berbew | 473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33.exe
Size

67KB
MD5

42f3b3205d5a6bc88f32a3c5f7ecf572
SHA1

b02b5e9e392c377f16bdf324b99e350a6a8723dc
SHA256

473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33
SHA512

90833c35773fccdedf49a7ce524a2f68682350a30fb3fce3b309901e1e2a217e231c69f50e2cce595acb88b32d698b495c632eb724c9b2ebc97c9461d03b4011
SSDEEP

1536:JlBxxfeeYziDLbuH+AmjyIslsJifTduD4oTxw:9Pe/cba+MlsJibdMTxw

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khbiello.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mofmobmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfnhfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfepdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgoakc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggkqgaol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieagmcmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihpcinld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgjoif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpqggh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pffgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cggimh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqgedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaqhjggp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibegfglj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgjhpcmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpioin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqlfhjig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjodla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amnlme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaonbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mokfja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnifekmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fooclapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpepbgbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ombcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqncnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iahgad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiopca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iamamcop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paiogf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcfidb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcoljagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplobcpp.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4944	Mqfpckhm.exe
4308	Mgphpe32.exe
2384	Mfchlbfd.exe
5016	Mjodla32.exe
4828	Mnjqmpgg.exe
4060	Mmmqhl32.exe
2984	Mokmdh32.exe
4844	Mcgiefen.exe
3108	Mfeeabda.exe
4808	Mnmmboed.exe
1388	Mqkiok32.exe
4644	Monjjgkb.exe
3168	Mcifkf32.exe
4608	Mfhbga32.exe
5072	Mjcngpjh.exe
4192	Nmbjcljl.exe
4204	Nopfpgip.exe
4640	Nggnadib.exe
4532	Njfkmphe.exe
4128	Nnafno32.exe
4796	Nqpcjj32.exe
2400	Ngjkfd32.exe
800	Njhgbp32.exe
5036	Nncccnol.exe
1976	Nqbpojnp.exe
672	Ncqlkemc.exe
4704	Njjdho32.exe
4064	Nmipdk32.exe
4748	Ncchae32.exe
3312	Njmqnobn.exe
4336	Nmkmjjaa.exe
2072	Npiiffqe.exe
3228	Nceefd32.exe
2624	Onkidm32.exe
1380	Omnjojpo.exe
688	Oaifpi32.exe
4820	Oplfkeob.exe
3268	Offnhpfo.exe
3596	Onmfimga.exe
4660	Oakbehfe.exe
1400	Opnbae32.exe
4860	Ogekbb32.exe
2948	Ojdgnn32.exe
1292	Onocomdo.exe
1684	Ombcji32.exe
408	Oanokhdb.exe
4492	Oghghb32.exe
2872	Onapdl32.exe
4312	Omdppiif.exe
1088	Ocohmc32.exe
792	Ofmdio32.exe
4552	Oabhfg32.exe
1128	Ocaebc32.exe
844	Ohlqcagj.exe
4908	Pnfiplog.exe
220	Paeelgnj.exe
1096	Ppgegd32.exe
3584	Pccahbmn.exe
3064	Pfandnla.exe
840	Pnifekmd.exe
5000	Pmlfqh32.exe
988	Ppjbmc32.exe
4656	Pdenmbkk.exe
4036	Pfdjinjo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Jafdcbge.exe	Jbccge32.exe
File created	C:\Windows\SysWOW64\Chiblk32.exe	Cdmfllhn.exe
File opened for modification	C:\Windows\SysWOW64\Cnjdpaki.exe	Cogddd32.exe
File opened for modification	C:\Windows\SysWOW64\Kapfiqoj.exe	Kcmfnd32.exe
File opened for modification	C:\Windows\SysWOW64\Nfnamjhk.exe	Nbbeml32.exe
File created	C:\Windows\SysWOW64\Hknfelnj.dll	Dnajppda.exe
File created	C:\Windows\SysWOW64\Gejhef32.exe	Ganldgib.exe
File created	C:\Windows\SysWOW64\Mjggal32.exe	Lcmodajm.exe
File opened for modification	C:\Windows\SysWOW64\Oifppdpd.exe	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Eqncnj32.exe	Eomffaag.exe
File created	C:\Windows\SysWOW64\Lojmcdgl.exe	Lpgmhg32.exe
File opened for modification	C:\Windows\SysWOW64\Oihmedma.exe	Ofjqihnn.exe
File opened for modification	C:\Windows\SysWOW64\Pfojdh32.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Mlhqcgnk.exe	Mjidgkog.exe
File opened for modification	C:\Windows\SysWOW64\Pjlcjf32.exe	Pfagighf.exe
File created	C:\Windows\SysWOW64\Kajimagp.dll	Aajhndkb.exe
File created	C:\Windows\SysWOW64\Hbobhb32.dll	Apodoq32.exe
File opened for modification	C:\Windows\SysWOW64\Khiofk32.exe	Kekbjo32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbala32.exe	Omfekbdh.exe
File opened for modification	C:\Windows\SysWOW64\Mnjqmpgg.exe	Mjodla32.exe
File created	C:\Windows\SysWOW64\Cdmfllhn.exe	Cpbjkn32.exe
File opened for modification	C:\Windows\SysWOW64\Hemmac32.exe	Hnbeeiji.exe
File created	C:\Windows\SysWOW64\Hanpdgfl.dll	Kolabf32.exe
File created	C:\Windows\SysWOW64\Lhenai32.exe	Lchfib32.exe
File opened for modification	C:\Windows\SysWOW64\Mnmmboed.exe	Mfeeabda.exe
File created	C:\Windows\SysWOW64\Fenpmnno.dll	Offnhpfo.exe
File created	C:\Windows\SysWOW64\Okddnh32.dll	Qaqegecm.exe
File created	C:\Windows\SysWOW64\Gcmjja32.dll	Jldbpl32.exe
File opened for modification	C:\Windows\SysWOW64\Jimldogg.exe	Jafdcbge.exe
File opened for modification	C:\Windows\SysWOW64\Mlhqcgnk.exe	Mjidgkog.exe
File created	C:\Windows\SysWOW64\Ofegni32.exe	Objkmkjj.exe
File created	C:\Windows\SysWOW64\Qedegh32.dll	Onapdl32.exe
File opened for modification	C:\Windows\SysWOW64\Oqoefand.exe	Oihmedma.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pakdbp32.exe
File created	C:\Windows\SysWOW64\Fgjhpcmo.exe	Fqppci32.exe
File opened for modification	C:\Windows\SysWOW64\Khgbqkhj.exe	Keifdpif.exe
File created	C:\Windows\SysWOW64\Fegbnohh.dll	Lpochfji.exe
File opened for modification	C:\Windows\SysWOW64\Pimfpc32.exe	Pjjfdfbb.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Jlgfga32.dll	Keifdpif.exe
File opened for modification	C:\Windows\SysWOW64\Lcclncbh.exe	Lpepbgbd.exe
File created	C:\Windows\SysWOW64\Ecfjqmbc.dll	Nciopppp.exe
File created	C:\Windows\SysWOW64\Pblajhje.exe	Pciqnk32.exe
File created	C:\Windows\SysWOW64\Mgpilmfi.dll	Gpdennml.exe
File created	C:\Windows\SysWOW64\Acbldmmh.dll	Kakmna32.exe
File opened for modification	C:\Windows\SysWOW64\Kheekkjl.exe	Kibeoo32.exe
File created	C:\Windows\SysWOW64\Jnifpf32.dll	Mgphpe32.exe
File created	C:\Windows\SysWOW64\Mjodla32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Onocomdo.exe	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Bmhocd32.exe	Boenhgdd.exe
File created	C:\Windows\SysWOW64\Dkndie32.exe	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Doagjc32.exe	Dgjoif32.exe
File created	C:\Windows\SysWOW64\Lchfib32.exe	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Ibegfglj.exe	Ipgkjlmg.exe
File opened for modification	C:\Windows\SysWOW64\Jifecp32.exe	Jaonbc32.exe
File created	C:\Windows\SysWOW64\Npmknd32.dll	Jifecp32.exe
File created	C:\Windows\SysWOW64\Jlgoek32.exe	Jhkbdmbg.exe
File opened for modification	C:\Windows\SysWOW64\Kcmfnd32.exe	Kpnjah32.exe
File created	C:\Windows\SysWOW64\Mpapnfhg.exe	Mhjhmhhd.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Cdpcal32.exe
File opened for modification	C:\Windows\SysWOW64\Dkhgod32.exe	Ddnobj32.exe
File created	C:\Windows\SysWOW64\Ibgdlg32.exe	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Lcfidb32.exe	Lojmcdgl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10784	10676	WerFault.exe	487

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqbpojnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqfpckhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eghkjdoa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foclgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnabm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaifpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pccahbmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pffgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doagjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmbjcljl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jemfhacc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmlla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhmjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojdgnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Panhbfep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kakmna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplhhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmqnobn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnifekmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdjinjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfnhfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nciopppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgklkoc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilnlom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ombcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdenmbkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjpfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjknfnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgbqkhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaqhjggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpqggh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlljnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nodiqp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnjqmpgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnafno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opnbae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paeelgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcmfnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjbcplpe.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nffaen32.dll"	Pbekii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmmqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhdbgapf.dll"	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcapicdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejphhm32.dll"	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhgonidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpqggh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfhbga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddnobj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocohmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckjknfnh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ganldgib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lchfib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmdkcj32.dll"	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idknpoad.dll"	Ihpcinld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogakfe32.dll"	Pjbcplpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgjhpcmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogeacidl.dll"	Fqgedh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfgbakef.dll"	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmlfqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iehmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqobhgmh.dll"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmapoggk.dll"	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofegni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omfekbdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcifkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fecadghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klndfknp.dll"	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpfohk32.dll"	Nimmifgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipgkjlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlhqcgnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibgdlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbepme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqfbpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdpoomj.dll"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhhlki32.dll"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeclnmik.dll"	Lcclncbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahaceo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4944	4176	473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33.exe	85
PID 4176 wrote to memory of 4944	4176	473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33.exe	85
PID 4176 wrote to memory of 4944	4176	473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33.exe	85
PID 4944 wrote to memory of 4308	4944	Mqfpckhm.exe	86
PID 4944 wrote to memory of 4308	4944	Mqfpckhm.exe	86
PID 4944 wrote to memory of 4308	4944	Mqfpckhm.exe	86
PID 4308 wrote to memory of 2384	4308	Mgphpe32.exe	87
PID 4308 wrote to memory of 2384	4308	Mgphpe32.exe	87
PID 4308 wrote to memory of 2384	4308	Mgphpe32.exe	87
PID 2384 wrote to memory of 5016	2384	Mfchlbfd.exe	88
PID 2384 wrote to memory of 5016	2384	Mfchlbfd.exe	88
PID 2384 wrote to memory of 5016	2384	Mfchlbfd.exe	88
PID 5016 wrote to memory of 4828	5016	Mjodla32.exe	89
PID 5016 wrote to memory of 4828	5016	Mjodla32.exe	89
PID 5016 wrote to memory of 4828	5016	Mjodla32.exe	89
PID 4828 wrote to memory of 4060	4828	Mnjqmpgg.exe	90
PID 4828 wrote to memory of 4060	4828	Mnjqmpgg.exe	90
PID 4828 wrote to memory of 4060	4828	Mnjqmpgg.exe	90
PID 4060 wrote to memory of 2984	4060	Mmmqhl32.exe	91
PID 4060 wrote to memory of 2984	4060	Mmmqhl32.exe	91
PID 4060 wrote to memory of 2984	4060	Mmmqhl32.exe	91
PID 2984 wrote to memory of 4844	2984	Mokmdh32.exe	92
PID 2984 wrote to memory of 4844	2984	Mokmdh32.exe	92
PID 2984 wrote to memory of 4844	2984	Mokmdh32.exe	92
PID 4844 wrote to memory of 3108	4844	Mcgiefen.exe	93
PID 4844 wrote to memory of 3108	4844	Mcgiefen.exe	93
PID 4844 wrote to memory of 3108	4844	Mcgiefen.exe	93
PID 3108 wrote to memory of 4808	3108	Mfeeabda.exe	94
PID 3108 wrote to memory of 4808	3108	Mfeeabda.exe	94
PID 3108 wrote to memory of 4808	3108	Mfeeabda.exe	94
PID 4808 wrote to memory of 1388	4808	Mnmmboed.exe	95
PID 4808 wrote to memory of 1388	4808	Mnmmboed.exe	95
PID 4808 wrote to memory of 1388	4808	Mnmmboed.exe	95
PID 1388 wrote to memory of 4644	1388	Mqkiok32.exe	96
PID 1388 wrote to memory of 4644	1388	Mqkiok32.exe	96
PID 1388 wrote to memory of 4644	1388	Mqkiok32.exe	96
PID 4644 wrote to memory of 3168	4644	Monjjgkb.exe	98
PID 4644 wrote to memory of 3168	4644	Monjjgkb.exe	98
PID 4644 wrote to memory of 3168	4644	Monjjgkb.exe	98
PID 3168 wrote to memory of 4608	3168	Mcifkf32.exe	99
PID 3168 wrote to memory of 4608	3168	Mcifkf32.exe	99
PID 3168 wrote to memory of 4608	3168	Mcifkf32.exe	99
PID 4608 wrote to memory of 5072	4608	Mfhbga32.exe	100
PID 4608 wrote to memory of 5072	4608	Mfhbga32.exe	100
PID 4608 wrote to memory of 5072	4608	Mfhbga32.exe	100
PID 5072 wrote to memory of 4192	5072	Mjcngpjh.exe	101
PID 5072 wrote to memory of 4192	5072	Mjcngpjh.exe	101
PID 5072 wrote to memory of 4192	5072	Mjcngpjh.exe	101
PID 4192 wrote to memory of 4204	4192	Nmbjcljl.exe	102
PID 4192 wrote to memory of 4204	4192	Nmbjcljl.exe	102
PID 4192 wrote to memory of 4204	4192	Nmbjcljl.exe	102
PID 4204 wrote to memory of 4640	4204	Nopfpgip.exe	103
PID 4204 wrote to memory of 4640	4204	Nopfpgip.exe	103
PID 4204 wrote to memory of 4640	4204	Nopfpgip.exe	103
PID 4640 wrote to memory of 4532	4640	Nggnadib.exe	104
PID 4640 wrote to memory of 4532	4640	Nggnadib.exe	104
PID 4640 wrote to memory of 4532	4640	Nggnadib.exe	104
PID 4532 wrote to memory of 4128	4532	Njfkmphe.exe	105
PID 4532 wrote to memory of 4128	4532	Njfkmphe.exe	105
PID 4532 wrote to memory of 4128	4532	Njfkmphe.exe	105
PID 4128 wrote to memory of 4796	4128	Nnafno32.exe	106
PID 4128 wrote to memory of 4796	4128	Nnafno32.exe	106
PID 4128 wrote to memory of 4796	4128	Nnafno32.exe	106
PID 4796 wrote to memory of 2400	4796	Nqpcjj32.exe	107

C:\Users\Admin\AppData\Local\Temp\473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33.exe
"C:\Users\Admin\AppData\Local\Temp\473142173cecd2091bc71409a6581f08eb82d6acde75f19fd02f4fa602e12d33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\Mqfpckhm.exe
  C:\Windows\system32\Mqfpckhm.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\Mgphpe32.exe
    C:\Windows\system32\Mgphpe32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\SysWOW64\Mfchlbfd.exe
      C:\Windows\system32\Mfchlbfd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1388
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        23⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:800
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        25⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        27⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        29⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1060
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        31⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3312
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        34⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        36⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:688
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        39⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3268
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        41⤵
        Executes dropped EXE
        
        PID:3596
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        42⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        44⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        46⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        48⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        49⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        51⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:792
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        55⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        56⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1096
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        64⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        66⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1300
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3480
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        71⤵
        Modifies registry class
        
        PID:320
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        73⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2012
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        74⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        75⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        76⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        77⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        79⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1336
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        81⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        82⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        84⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        85⤵
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4260
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        87⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        88⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        89⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        90⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        91⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        92⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        93⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        94⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        95⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        96⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        99⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        100⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        101⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        102⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        105⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        106⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        107⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        108⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        110⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        111⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        112⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        113⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        115⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        117⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        118⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        120⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        121⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        123⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        124⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        126⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        127⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        128⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        129⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        130⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        131⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        132⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        133⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        134⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        136⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        138⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        139⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        145⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6516
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        147⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        148⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        149⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        150⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        153⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6868
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        155⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        156⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        157⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        159⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        160⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        161⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        162⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        165⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        166⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        168⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6768
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        170⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        171⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        172⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        173⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        174⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        175⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        178⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        179⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        180⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        181⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        182⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        183⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        184⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        185⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        186⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        187⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        189⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        190⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        191⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6240
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6304
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6796
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        197⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        198⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        199⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        201⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7376
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        204⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        205⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        206⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        207⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        209⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        210⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        211⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7852
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        214⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        215⤵
        Drops file in System32 directory
        
        PID:7984
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        216⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        217⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        218⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8164
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        220⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        221⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        222⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        223⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        224⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        225⤵
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        226⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        227⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        228⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        231⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        232⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        233⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        236⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8156
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3232
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2208
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:7392
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        242⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        243⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        244⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        245⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        246⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        248⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        249⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7636
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7848
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        253⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        254⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        255⤵
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        256⤵
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        257⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        258⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        259⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        260⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        261⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        262⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        263⤵
        Drops file in System32 directory
        
        PID:7284
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        264⤵
        Drops file in System32 directory
        
        PID:2084
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        265⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        266⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        267⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        268⤵
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        269⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        271⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        272⤵
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        273⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8524
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        275⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        276⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        277⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        278⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        280⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8832
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        281⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8876
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        282⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        283⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        284⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        286⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        287⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        288⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        290⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        291⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        292⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        293⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8556
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        295⤵
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        296⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        297⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        298⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8992
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        300⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9192
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        302⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        304⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        305⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        306⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        307⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        308⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        309⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        310⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        311⤵
        Drops file in System32 directory
        
        PID:8496
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        312⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        313⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        314⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8776
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        317⤵
        Drops file in System32 directory
        
        PID:9136
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        318⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8948
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        320⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        321⤵
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        322⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        323⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        324⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        325⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        326⤵
        System Location Discovery: System Language Discovery
        
        PID:9376
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9420
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        328⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        329⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        330⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        331⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        332⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9640
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        333⤵
        System Location Discovery: System Language Discovery
        
        PID:9688
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        334⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        335⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        336⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        337⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        338⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        339⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9996
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        341⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        342⤵
        System Location Discovery: System Language Discovery
        
        PID:10088
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        343⤵
        Drops file in System32 directory
        
        PID:10132
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        344⤵
        Modifies registry class
        
        PID:10176
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        345⤵
        Modifies registry class
        
        PID:10220
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        346⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        347⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        348⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        349⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        350⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        351⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        352⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        353⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        354⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        355⤵
        Drops file in System32 directory
        
        PID:9804
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        356⤵
        Modifies registry class
        
        PID:9936
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        357⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10084
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        359⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        360⤵
        Drops file in System32 directory
        
        PID:10216
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        361⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        362⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        364⤵
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        365⤵
        Drops file in System32 directory
        
        PID:9724
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        366⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9852
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9944
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:10064
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        369⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        370⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:9256
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        373⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        374⤵
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        375⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        376⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        377⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        378⤵
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        379⤵
        Drops file in System32 directory
        
        PID:10024
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        380⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9748
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        382⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        383⤵
        System Location Discovery: System Language Discovery
        
        PID:9716
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        384⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        385⤵
        Modifies registry class
        
        PID:9848
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        386⤵
        System Location Discovery: System Language Discovery
        
        PID:10268
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        387⤵
        System Location Discovery: System Language Discovery
        
        PID:10316
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10360
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        389⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        390⤵
        Drops file in System32 directory
        
        PID:10448
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        391⤵
        Drops file in System32 directory
        
        PID:10480
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        392⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        393⤵
        System Location Discovery: System Language Discovery
        
        PID:10568
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        394⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        395⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10676 -s 400
        396⤵
        Program crash
        
        PID:10784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10676 -ip 10676
1⤵
PID:10744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amlogfel.exe

Filesize
67KB

MD5
e41d19a50826cabc45acf662f8cc6599

SHA1
c37b9a62c5daf653b166a77072273f81260c3a97

SHA256
367477b1f8c34730c3e5d1d46282cc098831d395c3d0cbe3266ae0170ab31e8f

SHA512
824a87e1915de0b8466d1205d1e05167ae4040ff25458794804610c405407c23103fe82701b693155d00d4fd16a9075500c838109fabc54b5e8869123fc06aa3

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
67KB

MD5
c24c5a94343673a65a93d6f46676652f

SHA1
8b257df3ac8b1103da3af851e4a9d4cdf422cda8

SHA256
454cad38fddb15e8d5aaa8bda9c8b3d33904a0e59758a910563ce8f67fe2f195

SHA512
9948c8c566d6f534785f6322b47ee5eeaf5bdee63af3c370d7cc828f67da1a7953291c20f7976e1dabb767b96e3127e828cc858f99e919ace8d27d4affc7d366

Download Submit
C:\Windows\SysWOW64\Cdkifmjq.exe

Filesize
67KB

MD5
b3162f40aea7c2d0f9593a9dfbb85a25

SHA1
18863d0badb6c79a8232afc3e09ca1dd200277a4

SHA256
4cc6fbf17817305fb10b9a3103af20d827a04521aec5bca63a99c6f49991a68e

SHA512
f44734ca162d46e18b05bffb99f577a11ae209fd23760d67b6e0b9aff270c9e98a7077ceac4be23b05d2bfd66f7225ea6d40e390ea4d2a9e380e09f5a20c654f

Download Submit
C:\Windows\SysWOW64\Cdmfllhn.exe

Filesize
67KB

MD5
2e5341d905d85cf0ff79b2808aec6a19

SHA1
2e8ee5d121292805ae7a089fc9a543d7bab6cf12

SHA256
44ec7750f2ea932e807139d49633fabd6daca6da9a68f34c1b7049614a9e62d0

SHA512
4111af161116001c45820358afcab2438cfa5f1b82f1319489540d89433046883c8d3d26b5923dc9eb7d32a787226f193852dc1436b6fc18b450963a0f468bef

Download Submit
C:\Windows\SysWOW64\Cncnob32.exe

Filesize
67KB

MD5
5e6b6bea597425728aae900d29d3ed57

SHA1
e3aca27ea463617e6c7c30efa4ab59da01306436

SHA256
82416ee0303d043d8949158217fe1484dbee031773cf3f89d600015bf446bda4

SHA512
ba219df179e6b926c5241a76d56c06c657004afe8f8016c415a14b1d8a169a0f9d770e89cac45b47fd74bef70c2323f56c01a80366589a77a3630d2117656332

Download Submit
C:\Windows\SysWOW64\Ebdlangb.exe

Filesize
67KB

MD5
fc533d0da50fdde752a74a2106485b75

SHA1
4c203790c9cf50ecc4553aad47fe302ef0171b8d

SHA256
eba23531a0a758ede848fda57e6c504edf3da20b975abf35bd3072d59b2cd53e

SHA512
13b34d93762ad73c1097a399d5bbfd014c4f035841bf690ffe9d3a0b01958bbbb376c46bb002703f7819416046bf8f28841c77f1bbd5f1bda5fa62f67e92a64d

Download Submit
C:\Windows\SysWOW64\Ekonpckp.exe

Filesize
67KB

MD5
1a2e974898eb777092538a75ec7e70b8

SHA1
e496c74184c0f9157022403be60bec3c458e9342

SHA256
c0ad2b2cd9b0301b4d3edfa3851efcbfbc86006883939198cb8f49d5c422f53f

SHA512
847ac64b5e5650ed09a54a69312797d081d650352c23efd7b6c3d25c749b86ac4db38f0f48eaaaa32fbecdf1cd61404018d530b7af30701f2a19cc719ba5643b

Download Submit
C:\Windows\SysWOW64\Eomffaag.exe

Filesize
67KB

MD5
10a64223ce2b71c8eeda452cab975059

SHA1
19972858bbbd8cb3fed3eff1971dfd1c2fce8b52

SHA256
879924f45417a413c511e43f0f6cbf390025e6f460b0b10a535722f021fbe4b9

SHA512
1c9c3db6fd5cd433b13db4cd2016395fcb9b74397f3cb6bf95930556a5f7764ab1fd3cc66251d2b81405bf031f79329383cdc830737151f17bfeb33fc3c484d6

Download Submit
C:\Windows\SysWOW64\Fdnhih32.exe

Filesize
67KB

MD5
046c9966633a56020d0342406bdf95a3

SHA1
82597e4d52b3455b384cc325939f5a71a12959b2

SHA256
b9f9efc1793dd5ea3d9edf7ba56b82b9f0251ca2b324dd9dfc55df3cc3d6e381

SHA512
30a8ab6a4af43f127e67a3e5556fb9a0df159932f4df15154fcc2e84f8308ac36a6e9e9fb46f0ef1cd2ade3fb51b5aabb7c779f66b5e1c0289aa1681e7ea7576

Download Submit
C:\Windows\SysWOW64\Fgoakc32.exe

Filesize
67KB

MD5
9366c0af4414b65f90379fca118d7d2e

SHA1
71379fe04c24c4941145dc3dd2c675f86e4cb5eb

SHA256
91ddf4b82e1be03071b0171f2d94531711efeb0c10246c73de5a1c8589ffbeff

SHA512
81a9a4b9de8f57575a4e42254112993820142b400bd9690cc8c0277434f0cdbbe38fe68702e911a5598bdd69bbf6bfc76ecffef800365e6888ab59ea1a95f2b8

Download Submit
C:\Windows\SysWOW64\Fkofga32.exe

Filesize
67KB

MD5
aa77631e26c7e04a3fdacd5bb3343319

SHA1
87c57c549d614ab2b4a0aaba868720105ed75dbc

SHA256
347f519f98f4b6b3ab8c74b4922c15278fc411968157b0479222611585408890

SHA512
f7f9f7a7feeb3579895906078473cc960a4736b6b3fb7d9d382e26c75a9c8125a1403f47f9fb419c21419ed11ff2a32cc52a4a9d87e4078e13312e2b009f3f63

Download Submit
C:\Windows\SysWOW64\Ganldgib.exe

Filesize
67KB

MD5
77f7a8012c0256330f8e1f725e0ea300

SHA1
6bb911b91068eb0dacf1d1a2d789db1b03e4dd3a

SHA256
bcef533b40a78724aa6215a7fc8e32050590886e7db278d2f419229ec429eb3c

SHA512
7bd59afb6641197a93576bb12443bd8a59a48151e0be25fe5f8324d324e6c0aede1f34f62dd9be745e7d30832b87cfbd4554ff461464be2fd4ec044b607deaf1

Download Submit
C:\Windows\SysWOW64\Gpdennml.exe

Filesize
67KB

MD5
a6f1d7c9f2d94b9efa497095c8359cbd

SHA1
7cfe5df33490d25784a64a08b49ac9c67cc9c0fa

SHA256
8b90af21043d9044618bcf72d73f07de803fa27dfd920a2333f77e15358fafd0

SHA512
a78bfc9d21a531171da313c4beca7d7a53da351c7f845f2c0baccbcdc13ee0e285fc1b3021dcaa2baa143d5b7fa35a386bc2fedfaec8896523e2ffafe471074a

Download Submit
C:\Windows\SysWOW64\Hifmmb32.exe

Filesize
67KB

MD5
ddea625ffca190227e6cf77a7ff138e0

SHA1
b5116eb74f25c7b96293736e810bb75f409e5c87

SHA256
3a19b9dd47705ef25ec3f42b0dc7db91746c1adfa8a3db335557fb2260f16552

SHA512
a12a615f8a1fc651acf537092cc62f12a137d340b94a6e00747f69d41fe329ad459150187e62ce305df8ee1e6807d550f9e919dc55187d1b07641fac74241c54

Download Submit
C:\Windows\SysWOW64\Iehmmb32.exe

Filesize
67KB

MD5
18e39c400f9e5d4ceada4dc790ba3b22

SHA1
375a0ca63143c418d688d4aec4c9dc063dd71eb1

SHA256
97a625284946cda62c55834f4e41b84d9f69ee4428780f980f2434113e6bcc44

SHA512
f3b7428783907d237be45874c3c4661a8eae51b8427541ecfd0ed02aebaf929a7c58b755c3bba025669390cdb77bd619e685e0e7fd56d91321e686c0fcaf2916

Download Submit
C:\Windows\SysWOW64\Iijfhbhl.exe

Filesize
67KB

MD5
d451520bfe431f7c13ebe853433bb281

SHA1
7a2edef23ddb2adcc6b8d7426d7a1bd4a1acab78

SHA256
9a9c5d9018e2eaa4653391acbea080feac95b21fd77b03b1312f97fc96c7795d

SHA512
357d30fdedf4e0690d2eed8764188573a8b915494ddc3015aa8fd4fe88b8771bbe802e373ce8ffef8bdcf2f1cd4fca7bdca676e4e5f7cf78f3110788ad2ecfbd

Download Submit
C:\Windows\SysWOW64\Ilfennic.exe

Filesize
67KB

MD5
d9470761ef37fa67fe44f44edcf855b0

SHA1
ecb805319efa68ea907f2619197176ba59639e19

SHA256
df31440bbd990f9ed3c46792329e08da5f3071648c69933911597a72b7b119cf

SHA512
aa0115afda76b644f92449ba9902812b04d0b9220da62c93ff11c3ed8e7ac13c3bd154d4e150817e5952316f1b15ac999408bf4216968e676f39672dfb272d49

Download Submit
C:\Windows\SysWOW64\Iondqhpl.exe

Filesize
67KB

MD5
8bccb9a43e66b411c22b6af4d23007dd

SHA1
516468e42c6541a8096061c39d04e7c29c5629c1

SHA256
e9fb1231252549c92a99415a59864efeea19af423022a476ab8c887d9e4788fa

SHA512
8cf6b10ec985f2f68b6e66570dba3bd9ab12e40f2085688bcaa0f51f58520d98643abca6bbd50d146c282125f32299be714b0b505abe663534f97d978d6222b3

Download Submit
C:\Windows\SysWOW64\Ipdndloi.exe

Filesize
67KB

MD5
631c7fcff6ea3480448fc70e1d15d8b8

SHA1
fa64753255d5cf682a122712459fbdb9d791f2b7

SHA256
69784f78a5f49455ab6a8efa5484e8f6b558abf5b295c01c6756dbd93a702009

SHA512
169480a367f4d6f6918c1cf4bcace9550800720206c0e2067444274f8824f3234c2f398a32c1729ea4220d188375d710f717a122a7498e7a6395ae6eb2da1f8d

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
67KB

MD5
da051dbf29c4a62c0b0874aae64cfac7

SHA1
591cfababc4a82b7634081fe7ce23b778a3dfdd2

SHA256
10043da420567ed9bf4e9f5f7da557b9ed7bb0fdc6bf962990ec163b1a037f48

SHA512
97167fa0002ba681be2d2176773eb155a8880c90318e9200da4b0d12823af16f362de4edfba5125048c18d8f7d1f7c8312d6855c794c8e60267c346bc45e7c20

Download Submit
C:\Windows\SysWOW64\Jikoopij.exe

Filesize
67KB

MD5
cad0a6fd611018ff43017f576a0a97c1

SHA1
b4f572597de21e6e4c212e51dd790984a1c6f55a

SHA256
ba1d3a2fed80c448cef96e525597bddb96bd84e5d227650e004e0008ffe12bc9

SHA512
86a8be5de6118252ffc91ad0fb7157907a3a52bb86692dc6fa8222445c865a4ebc71168204c808dcdc5758d07c31804fb21088ee472e68861bc9d1f2aba8e538

Download Submit
C:\Windows\SysWOW64\Jllhpkfk.exe

Filesize
67KB

MD5
b6becc2240616a444eda48bfa692e264

SHA1
6613ab17743196d884a7e3a10675cb8a822fefe1

SHA256
61d81fd79f6de824f51545d6f5374e98fb65ae0d0b75cf19626a66c4eebf6efa

SHA512
c660c4046b5be33afd48cf862664cf5d9f5fa2041f933b72bef47170f291782a637c6708ee0ac05cd40c8a8e652a7d77bd18c956b24e43a13527d042d6f693fd

Download Submit
C:\Windows\SysWOW64\Kedlip32.exe

Filesize
64KB

MD5
fbc00c82c88d4ff2b87d3abada2a65b3

SHA1
50a1ca0c62690c2dece73167e00490c721bb60c3

SHA256
1f241713b51aa60f5d139de6271638433304dbddbbef7229b61c905c92c9559e

SHA512
20456c8fcff716006ded391350404b9980238bc68b15b6ec3565302ddd3617b66cea96bb0b0b2d87d07ce6fa51ac9cd3f7024049cfb554ee2b84b5270c620de6

Download Submit
C:\Windows\SysWOW64\Kekbjo32.exe

Filesize
67KB

MD5
dab751a207195e1440db0d54a7061fcd

SHA1
50c9f72c7d9fbf7fb65f536113ae993edd9384d9

SHA256
8052df7e13741fdbbaa845f1c077d5277803a73b503a8b8422ad4707228b7122

SHA512
3dfef221c785a1f52f27f9a38f0a269eefaf1368e1ca21351b1566cc5f8359f6cdeb16ba669ac56da38c223df7a64d04e382d16c6f484cbdfed8b4705d106a75

Download Submit
C:\Windows\SysWOW64\Kibeoo32.exe

Filesize
67KB

MD5
20ab887e03ff183c659cbae0bd7eb620

SHA1
5411cf930f2d98c7c6c7f4330dd109fcef0ef17e

SHA256
be42e66e5f8295293a7ed4f44a2b0b0d63a0b35b3269ef35ba8ea747e06f8ee5

SHA512
270ce3714a1ec373c3c390f2e6bd2333b9e118537c44e62fcc46cbfd0023e7ad85581784700a22e3ae3148c5136be9e9bd76d0233a76a824eac046dafaaa18dd

Download Submit
C:\Windows\SysWOW64\Koonge32.exe

Filesize
67KB

MD5
f597d5583b253bdb52ca27bc156706bd

SHA1
ebb51731a22206d98182556ce2e2ac30d6feb5c1

SHA256
30943fb1a23026438250b1c24185c4e88ec5ff8bff4b547c0803fab5468048ca

SHA512
7a51109e16b275d4527501d1a7e5b5818e3db45623b5b79c58982909674064ec3fb6dbe576917c915dbe1e874d1bbe73883feac9e6ac06db226feca8ab917b71

Download Submit
C:\Windows\SysWOW64\Kpqggh32.exe

Filesize
67KB

MD5
b52eb63ad590f4867723a4225194148e

SHA1
5afcf36c0c8d6e7a68d2931af4317c06573caaa6

SHA256
1ca8e57336abd530fb1c8fb6c05ab0d6aaf62a0b1a67e0acea3264a63f369f5a

SHA512
7f7f37760135bb0d6834d2f16dc84dd47d515426ea201cadf09002cf471c5f3552dbd94a10860123847182a0749352d788a2e74a7a785eec0dd2b47d105489f1

Download Submit
C:\Windows\SysWOW64\Lhenai32.exe

Filesize
67KB

MD5
a3e60d76b33579d74aee445e27d78258

SHA1
23b648ccee83692de387bce419564ac899a64066

SHA256
263b047b51e44699d3bdbae83b720abefe4d88a5310344f2812fe8dab08f4427

SHA512
d1ff515621390fddccc1654eed4b67dec888a7057c7bfd94b688dc5c5e7986df15f5efb0037b14ab50a7a3f46348714f818c61dcfdcf1bb72f34617429bdde97

Download Submit
C:\Windows\SysWOW64\Mbgeqmjp.exe

Filesize
67KB

MD5
fe0ba5c172bc2eab402a6edfab14ce18

SHA1
631ca0d6f010330f0efb188a74cd29a06c10ca12

SHA256
ec1f5dc7bd3edc1011d6854a84ab7e10f14a422d77b9452b3874ebcbbb51884b

SHA512
289c4da31318133569bbdb35ba2bb06757172b3fc74a9e3d92f5d030e6fdebd634f9359011e34142d4de12d13b952348ec2a96ce7ae7959cbda52b4852d1ca27

Download Submit
C:\Windows\SysWOW64\Mcgiefen.exe

Filesize
67KB

MD5
e7ffd302e6fe46b89549488abbc628b6

SHA1
20e82225101e438995fb571f486772d892bc5b69

SHA256
d698f0eb27dcf6283ead9a7c3257b7fa292396c721c29701123dc8eed0a98fb0

SHA512
95723cb37d5994138c40e01f457a07cf7fa8289dc955a824db709a4fb6a1acd9fdb5110166aa2488197ac268ce8a6a7bd3239338cf96a5bd555db76b378a4aef

Download Submit
C:\Windows\SysWOW64\Mcifkf32.exe

Filesize
67KB

MD5
a83627ca1ed2b81a84200b8fcfd369f2

SHA1
c49c7d0edf7bb30c7fea11f2c30260bf7d089cb0

SHA256
06b1c924139c0b7d7566ee4489251358e070c3e0dc7937fc3a60a6bb22a72dc3

SHA512
f7bc92c3bb2166ad61e255937bc599b7c96dd7e8511958e55d8b4c97c7887960fc1b3b1b85c605e9b4aa49e150159cf0f2ab1f7b0432c1625fb685a1fcbd40b2

Download Submit
C:\Windows\SysWOW64\Mcoljagj.exe

Filesize
67KB

MD5
1f92f783fe50b07f9a53c774c30ac501

SHA1
c7af42c26618b942c8a12f2f8566b6a0722cc1aa

SHA256
699be1a4d9b2fd4834c7acfc922ebd4a1f4c93904cbf16c325d2c25ae419b787

SHA512
3993b08074c63098369ef2816743eb71e857f196dfc211a88ce230d5b4df02f67f90d11909e66e9907b2b922fd40bf849aab86225f25e7d4f4f03974c29f3cdc

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
67KB

MD5
a38fcda8edcdedbedcf34ac89eb3ab53

SHA1
5e564714a232848f3900edf47ac4ffb382bb06f6

SHA256
3b755d974b9ad5a28282eb294734e3f9c7aec4711fce303c53cdd4cadf44d716

SHA512
4d122b6636db015d5ca9cd23e8dd1f90a49e5f7c62f25824d9381fea0ae70029dc45c175c28a76e7f841b58daffec6c282fcee4fd32d89bbd1e8abd54b2c1c55

Download Submit
C:\Windows\SysWOW64\Mfeeabda.exe

Filesize
67KB

MD5
77833869750cd6748cc5a088f5a7aee0

SHA1
fe657584191288c47f3951071d741a0af9557a47

SHA256
1d1387d8668635d67f3a25c9758920ee55b7c07ab8a746e6401a9ccdf1b277d9

SHA512
0cdd1f93436ef64eb56eaa7659615b7359c41f541d2fa27d36a381f66e3d5a5c0ff0530f4809ac553da2a2ae7db7c8758187570e476562927a77d798da4ec9b2

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
67KB

MD5
976b8b16a6b11a673dd059bc704b9b97

SHA1
c705bd305c6fb19d91edfcf100077ba323544aad

SHA256
884a1cc83fa371013d0e2678a40ddf1566e222d098a7bb863f111e22466a352d

SHA512
364b573601530ab8abc33c8b61d35b9c9cf0b0dc2689d7910112da897257988e7fcb6b30c4d8245d1701da695adb1f8555bed2d9dba012901415e992fa1cc96f

Download Submit
C:\Windows\SysWOW64\Mgphpe32.exe

Filesize
67KB

MD5
d2bbd389ffed6c49744580bd63cc4fcd

SHA1
f31d3219901a26f7f3237ead55e97ce5e0c0c154

SHA256
10d485dba24e7e2cb3778ca8b4e69257a0cf5fd62bd424885d1afc6acc95d4b3

SHA512
315bdabdca16c52065753a96874e97411ce45aa4c3c0e92e66ace59bbf4a3dd0e965184ac3f3e5e76e78428e13f6e6cb74e0130763ce202d79b28cf59570fb18

Download Submit
C:\Windows\SysWOW64\Mjcngpjh.exe

Filesize
67KB

MD5
69d87bfb93bc09d9dfaf553d2e6a5ded

SHA1
ad4ee231913941f21b21b5b29b91decaef095222

SHA256
a47f2e3f90f5410e3e2ef77c305bc120360535e3c5a1bc5189ef72808b40009c

SHA512
69468719ad22cc54277a5e730cb4c5aaf9500e754479647e47c2be191fb6a91298ecbf5405cda30526f29244abdba6556366e828b862997db6af5c00ffd54ebe

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
67KB

MD5
7cc6fc4b24086bb66c25ac254a7c431e

SHA1
e0c5c4d7515a8f964d61ed31d48d59be0dee834f

SHA256
342dae3fa51274151a06661ccd33eb709d21fba504a2bca670b4c45df4967858

SHA512
a1c99decfa0956065e8b78671fcd89b69816337598d9a0f11538a9b7d5d913b437a55ca646e005e14cab2a54c99d97d53e5a1ce17604593589bb77a1e19eb2c7

Download Submit
C:\Windows\SysWOW64\Mlhqcgnk.exe

Filesize
67KB

MD5
4ec81b03359aa580e3f1f14ebe51ff6d

SHA1
9c9b5cad066916a6ddebcd0b2d60e0d6952b8e87

SHA256
024314d9aa704fd0b5bbe35f55314a41878acd67ff5dab7fb37db56b10068fa1

SHA512
8be155ecf6d10ad77a732c8980582090048122fcf2559a5f527664ec5c833f81d280db1dea8ff2eecba70967b497d6f352da22b93187a691f4b708f8c1438fff

Download Submit
C:\Windows\SysWOW64\Mmmqhl32.exe

Filesize
67KB

MD5
1348b83767519df9e8e5402894b6cd53

SHA1
b3dd08825e02508acea6578d493e862c75121857

SHA256
7ca473653fbeac4742e4716a1ff9d18db8499c6a56e98d94b28afbd03c3fac76

SHA512
76b2f82381fa9757519639ae83adeefda34862f665d7bad342f23aa17b94bbe14c476ae0f477b56837e5a55815bdde2c5224d32befc6a736b5a9e6fd6a578940

Download Submit
C:\Windows\SysWOW64\Mnjqmpgg.exe

Filesize
67KB

MD5
31a975a313749e8f257a2cd05014b6fb

SHA1
4c99fa6ad392c46ec8239fd5b8177277b6685738

SHA256
c4864a78c0e8aa0c49b2c851c1309724c688bd6fe2c1c7e507abd59a5642cc36

SHA512
262917d9934c7a1e5c4cbbc53d8071d70ebdb831f74411cb37b28569116219920f4ccc15680a9fe37a13bbffb58f315412587626ac121cb6e1951aa0638d7b5e

Download Submit
C:\Windows\SysWOW64\Mnmmboed.exe

Filesize
67KB

MD5
7ccb64d8c121478df86c47e8722c2946

SHA1
ca10e1643f8564f0302d803614bcb5d74c7cd99e

SHA256
18910b409edc2104aec2d31592225847a35f7adea0124d11e843cca55aa8cc09

SHA512
59dad0f98bd60bac82b604c54121fc9f42076343ae8fc538509dbde4915a487b8cf5e660e84148dc2525b63c758a6a36a2e90520126d352b085946782ae7a602

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
67KB

MD5
ad98a8ffe574b5b76c3bb6eb57f7593b

SHA1
05676e3aa87426678b4790ddb9f629224990efdd

SHA256
2aa43326257f5639e114a2e15dab9ef84fbd7703d47b4e642a9ce3da176b3db3

SHA512
bcc5a59a1e36cd8c1a18a27006ca7e085554323e6265712c917285c588bd8fd70481be6f3d95c6d87e2c573f9b5003d0831027aa93b230bf85268591081d3011

Download Submit
C:\Windows\SysWOW64\Monjjgkb.exe

Filesize
67KB

MD5
ad5bcab0bf3e99cfdf51fec817de13aa

SHA1
90097b17eb22b859dc9979578ca1edb17184b954

SHA256
6c81cb6e407675310a58291a44ed2bf190446722be852f2b7da82a27ebf01862

SHA512
a0de455dface8093a21a8e1fc63e58e181a3ebc84b80628353496830f305cb8ab0852bb51268b44cee29e6232d6c0b725105c742e78f3ac35757e0579d3e7949

Download Submit
C:\Windows\SysWOW64\Mqfpckhm.exe

Filesize
67KB

MD5
1782a3e0259be7c42da4e26fe6ce4167

SHA1
efe51495ead57ce5bfe93ce1502277293c2e3e23

SHA256
59fff1d62a31fe22d068456968d7f38d1dc187d1c54b4449fa62f18e17f4d7c1

SHA512
0875c353337558d9be57a176a07e333938909f07d7e2d9c9f9f40c34728c8f448df57cab85af2b4bdc559bc8afa0ae514153bff2aa879e5d48d7bbffebb97b41

Download Submit
C:\Windows\SysWOW64\Mqjbddpl.exe

Filesize
67KB

MD5
7c2276f4a4cb1f5be8b9a9e7872918a2

SHA1
a44d2fb67fef8d0cb876a5cdcb96639ce9613ce6

SHA256
daa18b1e2084ec0a4b94213ed049e808d00e4a3f954e0fe98287042b4d2a94df

SHA512
5a2acd30f03e820c45b35ab1e85bfab75a7a41649a86c695e4e3112280a3390462ee837e2e5fa4a5ebe7be9bb02747a96852964359b38bde14b4b855beb73839

Download Submit
C:\Windows\SysWOW64\Mqkiok32.exe

Filesize
67KB

MD5
a3ce5a79e1c27f4d18593c3c52a727aa

SHA1
1036202426a79be16aa723c01665cc823e9b5129

SHA256
68331eafff1a40198f5c9c8b5abce1cd84e8ad9738256ce54c317a1584d6f467

SHA512
d61cae4b0c82900bf2d8b44a62591f3848124a594d34d8b206b3e668cd1d20aa1b8c1dcf3c6c2c12adfc1ade19f33310dcd3fe59f56481734adf90a9dfdc6e31

Download Submit
C:\Windows\SysWOW64\Ncchae32.exe

Filesize
67KB

MD5
b1e5e7fd18f1ee0341fd2e50c48fbc7c

SHA1
cf24f46e461485357b9bc8f1c01029db5a349313

SHA256
55b6f3a606dbc563a2dc148af25d0fa91430a398ed918755ed63ae803ba573d9

SHA512
fe74436b8f20a8987eee0b87d7412b6f6aaa192618b19d9ea9bb1b301da845ebb203088339539378ef8d8279de6ad2b71ed9253159cb1614279fc10649555182

Download Submit
C:\Windows\SysWOW64\Nceefd32.exe

Filesize
67KB

MD5
0dd1e298eaec9165cb15c635c18e571e

SHA1
9fb22a8a8333d8ba5745f26f4390116eb9c6ad03

SHA256
87d80537c4bb0884bc08b38aefc7fba54d27eb2a0cb09e2319dd89748ef1c5de

SHA512
819147202871ba2fb298a9579e5dfa1b0b2fecd5d76ba3e246ff43b22eba62e39f3b3a265222787e37002c9526f321382fed04e16d05d45efc069f73b4c541f5

Download Submit
C:\Windows\SysWOW64\Ncqlkemc.exe

Filesize
67KB

MD5
f56c9b57192a12f4d922679c53c3c08f

SHA1
dcdd535d9cfb3020ee4512d756cc89d4c2a6d618

SHA256
ccb16795c9efbde6efe3cce360693476a32ccae1b6817991eb77e7a7ec617df2

SHA512
0e1d844850125bd68a71a097f39c2b43cd52f8346dadf27f176cfa4421fea03f87bcacae984596333227ef69835fbc944c98643cdba65a706636b4c6ac16b645

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
67KB

MD5
a164f919e49090eb6c96803af7460cac

SHA1
f1b901ac13f010b34bffebcfa2ad0f570e7e2ad4

SHA256
8da4996965a15cffb0ed36f79d1691b6266ed4ed049cc51da53a91eab696a3af

SHA512
a705aaa865228f39c4b730daf4efbcd5918f788cfa5c0f9917c87a83cb4f96df6e011e5b7c1e819a6c89d738161b6a0292b47c792b62041620d5cf5f12d35356

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
67KB

MD5
fe17d0a5525646dde996e29fe8f5db98

SHA1
f9bf6d5592cd0e28f504f5027282d643306d6909

SHA256
27e9f05d2c3f4e8b2f26d7b95cd42743c82034d92c78c682bbd68c7100b97632

SHA512
45794e8cb3887759a6128a04d612ef0d605a652977d98ccfedfb30630e4d3ac0533a05755e67c2c33115536d7de3ea78b49c8f4638421e5a1b33d10660930fb3

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
67KB

MD5
36aa4a0ea1fc0a5d0df314840364134e

SHA1
10545121607724b5cb4b06f003fb308ffef8024d

SHA256
7e32fe80e5fc0e43e0abac235dc489273bb0aa9ebedafb8a85784df25d443ea0

SHA512
6584cb68e3aff2cba74203482dc47613dc0d79b895a94cb9416f1dfde79b87c245d3541e5bfdf786d7d24bb2a84f8a3c40eadcd67910d27e267d169816203b58

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
67KB

MD5
25ec43fab15d569896dc549b279310f7

SHA1
f8bdee6a7fafd05128dba30eb14a3ea43f41d715

SHA256
3762321e5fe9168779c1ba6437aa6a7076e8abe21a0d0bb8fea00064dd94146f

SHA512
6525fc0143bc0f9afcceda87cdaa05a6c7196b7bab6516f699507b53d95b69c6779d17b3c89b0e6facc97673b592b94c8d9bcc502ab9574a11ea9b85a73a3385

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
67KB

MD5
5852e046af2edec1316fcdfaf59441df

SHA1
5cb142ec9f94bc6333601b5ae84ebb9f9405966a

SHA256
1bc7de92e2c144718399d7d81e42527644e65a4005155c6623cf1688bb28c79b

SHA512
4272a806cc9f5585d1fc904771edaade1b5d91a1299499383416fb528ac09872761bbeedafe8e51e8c5d2c9b8e49f3875b340245735913a90cb0715820c296f0

Download Submit
C:\Windows\SysWOW64\Njmqnobn.exe

Filesize
67KB

MD5
f737c53d387172c5388ed1c85b1c113d

SHA1
a649f0432ace07f9d5db2c849888d0a3d05d788c

SHA256
e6f717f62165c0af41e6580e66363171894647a21dbf14d6cdeb8ed6dde38a72

SHA512
130d3ca230de757cbcf324c2bba4d55cf98a17c145bc9992f8b02f59ab6f722b2a2e0d0bffeef1e170eb4233a194ce4105fa0540ff275c647a46cf5fffb6e864

Download Submit
C:\Windows\SysWOW64\Nmbjcljl.exe

Filesize
67KB

MD5
c82fb07c08314e64db25d44ca74a3436

SHA1
d98eae27ced01826b44ed2ae65f64f1200e8aa95

SHA256
718eb57ad7f69552aa4d234e8f8a58e2fc3be8e199c8eded47071f0f8ff8602a

SHA512
3cb847b42b8f21bf4555941836960eb265ed49023960cf68549c7ac66d49dabc89fbce608d2b082a86ae1668a52338e88e78fbe42ce9bfaa9d671232bcf79fb3

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
67KB

MD5
708badd634342e37a1c02d7742ebad09

SHA1
26da75650023319bfb285e1129567490c5c0fef5

SHA256
29cd85985747f8f2168e1290f895a245069785e136c6e8fd20c60fe909b8916e

SHA512
86cb8a104dbb77477b3106d3fee77dfcad778349f4a044c9f5b25a2655bd3285735597f35c4047bf1e9f339ca351cd9c883d733be84357a41388899f54b1743a

Download Submit
C:\Windows\SysWOW64\Nmkmjjaa.exe

Filesize
67KB

MD5
d630cbc3ab7142dff40e697c2f100b1f

SHA1
67bda2dc3ca888ddb42bec157bc3c8bc32474cb0

SHA256
e7b294ab811d8abd53be801196778e55c5bab08cd0d9bc39439f1c346f6cd44f

SHA512
6bac855530c90cee8180abaf09ac9d7e53a5e7212b7207004ee0c4ff1388e7e68ad50e5c8acedd78e9c17afef06c130aad578f57c800b8c2864c339fb1bc054b

Download Submit
C:\Windows\SysWOW64\Nnafno32.exe

Filesize
67KB

MD5
04c69b5317d1199c04406e73f6fe2ff2

SHA1
8d858a2d687185f13085123358dbef358eecdd1e

SHA256
524cf76a30430d7eaf41f71a8ef4c9da8c06935d386cba7fd7ccc970b4660503

SHA512
11ef3bdb873a49f0b5ee3256c2649a455350cd21f83f34798adc8f995250202273df29aa8211e57fe0a43abc42bf14bdea28219418dfed7a19a92d5676c8ec6c

Download Submit
C:\Windows\SysWOW64\Nncccnol.exe

Filesize
67KB

MD5
0ebc66c9bd049fa149bb42495cbeb7d6

SHA1
24dfa1c8d9860035a1fb2aeab8577ab734fbe852

SHA256
777cfe0858f9fc7a43a67c2856fe30ed865968650626129729c522e782ba9f8f

SHA512
671faf2dd250f9e8ca4ada3cdd0dc9e55d293f49988b13d36073fa7dad7c87b0ffe1d77d8ef833fb3e80328074fec4531a604400e6b16e745168dc852c883c9b

Download Submit
C:\Windows\SysWOW64\Nofefp32.exe

Filesize
67KB

MD5
75612c907bc2e54a9492eeef5aec2538

SHA1
0149bbda1b3aeb8e75f776f6a82444d8856e5f6f

SHA256
d21dc1222bb04c5ccb372498efb07007bdf576f36de67e65e1acedecec6572a0

SHA512
83b0c80f567c5b5a687eecc7f4d11eea4892cc67246a5ac63b7f6471377d7883bf4561262f70bd624e667248354b85bb90b4380a2b3ce8e5a339d1903cfcbfc3

Download Submit
C:\Windows\SysWOW64\Nopfpgip.exe

Filesize
67KB

MD5
3eb273bb92c6ad4f675dddee9bfd6285

SHA1
f49a1efa00dd1ac7c2b91f331c09eb83428ab236

SHA256
d7271fa9cf4b30d83e1e4633488880cd839780d879f0b4dc1b59df2cda8bea4a

SHA512
f49c16993023c3831f563a0b7673b8faabbcc368fb02182b16b88137512d3d6bb4986e1d46ac7af74440cd77341353e2681f5c846b5bfabb727668404323e9b8

Download Submit
C:\Windows\SysWOW64\Noppeaed.exe

Filesize
67KB

MD5
d81bf62d852a157beef4544bcbf5e326

SHA1
8ec099a5de29a14ce79f124ba60b92c5d0ae39d9

SHA256
dea7220ba517e9b8e424b157733c094961394ce31644d15891a3abb2bd98942d

SHA512
f88e57ec2cf28dc63da2689a498de7d3ca75f9a10f4d7d3e422e736f826a4f0d1213a4119196699027388c0c418ada99c9f02a0fb49d29ce867d9822d8eb9fe9

Download Submit
C:\Windows\SysWOW64\Npiiffqe.exe

Filesize
67KB

MD5
38910b39bf2b3a24263ff428ad8e2897

SHA1
6a638f6097c0db8ad51b55e7433212ff7fec7301

SHA256
4401629a208a502f550f6f03ce8c6aba73bd6c892a367d053ea39251ef71f44f

SHA512
5bebbdfa08c112ac72468e1e7865720dc126e8dd07e3e4e9d0d0fdb4c7e8fc2ade33abdbba1465eccc02c23276b114868a0ce75996792be5a97d04599c2b6122

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
67KB

MD5
5f3d1490192da5348651780b63cafb89

SHA1
4f8878377c0ebdf987665564b1ea4f2358c99d9c

SHA256
df66849b14766b68bd41898d0c5520b0230a3b67933bbed514b703695cb230f4

SHA512
ace4616d476240dbd5c3f71bb3659508937991ccfa7c180a3c8a00af36561e72e496fb2a75649883c51df8da8a717366167c5f893558bd50f5fbffa78344ee28

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
67KB

MD5
ad20843389076061957fb66d1e4505ad

SHA1
78f32a1eb5ff2894a20969f4c15f24c3a0e73b73

SHA256
49a348992c6c5e282bb896f0f9d22818fc2152e3654636c021a05c05087ef136

SHA512
6b5b1c90d7472ce972d8fe9608ae683abb9c4a9c0b142e39c190c1fefa90b85435b650e75c58837d5f4db8a99d976d6533c1e57ad72f77a61fa156839d1acae8

Download Submit
C:\Windows\SysWOW64\Offnhpfo.exe

Filesize
67KB

MD5
4ea558349ed3fb6dbb97acd7e422450d

SHA1
ab41a0baddcb0233d2c961f5e84f5ea7e7f81a42

SHA256
009ccd8599ce9279069b89c36ccd7a5c368e496f47815feff2b79e0aeb55c3ba

SHA512
df1401c8c950e3647b12ca41b683f83d2a8110968607686d4aeeaed1c29c2f0a238c58a631ecb1acf3848d7abde3dda09585000317709adbab13e17de5957240

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
67KB

MD5
3c695266cc116ccaaca80fdcf668d4ff

SHA1
67115dddbb541efdc7e5537a027472da725540c5

SHA256
7e787e5491e35ab739f298cb8d277ec43fc05fc1b2e80ff617c3f0e58223c4fd

SHA512
301dc5be96b3a0ed3cafef06c44bf7c0f1a8497a3e11d98c021f14986418a97a798216f94e89f617452a170d0c9713095d8b66886ae4442a8be75396bb96dcaa

Download Submit
C:\Windows\SysWOW64\Oqhoeb32.exe

Filesize
67KB

MD5
da9bce586baea628b810064de1d61c6a

SHA1
1960058bb8d065ec2b6d9ca70d82c163d087e68b

SHA256
19ecdfb484bef909e470805239072a10363cbfab2d3ec0ecd32e3784bc2d4531

SHA512
85d1f76424ee07ccbfc91aa386b4ab64b9e62d80882421b3cd047e7a1396371c12fab56a6bdf7c3012b543483faa8411c07436d1ba9d5fffb4a12c9364096b11

Download Submit
C:\Windows\SysWOW64\Oqoefand.exe

Filesize
67KB

MD5
20b1cc6f296d994f31c06be2b83e2a8c

SHA1
9754f5c0361d429a974fb2f56b7c6cedda782c1c

SHA256
e6e724c1fed5931a407d9365c24a6a2c1007b5f54c679a540658e12fc2e9a488

SHA512
1ad3e86b6fe496420267b872b5584fd63ab4ff3603d091cf666674732a207da24526ebc936e6fad18517c1cc5c9832a85572bcee317398b38a08b35f9abbecc6

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
67KB

MD5
e7d7d16ff3f11c21600c1ff9de865dac

SHA1
9c2b726f9084c7005e265f3db3d266fc0015b30e

SHA256
ab641e7fbe794c9407580aaac9cdea2841b0315d08954c4ea506c9762898d718

SHA512
ad3e48605652c9bc13cf7b076731c4b483d0345e79d72eda85b6a6ceb976b557e7e369c4b02c5d01c49d422b27d03fae6a2bee0c40af42b0a2257532cba4f189

Download Submit
C:\Windows\SysWOW64\Pdjgha32.exe

Filesize
67KB

MD5
047ce01a76625093054a6c56864509d1

SHA1
2f29ffeca4b40ce838622e0b088885b42a3a4865

SHA256
a0f4d27b8747a689e933706ac116a61e2a84e410976f24dcd9aa53271b24ac31

SHA512
7bb0fdcf6fbfc46b8d1201d7bcf3fa2e8f56bc84c2a22130c650dc4d69c43a146aa32dc2e4132e6a46e3c2282d6bd41964c939fa802bb8be2a908ecb5ce0566f

Download Submit
C:\Windows\SysWOW64\Pplhhm32.exe

Filesize
67KB

MD5
4f4d455603c83c2b2ce603cd6da1eadd

SHA1
934d6a32304a0541a543433681ccf6d2bc20fcad

SHA256
0be904e5a677a79d6f9b6997e6d6aebfe783cc7d1847538b9130e8e4c5ca1caa

SHA512
44daf64496f3c5d90f58513dfb259f4fbb22ffdb4027e230942bde51634654b58df08fe19dff207480c56c0579eb6dad8c830173b684c80abb0d08214de950cd

Download Submit
memory/408-378-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/672-224-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/672-301-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/688-377-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/688-309-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/792-413-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/800-197-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/800-279-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1060-244-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1060-322-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1088-406-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1292-364-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1380-302-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1380-370-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-178-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1388-90-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1400-344-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1400-412-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1684-371-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1976-294-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1976-215-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2072-285-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2384-107-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2384-24-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2400-269-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2400-188-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2624-363-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2624-295-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2872-392-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2948-361-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2984-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2984-142-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3108-161-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3108-71-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3168-196-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3168-108-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3228-356-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3228-288-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3268-391-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3268-323-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3312-336-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3312-262-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3596-330-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3596-398-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4060-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4060-48-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4064-242-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4064-315-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4128-170-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4128-251-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4176-79-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4176-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4192-223-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4192-134-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4204-232-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4204-143-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4308-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4308-98-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4312-399-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4336-275-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4336-343-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4492-385-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4532-162-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4532-243-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4608-117-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4608-205-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4640-153-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4640-241-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4644-99-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4644-187-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4660-337-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4660-405-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4704-233-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4704-308-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4748-329-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4748-252-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4796-260-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4796-179-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4808-169-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4808-80-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4820-316-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4820-384-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4828-40-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4828-125-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4844-63-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4844-151-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4860-350-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4860-419-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4944-89-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4944-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5016-116-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5016-31-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5036-287-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5036-206-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5072-214-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5072-126-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads