berbew | f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe
Size

187KB
MD5

a81eaae6c4caef7ae52d2a86675fcf17
SHA1

303a11ff2fea1ea71293d172d101021da24c2606
SHA256

f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623
SHA512

db205be2357aa5cbcc4595663eb0b1818af2c77ffe834182adbabce8f0e5941e309f54860248dc04bd09cf94664fe0bee6536573b12814866e675d9a4cded879
SSDEEP

3072:5KC4SRQWIfQOkZTTgr/feXZl2NkzwH5GJks8WYlOWe7VsayDZVZev1N:5L4YTrp9zwZ9s8SZq/svL

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feenjgfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnhoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inidkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khiofk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcnjijoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbfmgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Edeeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kedlip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahfkimd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggmmlamj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mljmhflh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnbnjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chfegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ilphdlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Figgdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmjaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncchae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paeelgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apaadpng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amlogfel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Egohdegl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lokdnjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Finnef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Modpib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnaecedp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eoepebho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hemmac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oflmnh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnbeeiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paiogf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekgqennl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njjdho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aimogakj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hqghqpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpaihooo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlmchoan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjaabq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpolbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcoccc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ooibkpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfqlfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Keifdpif.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
2088	Komhll32.exe
3352	Knnhjcog.exe
5056	Kckqbj32.exe
1096	Knqepc32.exe
2432	Kcmmhj32.exe
4480	Kflide32.exe
4884	Kncaec32.exe
2820	Kpanan32.exe
940	Kcpjnjii.exe
2572	Kfnfjehl.exe
2272	Kjjbjd32.exe
4752	Klhnfo32.exe
232	Kpcjgnhb.exe
4848	Kgnbdh32.exe
2424	Kjlopc32.exe
4872	Kngkqbgl.exe
5116	Lljklo32.exe
2672	Loighj32.exe
1592	Lcdciiec.exe
1424	Lfbped32.exe
4720	Lnjgfb32.exe
1908	Llmhaold.exe
4836	Lokdnjkg.exe
4960	Lcgpni32.exe
3436	Lfeljd32.exe
4788	Ljqhkckn.exe
1992	Lnldla32.exe
2236	Lqkqhm32.exe
1556	Lcimdh32.exe
2768	Lfgipd32.exe
4260	Lmaamn32.exe
5104	Lqmmmmph.exe
4344	Lckiihok.exe
3064	Lfjfecno.exe
1692	Ljeafb32.exe
3356	Lmdnbn32.exe
1912	Lobjni32.exe
2224	Lgibpf32.exe
4180	Ljhnlb32.exe
1712	Lncjlq32.exe
100	Mmfkhmdi.exe
5012	Modgdicm.exe
2472	Mcpcdg32.exe
2456	Mgloefco.exe
4972	Mnegbp32.exe
2244	Mqdcnl32.exe
4912	Mcbpjg32.exe
3900	Mfqlfb32.exe
4288	Mnhdgpii.exe
1616	Mqfpckhm.exe
1528	Moipoh32.exe
3944	Mgphpe32.exe
4076	Mfchlbfd.exe
4536	Mnjqmpgg.exe
1704	Mqimikfj.exe
2020	Mokmdh32.exe
2348	Mgbefe32.exe
708	Mjaabq32.exe
1792	Mnmmboed.exe
2560	Mqkiok32.exe
2544	Monjjgkb.exe
1648	Mgeakekd.exe
5144	Mjcngpjh.exe
5184	Nnojho32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aopemh32.exe	Agimkk32.exe
File created	C:\Windows\SysWOW64\Ccegpn32.dll	Eqncnj32.exe
File opened for modification	C:\Windows\SysWOW64\Pnmopk32.exe	Pffgom32.exe
File opened for modification	C:\Windows\SysWOW64\Qmgelf32.exe	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Jbepme32.exe	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Bbhildae.exe	Bipecnkd.exe
File opened for modification	C:\Windows\SysWOW64\Edaaccbj.exe	Eaceghcg.exe
File opened for modification	C:\Windows\SysWOW64\Ehlhih32.exe	Edplhjhi.exe
File opened for modification	C:\Windows\SysWOW64\Cmnnimak.exe	Bbhildae.exe
File opened for modification	C:\Windows\SysWOW64\Nceefd32.exe	Nagiji32.exe
File created	C:\Windows\SysWOW64\Kibohd32.dll	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Pghien32.dll	Cglbhhga.exe
File opened for modification	C:\Windows\SysWOW64\Ibjqaf32.exe	Ipkdek32.exe
File created	C:\Windows\SysWOW64\Pekihfdc.dll	Jimldogg.exe
File created	C:\Windows\SysWOW64\Fpnkah32.dll	Ncpeaoih.exe
File opened for modification	C:\Windows\SysWOW64\Kpcjgnhb.exe	Klhnfo32.exe
File created	C:\Windows\SysWOW64\Ijikdfig.dll	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Jlkidpke.dll	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Doojec32.exe	Dhdbhifj.exe
File created	C:\Windows\SysWOW64\Ebfign32.exe	Enkmfolf.exe
File created	C:\Windows\SysWOW64\Aobmce32.dll	Fgoakc32.exe
File created	C:\Windows\SysWOW64\Falmlm32.dll	Jeocna32.exe
File created	C:\Windows\SysWOW64\Jafdcbge.exe	Johggfha.exe
File opened for modification	C:\Windows\SysWOW64\Nfjola32.exe	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Ckebcg32.exe	Chfegk32.exe
File opened for modification	C:\Windows\SysWOW64\Egcaod32.exe	Edeeci32.exe
File created	C:\Windows\SysWOW64\Fqeioiam.exe	Fnfmbmbi.exe
File created	C:\Windows\SysWOW64\Fgcodk32.dll	Khiofk32.exe
File created	C:\Windows\SysWOW64\Nohjfifo.dll	Paihlpfi.exe
File created	C:\Windows\SysWOW64\Fhcbhh32.dll	Qcnjijoe.exe
File opened for modification	C:\Windows\SysWOW64\Kbnlim32.exe	Klbgfc32.exe
File opened for modification	C:\Windows\SysWOW64\Ocaebc32.exe	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Apaadpng.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Cldaec32.dll	Aimogakj.exe
File created	C:\Windows\SysWOW64\Famkjfqd.dll	Lqmmmmph.exe
File created	C:\Windows\SysWOW64\Cklgfgfg.dll	Apaadpng.exe
File created	C:\Windows\SysWOW64\Hajkqfoe.exe	Hnlodjpa.exe
File created	C:\Windows\SysWOW64\Nlhego32.dll	Njjmni32.exe
File created	C:\Windows\SysWOW64\Dkedonpo.exe	Dgihop32.exe
File created	C:\Windows\SysWOW64\Enemaimp.exe	Ekgqennl.exe
File created	C:\Windows\SysWOW64\Hnbnjc32.exe	Hnpaec32.exe
File created	C:\Windows\SysWOW64\Ldnemdgd.dll	Jnnnfalp.exe
File opened for modification	C:\Windows\SysWOW64\Lfbped32.exe	Lcdciiec.exe
File created	C:\Windows\SysWOW64\Jgqjbf32.dll	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Cpfoag32.dll	Caageq32.exe
File opened for modification	C:\Windows\SysWOW64\Ihpcinld.exe	Ieagmcmq.exe
File created	C:\Windows\SysWOW64\Pfojdh32.exe	Pbcncibp.exe
File created	C:\Windows\SysWOW64\Lgahlk32.dll	Hnbnjc32.exe
File opened for modification	C:\Windows\SysWOW64\Ilmedf32.exe	Inidkb32.exe
File created	C:\Windows\SysWOW64\Lqmmmmph.exe	Lmaamn32.exe
File created	C:\Windows\SysWOW64\Phajna32.exe	Pdenmbkk.exe
File created	C:\Windows\SysWOW64\Ahofoogd.exe	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Hbldphde.exe	Hpmhdmea.exe
File created	C:\Windows\SysWOW64\Ibegfglj.exe	Ipgkjlmg.exe
File created	C:\Windows\SysWOW64\Aglmllpq.dll	Ipgkjlmg.exe
File created	C:\Windows\SysWOW64\Ilphdlqh.exe	Iefphb32.exe
File opened for modification	C:\Windows\SysWOW64\Bbfmgd32.exe	Bfolacnc.exe
File created	C:\Windows\SysWOW64\Fihgkk32.dll	Lmdnbn32.exe
File created	C:\Windows\SysWOW64\Ocohmc32.exe	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Ekajec32.exe	Egened32.exe
File created	C:\Windows\SysWOW64\Fpmfmgnc.dll	Enpfan32.exe
File opened for modification	C:\Windows\SysWOW64\Ibcjqgnm.exe	Ipdndloi.exe
File created	C:\Windows\SysWOW64\Nnojho32.exe	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Nqmfdj32.exe	Nnojho32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11600	3604	WerFault.exe	591

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaamn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdenmbkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpcdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paeelgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feenjgfq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggmmlamj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjcngpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekajec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnabm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmmhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdoacabq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aokkahlo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edplhjhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbfmgd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcdciiec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdjinjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfojdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caqpkjcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbejloe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcjjhdjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnhpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggkqgaol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipgkjlmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmfdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfcabp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phcgcqab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbdehlip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibegfglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njbgmjgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lobjni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmeigg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lafmjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Panhbfep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmgelf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Finnef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhnhajba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckiihok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqkiok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgeakekd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calfpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahfkimd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfeljd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcphdqmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaiij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpcjgnhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljklo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doagjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jppnpjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgbqkhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofkgcobj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aajhndkb.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Moipoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akkeajoj.dll"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Khbiello.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddklbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmephjke.dll"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ekonpckp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbkkik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpqggh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ampaho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgihop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Badjai32.dll"	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbdcakkc.dll"	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Falmlm32.dll"	Jeocna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kapfiqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kcoccc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljloomi.dll"	Hqghqpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenpmnno.dll"	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogekbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkpqlc32.dll"	Fbplml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qikbaaml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gndbie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figmglee.dll"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchkcb32.dll"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dagdgfkf.dll"	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foniaq32.dll"	Lepleocn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcknij32.dll"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnckgmik.dll"	Fecadghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnkah32.dll"	Ncpeaoih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Biklho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdglhf32.dll"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddlnnc32.dll"	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpmenm32.dll"	Iahgad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mokfja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enfqikef.dll"	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emamkgpg.dll"	Eiekog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjehdpem.dll"	Hlblcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfenigce.dll"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldicpljn.dll"	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eelche32.dll"	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckkpjkai.dll"	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnebjidl.dll"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Denlcd32.dll"	Ibbcfa32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2088	4380	f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe	88
PID 4380 wrote to memory of 2088	4380	f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe	88
PID 4380 wrote to memory of 2088	4380	f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe	88
PID 2088 wrote to memory of 3352	2088	Komhll32.exe	89
PID 2088 wrote to memory of 3352	2088	Komhll32.exe	89
PID 2088 wrote to memory of 3352	2088	Komhll32.exe	89
PID 3352 wrote to memory of 5056	3352	Knnhjcog.exe	90
PID 3352 wrote to memory of 5056	3352	Knnhjcog.exe	90
PID 3352 wrote to memory of 5056	3352	Knnhjcog.exe	90
PID 5056 wrote to memory of 1096	5056	Kckqbj32.exe	91
PID 5056 wrote to memory of 1096	5056	Kckqbj32.exe	91
PID 5056 wrote to memory of 1096	5056	Kckqbj32.exe	91
PID 1096 wrote to memory of 2432	1096	Knqepc32.exe	92
PID 1096 wrote to memory of 2432	1096	Knqepc32.exe	92
PID 1096 wrote to memory of 2432	1096	Knqepc32.exe	92
PID 2432 wrote to memory of 4480	2432	Kcmmhj32.exe	93
PID 2432 wrote to memory of 4480	2432	Kcmmhj32.exe	93
PID 2432 wrote to memory of 4480	2432	Kcmmhj32.exe	93
PID 4480 wrote to memory of 4884	4480	Kflide32.exe	94
PID 4480 wrote to memory of 4884	4480	Kflide32.exe	94
PID 4480 wrote to memory of 4884	4480	Kflide32.exe	94
PID 4884 wrote to memory of 2820	4884	Kncaec32.exe	95
PID 4884 wrote to memory of 2820	4884	Kncaec32.exe	95
PID 4884 wrote to memory of 2820	4884	Kncaec32.exe	95
PID 2820 wrote to memory of 940	2820	Kpanan32.exe	96
PID 2820 wrote to memory of 940	2820	Kpanan32.exe	96
PID 2820 wrote to memory of 940	2820	Kpanan32.exe	96
PID 940 wrote to memory of 2572	940	Kcpjnjii.exe	97
PID 940 wrote to memory of 2572	940	Kcpjnjii.exe	97
PID 940 wrote to memory of 2572	940	Kcpjnjii.exe	97
PID 2572 wrote to memory of 2272	2572	Kfnfjehl.exe	98
PID 2572 wrote to memory of 2272	2572	Kfnfjehl.exe	98
PID 2572 wrote to memory of 2272	2572	Kfnfjehl.exe	98
PID 2272 wrote to memory of 4752	2272	Kjjbjd32.exe	99
PID 2272 wrote to memory of 4752	2272	Kjjbjd32.exe	99
PID 2272 wrote to memory of 4752	2272	Kjjbjd32.exe	99
PID 4752 wrote to memory of 232	4752	Klhnfo32.exe	100
PID 4752 wrote to memory of 232	4752	Klhnfo32.exe	100
PID 4752 wrote to memory of 232	4752	Klhnfo32.exe	100
PID 232 wrote to memory of 4848	232	Kpcjgnhb.exe	101
PID 232 wrote to memory of 4848	232	Kpcjgnhb.exe	101
PID 232 wrote to memory of 4848	232	Kpcjgnhb.exe	101
PID 4848 wrote to memory of 2424	4848	Kgnbdh32.exe	102
PID 4848 wrote to memory of 2424	4848	Kgnbdh32.exe	102
PID 4848 wrote to memory of 2424	4848	Kgnbdh32.exe	102
PID 2424 wrote to memory of 4872	2424	Kjlopc32.exe	103
PID 2424 wrote to memory of 4872	2424	Kjlopc32.exe	103
PID 2424 wrote to memory of 4872	2424	Kjlopc32.exe	103
PID 4872 wrote to memory of 5116	4872	Kngkqbgl.exe	104
PID 4872 wrote to memory of 5116	4872	Kngkqbgl.exe	104
PID 4872 wrote to memory of 5116	4872	Kngkqbgl.exe	104
PID 5116 wrote to memory of 2672	5116	Lljklo32.exe	105
PID 5116 wrote to memory of 2672	5116	Lljklo32.exe	105
PID 5116 wrote to memory of 2672	5116	Lljklo32.exe	105
PID 2672 wrote to memory of 1592	2672	Loighj32.exe	106
PID 2672 wrote to memory of 1592	2672	Loighj32.exe	106
PID 2672 wrote to memory of 1592	2672	Loighj32.exe	106
PID 1592 wrote to memory of 1424	1592	Lcdciiec.exe	107
PID 1592 wrote to memory of 1424	1592	Lcdciiec.exe	107
PID 1592 wrote to memory of 1424	1592	Lcdciiec.exe	107
PID 1424 wrote to memory of 4720	1424	Lfbped32.exe	108
PID 1424 wrote to memory of 4720	1424	Lfbped32.exe	108
PID 1424 wrote to memory of 4720	1424	Lfbped32.exe	108
PID 4720 wrote to memory of 1908	4720	Lnjgfb32.exe	109

C:\Users\Admin\AppData\Local\Temp\f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe
"C:\Users\Admin\AppData\Local\Temp\f6fb48bd2e52682b24cf14839a3538bd055c000aab1949abeadb4b949bf7a623.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\Komhll32.exe
  C:\Windows\system32\Komhll32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\Knnhjcog.exe
    C:\Windows\system32\Knnhjcog.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\SysWOW64\Kckqbj32.exe
      C:\Windows\system32\Kckqbj32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
      - C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        23⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        27⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        29⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        30⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        31⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        36⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3356
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        39⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        40⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        41⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:100
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        43⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2472
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        45⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        46⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        47⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        48⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        50⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1616
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        53⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        54⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        55⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        56⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        58⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:708
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        60⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        67⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        68⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        69⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        70⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        71⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        72⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        73⤵
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        74⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        75⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        76⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        78⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        79⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        82⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        83⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        85⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        87⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        88⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        89⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1168
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        91⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        92⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        93⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        95⤵
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        96⤵
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        97⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        98⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        99⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5336
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        102⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        104⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        105⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        106⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        108⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        112⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        113⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        114⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        115⤵
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        117⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        119⤵
        
        PID:324
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        121⤵
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        124⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        125⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        126⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        127⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        128⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        129⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        131⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        132⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        133⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        135⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        136⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        139⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        140⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        141⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        142⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        143⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        144⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        145⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        146⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        148⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        149⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        150⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        153⤵
        System Location Discovery: System Language Discovery
        
        PID:6268
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        154⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        156⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        157⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        158⤵
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        159⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        160⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        162⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        163⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        165⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        167⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        169⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        172⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        173⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        174⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        176⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        177⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        178⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        179⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        181⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        182⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6692
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        185⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        186⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        187⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        188⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        189⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        190⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        191⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        192⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        193⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        195⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        196⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        198⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        199⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        202⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        203⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        204⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        205⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        206⤵
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        207⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        209⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        210⤵
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        211⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        212⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        213⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        216⤵
        Drops file in System32 directory
        
        PID:7516
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        218⤵
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        219⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        220⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        221⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        223⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        224⤵
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        225⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        226⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        227⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        228⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        229⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        230⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        232⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        233⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        234⤵
        Modifies registry class
        
        PID:7576
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        237⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7948
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        239⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        240⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        241⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7312
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        243⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        244⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        245⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        246⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        247⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        248⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        249⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7740
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        252⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        257⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7360
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        259⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        260⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        261⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        262⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        263⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8344
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        265⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        266⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        267⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        268⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        269⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        270⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        271⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        272⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        273⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        274⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        276⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        277⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        278⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9020
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        281⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        282⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        283⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        284⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        285⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        286⤵
        Drops file in System32 directory
        
        PID:8356
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        287⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        288⤵
        Drops file in System32 directory
        
        PID:8496
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        289⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        290⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8632
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        291⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        292⤵
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        293⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        294⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        295⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        296⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        297⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9188
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        300⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        301⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        302⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        303⤵
        System Location Discovery: System Language Discovery
        
        PID:8680
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        304⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        305⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        306⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        307⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        308⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        309⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        310⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        311⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        312⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        313⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        314⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        315⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        317⤵
        Drops file in System32 directory
        
        PID:9144
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        318⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        319⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        320⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9072
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        322⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        324⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        325⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        326⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        327⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        328⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        329⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9592
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        331⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        332⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        333⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        334⤵
        Modifies registry class
        
        PID:9768
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        335⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9856
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        337⤵
        Modifies registry class
        
        PID:9900
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        339⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        341⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        342⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        343⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        344⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        345⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        346⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        347⤵
        Modifies registry class
        
        PID:9432
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        348⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        349⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        350⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        351⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        352⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9852
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        354⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        355⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        356⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        357⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        358⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        360⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        361⤵
        Modifies registry class
        
        PID:9560
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        363⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        364⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        365⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        366⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        367⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        368⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        369⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        371⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        372⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10132
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        373⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        374⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        375⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        376⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9580
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        378⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        379⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        380⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        381⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        382⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        383⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        384⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        385⤵
        System Location Discovery: System Language Discovery
        
        PID:10360
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        387⤵
        Modifies registry class
        
        PID:10492
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        388⤵
        System Location Discovery: System Language Discovery
        
        PID:10556
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        389⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        390⤵
        Drops file in System32 directory
        
        PID:10648
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        391⤵
        System Location Discovery: System Language Discovery
        
        PID:10724
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        392⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        393⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        394⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        395⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        396⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        397⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        398⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        399⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        400⤵
        Drops file in System32 directory
        
        PID:11156
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        401⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        402⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        403⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        404⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        405⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10540
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        407⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        408⤵
        Modifies registry class
        
        PID:10712
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        409⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        410⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10948
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        412⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        413⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        414⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        415⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        416⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        417⤵
        Modifies registry class
        
        PID:10304
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        418⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        419⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        420⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        421⤵
        Modifies registry class
        
        PID:10800
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        422⤵
        Drops file in System32 directory
        
        PID:10860
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10992
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        424⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        425⤵
        Drops file in System32 directory
        
        PID:11184
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        426⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        427⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        428⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        429⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        430⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        431⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        432⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        433⤵
        System Location Discovery: System Language Discovery
        
        PID:11024
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        434⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        435⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10476
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        437⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:11308
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        439⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        440⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        441⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        442⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        443⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        444⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Dpopbepi.exe
        
        C:\Windows\system32\Dpopbepi.exe
        445⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        446⤵
        Modifies registry class
        
        PID:11608
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        447⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11644
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        448⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        449⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        450⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        451⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        452⤵
        System Location Discovery: System Language Discovery
        
        PID:11824
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11860
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        454⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        455⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        456⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        457⤵
        Drops file in System32 directory
        
        PID:12008
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        458⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        459⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        460⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        461⤵
        Modifies registry class
        
        PID:12152
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        462⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        463⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        464⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        465⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        466⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        467⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        468⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        469⤵
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        470⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        471⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11636
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11704
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        474⤵
        Modifies registry class
        
        PID:11772
        
        C:\Windows\SysWOW64\Gjkbnfha.exe
        
        C:\Windows\system32\Gjkbnfha.exe
        475⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11920
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        477⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Hbiapb32.exe
        
        C:\Windows\system32\Hbiapb32.exe
        478⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        479⤵
        Drops file in System32 directory
        
        PID:12108
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12172
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        481⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        482⤵
        Modifies registry class
        
        PID:10868
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11376
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        484⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        485⤵
        Drops file in System32 directory
        
        PID:11492
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        486⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Jaqcnl32.exe
        
        C:\Windows\system32\Jaqcnl32.exe
        487⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        488⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        489⤵
        System Location Discovery: System Language Discovery
        
        PID:11960
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        490⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        491⤵
        System Location Discovery: System Language Discovery
        
        PID:12216
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        492⤵
        Drops file in System32 directory
        
        PID:11304
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        493⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        494⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        495⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        496⤵
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        497⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        498⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 216
        499⤵
        Program crash
        
        PID:11600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3604 -ip 3604
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabkbono.exe

Filesize
128KB

MD5
0d6a1fde9da4eedb72a8595c5a1f7276

SHA1
d70ca168d78dc132a093ae84a73c49c7f127d30c

SHA256
7d7e0f78654dd50d0e032941a4d4a0381a71f522719fc3eea007af34cfead384

SHA512
dfe71725a829082dc9b351c5fac565bc2982ef45e15b2017e370a0de9958ed958092962c15b5759b979f439c8ece36c2623cb2617a671f94b923c854a3633acb

Download Submit
C:\Windows\SysWOW64\Agimkk32.exe

Filesize
187KB

MD5
f1ad2a211cf3c6797eeb155aea6e1ac3

SHA1
36152b8de6434dacb9a8e8040a05ce4dfe7193d8

SHA256
22a9fea37bd8875c20be5480280517122aa4841f6b0696235ce68a0a74008834

SHA512
cad8cb9c99137f09605f8530c243b6e35000824e94c20e64a8c1c081c4c2603cd5ef53327dcfb12133ff2c91f1294f5aff0503b665d790681b3a4307e3b679e9

Download Submit
C:\Windows\SysWOW64\Ampaho32.exe

Filesize
187KB

MD5
4fc22e05d8c947240201a5bda665bdbc

SHA1
34e277e0101567e58c4ef7e76ec75e32d6b3f188

SHA256
065228e017bd8ed784a784b32ffd10aaa5b80f60c5bc2095fe7daee0ec1244c1

SHA512
fcea9b33ecba0ebdb622ab9fedae119a984027c1cc9f607e1d916443d9dcc0e59ec0cbc35832c0dc9de03169282caaa866f25cc963e221488e46006b1ec77450

Download Submit
C:\Windows\SysWOW64\Biklho32.exe

Filesize
187KB

MD5
9622a8a7e552c2daf17ed64767ab6a88

SHA1
8631e678014811410504d951e2d2d8b9cdd05f38

SHA256
bd46fdc986cafb4ebdb0048582f169fa096c13b70be8b0d75edf3df2a38bbfa2

SHA512
f3e7dccf789f5c103c51e00f0fe4e0b2455f42534985b59eeaa62151edd607897e472cd2887db9eaa70b02299ff51e1e9342cec8d0f20011890919e4b73d202b

Download Submit
C:\Windows\SysWOW64\Bmdkcnie.exe

Filesize
187KB

MD5
6f07147056d20242d00663dfedaf044b

SHA1
ac837f3b1bfa6cb7f02ee9cb73a8a425e73e123b

SHA256
e60aa6226d42fa0ed7ea2c9d34ba521e7d51f9236447a15dbba55fabee521464

SHA512
678fc19659767a32e4a327fc6323fae70e16341e5f8f134b845456525ef42230140eb6f0bfdaa8257118adf4892bd422be279fd9152586c12a560f80c2c69320

Download Submit
C:\Windows\SysWOW64\Cdmoafdb.exe

Filesize
187KB

MD5
89b885ef5e165c859ca4afb06d89199f

SHA1
57ed4b444ba74441d161fc6275ab02635647b846

SHA256
b7166e944a179df59082617fa3b3b6216fc982321ba05541dc1aeed7539d8a00

SHA512
255b5d040ea888d0b86d41850c984cf4c5a369d1a39485d8aa90962258fa0d09cb8069e873beaa004a0503897097468903a2b7feeb1db04a562a7a15e5dc50d6

Download Submit
C:\Windows\SysWOW64\Dgbanq32.exe

Filesize
187KB

MD5
23c181f6656ca750d7fc9631ee12892b

SHA1
9094ca846a7b17ff83ded2a88063021e42930ea5

SHA256
35849b543c06ade088452e04b91b68d5e50d9b85526afa861dec240a471d60be

SHA512
cdf93e758eedf1de15055de131ee712fb627574085ac29bb9ad7f4a4d598598b7eab08d3bf29524ccd5147cc8da154553ac91876734092ae2c2d46f5614e072c

Download Submit
C:\Windows\SysWOW64\Doojec32.exe

Filesize
187KB

MD5
a431f23f54b326430368f8dfb9c36021

SHA1
2326e2ec50f2993ee4268cdc8fa81a4f249252e1

SHA256
dbbcaa744f152b0d2c86b4d730db43d5c7737195d6f64f1482f993051b052cde

SHA512
b1fec5c39c231f5a736cd247edd70ae1c4e9a2621b78291a55cad11020d61ef38f0bb4c15bcf361f997548a56a71c13d90dec2f776076f0844af89528ad739b6

Download Submit
C:\Windows\SysWOW64\Fcbnpnme.exe

Filesize
187KB

MD5
588f8a0de11124060e3943d583f725a9

SHA1
d75796aa52bfd5bb83b4f989db517af752d0708b

SHA256
26b8e19b74e8c0b966fbda2052af9a0885f6cad63f93fd66c9b84bb8617f4c92

SHA512
1413b0c1bec9811d646c4cc312f17c4956647f731096c091ef772c5a181e2cd40116e54e3f856f6b9bfe620ffd2328547dbcff1ab457c79231c30ec80a11bf19

Download Submit
C:\Windows\SysWOW64\Fnkfmm32.exe

Filesize
187KB

MD5
2cda5666e2ad1d94f1ff027893e5e9ef

SHA1
38b2c6e694fe98d99771fdb8689848462d7748b7

SHA256
2d48df1f59aee23832dad978c6c810c589cf955c44a43b0d3b6f522aa2400514

SHA512
0c5f82075ef0895d965efe9502bbbaf3d24c3f0c3afebb6d813bc3a60f5f9b09899f4fa9f15908d3d144925417bb7ba130909ebbc2d059430c20e055abf276e7

Download Submit
C:\Windows\SysWOW64\Gghdaa32.exe

Filesize
187KB

MD5
aedfe5c6025346010113d0e430afaec3

SHA1
a74de43c7e147e365f34a3289fcd4df9c840bc3d

SHA256
567c22b175d0217a872a2fbd3ceaa5279625db0693e7980da6d81551161cd5da

SHA512
41ae29acc732b1e2d17df7417f4f370bcbd7bc13af42d7f748751978cc6d923c0c4a0a96c29d3da4312414567d05b90083ef2add73f037b6aeec0d7a7c79c50c

Download Submit
C:\Windows\SysWOW64\Gicgpelg.exe

Filesize
187KB

MD5
0437a0aaf3f51ec7ff0460bf2d73a0bb

SHA1
45a178190a3025b196b363e2451181ce258487e6

SHA256
6a31d35cb5b299b69561395ad3140e4ef9c8e6bcd7a68fa79940729ab866c7cf

SHA512
621af412093675e51593304d0d5fa4e22421ceef9a8a4eea50337ebe24dc23687da6989494a2017d670b04e10ebf34bc2c100dea4367d97f857d609c185d9719

Download Submit
C:\Windows\SysWOW64\Gndbie32.exe

Filesize
187KB

MD5
fc3edc772c0f94e1c6bb8f5b8ead8f47

SHA1
a25a2c9d94d21826528513e6e5ea8e2af8f8a5e2

SHA256
90e62c6e9cc04ebc758ead3e006badb02c85ffd5331b0d2c7e1f9cd055287650

SHA512
0f69cb06b5fb9b3306d8fe3ed08675826dc72e544db3d5bbf8a92f5c0db9379144f6a67503b9fe7198b194b587216a349ac9c5875bbdef67d6ade2e18440274a

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
187KB

MD5
d9e68b1a3c9e9fdb51a8907e33e567cc

SHA1
cd13c038a0ce5e6275e9282b43b01e57275ad5a8

SHA256
90d635ab01f21233bd4b512e9f8011a794a624f6ad3830c58373bc951f36d83b

SHA512
9cc0ba005a7151afbc4af5363afbfce1037c0569e67e2137f3caf7110449ff4f8e6956f9b3661c5f54c88935c0a1b06fa894463548f4af7bb44bc2c9f117a391

Download Submit
C:\Windows\SysWOW64\Hnpaec32.exe

Filesize
187KB

MD5
ab0945da95ccf324227cd773cf1dbc54

SHA1
64513e8653be8fc6a89b2f89397534d58f537c26

SHA256
1d7489f3e70459ebb0775b76ce005bc3ec2785f9865e55bcd4faa10195a1cf35

SHA512
49d1bedcb9e7342a939e702fdd8e10e32585f767341092e73e422641279b00a54c9908d13c87280527f6faf38d4c4409ea1520a4b2d5c9fed031b0dcbfe42f97

Download Submit
C:\Windows\SysWOW64\Hpfbcn32.exe

Filesize
187KB

MD5
c38b39f28f254dc0216e7322acacb0ad

SHA1
0002cc7f8892714d105efff64de38e3ad08424b0

SHA256
02c1d85106b78fa6f35c4e4fd412307035f4adae1000f8a2ad246b2c88950cc8

SHA512
84e5b82bad8878da5ca7eff87a10db87a4479069276229ead9c361f36781349ba9681b8af49b68a7d9659f3d7c4f64fd18591d3288fda04b5842bfc09486fc7d

Download Submit
C:\Windows\SysWOW64\Ibcjqgnm.exe

Filesize
187KB

MD5
febd92a803bad7787064d78c9f888087

SHA1
c4c09ce7664cddc361ffc6ec270d7b54c3e98adf

SHA256
f0defd9f8b9bc69921e04d5cc67eefd1f89e503085ff7184089f5bf42eafbe9f

SHA512
3a33a12464a42712d804822f2ec92b6f91d73c44abf1efc42383adec5d830d49eeddb7534dbc204f8dbeb6dc890760aa7b71b26d1b6e93cacfd089de9dea167e

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
187KB

MD5
47ce7d18707028abec2ec92b21ada8ab

SHA1
20f841cfa7f2b3f8f3db8b39aac22654ad8079ac

SHA256
755c8677d369eed9f80f9cc113a8872733f76277d127b54a98ee7b4a54e5af3b

SHA512
d3e294202e3a3ac309bdfb807ef956669e9aeb706859367501c7adc3b44ffaa1cd7c711ef2475f7c669794b874ef29500a673a45280e5414305c0a4291051891

Download Submit
C:\Windows\SysWOW64\Inebjihf.exe

Filesize
187KB

MD5
cb1f0e9df8ec9561a7029ec798aa99cf

SHA1
60d622cc42d61f660797ef5bbcfafd8225d80505

SHA256
d183ac2f30c70ca923d8fb1e3c907cdfae7f6ad4e4842a6438177822cd3e545e

SHA512
4c19e6915425c08571d1d2a89ae3fb903df4ec6fbb4e8b710f3a254fe3097fe46554a25a04f2e9f25e0f182db1b0b58e17cbc679b2f289133b49a99d35179624

Download Submit
C:\Windows\SysWOW64\Ipgkjlmg.exe

Filesize
187KB

MD5
a8dc099512d75ea89669abba0c262bf1

SHA1
b172560dff539f69a3608886bfe53374f75ac58b

SHA256
7920ba4c810b91fa4f61ee0255d2537b8e71711483ef1b037eba5b1d8708285d

SHA512
8a5c1cf0009c9739567369bc0dc9a7a3f5271de3aaa51bc4d4380449b3b25b0b519142a62039681f54876538c9af1ee3fd36d29b87ca026b4976576c31519933

Download Submit
C:\Windows\SysWOW64\Jeaiij32.exe

Filesize
187KB

MD5
a0be4b5dfe2ec8c7f96de3e9196a54e0

SHA1
2807106fa6fb12edc3df28226d9a84da94e6b454

SHA256
a3147d437bd9a4a0612409c78814d233b252186f1cb97ab16c017e15b9c89854

SHA512
394322e68696e4759d652262e343a44732cfddf92eb5781c346770759ad17ed8f24c91cfba5e1d7ef04e5e0250d5b2676d223b502a9934fe147c84c7ec520345

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
187KB

MD5
c0f693a809de402f49f0eaf7c9ac6cbf

SHA1
064a3c3c7f9d81b7c2d59f587b7ddfb27d6b4417

SHA256
9c49c50fdbddbe1a2dfb914a8ba10abaadd5d30b1f738738f2dd02ec8fca6514

SHA512
2110ef8fa40f7a5782ef61a419d1bd5e92a3625fff688c41508dc870f0429de59d8f41359d478981eb9055e96a4788410e0c0555a88633f42a2be351ad68880a

Download Submit
C:\Windows\SysWOW64\Jnnnfalp.exe

Filesize
187KB

MD5
82ab03402e8376a552613595cb76a4d4

SHA1
026e494aa220607a0ac250f1f0156c32f5a9bdf7

SHA256
d9667ef539e01040290e7ac8a73f48de42e4093583ad8aff338931e8ee9b91dc

SHA512
8f832a3710cd17aeecac4d24c2ec8cbcff5476d62581f87494eecccce2c39ea54a253628615ccc38afee68e9ab0be6c0c5807b91615b71aef5c06ef470650507

Download Submit
C:\Windows\SysWOW64\Joqafgni.exe

Filesize
187KB

MD5
d86e4ae2ef2e81c8ac23ee14c1c6b7e2

SHA1
ccc50cff4edfba7274c4bfc2cfa0b795672752de

SHA256
c7407342a32a89931a9ce4a11ab3199ceb736e95c606cc54bb59578eadbc5d3f

SHA512
800c7fd2029f07c77b05e5ced848b5cbf857e3c850258c42e9c5f9677d3757a19fe6b83e1f4361b169a638fa8572b44e58ce3c73db240af7e3195990d8572b36

Download Submit
C:\Windows\SysWOW64\Kajfdk32.exe

Filesize
187KB

MD5
cc268aecd98456756621ca8bb9951e8b

SHA1
de9c168b8cf9deba863492e1ca73d0c5aaeff7e7

SHA256
f5595cc22f0a748db4722ab794a4ee3ca243d587b64b52ef224a2bf8e8563e6e

SHA512
be518dae5997b225ca196f0bd31d37b2bb46bf06cb1c5694e43060f9dcfc48fc1c786906e3f0bbb705e0122fc2f089bbb1c7917f0e3d52002a5d58fc2df6b403

Download Submit
C:\Windows\SysWOW64\Kckqbj32.exe

Filesize
187KB

MD5
6e004b6735029c5a950a40d73382b99f

SHA1
c6e40420988c24c305d82d8f71cddfa0397f8952

SHA256
267ac9d7d4585a2e1be12bfe107150e8e4900c43a1b5e9bb9d818b6d212c7ed7

SHA512
fac2c77e74765a8822e3103d9465cb05b779438d3a03645d443ba9273adfe82f113db20082b45bcdd22716ea06f824cb06a2fdfdd91daa9cd5d6a58fbc49000d

Download Submit
C:\Windows\SysWOW64\Kcmmhj32.exe

Filesize
187KB

MD5
11f7ea4ea9379f9123b7cf1364cf3b6e

SHA1
e0571bd08efd66aba971a2d15ee9d6ad5d2cf9a2

SHA256
2553117adc7d5aca8034350e3fc1702113703f7c4386a061f3d3fa4b78e4ebc0

SHA512
e8a99cb5fd49fb277ec6cb0abdd04c509ad25623a7e888dcfb73f4055b0316d0bd3d434662eb699e1d96829788e5a26e469f93ed12d32548d25b5f5f1758c671

Download Submit
C:\Windows\SysWOW64\Kcpjnjii.exe

Filesize
187KB

MD5
fd51f062add4871d63a48fcd3cff808f

SHA1
c3f47750b927a5391791f5b7086d01e7cedc3bda

SHA256
a08b97c412abd19de0103cded59ad99e2ea9314ad87f43563ec84195eb053212

SHA512
34766fa17cc98ff959c385146d06e2c74de91c0b366c9b0b8085cfe8533a7a05ea10c94b5678796505ffbefda8084744aa088898aefb0986fa48139c0db1373b

Download Submit
C:\Windows\SysWOW64\Kemooo32.exe

Filesize
187KB

MD5
caf6e8de4ea29ffd085812a333d8c0ae

SHA1
33e40fa704e2789d733db692ae2f4171a478149d

SHA256
139e09725af69e5a6c6c4154b8d67b520fbb274018ee9bfffab8118ae1b084f8

SHA512
f467eec290ef58b19d859d31f6bdae3cf7f5a0d142968226a048a8e03799a02c4f889c890dd6d1dd2216c168044376e09c328cc00e7011748a596594aaa3d721

Download Submit
C:\Windows\SysWOW64\Kflide32.exe

Filesize
187KB

MD5
88f677c4ec084ed0c2eb3e5821337e6e

SHA1
af812b6e79a65aa464dc013927589e929e9e95a8

SHA256
862e0fe7e7c45a1f84bcea677ad29862c073c615fc8cf88cd795cca63eb29d24

SHA512
e96fe6c47423f23c724b95ae93f4d59d1b5a125b89730a438ad16f7544200ea8cba57961589aa8d600598ebdc666ab786a0b543e5aa8d65e678573ac63dc3e67

Download Submit
C:\Windows\SysWOW64\Kfnfjehl.exe

Filesize
187KB

MD5
b4a64dd1cbc8ac74e21ad493e2adf15f

SHA1
954f245a7122119362540feda8ef59bd72df4e9c

SHA256
8e49576648862f8b979b7f21f2fb147b755904630df7f864b3db93aa86d81ff9

SHA512
db634e4cd641648e8a12ceb505a2552e75ff2397c7e1dc20db9f8e56124518449ab6f2d2f81395ab4cbb491ee2348a885960f98aed81efcbccb4db194797ea1d

Download Submit
C:\Windows\SysWOW64\Kgnbdh32.exe

Filesize
187KB

MD5
cd055576ae2f4d284a6e344c32b64132

SHA1
6710b23c0cc35fd5ee435c4992608c1411305773

SHA256
a7b85ba6c6833b5cd4e4425827e86914927f77b30c3b79245401c83febbef2ae

SHA512
6dc82162819fc9cf69373f450c07f8e7d9df88d62bcae2705eaa411a3adf321fc4df4470e505c4d30587d1f5b81df8c1c3cdfe2acda00b65d6f2c68e43bf71b1

Download Submit
C:\Windows\SysWOW64\Khbiello.exe

Filesize
187KB

MD5
7e31488652bca05d20281b11adf3215f

SHA1
c3d00b8d89e65145ef53ba66eb638cca9c12aad9

SHA256
2c62e12cb953c136f81ca701ae61b63b92dff7fc2b0409c60cfa8ab762f0d3bf

SHA512
b4664468d4d1e546d718e4b32f5e2416128669900d8a31a5c30214d6160105264f072d0c2900f61a282699c3459a93cffda9cabba2f78e1550b29e091b3a36f7

Download Submit
C:\Windows\SysWOW64\Khgbqkhj.exe

Filesize
187KB

MD5
76259b91f4d986e135d6bf2b37845a1f

SHA1
13de08cd1bcc1b21f82d837842a98227cddf6386

SHA256
957e7a8386f59bd6e1b2d7503c28b154d9e2240dc6e3892fd9ed9e186105f726

SHA512
71b74ba556217795991e2bbc1aeedfade1321b10c64cf35b23c943ec6caa8df6834d61353f2d2051c091afe98bdff690f8c9c0c19e5d4e2d59636fa1e3a61cd3

Download Submit
C:\Windows\SysWOW64\Kjjbjd32.exe

Filesize
187KB

MD5
caf1e8f0d290cb8c9fd3a2ba1b279e3b

SHA1
78d752d9e10f6286a36b1070db0aa9a9b9fbfa26

SHA256
610990c8fc6c48387bde3248ace0791aa6235071b683c78025059cbba6942b21

SHA512
5d08f942d060a509b9515ed724e6aa56ac5bd4f6f4bf39fe330a0fdad5559fd51652ddae247395bcc255cf52dbc2376a5bfd6cf8fb6ff6ece971a5f061d6240c

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
187KB

MD5
fe2ed037ce08a0b3f01b0ae6f5aea4ff

SHA1
fc215c44de4058e6c89493fc1e60be33fabc0c0a

SHA256
6294d8c80be5fcef56956e2c6707a42c59bf9a65449a05bb513e98993365336f

SHA512
04318c9fb7574232d6d049d9c9bf559fb4a8f07796ee9935eff4ea626ad0165e7d68007d27077e8286e03c2ceeb6fbaa3491efa1557191556482e67c7e3bfc5e

Download Submit
C:\Windows\SysWOW64\Klhnfo32.exe

Filesize
187KB

MD5
5a21913ca8dcdd37e9523165044e7788

SHA1
47aa6786ecb667b3e8397db6969671acd4ad489c

SHA256
04229fe0224058d6c7893819437eb07e31d8efa1c60300cb2120e7acbf258356

SHA512
f799646fa93e2b639b1853a3861aeac58d7bd5919ce6fa1f6906b13d3d5b8ed547849924aadad7ee11790acb2ab768ccdaa8e7d4562034547548af3f7616bc05

Download Submit
C:\Windows\SysWOW64\Kncaec32.exe

Filesize
187KB

MD5
9fc71d0013b3af887fe48f5f552c512a

SHA1
51c2576cf14aad29abcae22787840c74d65ad9ec

SHA256
4ff4fddb226166343f0222e6ed4375b8fab220e52059fa372118bb9be390aefb

SHA512
b65bd3abd62a84a72d05bc1c4704d179a209302f9f75629088839d56b206cbd5905431f57381a80101ec29f2e5c008c55f759ef3b869a3a5cd443e15bb898591

Download Submit
C:\Windows\SysWOW64\Kngkqbgl.exe

Filesize
187KB

MD5
e679ff4d60f90623cb606894e1d7b91e

SHA1
87ed08ef5335d387f429ac313de3abd7143d01bd

SHA256
05636e6d9547258d804438260cc7919cdf19689d822227228feef2965aa803f2

SHA512
fda781d6a7375252bb02949f420406829faa9c8a61b5a7ce3325a58a04a2e8759d4d7567776e608bcbf1b931a84450d38ad0c9f17837f5824aa473d28934238c

Download Submit
C:\Windows\SysWOW64\Knnhjcog.exe

Filesize
187KB

MD5
d49ac9f8d1838aa568c1e4608f97488f

SHA1
ec87d93724dfdcaeb3a92053c49ead1faa323a7d

SHA256
e2e384c6971b4f03910e7aee34b75d35ab04d7eb2dc2608e042253939c982c71

SHA512
239ad8dcac89a37c5f1d11bc0f34f70316da9f8920bcc99690f86b2c59cf2b32e82a90ae2584ec37737a52556846442338ea4d5c004e654a35b8128f9197be52

Download Submit
C:\Windows\SysWOW64\Knqepc32.exe

Filesize
187KB

MD5
27b2a64f6455f487a3c0b248daa277ff

SHA1
a05881976eb21ee3deee3f09aed486beb3b8c626

SHA256
ee4b19622d02174da8c9f8c55c9e702edf1d175ecf4946ce9ffe769c05beb9f4

SHA512
8d204109aa1c0bd2f9a5c90c43b5274889b6346a3c9587fb2cd73037983dd201babed3cb64d1ca13085ac4b6f8c906d3e1253d71044ad5340c62ef4ab1581d16

Download Submit
C:\Windows\SysWOW64\Komhll32.exe

Filesize
187KB

MD5
54b3e603dc05d782dbfe78111a66cee3

SHA1
8ec9a18e3dcdf874e7195413b214f4392052ccfb

SHA256
e22d0f85963ccef7e39cd5d31abac61b42c3e75b790169773acfe7e0dde6dc48

SHA512
dacda884751f0876b52ee6591746e0a08a5b885c1e84ae552b1f159cee8c2d6d6bc7044ff8fa982a3980b6a1c7b76f2240e98ddfc8249137e5d0dc240428eb38

Download Submit
C:\Windows\SysWOW64\Kpanan32.exe

Filesize
187KB

MD5
7cd7d060d3c516d1cd31edea00910202

SHA1
44126d91a5ec686977dac471ca07be676fc61766

SHA256
a634b8de7d061a0f541d118d1c6526412c0c6f0209afe59ff28c6606ab1388d4

SHA512
28e0467296d28c0fe4beff6345e84a8a63ff2f59422f5f2605c7090e79a6607b5d7dede34ec1b880afd817faa23911921a961b3c3a4273d55f7322453d922301

Download Submit
C:\Windows\SysWOW64\Kpcjgnhb.exe

Filesize
187KB

MD5
efd14961b7bee9dfd4ed0dc5d02dfb21

SHA1
7827d753744b5195316e04be6c5639d225069c94

SHA256
28d367d3d3c5fa81d457156e7fe007eabce9f5c389a8f8216d3bc38c44c1bf94

SHA512
3cb50ad3707e00e26f483ff57e7c87e6f2da0ed93b540d9f2c7860e57da1ad6ed76982dc9208c008320b8a2ad19c5e8667cad4c77e7bad6a123e35301e1f9382

Download Submit
C:\Windows\SysWOW64\Lacijjgi.exe

Filesize
187KB

MD5
6fef847b0392c5b02bb3e7e9b219f7b1

SHA1
5371d4427e85887d8b870adfca8217f8901a23fb

SHA256
49146f97a4ffbeeeb8f7f9f6a381e2294e036ea32d95c4bc59de6e3a4ae00912

SHA512
e0b3bc5f1959f12bf50aaf2e7388a47d3174bd38fe90b768a00e1274422211910e46a027a6bdbda0f45c16dc400d61bafd9ce7c715ab555db437b179d6891867

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
187KB

MD5
f8e7197fb4643a25bd546cff17035b25

SHA1
9c3c4dac34a9ec00c09a3b62104e8638e4e1629c

SHA256
aacf1bbeb077262c2c81429813a32861c5f7efa1fcdf5e17cd7fc8b2f4d4aa87

SHA512
1d0f1d5f7aa31d5230c8c4c3625a1dc7e3f78e2d2777b40df02ff6be8898e5db5d57e123d25a146bf245a7fcf24333bcb88deec9ab40effa590e76ef1ddf01ad

Download Submit
C:\Windows\SysWOW64\Lcgpni32.exe

Filesize
187KB

MD5
53a3d2dcdd1d3a094900b5099ba3738e

SHA1
744600157bccb66b61718c63f3fa4b1ebddc73b3

SHA256
63e15b465b4940b41c29b1977b53f5808f36fe9d7a3c17d1c8e006ce85db815e

SHA512
37cbe26c95f9f984694b477b457de04314b6fca3eb3d0866f713f177a8381f23d5d18fdf966352719a61a0c81d79e4346e6a68eebea96797c163137f2d1bf3a0

Download Submit
C:\Windows\SysWOW64\Lcimdh32.exe

Filesize
187KB

MD5
b4c0822a810e7ef6ea713c02e83f4ad7

SHA1
10b655c7828b6b610cdfab2e1acc7468007c516a

SHA256
902b8bfd35a62c62da85a17303a2cfcb1f8fdf28c5d20abfc519c943217f71fd

SHA512
d9ec2ae87e9a1ff592379e69f01c47d9dcaea46eec5e82bb7ef03f63c4926a8139d070f68e57979c54eaf27b43285b172510a7bfc99349f2469053bbf0822887

Download Submit
C:\Windows\SysWOW64\Ldjcfk32.dll

Filesize
7KB

MD5
db255847a9aea69d75111c4bf777fea2

SHA1
c13ee55a4e77ec3db7d8ff8762b73843b037c24c

SHA256
4b74c67491f798ff36988c105464dc12a674050ac30a0959be94429b62cba3e9

SHA512
678d4ff31bdbda61c527e10418b84eec5bac2c0bb157e42b0ebcb60532808fa924e840a4de3c3632613be9dad4318735694ad5674c4db3d060d4375f4408ad55

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
128KB

MD5
6012970ceeaf286106699c813b2b5f75

SHA1
733305567a51205a3d2f4c780bf68ce86d764b3b

SHA256
b8b1d8334e617d98547365995f9bda0b37e8a65e8212d4ba5cf10f69c3d9bf57

SHA512
15bbecd3a961de547f481b445288f8e1eb8de9d7bbbb4620635de3538439e7faa6f7fdf97d4acdb6a5bbe26eddb7f48282a789ac443a513f9dc1bcb1b7bb6297

Download Submit
C:\Windows\SysWOW64\Lfbped32.exe

Filesize
187KB

MD5
a23801fef1d0c8b0d9d77b5f71ffc1e1

SHA1
fade7f01abae5fe22cd7b8988d6e28063e284786

SHA256
fce0c41edda615f7772824fdacef749a0c0287748fa4a4ccb953bb1b9540d695

SHA512
da9f14f3a102b7167864bb3a6c963e25394338e6a3eccd2f5dd9849ecceba13a413d4f9104db2c39ac8074c58bab93f3e58615219440138d0769634381ea5160

Download Submit
C:\Windows\SysWOW64\Lfeljd32.exe

Filesize
187KB

MD5
a99070edbccf6567fb7e0cc47e62b354

SHA1
430db5636ee298af6bd3cec47abff91f07674880

SHA256
e37a679405fb8361034bb73d382f0f6f07bd8c3bf9e094113880332cb9377f56

SHA512
20152961a2fcbf3846930a509cbfaa20cfb74fa497d3ea13a355789a5c0f26e02a2417375e0857fbc3b6829fbac07caec401bc8efbf02b5f54ea2620cdc82b3d

Download Submit
C:\Windows\SysWOW64\Lfgipd32.exe

Filesize
187KB

MD5
7b20af05b2446a3a1b812e876075fa25

SHA1
25284e48276f7098759de61d6ecbe213e832d055

SHA256
f2a9308aec1f72d9aa1d1835f11cde71572cf1cd3e5226e75dfb4945c44de324

SHA512
08a7ba70ad8c62721fb1a773944b07b1f1da38b3bd11a204c070350cf3bd3e817cb4977195003a17358d77755b64746989b7f2e899c64e69eb5133c4693ad93c

Download Submit
C:\Windows\SysWOW64\Ljqhkckn.exe

Filesize
187KB

MD5
547f0d5ee3397ca55fb57877151da5b5

SHA1
9cb68a968379f1912934e4a0d662f7d4e9e1840f

SHA256
10ab44389b97ff86fe00f7afa97207f52f19f8341842d39cf02751ea79c39781

SHA512
73ba01d6e88885931ca0c392bfd0a833612a06b7fa0fec35b9f26237e9ffb9bc3e224ea5e9e233c064d33ef0d18eb264baa5d5e4a004da2d76de2edfbb9c9c5a

Download Submit
C:\Windows\SysWOW64\Lljklo32.exe

Filesize
187KB

MD5
65437d1a16e2e1787c2ab51ae04eac53

SHA1
15f8748e0b0c8d032078ff9348acaf2b2502d152

SHA256
6768ffbf59aad141bf9daf2aa65061725759abecec2bcae420690fa225432d15

SHA512
7d3872f404a2d312142080482388d46a2a505f8d779b56fcc609c2501ca9fb0aa21cb4a6987871605ea2de11abf0e5bae4d1870c9d5a0c56e29281645b055cb2

Download Submit
C:\Windows\SysWOW64\Llmhaold.exe

Filesize
187KB

MD5
3ca4039d2f1b6afeeee617118192f53a

SHA1
59df3b33c576c034ed772e9689bc1d5d7a635702

SHA256
fc4fbe81eff9495d0f9116c1ba0b2c1636631178ccbb5e4502553d6d25fc56dd

SHA512
a71bd8e23d4a86a821bc569cb1afa166f942c22938ae5a5b1f4d68ff3cb3cac77fbc15e59fab19134042f8ad26a3825f7601576f532aa650fc67cf55c62b0715

Download Submit
C:\Windows\SysWOW64\Lmaamn32.exe

Filesize
187KB

MD5
fe89859a0cedd48ba51e76b3ca832241

SHA1
91d0c19967d8fbaca1d6b02349358cb920e8b19c

SHA256
7684f5aea7e801b4d518c4c8c4196f9d668b369a91431357776d1abad2cf9a93

SHA512
9bf5f48cc7832bee7f65d1a9a86856db24590f79596a76f41ef6b11d9df96e525dec9cff4af2ce9484a182dac0ad36ad6b1714a1c622a5797077295a45c35711

Download Submit
C:\Windows\SysWOW64\Lnjgfb32.exe

Filesize
187KB

MD5
0424f40897f12d3fa6060d0183422d71

SHA1
9f972014fdf03efd69803baeadd778ae9ef93f9a

SHA256
591d9e130bd48ff2ca6f1cdcb31dc5cd8536f89b4dcc37da24f3193730329a24

SHA512
d9a1c069987d43a652a53de954cffc1bdb1af9f7c2c3d4345ba56434d0ce8627bf231f946e0b1375c072d73ef205b6e51b5002c663b25ab199ae5625187f5a9c

Download Submit
C:\Windows\SysWOW64\Lnldla32.exe

Filesize
187KB

MD5
a1b71fb864ca03b3c98246198366ce39

SHA1
e2420cb56c88a04d6902ad2e48f1d6e6417303dc

SHA256
3e1db868ca92581b3662e98a9e206ab8aa171c5b852447ac4e73cc15b99149aa

SHA512
89631c89e286cfcd9ad0bac04a659ffe375c9741b573f497742f2b204de12b3b7abf2d4fdd84c95ded857728f9df27e41382d98eafe678ee597c0a1a813cad80

Download Submit
C:\Windows\SysWOW64\Loighj32.exe

Filesize
187KB

MD5
68afc8141898aa5c38d1202e8230a61b

SHA1
b29762ad9629a5b58410ad6af9677a8dfd222d91

SHA256
e7c0b47ec7131b4277321cce54b039bf9e1b8308696ddd2c153a6dfb163a47e3

SHA512
e997af1b6069bc1652ae0faffd66ded219a1e4a328070d1cf965cfd3707ab5b3d64f5456bde6c15b99b83bc53a2756cc4d7f8dacb8b6313350e55e7f1872b39e

Download Submit
C:\Windows\SysWOW64\Lokdnjkg.exe

Filesize
187KB

MD5
648efc93ca6867cb79e8d43fb1e8d642

SHA1
ee2f16ab59c7660d0c0eaddacffe52f3352cac60

SHA256
903b04830d858b266501f63d8080dc8007c23432d37139691b60793bf5a2d9d8

SHA512
64d6b15bff1b2836a39e014a9e898fa74d88a3d8d779d09a09e95f2abfa2d3d24668217221346d05cf15cb722f71efd9a9bcdd85b79320f9cb071a385a32c3c0

Download Submit
C:\Windows\SysWOW64\Lqkqhm32.exe

Filesize
187KB

MD5
dc137f32b4b3b11383ccdcbb7062a33d

SHA1
10e45eca7646e2a0c20caf4fe0614aa735c8dfcc

SHA256
5a24ab79b4774dded8d576bbbf354d90385816a083a91fe24f1eded9192d837a

SHA512
f1d94e8520b1be74a5346d659621582e63ff1aa8cc06d5a3b8fc14e6e0343ac94e5fb079186dfeff8c0998d9d30bdbf5495facac34fd8ed464ab026026090d6b

Download Submit
C:\Windows\SysWOW64\Lqmmmmph.exe

Filesize
187KB

MD5
e4ed04e9f67697f6a00d194bfb955b58

SHA1
616e1a17b94ff59a3b911a723f721e11c29925d8

SHA256
1ad48a9811e13ecd8c22c5e88d622c4e40b49d9b3a0176d1fe1947b392815977

SHA512
5ab7fed9e90531bd37795a223c3822e037ba125496b0a0b4873854ec8ec6a318810e37194b1a7bb7f539cd847f1ee65d0fa5176a302d7cfa945b4f7926acaa81

Download Submit
C:\Windows\SysWOW64\Mlhqcgnk.exe

Filesize
187KB

MD5
ab7489a6c2907acca0b4d672b83e4fdd

SHA1
68a10c7176def4c924d46f8268b84a6a42390683

SHA256
51015f51264cbaeea9171a2f9f9b3985cff615e5ee9aa1f2b26cde796a77bada

SHA512
a3295bf8aca88ce1b77c58e0712d2b2d5a2a01eb626f821eb5aa9284a6c8c668d6efcfb557a686ab4469b1ff444b1aecd5a502dbb94a0cf23116db43abdd8d9a

Download Submit
C:\Windows\SysWOW64\Mokfja32.exe

Filesize
187KB

MD5
984c56e5189a8be9887aa5ea9b2767c6

SHA1
07d20827d9507e1ddb76dc2ca6a7b98e6da789b8

SHA256
2c1b0473c654b015c0f9398c415cab49abbd4d4a8230f80c4a3ffce3c056a031

SHA512
9f3c7aa9a45dc5f105d08157584bda426c953a6da7e26d2039d09e99dbc97f2adde3b1fd667712ea1151a8224d207b9058e42048bfbaa252306e2923638767b5

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
187KB

MD5
6c00d146e67d726c38ce712949891430

SHA1
4d1e441c5614e9131c592b55d3ff831dc9b78bf6

SHA256
efc6c51c26a3285070bc9308597445f4b8adecd5c27266894f7bfe5ee3fa1ea5

SHA512
ea0a179b293dbc64098ba4d7fb919e2f27d78b2c9b601ee6d70ef6f32a16b053262d1571a02c5931ccf1a389decd9cf32e9a8a208b2bab21bf1ed59a7a4ed179

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
187KB

MD5
b54c49941895572f94cbc0cc91b434ca

SHA1
4b39f5e3d6df31e169b693034e09dd607aab165e

SHA256
1ebaf4c0cf03f7935a02c5f5a260c36e434dcd734ad35ae9d97c6c50df20fa1b

SHA512
316f61828d4552d7c029a45b1dc3696989c12ceb63365a213a50769965f62629db30f0c0e6beec0f90b230c6285bbdad043126c9a9a0dc243d2a84a038f0b636

Download Submit
C:\Windows\SysWOW64\Oblhcj32.exe

Filesize
187KB

MD5
87c6aae8f2c4a5b0cb0d17c9b6c824e4

SHA1
5a3111858aac8bf6fef518c69f45190fc9ef3bbc

SHA256
37814cee66ffcd77928a28d8ee8d04d4b1259a646a8786bf5adea1afc0da7420

SHA512
741f22254977d729a6baa335fdbc44245e45b337deb281a29098de6e89f58fbbdf60cd943bcaa2bd81529fb48f18f7a39559a4e755597dcef9578bccf4c39008

Download Submit
C:\Windows\SysWOW64\Ocgkan32.exe

Filesize
187KB

MD5
6e8932ba7cea0bfbb708aeca4727f784

SHA1
f31c3b28aa4f62e7265a86c6658c9a0fb178953c

SHA256
e76c2b1550fc9dcf26b842e02052bab3269afb1bfbe1eb0a9f7a3328644e3e27

SHA512
c2fb035a0bc49633a9a61a4f8a5105a2fe95529da725eabc1958c14abeb056ccb7449625a033d69132b55cd5e5773dcb1136e3a4ff1e11e168a6880b598e75ae

Download Submit
C:\Windows\SysWOW64\Phfcipoo.exe

Filesize
187KB

MD5
ae76067a1cd3fd808433908bad8efc87

SHA1
43cef5730df6dc3844128b02b68b933b8cf2c5cf

SHA256
953df2f109106a8c7694441ee92848073047c4cec5b04a45abd2ee6593b0b0a6

SHA512
f9c1fdf9a65fd3b2a0a1c091560b0c4e27e626f9f5a3fc901c342959a31dca9ff22f8fc5c74d511082dc8fc65b615993d868783accb1612e904c2ba4204f48bf

Download Submit
C:\Windows\SysWOW64\Pjkmomfn.exe

Filesize
187KB

MD5
b60bdcdb07ef32e6fa0d5065101c4f2e

SHA1
f46573e58302479d84d6296cfc37a20f5bc90659

SHA256
45ae3910c959c874a1bce1401ecc2fe5386f619376bc00086d60dec7d03b956e

SHA512
d4388012648b55020f77165d810ce36c12735ea9766e0338ce85d828c8882616651e8c425ebf5853ae7c45b9384635d1361938d7b34943836c95a463679dd703

Download Submit
C:\Windows\SysWOW64\Ppnenlka.exe

Filesize
187KB

MD5
df170237accea46f8f3b09c2427dd1e8

SHA1
36c0903acf3daadc688ed1862c81264e56cacb30

SHA256
493686f13e012454c20000aafdf7e14206e4547ff4b6a2214f33dca0b25b7d12

SHA512
25e44e925f2c2d47f3ccfaee5918448a6671a140321779d980c0db3e0763c29dab1fb694ca54878f4f2390d7fa10f39911ed1004a6636143c6934a12b2250e1b

Download Submit
C:\Windows\SysWOW64\Qcnjijoe.exe

Filesize
187KB

MD5
cc967d8184eb4b5c622daf06d571326a

SHA1
cb0ea06a8cd76df8032d60ccc9430cb24593fc25

SHA256
0f73553ae6e07824139ceeaaa9bdc57e3e2f7a1b1273688f297d816f688d0f3d

SHA512
7dc27f9d162e0114a7bb79ceb7dcd5b12493deb3ef57677cc9a47da00a53207dc4bcdf8ebfa3298f9c969885e7d13326984fa874b08e159f79586ef0b871bf52

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
187KB

MD5
be46424ea51da0175c41cb0cc3abea4f

SHA1
34412a184405241b7724c75cc67016e616e69a2b

SHA256
7fe6f6158f869d13b8833dca47298d8d328d418e5bc95fa6aa732e2da6b8382b

SHA512
f2bb579536fff82f9898b16682ad0c47d22d9cbd91512301debf4fa3aeb2d01d49dfed141c28bef2105e38090908a890a8a30a3cd0efdd87821f95b912ea31cf

Download Submit
memory/100-323-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/232-290-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/708-417-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/940-330-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1096-31-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1168-603-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1176-634-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1424-299-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1528-375-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1556-311-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1592-296-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1616-369-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1648-441-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1692-317-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1704-399-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1712-322-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1792-423-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1908-303-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1912-319-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1992-309-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2020-405-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2088-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2224-320-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2236-310-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2244-345-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2272-289-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2348-411-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2424-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2432-44-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2456-332-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2472-325-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2544-439-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2560-429-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2572-288-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2672-295-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2768-312-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2820-89-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2944-609-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3064-316-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3180-597-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3352-15-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3356-318-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3436-307-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3448-626-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3716-615-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3900-357-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3944-381-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4076-387-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4180-321-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4260-313-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4288-363-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4328-628-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4344-315-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4380-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4480-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4536-393-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4720-302-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4752-331-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4788-308-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4836-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4848-291-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4872-293-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4884-67-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4912-351-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4944-621-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4960-306-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4972-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5012-324-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5056-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5104-314-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5116-294-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5144-447-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5184-453-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5224-459-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5264-465-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5304-471-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5344-477-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5384-483-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5424-489-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5464-495-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5504-500-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5552-507-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5584-513-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5624-519-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5664-525-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5704-531-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5744-537-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5784-543-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5824-549-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5864-555-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5904-561-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5944-567-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5984-573-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/6024-579-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/6064-585-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/6104-591-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads