-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2128-260-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2256-508-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2284-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2332-458-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2444-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2604-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2624-488-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2696-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2696-544-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2728-103-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2796-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2848-573-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2852-500-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2968-538-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3032-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3056-350-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3140-410-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3212-494-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3256-338-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3368-558-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3368-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3416-428-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3444-314-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3500-551-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3500-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3508-284-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3600-476-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3632-440-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3640-552-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3652-181-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3664-374-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3684-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3700-159-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3716-386-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4056-247-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4116-559-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4140-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4156-204-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4172-196-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4176-296-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4300-290-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4308-362-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4328-416-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4372-220-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4432-545-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4456-228-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4460-434-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4516-308-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4620-593-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4620-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4644-446-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4736-482-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4788-380-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4804-520-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4900-368-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4980-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4980-586-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5088-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5128-587-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5172-594-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads